lumma | 3729104fc485ea9c5a752f6de9226ad5add663f528b8114050d0f958a68ae774

Resubmissions

20/02/2024, 05:29

240220-f6qj2abh3z

15/02/2024, 19:11

240215-xvx86seb9110

Analysis

max time kernel
423s
max time network
451s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2024, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mia_Khalifa 18+.msi
Size 64.5MB
Sample240215-xvx86seb91
SHA256 bfa7a13a97f61cc63ae748ad806978d11391a5c17b1a8a8f4fbaadf07f4e0891
MD5 a347250844a6e54c27bd5fcc464dae85
SHA1 3b27a896233eb882d1475f773836bf69d1c3bddf
SHA512 9b9b3776ee46ed61bb9ecf8b9c04a4607097c88a873616ab83b21c5a1fde304424191d5399899b1665f9d99824d3243e3cc29a9358a857872c93f7e6aa0a5935
SSDEEP 1572864:Y4pJnZxr9EOH5skMiNRvKT8SVNWX/nNKRtYA3X8gHAn/VIK:YgJL3svi3iTNVNWX/n0rDnNgn/G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://stamprollabbeymemberw.site/api
https://gemcreedarticulateod.shop/api
https://secretionsuitcasenioise.shop/api
https://claimconcessionrebe.shop/api
https://liabilityarrangemenyit.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Blocklisted process makes network request 4 IoCs

flow	pid	Process
20	2140	msiexec.exe
22	2140	msiexec.exe
24	2140	msiexec.exe
93	4704	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	InstallerPlus_v3e.5m.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 22 IoCs

pid	Process
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4704 set thread context of 4492	4704	powershell.exe	104

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI7980.tmp	msiexec.exe
File created	C:\Windows\Installer\e5874df.msi	msiexec.exe
File created	C:\Windows\Installer\e5874dd.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5874dd.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{012FB3C5-AEAA-4AD9-BE59-398414C7C234}	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4924	InstallerPlus_v3e.5m.exe
4556	Installer-Advanced-Installergenius_v4.8z.1l.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	4492	WerFault.exe	104

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000006c2b12180e4adb550000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800006c2b12180000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809006c2b1218000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d6c2b1218000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006c2b121800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3284	msiexec.exe
3284	msiexec.exe
4556	Installer-Advanced-Installergenius_v4.8z.1l.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2140	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2140	msiexec.exe
Token: SeSecurityPrivilege	3284	msiexec.exe
Token: SeCreateTokenPrivilege	2140	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2140	msiexec.exe
Token: SeLockMemoryPrivilege	2140	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2140	msiexec.exe
Token: SeMachineAccountPrivilege	2140	msiexec.exe
Token: SeTcbPrivilege	2140	msiexec.exe
Token: SeSecurityPrivilege	2140	msiexec.exe
Token: SeTakeOwnershipPrivilege	2140	msiexec.exe
Token: SeLoadDriverPrivilege	2140	msiexec.exe
Token: SeSystemProfilePrivilege	2140	msiexec.exe
Token: SeSystemtimePrivilege	2140	msiexec.exe
Token: SeProfSingleProcessPrivilege	2140	msiexec.exe
Token: SeIncBasePriorityPrivilege	2140	msiexec.exe
Token: SeCreatePagefilePrivilege	2140	msiexec.exe
Token: SeCreatePermanentPrivilege	2140	msiexec.exe
Token: SeBackupPrivilege	2140	msiexec.exe
Token: SeRestorePrivilege	2140	msiexec.exe
Token: SeShutdownPrivilege	2140	msiexec.exe
Token: SeDebugPrivilege	2140	msiexec.exe
Token: SeAuditPrivilege	2140	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2140	msiexec.exe
Token: SeChangeNotifyPrivilege	2140	msiexec.exe
Token: SeRemoteShutdownPrivilege	2140	msiexec.exe
Token: SeUndockPrivilege	2140	msiexec.exe
Token: SeSyncAgentPrivilege	2140	msiexec.exe
Token: SeEnableDelegationPrivilege	2140	msiexec.exe
Token: SeManageVolumePrivilege	2140	msiexec.exe
Token: SeImpersonatePrivilege	2140	msiexec.exe
Token: SeCreateGlobalPrivilege	2140	msiexec.exe
Token: SeBackupPrivilege	4860	vssvc.exe
Token: SeRestorePrivilege	4860	vssvc.exe
Token: SeAuditPrivilege	4860	vssvc.exe
Token: SeBackupPrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe
Token: SeTakeOwnershipPrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe
Token: SeTakeOwnershipPrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe
Token: SeTakeOwnershipPrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe
Token: SeTakeOwnershipPrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe
Token: SeTakeOwnershipPrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe
Token: SeTakeOwnershipPrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe
Token: SeTakeOwnershipPrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe
Token: SeTakeOwnershipPrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe
Token: SeTakeOwnershipPrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe
Token: SeTakeOwnershipPrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe
Token: SeTakeOwnershipPrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe
Token: SeTakeOwnershipPrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe
Token: SeTakeOwnershipPrivilege	3284	msiexec.exe
Token: SeRestorePrivilege	3284	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2140	msiexec.exe
2140	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 2296	3284	msiexec.exe	95
PID 3284 wrote to memory of 2296	3284	msiexec.exe	95
PID 3284 wrote to memory of 4924	3284	msiexec.exe	97
PID 3284 wrote to memory of 4924	3284	msiexec.exe	97
PID 3284 wrote to memory of 4924	3284	msiexec.exe	97
PID 4924 wrote to memory of 4556	4924	InstallerPlus_v3e.5m.exe	98
PID 4924 wrote to memory of 4556	4924	InstallerPlus_v3e.5m.exe	98
PID 4924 wrote to memory of 4556	4924	InstallerPlus_v3e.5m.exe	98
PID 4556 wrote to memory of 4704	4556	Installer-Advanced-Installergenius_v4.8z.1l.exe	102
PID 4556 wrote to memory of 4704	4556	Installer-Advanced-Installergenius_v4.8z.1l.exe	102
PID 4556 wrote to memory of 4704	4556	Installer-Advanced-Installergenius_v4.8z.1l.exe	102
PID 4704 wrote to memory of 4492	4704	powershell.exe	104
PID 4704 wrote to memory of 4492	4704	powershell.exe	104
PID 4704 wrote to memory of 4492	4704	powershell.exe	104
PID 4704 wrote to memory of 4492	4704	powershell.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Mia_Khalifa 18+.msi"
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2140

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2296
- C:\Users\Admin\AppData\Local\Outweep Dynes\InstallerPlus_v3e.5m.exe
  "C:\Users\Admin\AppData\Local\Outweep Dynes\InstallerPlus_v3e.5m.exe" -pe548ycMIJPeyhTd
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installer-Advanced-Installergenius_v4.8z.1l.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installer-Advanced-Installergenius_v4.8z.1l.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Blocklisted process makes network request
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        5⤵
        
        PID:4492
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 1052
        6⤵
        Program crash
        
        PID:1928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4492 -ip 4492
1⤵
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5874de.rbs

Path C:\Config.Msi\e5874de.rbs
Size 8KB
SHA256 9ccd2bba5fc0d1d728fc9cf67676e33e982120de9be689bc5917f2e5f19bd697
MD5 b5cf9ac7af40e128d718ad7655313191
SHA1 949a9c5c2f3d05c035911f46d2edbb7314f4a643
SHA512 537bb78cfaf7d625285bb9668b88ffccb067aa5e710005663d527a712c1cdab885bf25474d57a93711c92a362d084275069d8ee6e6192fb881aae06025758fea
SSDEEP 192:DZh7NxuehI63VoZIB663VoZ4BsfUips8ezPuMUD:DX5xcQC3QCZfii
MD5 SHA1 SHA512 SSDEEP

Submit Download

40C68D5626484A90937F0752C8B950AB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40C68D5626484A90937F0752C8B950AB
Size 834B
SHA256 fb69fd0d9babc979c3b479a20301fb658b23ccab1b0377925423860439dda4d5
MD5 9b1f6b70bda69a1103260c6951aa560f
SHA1 121da6f9d62998913f09dedbb4b23efdc2d509c2
SHA512 3ab2380733ec7c1e1bdf2252cecaf4b5d50aff8b887184de127b0849016a19dd332dc9d392254f4dcca71c730f17bb9d1a57b1fe47e32adc78a1021d433448d7
MD5 SHA1 SHA512

Submit Download

C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
Size 5B
SHA256 2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e
MD5 4842e206e4cfff2954901467ad54169e
SHA1 80c9820ff2efe8aa3d361df7011ae6eee35ec4f0
SHA512 ff537b1808fcb03cfb52f768fbd7e7bd66baf6a8558ee5b8f2a02f629e021aa88a1df7a8750bae1f04f3b9d86da56f0bdcba2fdbc81d366da6c97eb76ecb6cba
MD5 SHA1 SHA512

Submit Download

C46E7B0F942663A1EDC8D9D6D7869173_DF4CA81DC775CDA9B3214BDB5B55900E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_DF4CA81DC775CDA9B3214BDB5B55900E
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

EA618097E393409AFA316F0F87E2C202_B06B4CAE26C37390498546FC139D1207

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_B06B4CAE26C37390498546FC139D1207
Size 1KB
SHA256 f4ad369a305c524df53a20cc5af08224efe87be87f8a8b1642c667e20192a6a2
MD5 90e365a871fce9b1ee1dc9e524df15e7
SHA1 d8be225623283df373dda675eb12899d7d087464
SHA512 10cd881c490948ca5f53448f002bedbbc883b521c38093f2d194a7ff972c8b6afe1c6c794589a7fc1ce0ec5d8c8c1ffac0fddec871c1b0c0b17bcb02de40a877
MD5 SHA1 SHA512

Submit Download

40C68D5626484A90937F0752C8B950AB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB
Size 180B
SHA256 d7f0521d3b1b34bba163e0516f580efb3aecbd37b15a71022bb56f4fba681b7f
MD5 3670fda3fedf453e0cfa40c23e5941d2
SHA1 c6707c191e4fb26ef909c5f758b7dbe7bc2257f8
SHA512 0d0c34b57658f89f9c13eb54c7239e9b48bf768f8c859d94f3d0647c87ce2965b4d57a1fc7aa45bee56abc32d1c84497b872df0794befb94bd5d1afaa1ff8519
MD5 SHA1 SHA512

Submit Download

C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
Size 398B
SHA256 2e0ca3d07af6566e832036a8281e8697a02bb7bccec9dfad1a6ab5afe5786e8a
MD5 84aa415d81dcfd3635c3c26c80009564
SHA1 e6d55058b89fd6cb82cf23fce888581400dfbe78
SHA512 6b6d5e8cbe03e685d63dc48f7441b2472f49912f2a7dd1d3ae5e1a7cbdad15c79b929d1273c1aee79f01c80dd68f5c49f454705543bcfb9d1256c3f768e06310
MD5 SHA1 SHA512

Submit Download

C46E7B0F942663A1EDC8D9D6D7869173_DF4CA81DC775CDA9B3214BDB5B55900E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_DF4CA81DC775CDA9B3214BDB5B55900E
Size 476B
SHA256 6a8b38536b37de877e599d924386683cd557f920ceeffe4055533ad6493ba0fc
MD5 cc7fb48fec89fea20f8072845b9054c4
SHA1 81943a7539f2bcbe240ed5fe3a4650b3ef509113
SHA512 96e2b9e4ecf998298288ed571f8ac6ba4b7ccd4009c8fb8b04ee369f8c2e00ac16b1ecd827d39e6498f1c6dedde2edc61164f46dffbc2c97aa64700b7b506031
MD5 SHA1 SHA512

Submit Download

EA618097E393409AFA316F0F87E2C202_B06B4CAE26C37390498546FC139D1207

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_B06B4CAE26C37390498546FC139D1207
Size 402B
SHA256 a79c99c141845adb3bda9d12f625dccad14b77a1c1ebe78f4a814096a1ddcd82
MD5 65c6c9a1e1bfba3ee960409988532ca9
SHA1 2b6bef503e9ed0a0ca3c94737995595fe132bbec
SHA512 68e8d7bfa0e0d3d1ca9d9d7661e1875ee28d8ad9ecfac155a49e191c66feb7eadff32a87d63973935b9a68fa3cec74ce3e2d0857d2d9741b519c861f576b739d
MD5 SHA1 SHA512

Submit Download

InstallerPlus_v3e.5m.exe

Path C:\Users\Admin\AppData\Local\Outweep Dynes\InstallerPlus_v3e.5m.exe
Size 665KB
SHA256 9feee3b0a043fb1212da22f55045ae69102309efb6cf6b7a92ff40d61b6071ef
MD5 444b9ea8ffa34e07e733b37e370957e9
SHA1 4e2d8557870c10366514b37e41a195814b8072a7
SHA512 0c930dc9c9a02fe2156b619b47a127ec2f47fb5f57261ca6f5a6fe620c2108579cdabeb1eccb323cddd45a4ab28fbc3018b5b1b0b7c8631aee803a275b837d54
SSDEEP 12288:PzxzTDWikLSb4NS7FrXMIFIbmZO45hFlrkHSEE5xooUgxNH:NDWHSb4NwoIAQBhEShnJp
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallerPlus_v3e.5m.exe

Path C:\Users\Admin\AppData\Local\Outweep Dynes\InstallerPlus_v3e.5m.exe
Size 603KB
SHA256 5c959be8e43af51d68f26ce3fea7c7d3150b7a08b2aa0a01ee387c87b94a99c9
MD5 c30bbaf8ee135dadab38f6e3984844be
SHA1 4008a723919968ce26dab1ba949cdfd2b48de6f0
SHA512 230b6d495e43079e785999109c8bad037a6639fa6d3fe4ebe95a293417ae9a85bd1c38569d4eafda203138800f364cdb5cc6efea8ce3b1abb2856b6120b3d53b
SSDEEP 12288:PzxzTDWikLSb4NS7FrXMIFIbmZO45hFlrkHSEE5xoU:NDWHSb4NwoIAQBhEShnZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Installer-Advanced-Installergenius_v4.8z.1l.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installer-Advanced-Installergenius_v4.8z.1l.exe
Size 3.7MB
SHA256 71a17af81863be9094a2e0f77d16156b6c476b7ea8c820ff5083b5765a24a784
MD5 0e18061c3791e60681195788f58f96a9
SHA1 20f70fffb5aa836265f23f8cfa49b970a5ef06b9
SHA512 adca6947f7d1b6ebb64152bdf46782b2ece9972b1e6ad4f33006c69755f48c14a1e1f0cf06ac9c6bc747b461c262f9a4e11e11ed850a18573e5bfa8ae8d5aebe
SSDEEP 12288:vPbE7Qd4ato3eFADFZLmE8BU0xhR1ozbES87piVrWIB9DE3v3OhQrWbMvv9RlYBv:7NbtoPZLzE/CzYH7piVrWIB9Ifk4nts
MD5 SHA1 SHA512 SSDEEP

Submit Download

Installer-Advanced-Installergenius_v4.8z.1l.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installer-Advanced-Installergenius_v4.8z.1l.exe
Size 3.3MB
SHA256 f5badf4fb6b85df75068b6f4c745fa9351e7a43107d8c0a8481c70d6daa2a286
MD5 52bf0db7f043dfccd01087642694ee8c
SHA1 ae11be42a63c8928c15acf5b2f50309ae7336c9a
SHA512 930a1211f77aed207384db7fa9519a3aab36afb99f2d847f11d78e80b359cf32df172ce91fc485381f0e103bd0333f7a4592d6f22a6bf0451ece5d5acac204b1
SSDEEP 12288:vPbE7Qd4ato3eFADFZLmE8BU0xhR1ozbES87piVrWIB9DE3v3OhQrWbMvv9RlY4:7NbtoPZLzE/CzYH7piVrWIB9Ifk4nt9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Installer-Advanced-Installergenius_v4.8z.1l.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Installer-Advanced-Installergenius_v4.8z.1l.exe
Size 1.9MB
SHA256 2b5d07526a57cf4cf0a6baef51755b0ada01b77e35a68a87fd0186b51c75e17c
MD5 7e97498434b13a0576a06ef3adcd53ad
SHA1 5705de567769d831134eeae525e91cc6643ffc85
SHA512 86c4c2d5a1218d8c8d3798979f3337955bdb9aff8f80606cff4ca76bef72d161947f685d4ada5125b43f89aac684f17ae168634869d50c131bb80a580f7e7aca
SSDEEP 12288:vPbE7Qd4ato3eFADFZLmE8BU0xhR1ozbES87piVrWIB9DE3v3OhQrWbP:7NbtoPZLzE/CzYH7piVrWIB9Ifk4k
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_xrzyf2cb.tdv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xrzyf2cb.tdv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

e5874dd.msi

Path C:\Windows\Installer\e5874dd.msi
Size 11.4MB
SHA256 bdbbb6bf16840e49e7b75e9df26bd2780839f416d751fbfd27a29e24cfc0757a
MD5 c7b393fb12646037aa0ab75cc221f0df
SHA1 af756fbcda32ee6e743961ce6e3f0fda283c0ddb
SHA512 646ab7212960d0ca73baa2111cdd8eb4bcdfa0fd52f47112253c15a5b0439da1f0e3d142d8b9e67dbb9f8a5445d87c15bf792bb067ce42a7e02c3e364b4be9f2
SSDEEP 196608:TsxHXPNb3XPFyPZCGuJ7/+nHdNSeq+lnOOAqLI8SSckCK6wgtPYjK20iSuZ3gyx5:Tu31bNQZCGuJ7GHj9qmnOOAUrSScqxkg
MD5 SHA1 SHA512 SSDEEP

Submit Download

{df0ac36f-0d21-4301-b321-2d49c6cb6e74}_OnDiskSnapshotProp

Path \??\Volume{18122b6c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{df0ac36f-0d21-4301-b321-2d49c6cb6e74}_OnDiskSnapshotProp
Size 6KB
SHA256 d350136c984e8492637921c342b5ac05d547da10e27401da9a7a191338f95760
MD5 8a375fbe407b2bbb1e7e76639cdbc34a
SHA1 c2f10163011dfb367ae5f941a835ab4c83ab4710
SHA512 09442d9e63e6c6560337c4d2ede8def7207b8f2223bf3d8efc3915ee8973999d8975391e76900bfe0544a18e1d446579fee4b7e56e252274d244bff4a74a0c43
SSDEEP 96:FTkcj9SYFpDD84LTHzbOHXOHBlBRQJ8Sc9XE56tOSVQEJ:mcNb++sVe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4492-102-0x0000000015380000-0x00000000153B2000-memory.dmp

Download

memory/4492-101-0x0000000015380000-0x00000000153B2000-memory.dmp

Download

memory/4492-99-0x0000000015380000-0x00000000153B2000-memory.dmp

Download

memory/4492-98-0x0000000015380000-0x00000000153B2000-memory.dmp

Download

memory/4492-97-0x0000000000B60000-0x0000000000BF6000-memory.dmp

Download

memory/4492-109-0x0000000000B60000-0x0000000000BF6000-memory.dmp

Download

memory/4556-69-0x00000000732F0000-0x0000000073AA0000-memory.dmp

Download

memory/4556-65-0x0000000030AF0000-0x0000000030C96000-memory.dmp

Download

memory/4556-67-0x0000000030670000-0x00000000306D6000-memory.dmp

Download

memory/4556-70-0x000000002C3D0000-0x000000002C3E0000-memory.dmp

Download

memory/4556-60-0x00000000732F0000-0x0000000073AA0000-memory.dmp

Download

memory/4556-108-0x00000000732F0000-0x0000000073AA0000-memory.dmp

Download

memory/4556-61-0x0000000000CA0000-0x0000000001CA0000-memory.dmp

Download

memory/4556-62-0x000000002C3D0000-0x000000002C3E0000-memory.dmp

Download

memory/4556-68-0x0000000046870000-0x000000004690C000-memory.dmp

Download

memory/4556-63-0x0000000030DB0000-0x0000000031354000-memory.dmp

Download

memory/4556-64-0x00000000308A0000-0x0000000030932000-memory.dmp

Download

memory/4556-66-0x0000000030850000-0x000000003085A000-memory.dmp

Download

memory/4704-75-0x00000000059C0000-0x0000000005FE8000-memory.dmp

Download

memory/4704-87-0x00000000060D0000-0x0000000006424000-memory.dmp

Download

memory/4704-89-0x0000000006710000-0x000000000675C000-memory.dmp

Download

memory/4704-90-0x0000000005380000-0x0000000005390000-memory.dmp

Download

memory/4704-91-0x0000000007DF0000-0x000000000846A000-memory.dmp

Download

memory/4704-92-0x0000000006BC0000-0x0000000006BDA000-memory.dmp

Download

memory/4704-93-0x0000000007B50000-0x0000000007C60000-memory.dmp

Download

memory/4704-94-0x0000000005380000-0x0000000005390000-memory.dmp

Download

memory/4704-95-0x0000000015570000-0x0000000015592000-memory.dmp

Download

memory/4704-88-0x0000000006650000-0x000000000666E000-memory.dmp

Download

memory/4704-77-0x0000000005910000-0x0000000005976000-memory.dmp

Download

memory/4704-76-0x0000000005770000-0x0000000005792000-memory.dmp

Download

memory/4704-73-0x0000000005380000-0x0000000005390000-memory.dmp

Download

memory/4704-74-0x0000000005380000-0x0000000005390000-memory.dmp

Download

memory/4704-103-0x00000000732F0000-0x0000000073AA0000-memory.dmp

Download

memory/4704-72-0x00000000732F0000-0x0000000073AA0000-memory.dmp

Download

memory/4704-71-0x0000000002D20000-0x0000000002D56000-memory.dmp

Download