lumma | 5d58bde372ddc0e1515be4ce41246f302e7e4c9962e3296af49aabdec74bee2c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 13.8MB
Sample240829-ghfwcsycmp
SHA256 5d58bde372ddc0e1515be4ce41246f302e7e4c9962e3296af49aabdec74bee2c
MD5 5338555a715f0c321beab2e202032826
SHA1 43a005c8676a34f740f2d320026f52d520355470
SHA512 20de0d65d5c98b8d28e8b671adc6ceac103ad3e5a026e82f6032999c555f80a710706415c31650f5b255d60c7d518834fd7384f8c99e2b03de20f572cf3dd74b
SSDEEP 393216:TpxkDz91mUvoDQFiL0FozQMI3vv2Jknvt:9xkDPmUw5KkTI3v+Kl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://constructgeneratisa.xyz/api
https://singerreasonnbasldd.xyz/api
https://surprisedscaledowp.xyz/api
https://clerkpolicemandwusi.xyz/api
https://matterrydamagedowkds.xyz/api
https://fiondationkvowos.xyz/api
https://voyagedprivillywk.xyz/api
https://spitechallengddwlsv.xyz/api
https://varitycookypowerw.xyz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Setup.exe

Executes dropped EXE 3 IoCs

pid	Process
388	WinNc.exe
5068	WinNc.exe
2388	Setup.exe

Loads dropped DLL 4 IoCs

pid	Process
388	WinNc.exe
388	WinNc.exe
5068	WinNc.exe
5068	WinNc.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	WinNc.exe
File opened (read-only)	\??\v:	WinNc.exe
File opened (read-only)	\??\y:	WinNc.exe
File opened (read-only)	\??\z:	WinNc.exe
File opened (read-only)	\??\j:	WinNc.exe
File opened (read-only)	\??\l:	WinNc.exe
File opened (read-only)	\??\q:	WinNc.exe
File opened (read-only)	\??\s:	WinNc.exe
File opened (read-only)	\??\h:	WinNc.exe
File opened (read-only)	\??\m:	WinNc.exe
File opened (read-only)	\??\y:	WinNc.exe
File opened (read-only)	\??\e:	WinNc.exe
File opened (read-only)	\??\n:	WinNc.exe
File opened (read-only)	\??\h:	WinNc.exe
File opened (read-only)	\??\r:	WinNc.exe
File opened (read-only)	\??\a:	WinNc.exe
File opened (read-only)	\??\j:	WinNc.exe
File opened (read-only)	\??\o:	WinNc.exe
File opened (read-only)	\??\p:	WinNc.exe
File opened (read-only)	\??\t:	WinNc.exe
File opened (read-only)	\??\w:	WinNc.exe
File opened (read-only)	\??\g:	WinNc.exe
File opened (read-only)	\??\i:	WinNc.exe
File opened (read-only)	\??\o:	WinNc.exe
File opened (read-only)	\??\g:	WinNc.exe
File opened (read-only)	\??\z:	WinNc.exe
File opened (read-only)	\??\k:	WinNc.exe
File opened (read-only)	\??\n:	WinNc.exe
File opened (read-only)	\??\q:	WinNc.exe
File opened (read-only)	\??\p:	WinNc.exe
File opened (read-only)	\??\r:	WinNc.exe
File opened (read-only)	\??\t:	WinNc.exe
File opened (read-only)	\??\w:	WinNc.exe
File opened (read-only)	\??\s:	WinNc.exe
File opened (read-only)	\??\a:	WinNc.exe
File opened (read-only)	\??\b:	WinNc.exe
File opened (read-only)	\??\i:	WinNc.exe
File opened (read-only)	\??\m:	WinNc.exe
File opened (read-only)	\??\b:	WinNc.exe
File opened (read-only)	\??\k:	WinNc.exe
File opened (read-only)	\??\u:	WinNc.exe
File opened (read-only)	\??\x:	WinNc.exe
File opened (read-only)	\??\x:	WinNc.exe
File opened (read-only)	\??\e:	WinNc.exe
File opened (read-only)	\??\l:	WinNc.exe
File opened (read-only)	\??\u:	WinNc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5068 set thread context of 3316	5068	WinNc.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
64	2388	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
388	WinNc.exe
5068	WinNc.exe
5068	WinNc.exe
3316	more.com
3316	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
5068	WinNc.exe
3316	more.com

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
388	WinNc.exe
5068	WinNc.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
388	WinNc.exe
388	WinNc.exe
388	WinNc.exe
5068	WinNc.exe
5068	WinNc.exe
5068	WinNc.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 388	4684	Setup.exe	87
PID 4684 wrote to memory of 388	4684	Setup.exe	87
PID 388 wrote to memory of 5068	388	WinNc.exe	89
PID 388 wrote to memory of 5068	388	WinNc.exe	89
PID 5068 wrote to memory of 2388	5068	WinNc.exe	90
PID 5068 wrote to memory of 2388	5068	WinNc.exe	90
PID 5068 wrote to memory of 2388	5068	WinNc.exe	90
PID 5068 wrote to memory of 3316	5068	WinNc.exe	98
PID 5068 wrote to memory of 3316	5068	WinNc.exe	98
PID 5068 wrote to memory of 3316	5068	WinNc.exe	98
PID 5068 wrote to memory of 3316	5068	WinNc.exe	98
PID 3316 wrote to memory of 4984	3316	more.com	102
PID 3316 wrote to memory of 4984	3316	more.com	102
PID 3316 wrote to memory of 4984	3316	more.com	102
PID 3316 wrote to memory of 4984	3316	more.com	102

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Users\Admin\AppData\Local\Temp\WinNc.exe
  "C:\Users\Admin\AppData\Local\Temp\WinNc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Users\Admin\AppData\Roaming\Gr_Fm\WinNc.exe
    C:\Users\Admin\AppData\Roaming\Gr_Fm\WinNc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Users\Admin\AppData\Roaming\Gr_Fm\MNNSVTSRROPILODT\Setup.exe
      C:\Users\Admin\AppData\Roaming\Gr_Fm\MNNSVTSRROPILODT\Setup.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 832
        5⤵
        Program crash
        
        PID:64
  - - C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3316
    - - C:\Windows\SysWOW64\SearchIndexer.exe
        
        C:\Windows\SysWOW64\SearchIndexer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2388 -ip 2388
1⤵
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\7z.dll
Size 1.4MB
SHA256 15b10608affd4442d0e2ddb9b2fea847cd15d5405928d78ab73d81dae66db9e4
MD5 23a37370f275aa63255dfcc703951c37
SHA1 79e6cfa11747b633eb3d742d62dbed93a7b5f0d7
SHA512 98c917274b5bc9d005de4d53390bbecf1e685a42c6460db0503f36c27c4fba76048aae90064e78e81a1e6b9317a87d4e6f8e32317f63cc6f9c0704e8837dbe61
SSDEEP 12288:i/HBx5Byjg5f1t0dwQzZKZ03HGLIIdE4gtND+3PxAN2h6QoAhM0ZYN3cOqfnebcn:yBxB0dwvZ03HGLIqCWf3DeitpBQDtHh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Changes.txt

Path C:\Users\Admin\AppData\Local\Temp\Changes.txt
Size 65KB
SHA256 6ca51ff7d55c035df40661219b56de7c00350bbd87772cb0a57189a24d4fe987
MD5 f240b64249575418937142613a18d6d2
SHA1 8a63a1839c5b5a099d4583972d23ff6aaf87ee2a
SHA512 fa8297f5117b2ccfc1134fcb48db1908573a4f4705d37ef0bb62c2cc103f97665ea9e5ae90a15879fdec46fada248355d7403582ad3d48896fd96b7c28b0894c
SSDEEP 1536:2d0ZZNgCg4p6UdUKe/cEdQbgD+TLoliVg0Ko:20ZSUdhekEGQ+QSF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Colors.ini

Path C:\Users\Admin\AppData\Local\Temp\Colors.ini
Size 6KB
SHA256 a9d578c52418dcd65bb8694cfba23be1bddbd703908ceab535fd0c4ed01e75a3
MD5 72a502b416df16b5368db7d06836a9de
SHA1 015a8a4df10c0988477f5a69e44152ad1a90e237
SHA512 2e5ccc6e38e533af799fc56bd5ee90cbb9ffe631daf74e0f5cd0e97dd6eebb2ddbe9095532737f1b381157cc77a5df3997ce6572b35028de76e549e13604b41b
SSDEEP 96:sPWx12aK3hTiHpc95bB8iEf2oxFKdVbYBkMh6h4Bg9RLpFHCJ2X1sPj+hmJXZtvM:sPU12aK3gHp0g8ytBKRL7qFj+hmJZ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Drive.ico

Path C:\Users\Admin\AppData\Local\Temp\Drive.ico
Size 24KB
SHA256 85cb1befded0b2a9125f22fe0fee7875030ec88d8ae4bf8395565ab8f3218341
MD5 d7f7ea5129480611ccddefa4b4345b14
SHA1 c0403442a5713dc4ff275fca41848347de97cbfd
SHA512 7353549f77b74cb461942856edba5eecfe65a8c0b519dff3578204d607bf8dbe207719d5a474700c17e69b490a2afea067f7fe8d7dd1e501338d2bdf13a318f1
SSDEEP 192:35MPwhPy0q/SK9klNQhQmQSsM6jDL5ukOXzbKDeMH2ap8dW5MRu3o/:pc4XusmdO4kOXPSot
MD5 SHA1 SHA512 SSDEEP

Submit Download

Find.ico

Path C:\Users\Admin\AppData\Local\Temp\Find.ico
Size 26KB
SHA256 b25c319bd185fec214bd28d885dcc7a1609f0a08e2e3bd88291368444c5ae5e3
MD5 b67fc654fb82cf28004c30c07d00ff6b
SHA1 767109e054fc0c571e51fa7d4f230ff5f3262d40
SHA512 1bf456278d9c90cc0a2187cc6f33a47d48cf7688c9a2ea3c392408a4b5f5f8c9329cdde30a3d6273873ceab2ae9aa19f210f025914e18042ec397571de7d5e12
SSDEEP 192:k3vCSrm++MESaD7TMyrE9V3e5sHP1DxS1CtP6ACas04SvuxBY2X:k3K5vMyTMyrEb3e5iP1DI1wiaQsAeI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Find_.ico

Path C:\Users\Admin\AppData\Local\Temp\Find_.ico
Size 41KB
SHA256 b08419e753072537e2ef83b6c56ed0a0592e89963cee70d3caf9da5aa049943d
MD5 164cba34a6ab532188c21e6e2c9d99ed
SHA1 c2a5a3b662377d8cd4159a923b4b07fc17f3123e
SHA512 5a78c166338def5a97d9caea0bb43b19e607e663a52d2e9b6aa3ef150f19af3b9524257a9c26a57bccf5d1265578c00f4e3e2642dfc9d3f5d4a1f6529e7291dd
SSDEEP 48:2GM0lhooHeHooeooooooeoooooo6X7spAWupJpi1cn0XHHHPPPPPPP/f/en7ZH3+:7M0ltXiyZH3H3NdhF33P2OYxg8P6dudF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sfx_en.bin

Path C:\Users\Admin\AppData\Local\Temp\Sfx_en.bin
Size 33KB
SHA256 d8f22e16a72e981b8c1d9978bdaefebfc2546d49c8f49f1ed3ede792f3812297
MD5 f16ba53292b1dbabe6dd6bf76a2b4f02
SHA1 dc23a0dc21eb7bb89b10eb7f8159ae9c989ba319
SHA512 a3ebcd4eec85481f5c70e4e83e01f225dbc6b7534247e4e34671367c2794048a70fadea0b42b64b680d5eb79dcbd72479cf9f15859e26f9f8002f7d09e4b1d43
SSDEEP 768:rr5NqrKII3Kn88aOQVY22qzzJWA87m7kf:xNqrKR6n88GGvYJgN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Startup.xml

Path C:\Users\Admin\AppData\Local\Temp\Startup.xml
Size 88B
SHA256 a52d86083e3c77b364b36dc151cedb5722adba7b1d5043f7aee693774f5f479e
MD5 5d0cda749ee4ec8e4da55481417f12c8
SHA1 34ebff7e948d11eeabf6ca908c58fc71efdd03e9
SHA512 dbec1dd4b83dc5d542962f774e08a03be98e1e48afb5f8201be182c270d5b0f00548f230a64a87fb4ddab65e9a6da1a929decd41fc0a9e03125254bf0497dcc9
MD5 SHA1 SHA512

Submit Download

State.ico

Path C:\Users\Admin\AppData\Local\Temp\State.ico
Size 26KB
SHA256 15c7d8bc701d6de77a31e2bdb1dbd6ef325634903609e201908bb1a060a22518
MD5 8afac5817dac9bac9b0b7fd4dc4fa448
SHA1 e75831ca700fdc8693fba6e8c098a2864139cd4c
SHA512 29b9a75087e3f7db037bdd39a41b7aeebbfdb3b7256d072a63f231d299e239b0b575ae7e81715a760482c4cf93355e9d87a04c5f9079262522f3ae5af71b9eae
SSDEEP 384:LqJXzs5QzEAAADAtvKADKyULu3K//eVIfhKR5I4aRfkcihqdWg1beflAAAD+NMZj:LmJzgwAbWuVIG5+Rkq1be3GIr++g
MD5 SHA1 SHA512 SSDEEP

Submit Download

VirtualFolder.ico

Path C:\Users\Admin\AppData\Local\Temp\VirtualFolder.ico
Size 158KB
SHA256 e46eea0e585c2a729d4d9bd7790fcd530ae639498407868145115638c9dec09b
MD5 1bbece3668dc49193ef0fd4dc81e7c83
SHA1 946c509152b51813c6878adfbd567080ee31b799
SHA512 4b6388004daf4ff14c2d1022cfd509a927c5e02d42f0cb7a6facdde3078ecbe227d613eab782b4cc112ab58f99199e8162adc9bfcb5dd52f0579156fc9b619f6
SSDEEP 3072:nxLrC3US4eNJwLtkafnof7az+YkvMeQJKZN54RXE0yioE/h9av:lp+B7RMav
MD5 SHA1 SHA512 SSDEEP

Submit Download

VirtualFolder_.ico

Path C:\Users\Admin\AppData\Local\Temp\VirtualFolder_.ico
Size 41KB
SHA256 717f55840329974331d0482ad75646ca8e83c50ab023f5fefbe9b03e66bd35fe
MD5 908a4b26b19276092e940b5dee08b444
SHA1 6d17f5e5ec4f543eb57e51f7161b782dc6dad849
SHA512 b20113c41fe51e6a499d8aca213d0ce25b853fc13050202217a98ce49ae505ad83a188c9dabeb9b3a930bca2411d274fce9bcef5e00d45c0f2151d645c59d906
SSDEEP 384:r666666Un3TSBlg2p5dhAAAAAcdGlMV7tT5:FTIlMV7p5
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinNc.exe

Path C:\Users\Admin\AppData\Local\Temp\WinNc.exe
Size 21.3MB
SHA256 34a31ce56c97fdc7a5db20c1dec741830c75d97b87c11c1658754419213ff6d7
MD5 167f5ba070706c4f1da96eba30c06c6d
SHA1 67b7034ab54a47da6c1b9dfb4268e1b4d24c2b8b
SHA512 840f30f1c4b6df8b430bbdc914b9f39647efa6b29c51c2aa7b0466e15cdf88d382aa0e9782299fb4ecec29b82b0c3be3c25d13c22702aa0fcb8892ce9ffa2075
SSDEEP 98304:caSXP8DYAoeoOmj/0I6qMizj14flA+IK7BJPcTt/229oduREUlIvPy:alAoeoOm0qhzj6ld7BFq/2i6uZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinNcDataFolder.reg

Path C:\Users\Admin\AppData\Local\Temp\WinNcDataFolder.reg
Size 511B
SHA256 3512218bc974944424ef7b6ddafe4c20e6feac90a78728198903890dfd507b93
MD5 93cf30467670389d05950ae1b0c5cdf9
SHA1 16728c1f1e6bcd7495420d33bdaf9ddf3d6bbd15
SHA512 f740c2d2fe66ced7858926750b17c56297bcea76891c2e5824a14d4cc889081ca32409a8656fb6d68f69ee99b8038769a2195b168512d3ec52f2b56d4b220178
MD5 SHA1 SHA512

Submit Download

WinNcIconsFlat.icl

Path C:\Users\Admin\AppData\Local\Temp\WinNcIconsFlat.icl
Size 11.0MB
SHA256 fae9aa2b888f35b9d74e9a1c7fca347d6fa10f5f3295e94dbf2231f19db46a40
MD5 82566032046f86147e9765ddc0272092
SHA1 929b440277d0b1a1f0de29a974b14b3246c2beb6
SHA512 9136c8dd8026cee07d9ecca3ff7d2d4c7c112d576a63aea22a99726478ad8a3156fa9c1caa5537d0554dfe48f0cf1e0a00a584cf54c7427f08940fbd9744c6b4
SSDEEP 98304:T1bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbebbbbbbbbbbbbbbbbbbbbbbbbH:notgW/tiUTLlz
MD5 SHA1 SHA512 SSDEEP

Submit Download

burn.ico

Path C:\Users\Admin\AppData\Local\Temp\burn.ico
Size 37KB
SHA256 11f189a24dd872d2d8407f5dfd0ae589377ad798dfff30b1c5cc13da914ec0e7
MD5 6081d810d4f371db5dcdaf5a0e8be787
SHA1 0f84fec7e0cbd63dfbe9abcf96fb1ef61bc37979
SHA512 d40477e011415ebe58dba6bf37019e42b73a5c68158cbd7ea287099581fb966ae7d46a94c03f4d1576e647894839f43694d56a9808a335cb58bfeaab32bc7497
SSDEEP 384:bA5RbbO+BMgvsEq2swn0NF7R2HeXMC+F/fA1vwOtkKBioeyec4HZ7l7De6ljkFIg:bAvvBfvXewY7R2+d+KtdBsyecMDeSjMp
MD5 SHA1 SHA512 SSDEEP

Submit Download

burn_.ico

Path C:\Users\Admin\AppData\Local\Temp\burn_.ico
Size 41KB
SHA256 4f6fc275f5216d40f303d9f277d565fb541a3fc2e71914136bcc321b6b959a7c
MD5 1b71a70372ef47057828a9f473787994
SHA1 f7087d8c1ef5affbea2c8a518792f57143ad21ef
SHA512 49745f163411f5716acb6b10c59488edc5ac18f3d036b9c2c74e43ced010a047bceff6713fd78e67ade2df058af1698561c8fc4f3caab1baa17326c8896049d2
SSDEEP 192:dMYusgkMQbDp+MMMMhMMMMCDMMMMvMMMM4iMMMttMMMqMM4MMi7M/Mj+FMHMMCGT:zg8bDLSfbSfgrFHx53
MD5 SHA1 SHA512 SSDEEP

Submit Download

charango.ppt

Path C:\Users\Admin\AppData\Local\Temp\charango.ppt
Size 851KB
SHA256 5163400d42478be4a6c4b7112ee9e99078d1a479b47700b8e4e05f41831bf0bd
MD5 b9b3d185ccf1d567ce2047c5fefd3dc1
SHA1 7801b0c21caf46b4a17983db90286f5990a063d3
SHA512 d2ced5b3a0d2e98d598017b5193458ec8cc162a0f14a3bb663af6bc52c13738a50dffa100ba0622a54833d4a04c9762d1742eb231107f2ec24688aaa6af703ae
SSDEEP 24576:gYtuhUWhP5crLxnqKYZxfn3QbLzOfo418y3p:gYtu2gcrLxnqtnf3QbXz4my5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftp.ico

Path C:\Users\Admin\AppData\Local\Temp\ftp.ico
Size 18KB
SHA256 a2481b8506408d7dc6a4767f4a48ce8e1dda651fa225a1b142acfe8cccc1190a
MD5 b1b05a4b932568a42082b65a2600564c
SHA1 1cdd4289df3e36fc35b783e63986999c5230101f
SHA512 72defdaa817f465280053dd1d881fca837e11bc558d89878a92b43ee9e3cef85233695eeb1d7e88dcc36cf09109c60f558567b248046682af0f1d8722a2be1d9
SSDEEP 192:wjOUpYzogjOUpYnB5byhuplj3Uj07Vv4Bd6alQJJmlmrJOwWiU6eullQqsiIQNLc:2XpaoGXpOB8sxUGd/mmrPtZeYQqrqLN1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftp_.ico

Path C:\Users\Admin\AppData\Local\Temp\ftp_.ico
Size 33KB
SHA256 124cc7263e0ff5abf2288460fd50239f56be894f20f4caf8384a66608859ef9b
MD5 f39310441853f0935dfefee6b1c5f82f
SHA1 05c23c5ac14d66d0725487ce5e288d9b75268cfb
SHA512 50698c8f07015d93aa2b4569d14f0fe98ca2db115a1bb13b7cf29981ada0638df3dd9e0647492dfaa4de1301037b4168f5a2d97aa6adb20d1e4907725b283663
SSDEEP 192:Eddk2B//3n7MI3pUOxPnJT2blrpyVEK+0a7JQVfr8rr+UO4d083EGJIXixPKMYGM:Eddk2hh3pPxP0bN8U0YQSSGRpJ7YB
MD5 SHA1 SHA512 SSDEEP

Submit Download

help_en.ini

Path C:\Users\Admin\AppData\Local\Temp\help_en.ini
Size 9KB
SHA256 46264ab1e9f51b1897372dfefbe148e1571ca834a67a4025292744176549a645
MD5 2b66098cc0c902a3549af0e7920b2c2e
SHA1 e4f0b168cf6b2dab0ba3eb162a0e4413f5f55b5a
SHA512 2dc06ef3f41ca6494e2dfda5b46c4040dd5e819edf4ab68ac4da54638b194e78daea17dfba67726c2e9faf2b22ff85b5fadb8397ac433a1270c40b1d5a37d298
SSDEEP 192:SpPAmZf/VRbaj5IUF7CdMpfl9kPGdVXHz+aR2fS:Aoi9RbuIUF7Cd2l9MGPqaofS
MD5 SHA1 SHA512 SSDEEP

Submit Download

lang_en.ini

Path C:\Users\Admin\AppData\Local\Temp\lang_en.ini
Size 92KB
SHA256 a7cc60602eab9596ad9c5a4fcda84354cb12d1d1c118222d16144f0ae655db06
MD5 c683f35f2637ad00f8e2fcfe3b839abf
SHA1 b7f305e8dc557ea387142722efca5568f21e0344
SHA512 bd66ec1104de9d4dc2891c4c420207859395f869ae4a5fcfdcf25bd4b68a6bff87255d1149554dd3dbe5e2717bfa95479c0144f869cef850eb97a1e661bf600e
SSDEEP 1536:KaHFA+Gex66odEPXsThOH+7Ch9C1FBZs6d:KaHFAnex6ldqsNOaCh9C1FBO6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

nucha.doc

Path C:\Users\Admin\AppData\Local\Temp\nucha.doc
Size 90KB
SHA256 f78851e9b5679e8cfbb075aedda0f2ad3182545fe0e1b901eeaa912d2a647cb6
MD5 bd432a88f12d30f43c4ac0d9244c931b
SHA1 37ca2914e791580bc660c49deda17b22844d7bec
SHA512 96ea342344ef36ccd8d11568b98403f90f1bbc0881f21b0bc54b1320be4de38e56714115a8f67a2d565c87271d5075f482951bbb200e1b09379bea622c3d2cc0
SSDEEP 1536:bpDTMtTE4E83LxT6OAeHb22/sPVhPvhbydjd4dl6wj4Phh+5C7qbfDwt:bp0tTvE26OAmbL0bZOja6wj4fQCkfUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

unrar64.dll

Path C:\Users\Admin\AppData\Local\Temp\unrar64.dll
Size 254KB
SHA256 3dbc0e6e073f8990ed4a0727c10bd80fa1c62a60690d8a82c65728ff3650c173
MD5 f991d61963efcd40f735320e3681603f
SHA1 dcf4f9e0f24d24939dc0c346c3e3f8ae350c625f
SHA512 011cf8c1339a87a9ac344307f0acefa18ed8bfb2f67c0d6bea35287062af28af10c343c07f4f69752d622d5c26f15627d82594bfc5c9cc75f97c18675d24b95c
SSDEEP 6144:HdtGQ5JMTZJPnefq1bmm06DpA/2nODuSCPiGknQ:Hdt9+VFyq19dk2ODtQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Drive_.ico

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\Drive_.ico
Size 41KB
SHA256 04fbb121dcacfb5a3ce722f0d85d8b531d87a85dea645c12963ebebe925fc8d9
MD5 a2e212ac2890d223a122164f1cd5577e
SHA1 c8347f27b47bb4ba272a2ea019a8e7faa855849c
SHA512 76c17873433938375bbcf45698c571546b954c3839fce8e169002f6b3d4034d4c37eb9fd24a09c036383e08ab981fb878f79445912149b7d64336ffef378a327
SSDEEP 384:xDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD8hTh6mwc:Shgvc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_de.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\Lang_de.ini
Size 110KB
SHA256 32ba428d5d916906fdef2189d031c9863c44c5f92e992e110147c99eefdf5763
MD5 b8fbc85f8cdeda4f68355365d0af1194
SHA1 6617b1310ba526354c50f013c0b8a3b45a2a5011
SHA512 723b4b701efb8642fa182077d1d3bff6b040f984c59b339f5788a0329237a12ffa34917dbe65691a602470980492039602a6ae2023e50486c959a5f0f84f5356
SSDEEP 3072:VBh+6L06Lm6bs6b9Z7Z72B2xvHckrau2a08qUUtMQbn9rEKGk05nnsiUt6iyl5Mj:fmvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_es.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\Lang_es.ini
Size 104KB
SHA256 b0f5408c1d42511b5fecd5f9dd4438e041e18ace640591ae6e5a2c9b629f6969
MD5 7ad3f35c79a309b5fc67f44c374dade3
SHA1 a3d45f8d22d46161f5f4333c9adec40a577e71de
SHA512 6859b3a7c8df1c6a1615e0665ac60ec0410b0f26dafb456525796f3a91eaefccbc6227962f5e2a9ac10bbf1e5e2b72c1780fc787d4093855496c8c9a36cd3797
SSDEEP 768:AE90bTUuD9i0bli57zXBFOhlhjx325nJ45sAtKK+LohsCEm0BpgGwZzqnI:A1UuD9i0bli5ZMhlkZIcoV0OYI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_fa.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\Lang_fa.ini
Size 94KB
SHA256 8abe57ed3f9f377009ff2cd09a8f065fbe44934ecf152c5ef1092ca090e7d8da
MD5 272fb0b96d1c2ab596bc25207f4230ed
SHA1 8e27e8d4b3443c5441f44278098aa003ba217309
SHA512 178eab02ceb8f61a7331063d27caeaf402c38ca44aea2a168e657172658ecc0268e9c5048363b9e375f052e76c87c29c34ef1142c11bc0bf9c90f04b0c07fab5
SSDEEP 1536:ykmYm3mWwI4xmTNvfnpwtPep7TItzUu3SvqX+WjP0LSCWaRL:Zm3mWwI4x0VyPqTItQlqX+W2S0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_fr.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\Lang_fr.ini
Size 109KB
SHA256 bbba55dd0dce3aa8ed7c648e219fd58e48ed646d2a5e3a3082f30975f5ecae19
MD5 bf2c682351207872f9a615e8563bd1f7
SHA1 47b96c6e1a4aef91bf788eab15e0cedd952b51ed
SHA512 6610350cbb163b93206c821b37bac104e92ed39cd72e1d5f047c52c63a389863f1f251cff95848c1a7b16e3042e8d893e0a973a379fa824946572ed9dfa17dec
SSDEEP 768:do2sD7U70EQ3VuGMRuyLjwn0bmQWWs3+Zkfkr4nOv/LmwPYIaWIkpuEIEZHIZV:do2sD7U70EQ3CLL7xG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_it.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\Lang_it.ini
Size 73KB
SHA256 4d33e9f56db48cfbe8236545c871f7d3441a2748a42268e9efea8e71cc68b25a
MD5 39b09e4993288c628db6c8cdaf51bb19
SHA1 d1de0bab86eae80c90fdcbe883dd8d01eb29d591
SHA512 8b24bab0c690390b5b3e44989e1211f747b2475063ad8b0619975b0974e8db5b82673ca3d42ee66891b99ea0ddc6d2ee460abca9ba84c906aff57223bd855e29
SSDEEP 1536:UyB0DpWfQwUKz0ZqHr23n8hwEqVvOZZWz:UyB0DpWfQwUKz0UHr+n8hwEqVvOZZWz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_ko.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\Lang_ko.ini
Size 64KB
SHA256 b081a37588a795b1e3be7bb809ae7cfefa93b16df858fd813e491dad6070887b
MD5 a047f4b1e900baea21e8c544a932b90c
SHA1 b35f41f50286bb71fab3c768829e123ed5eb4ec9
SHA512 7a50b75a1ce49182e3d9393c3a5af863533cd8912e7c5b959d7f037044a267f342b260debf4b6d85361bd7702186846fdeed3dc82a2ad44e4571b026b6c73ca5
SSDEEP 768:CqP+CfQDtOqo0ObWM5biJpvNKXRFOC6nj/XVI72hyICuiwrJ44zdt/Q+Ao:CqP+CfQDtOqo02vCKXTCIKdZmXo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_nl.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\Lang_nl.ini
Size 103KB
SHA256 86938ad61f799dc0c7cedec742f45493a8b2e2ae9b4f979243f8fc9fbda9602f
MD5 9611c34293071403c87f64935c9e10d9
SHA1 33ee043ddfaa78e15198a7cb629b3bd52d56f8c6
SHA512 19c917f95ce3e5b72dd8e3f3c29cfb0cb4590bfe8d283242fec8a04356b83377193e39a3d34bcf450db3b1d0343b3b056284632ad54980b66aef94bb74e1073e
SSDEEP 3072:037ccTmQ1kkDEjYdSJj08PJtJFx+JJC38hNHrBAry2UQlAfSIMXfatZTucMOPmhV:pH8CabG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_ru.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\Lang_ru.ini
Size 96KB
SHA256 10f4e798a242dd30dd78d268fb73546aa5e41ccb6c7945f5853457924389c54c
MD5 eedfb44c3e2deb80e3983b9ef62dfdc3
SHA1 a5d46320766225ed2b27c699554033f6d2e15db8
SHA512 53691eebba411f3e143e204e25b577347978aa4659d826b6c52db8545ace80b210fc522a82a77f924819b24ba06ee565fda139f4ae7b8aa877c73535491fe411
SSDEEP 768:1Gk2oKDZ93G6zsHlRe0DCOnDy09KKW6AY8jEs3dCy6uY:kk2oKDZ93GHbRDFZoS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_sv.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\Lang_sv.ini
Size 61KB
SHA256 467d221865b48b5311a21db160ffcff129e8a1145541ee67b6ea8f1d81430bd9
MD5 913520dc0232199744b2ed2f611c6214
SHA1 80257f8670afb0d773b02b19911b6e02ae3b1b02
SHA512 9a39a4a267bbc6979ad61823962c1eba8e14390d501a2d191373ecbf594e393ad833898c0a1dbe6e99c4b5345f8ef8f4f4bfebea5cde5980c22964dba686974d
SSDEEP 1536:HIGKpyFY+6szf6alM8OAV/HxtjMq9OykEAJArHBFdbvxJ+bl2YXOO/uPtgRE:0py2+6szf6vDAVfxtjMq9OykEAJALBF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_tr.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\Lang_tr.ini
Size 97KB
SHA256 35dad73ec3f06be10897e141023a13864fafbfb38d62fbf169bb732b202db555
MD5 5fdf96496dec453da81c88977eac035d
SHA1 5c7086f3ba39721508f01579f97f9995e0591acf
SHA512 ae62d333b04b8ae885d26cb9fad481a26b0b12934fbbcef8a7c8e78a058c52a03f911f6985fc121b9342d5e383982883fd40dfca31d3e081c005e51911d26c0a
SSDEEP 3072:XT8YGc0gZJZ14nqopIHGOwaK9vfevuR33h/0Q3KHS2TEpkyCFeJsSBsG00QOhXIw:Kpn0s5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_uk.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\Lang_uk.ini
Size 95KB
SHA256 b62e35e5817d0f8ebcf9813eabb97e73b43a4aef1dc8b43f148c4d7319c7e820
MD5 65333e43a75310b68ea47babf0450b98
SHA1 2276377db122758ec9ae0e04854725792c4f666c
SHA512 8265fc135e34c0e58bab3b7c0f7899abc2040cffedb96e0dd886bbb242f33dfbf8f9ce888caf21c3871454baf964820832acb463a73dde952efcfa2e6f75aeac
SSDEEP 768:dLb9f12UxjRETXQZtyTVek1Wf/8uOdnK2eLMnwiqSoIeWzqoIZdMZMX2yU:xb9f12UxjRETgZtyTIkyglwA3vOoMMyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lang_zh.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\Lang_zh.ini
Size 52KB
SHA256 815b9777943c59b9b5e419c663206c8b82edc7e4a00578e897a9a3811c0f2b17
MD5 3e534a49be558893246c35a06ae06f95
SHA1 ea1cb61bf89a42d5d28d554d6a07e57ba19e96be
SHA512 fbb46441efc2c663dd5575177cefc43f8e33c7738e77ccd6a14b6582fca3ad1fc980e9b8a43aec4cf3915e1063a47f343fb821d868aa365acb3f2debbe4f4d35
SSDEEP 1536:mresf5DNwEJ/onhksfXwIzuTAk8bRsRmvz5O:mrTf5DNwEJ/onhksQCsgY
MD5 SHA1 SHA512 SSDEEP

Submit Download

State_.ico

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\State_.ico
Size 41KB
SHA256 f8fe9fe26a0ac55442219b1c2ba00cfc769f0254ea06aa14c324acd0d4c88aee
MD5 293602366af820d6b270a52bdd627ead
SHA1 b61d39be720127bee8a756c56c95aad13b50b438
SHA512 5894cb750997c14563cf831f170bc54f1e57fc438e86b9708d3cc5cbe3603ac71f475f2d317616f0670c0d47e3d1142c550f691c129453619129ee91f117850d
SSDEEP 192:wTLosR3WeZQBYhCI9ZHxPdRnWYzFTqXjcUHcpRT0EsDn:6osRm+aYhCI9JNdBjxTqXdhn
MD5 SHA1 SHA512 SSDEEP

Submit Download

lang_cz.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\lang_cz.ini
Size 79KB
SHA256 1352a22374bdfa1c2650592a67bbe1968c1dc0deb7ede19023c9cca932e486d5
MD5 0ba05a01d0ff7aef09365ab71857a552
SHA1 9459babc8f09b012b11f39e944ab2eaf8f81f092
SHA512 9468fa916770aa4ade62d07be5513987bb34aefeae426b603873e0cfdee39f1627930254f9aed692e324bcebb5f4d181dec26b49049661b1428f5bdb2b05fd46
SSDEEP 768:3bMX7/WXgZyvftQ7kNSB/ziO3+wsDIprEX1l9zZsJAqc5Eo0/VU0YSse9mq1v3l3:rMX7/WXgZyvftQ7eo+w6t6RfF
MD5 SHA1 SHA512 SSDEEP

Submit Download

lang_hu.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\lang_hu.ini
Size 98KB
SHA256 fa090f04f20cbbf9079d3ee39e336f0b7d625f8deddee18c67aeb00480793b39
MD5 ed13458e7c0cfe4683574fedd4586337
SHA1 6f18fa9ec84bb69600ced80d4f7886748d2af935
SHA512 dae6b509c4f822176b8b54326baa35e31b9cb05e8e844c77e08d7553bf3a5678bcebf3679635c600a9338bc2f8037aabb9dc5be7b5e0d3d1fe36c7d38c842a05
SSDEEP 3072:ZoUmsbNUncvf06e+fmWcQqPBUHFNLR70VAQyXeXfNT74z8QbX3nDYmB1DEi/+wV/:9RvV
MD5 SHA1 SHA512 SSDEEP

Submit Download

lang_pl.ini

Path C:\Users\Admin\AppData\Roaming\Gr_Fm\lang_pl.ini
Size 100KB
SHA256 75f8be435b9a0473859e5404cc723994d5f2a8ad767c40e5b560846f5da6feb8
MD5 300fa08c9163f7abd49b282394071ee3
SHA1 1a3e7ddd73bb2224f96c88963236e176d70fc398
SHA512 3f455e171f40e93e7642cbe94a33ff72f23e57713e5aa82d0253b7ea8a8ce16a3821b3bafa1c3f324c3b11d6ac6b0b90d0c7d1e520ff82915f33f525a56b9fc7
SSDEEP 1536:rP1zY0XSFr0DP1EZ5skHXNlUbY364V2ogFdmed4pROR:b1zY0XSFr0D2THXNlUbYxV2pmN+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-89-0x00000000039E0000-0x00000000039E1000-memory.dmp

Download

memory/388-174-0x0000000000400000-0x0000000001BD3000-memory.dmp

Download

memory/3316-204-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

Download

memory/3316-205-0x0000000075810000-0x000000007598B000-memory.dmp

Download

memory/4984-207-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

Download

memory/4984-208-0x00000000005A0000-0x00000000005F9000-memory.dmp

Download

memory/4984-211-0x00000000005A0000-0x00000000005F9000-memory.dmp

Download

memory/5068-195-0x00007FFC994B0000-0x00007FFC99622000-memory.dmp

Download

memory/5068-197-0x00007FFC994B0000-0x00007FFC99622000-memory.dmp

Download

memory/5068-199-0x00007FFC994B0000-0x00007FFC99622000-memory.dmp

Download

memory/5068-200-0x0000000000400000-0x0000000001BD3000-memory.dmp

Download