lumma | 86bb9a397e62d756578dbe6c40cc07050f2066db6fb5d54499e03469a7cdccd5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66d5ddcec1520_shtr.exe
Size 206KB
Sample240902-trxxfstfkm
SHA256 86bb9a397e62d756578dbe6c40cc07050f2066db6fb5d54499e03469a7cdccd5
MD5 ab68db6a238464a75b669938a3512ae1
SHA1 48a7e2ed179d29d783d55fe610598474825bdf95
SHA512 b811a8f5d3d2fab469a97a9a0d59d6b132b4fecbc7048dd203d25c938e7047b487e9a85799f8d9b04c0e01f307f3ff1bd0c3af967a8813c3ab0d72c69650364c
SSDEEP 6144:DYwI7yviKKJGngBT7nI5n6gtJuMM2lxG5IvjKEO:DYwIueBT7IRntJuMPXZKEO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealc vidar default credential_access discovery spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

default

http://46.8.231.109

Attributes

url_path
/c4754d4f680ead72.php

Extracted

Family

vidar

https://t.me/edm0d
https://steamcommunity.com/profiles/76561199768374681

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Extracted

Family

lumma

https://stamppreewntnq.shop/api
https://locatedblsoqp.shop/api

Signatures

Detect Vidar Stealer 20 IoCs

stealer

resource	yara_rule
behavioral2/memory/1724-97-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/1724-93-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/1724-103-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/1724-125-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/1724-126-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/1724-141-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/1724-142-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/1724-158-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/1724-159-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/1724-167-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/1724-184-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/1724-191-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/1724-192-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/1724-193-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/2504-231-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/1724-234-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/2504-241-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/2504-242-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/2504-257-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral2/memory/2504-258-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Executes dropped EXE 4 IoCs

pid	Process
3332	AdminIEHJJECBKK.exe
3908	AdminAFHDAEGHDG.exe
3108	AKEBFCFIJJ.exe
4896	CAFBGDHCBA.exe

Loads dropped DLL 4 IoCs

pid	Process
3032	RegAsm.exe
3032	RegAsm.exe
1724	RegAsm.exe
1724	RegAsm.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 400 set thread context of 3032	400	66d5ddcec1520_shtr.exe	85
PID 3332 set thread context of 1724	3332	AdminIEHJJECBKK.exe	100
PID 3908 set thread context of 4420	3908	AdminAFHDAEGHDG.exe	105
PID 3108 set thread context of 3200	3108	AKEBFCFIJJ.exe	116
PID 4896 set thread context of 2504	4896	CAFBGDHCBA.exe	123

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1928	4420	WerFault.exe	105
3120	4420	WerFault.exe	105
4000	3200	WerFault.exe	116
4912	3200	WerFault.exe	116

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66d5ddcec1520_shtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AKEBFCFIJJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CAFBGDHCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminAFHDAEGHDG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminIEHJJECBKK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1700	timeout.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3032	RegAsm.exe
3032	RegAsm.exe
3032	RegAsm.exe
3032	RegAsm.exe
1724	RegAsm.exe
1724	RegAsm.exe
1724	RegAsm.exe
1724	RegAsm.exe
1724	RegAsm.exe
1724	RegAsm.exe
1724	RegAsm.exe
1724	RegAsm.exe
2504	RegAsm.exe
2504	RegAsm.exe
2504	RegAsm.exe
2504	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 1240	400	66d5ddcec1520_shtr.exe	84
PID 400 wrote to memory of 1240	400	66d5ddcec1520_shtr.exe	84
PID 400 wrote to memory of 1240	400	66d5ddcec1520_shtr.exe	84
PID 400 wrote to memory of 3032	400	66d5ddcec1520_shtr.exe	85
PID 400 wrote to memory of 3032	400	66d5ddcec1520_shtr.exe	85
PID 400 wrote to memory of 3032	400	66d5ddcec1520_shtr.exe	85
PID 400 wrote to memory of 3032	400	66d5ddcec1520_shtr.exe	85
PID 400 wrote to memory of 3032	400	66d5ddcec1520_shtr.exe	85
PID 400 wrote to memory of 3032	400	66d5ddcec1520_shtr.exe	85
PID 400 wrote to memory of 3032	400	66d5ddcec1520_shtr.exe	85
PID 400 wrote to memory of 3032	400	66d5ddcec1520_shtr.exe	85
PID 400 wrote to memory of 3032	400	66d5ddcec1520_shtr.exe	85
PID 3032 wrote to memory of 4540	3032	RegAsm.exe	95
PID 3032 wrote to memory of 4540	3032	RegAsm.exe	95
PID 3032 wrote to memory of 4540	3032	RegAsm.exe	95
PID 4540 wrote to memory of 3332	4540	cmd.exe	97
PID 4540 wrote to memory of 3332	4540	cmd.exe	97
PID 4540 wrote to memory of 3332	4540	cmd.exe	97
PID 3032 wrote to memory of 2924	3032	RegAsm.exe	99
PID 3032 wrote to memory of 2924	3032	RegAsm.exe	99
PID 3032 wrote to memory of 2924	3032	RegAsm.exe	99
PID 3332 wrote to memory of 1724	3332	AdminIEHJJECBKK.exe	100
PID 3332 wrote to memory of 1724	3332	AdminIEHJJECBKK.exe	100
PID 3332 wrote to memory of 1724	3332	AdminIEHJJECBKK.exe	100
PID 3332 wrote to memory of 1724	3332	AdminIEHJJECBKK.exe	100
PID 3332 wrote to memory of 1724	3332	AdminIEHJJECBKK.exe	100
PID 3332 wrote to memory of 1724	3332	AdminIEHJJECBKK.exe	100
PID 3332 wrote to memory of 1724	3332	AdminIEHJJECBKK.exe	100
PID 3332 wrote to memory of 1724	3332	AdminIEHJJECBKK.exe	100
PID 3332 wrote to memory of 1724	3332	AdminIEHJJECBKK.exe	100
PID 3332 wrote to memory of 1724	3332	AdminIEHJJECBKK.exe	100
PID 2924 wrote to memory of 3908	2924	cmd.exe	102
PID 2924 wrote to memory of 3908	2924	cmd.exe	102
PID 2924 wrote to memory of 3908	2924	cmd.exe	102
PID 3908 wrote to memory of 1568	3908	AdminAFHDAEGHDG.exe	104
PID 3908 wrote to memory of 1568	3908	AdminAFHDAEGHDG.exe	104
PID 3908 wrote to memory of 1568	3908	AdminAFHDAEGHDG.exe	104
PID 3908 wrote to memory of 4420	3908	AdminAFHDAEGHDG.exe	105
PID 3908 wrote to memory of 4420	3908	AdminAFHDAEGHDG.exe	105
PID 3908 wrote to memory of 4420	3908	AdminAFHDAEGHDG.exe	105
PID 3908 wrote to memory of 4420	3908	AdminAFHDAEGHDG.exe	105
PID 3908 wrote to memory of 4420	3908	AdminAFHDAEGHDG.exe	105
PID 3908 wrote to memory of 4420	3908	AdminAFHDAEGHDG.exe	105
PID 3908 wrote to memory of 4420	3908	AdminAFHDAEGHDG.exe	105
PID 3908 wrote to memory of 4420	3908	AdminAFHDAEGHDG.exe	105
PID 3908 wrote to memory of 4420	3908	AdminAFHDAEGHDG.exe	105
PID 1724 wrote to memory of 3108	1724	RegAsm.exe	113
PID 1724 wrote to memory of 3108	1724	RegAsm.exe	113
PID 1724 wrote to memory of 3108	1724	RegAsm.exe	113
PID 3108 wrote to memory of 3200	3108	AKEBFCFIJJ.exe	116
PID 3108 wrote to memory of 3200	3108	AKEBFCFIJJ.exe	116
PID 3108 wrote to memory of 3200	3108	AKEBFCFIJJ.exe	116
PID 3108 wrote to memory of 3200	3108	AKEBFCFIJJ.exe	116
PID 3108 wrote to memory of 3200	3108	AKEBFCFIJJ.exe	116
PID 3108 wrote to memory of 3200	3108	AKEBFCFIJJ.exe	116
PID 3108 wrote to memory of 3200	3108	AKEBFCFIJJ.exe	116
PID 3108 wrote to memory of 3200	3108	AKEBFCFIJJ.exe	116
PID 3108 wrote to memory of 3200	3108	AKEBFCFIJJ.exe	116
PID 1724 wrote to memory of 4896	1724	RegAsm.exe	121
PID 1724 wrote to memory of 4896	1724	RegAsm.exe	121
PID 1724 wrote to memory of 4896	1724	RegAsm.exe	121
PID 4896 wrote to memory of 2504	4896	CAFBGDHCBA.exe	123
PID 4896 wrote to memory of 2504	4896	CAFBGDHCBA.exe	123
PID 4896 wrote to memory of 2504	4896	CAFBGDHCBA.exe	123

C:\Users\Admin\AppData\Local\Temp\66d5ddcec1520_shtr.exe
"C:\Users\Admin\AppData\Local\Temp\66d5ddcec1520_shtr.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminIEHJJECBKK.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Users\AdminIEHJJECBKK.exe
      "C:\Users\AdminIEHJJECBKK.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3332
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Checks computer location settings
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1724
      - C:\ProgramData\AKEBFCFIJJ.exe
        
        "C:\ProgramData\AKEBFCFIJJ.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 1360
        8⤵
        Program crash
        
        PID:4000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 1340
        8⤵
        Program crash
        
        PID:4912
      - C:\ProgramData\CAFBGDHCBA.exe
        
        "C:\ProgramData\CAFBGDHCBA.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2504
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBFHDBGIEBFI" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3420
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1700
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminAFHDAEGHDG.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Users\AdminAFHDAEGHDG.exe
      "C:\Users\AdminAFHDAEGHDG.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3908
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:1568
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 1328
        6⤵
        Program crash
        
        PID:3120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 1356
        6⤵
        Program crash
        
        PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4420 -ip 4420
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4420 -ip 4420
1⤵
PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3200 -ip 3200
1⤵
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3200 -ip 3200
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AAEBAK

Path C:\ProgramData\DBFHDBGIEBFI\AAEBAK
Size 116KB
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
SSDEEP 192:CTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWtETVumQ6W:UPWJ6a9xpnQLqtzKWJnsVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

FIJDGI

Path C:\ProgramData\DBFHDBGIEBFI\FIJDGI
Size 11KB
SHA256 1f10cf66ce960ca95a4524b60ea0a4831533fd932625be7e6a628e677591ba70
MD5 a66ca9cd5f3bc1a70998a1f0f2175467
SHA1 83a00a58f709d7409af3a724854c01e862dba7c3
SHA512 50b5894735fa52ca20c6435c58a0e26a4ca42266288886f9630e3ff43717e27e673f2e2067c97798248fba043697474ad2d4899a0eef538c4b543c3cd448b74d
SSDEEP 192:nL5nnRDfYvZ3huMsfYtv4Wcd+fSttkDnjXv60fNaX6wTiCLelBw8Vy:DApsiv4D84tkDnOA+TioSw1
MD5 SHA1 SHA512 SSDEEP

Submit Download

KECGDB

Path C:\ProgramData\DBFHDBGIEBFI\KECGDB
Size 114KB
SHA256 e6287cb739a35ef64a6d19ec146c90c848de8646032fd98d570042c0e2ecf070
MD5 db26309558628fa1ef6a1edd23ab2b09
SHA1 9bfb0530d0c2dcc6f9b3947bc3ca602943356368
SHA512 4171bc6af1ffc5d24d6ddade7b47e94b0547297e25d9a4d45ca831801208b7d83edda0b138436626749711a953a5818486c293e8749c5c2539ef070e848b237c
SSDEEP 192:KZPM23W/l1jXhPE4nP+hoIky6cVqLVumf:I02m/lxhlnmhouHcVumf
MD5 SHA1 SHA512 SSDEEP

Submit Download

EBAAFC

Path C:\ProgramData\HDBKJEGIEBFH\EBAAFC
Size 20KB
SHA256 ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7
MD5 a603e09d617fea7517059b4924b1df93
SHA1 31d66e1496e0229c6a312f8be05da3f813b3fa9e
SHA512 eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc
SSDEEP 24:TLYP1kwIrnLbXYFpFNYd+6UwcQ8ri5fB:TcPawkLLopFsU1+B
MD5 SHA1 SHA512 SSDEEP

Submit Download

KFBGCA

Path C:\ProgramData\HDBKJEGIEBFH\KFBGCA
Size 40KB
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
SSDEEP 48:2DcnBA+IIBoCVEq8Ma0D0HOlf/6ykwpLf/EUwMHZq10bvJKLkw8s8LKvUf9KVyJJ:uSQCn8MouB6w9f/8iZqmvJKLPeymwil
MD5 SHA1 SHA512 SSDEEP

Submit Download

KFBGCA

Path C:\ProgramData\HDBKJEGIEBFH\KFBGCA
Size 160KB
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad
SSDEEP 96:bBY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:bBY/tH+bF+UI3iWGVYWNkqp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebl3.dll

Path C:\ProgramData\freebl3.dll
Size 669KB
SHA256 edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa
MD5 550686c0ee48c386dfcb40199bd076ac
SHA1 ee5134da4d3efcb466081fb6197be5e12a5b22ab
SHA512 0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e
SSDEEP 12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\ProgramData\msvcp140.dll
Size 439KB
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
SSDEEP 12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

softokn3.dll

Path C:\ProgramData\softokn3.dll
Size 251KB
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6
SSDEEP 6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\ProgramData\vcruntime140.dll
Size 78KB
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
SSDEEP 1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdminAFHDAEGHDG.exe

Path C:\Users\AdminAFHDAEGHDG.exe
Size 334KB
SHA256 c45735085c630196f711708160c78f204d8fa3fd36dc7c49cfc039442ae4c9d7
MD5 24b1ff1f8ba8c5e20613a652b7ddcafb
SHA1 48cb72e8fb1bb1d586ccde26de74154130d2b219
SHA512 d277a6a0830dabc5b7d535f3d84c948a70ae3fd9a16948b55ccd69340726390f6346c91098c0a48d8f40cb76a83299fcfccf92b59675f36692b8537bbd720c8c
SSDEEP 6144:FxpZyOaZfFb7BrazG0/yWbFmss4GgI7k4nab/hY/ryS4tURNBFmfa8X7HqvIJ3EO:FxLyrRFb7hoG06WbFmhs4naIGtU5FQZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdminIEHJJECBKK.exe

Path C:\Users\AdminIEHJJECBKK.exe
Size 282KB
SHA256 90c0395f668f198d1aed010aaabbdab7c7f78b5a8c90072f4a2225683ebaac36
MD5 9d1e5520a634731ed9747be9e9af7c5d
SHA1 6bc547c7e26073f71be0017e29c8702ddea2fc11
SHA512 3cc597e4b451252361707740fe58ea18ff8734a9adad48458760518d1828beb55bd0ddb080daf7c1a29cda462b7cabab3c3829fc5c811b1d3069a5d507b7cbaa
SSDEEP 6144:A2nQ8BC0EIUnhElVMKMBMmhRbEiy+ssEO:pnQ8BCYhli3npyyEO
MD5 SHA1 SHA512 SSDEEP

Submit Download

156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE
Size 2KB
SHA256 2e0e9be598d0f657d9f1f3b4ff8bc5151751b7a639216bf362a40c6453cd6ce2
MD5 221cbda4be9defbf02dfd97302d75c46
SHA1 0d21680154fd26b408730476d1aaf6a845a929f3
SHA512 6c7299a7520afdd37872302dcb33cb732688e94e99674889aef12cd45a7be9213ffd3dbe22f39ec0d1a588f342cab24255cee6fa1d129185ec33c8aa7c84b305
MD5 SHA1 SHA512

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 235b6b76edce553b578f71630f2142d5912707668009d1d6e9616af094c0e966
MD5 3e10c8ad351895a4c7f0d67f068fe698
SHA1 7a78e8a78b1b5991152f4de1e2d4d5eb259cb942
SHA512 a2296585db1716f904f2758362207060b4bb3898556c43ef5bbfc1bb54bd2d3b36ebd84ff4791053ead37647561b07cbd526048d10c648c1060a89de5ffb8e0a
MD5 SHA1 SHA512

Submit Download

EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Size 1KB
SHA256 cc4813486165df18b36b09814922c3f054897170ae412a7aa13c1178e25cf56c
MD5 4eb9f3b5c13e5f37ea56ec2861b48419
SHA1 5496b7e9b7d004f454fbfaa9a6b979e15ef44eb0
SHA512 13d71c96d91f116423918d6b0efa74e9d37eb8a876c44f7560f4bee21b74f5ebbb71d31198da5b344cbe03765bf1cc886f1e741fca68df9ee1a97773955d2579
MD5 SHA1 SHA512

Submit Download

156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE
Size 458B
SHA256 2c610a10c0ebffdbf7280b200ba31f783e583a88ebf8e3c5d35f3168ee05cd17
MD5 d2110285d30ded827441ec861d5291da
SHA1 a4578a445a729aa7c45dadd5ad718afb31599b4f
SHA512 d8f61e607f859911940eb6a77c79248ff3f236df53fb72cffcbe7d5cca8ff0269885f7a93d8615913236bb584c7f0d6d91460a0554873b93e3e90de6b1148961
MD5 SHA1 SHA512

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 fc48f39230d02b8f8dfcd40a7de7550223d385b46206875e1f411f5a6265fb8b
MD5 6948e6089603604c4cc1c4f7ff47e525
SHA1 3dd307a0e78bfe587958825581a04bffbfe9db2b
SHA512 c3a9ff8e139d7cda387d3196f60e87d6ba482ee6ffe7f075ac038c77eb601476cd1bf4e1d07240bca8018d3f2ebdd03d15eaa9d8d7e58484388b2479dda04db2
MD5 SHA1 SHA512

Submit Download

EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Size 458B
SHA256 44f1f1959813553e235f3898db77938aa6721d93393c1b8a430e109365bd5d26
MD5 436de5c4e769f9025b905a94753ebf60
SHA1 893b88e63f4a6d2652e95f6775768cc1bea557b1
SHA512 b27002fba563bd32683704d3fb58e4668ba441a7097e3d11285738fe017a132ed0395f08e71635a32474c789339b3d59c4a75a6e2f7282ecb46fd14ef8922997
MD5 SHA1 SHA512

Submit Download

CAFBGDHCBA.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CAFBGDHCBA.exe.log
Size 425B
SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
MD5 4eaca4566b22b01cd3bc115b9b0b2196
SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
MD5 SHA1 SHA512

Submit Download

memory/400-96-0x00000000751F0000-0x00000000759A0000-memory.dmp

Download

memory/400-7-0x00000000751F0000-0x00000000759A0000-memory.dmp

Download

memory/400-1-0x0000000000DE0000-0x0000000000E18000-memory.dmp

Download

memory/400-0-0x00000000751FE000-0x00000000751FF000-memory.dmp

Download

memory/1724-158-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1724-141-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1724-142-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1724-127-0x0000000022AE0000-0x0000000022D3F000-memory.dmp

Download

memory/1724-126-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1724-125-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1724-159-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1724-192-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1724-167-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1724-97-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1724-93-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1724-103-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1724-234-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1724-184-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1724-193-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1724-191-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/2504-231-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/2504-242-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/2504-257-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/2504-258-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/2504-243-0x0000000022570000-0x00000000227CF000-memory.dmp

Download

memory/2504-241-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/3032-8-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3032-102-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3032-6-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3032-3-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3032-259-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/3032-9-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/3332-87-0x000000007339E000-0x000000007339F000-memory.dmp

Download

memory/3332-91-0x00000000001C0000-0x000000000020A000-memory.dmp

Download

memory/3332-101-0x0000000073390000-0x0000000073B40000-memory.dmp

Download

memory/3332-166-0x0000000073390000-0x0000000073B40000-memory.dmp

Download

memory/3908-107-0x00000000006A0000-0x00000000006F8000-memory.dmp

Download

memory/4420-109-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/4420-111-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/4420-113-0x0000000000400000-0x000000000045B000-memory.dmp

Download