lumma | d49f9a79848735ce6ea9e8bd2a4570d0203bc2fa7b3fbd5fbfc948b6ea3825fd

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/11/2024, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Release/Xeno.exe
Size 1.0MB
Sample241113-mehtfazend
SHA256 a37b5f789d4b44a83ed1e9de6b2d4da18072c8a5e31494fcd1a302a9e0f4ab12
MD5 c7581deaff2cb6b2a04301e7eed178d1
SHA1 9a5fc31cf91344cfe29ffe31b013c0bff72b707b
SHA512 f599f7e49c48cef40be2a8aa1f4d7965aaea6da1934c8b459553ad789b78b6b01d6b499df18e4bb297a18da32d62bb61212b17d97a5021f0d38d8b7c96f6d57d
SSDEEP 24576:ijhLIH1HVUfSHSpAjPBQZpVRJOLCroyoBz4ge:MqH11VyocRkLC8ysz4z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://financiauglyk.cyou/api
https://thicktoys.sbs/api
https://3xc1aimbl0w.sbs/api
https://300snails.sbs/api
https://faintbl0w.sbs/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
1432	Af.pif

Loads dropped DLL 1 IoCs

pid	Process
2300	cmd.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2656	tasklist.exe
1688	tasklist.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\RelationshipKenny	Xeno.exe
File opened for modification	C:\Windows\WaIron	Xeno.exe
File opened for modification	C:\Windows\PlaysSometimes	Xeno.exe
File opened for modification	C:\Windows\BiographyVisits	Xeno.exe
File opened for modification	C:\Windows\RangingTwinks	Xeno.exe
File opened for modification	C:\Windows\AnnouncementCircuits	Xeno.exe
File opened for modification	C:\Windows\PowersTried	Xeno.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Af.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xeno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Af.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Af.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Af.pif

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1432	Af.pif
1432	Af.pif
1432	Af.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	tasklist.exe
Token: SeDebugPrivilege	2656	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1432	Af.pif
1432	Af.pif
1432	Af.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1432	Af.pif
1432	Af.pif
1432	Af.pif

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2300	1712	Xeno.exe	31
PID 1712 wrote to memory of 2300	1712	Xeno.exe	31
PID 1712 wrote to memory of 2300	1712	Xeno.exe	31
PID 1712 wrote to memory of 2300	1712	Xeno.exe	31
PID 2300 wrote to memory of 1688	2300	cmd.exe	33
PID 2300 wrote to memory of 1688	2300	cmd.exe	33
PID 2300 wrote to memory of 1688	2300	cmd.exe	33
PID 2300 wrote to memory of 1688	2300	cmd.exe	33
PID 2300 wrote to memory of 1852	2300	cmd.exe	34
PID 2300 wrote to memory of 1852	2300	cmd.exe	34
PID 2300 wrote to memory of 1852	2300	cmd.exe	34
PID 2300 wrote to memory of 1852	2300	cmd.exe	34
PID 2300 wrote to memory of 2656	2300	cmd.exe	36
PID 2300 wrote to memory of 2656	2300	cmd.exe	36
PID 2300 wrote to memory of 2656	2300	cmd.exe	36
PID 2300 wrote to memory of 2656	2300	cmd.exe	36
PID 2300 wrote to memory of 1816	2300	cmd.exe	37
PID 2300 wrote to memory of 1816	2300	cmd.exe	37
PID 2300 wrote to memory of 1816	2300	cmd.exe	37
PID 2300 wrote to memory of 1816	2300	cmd.exe	37
PID 2300 wrote to memory of 2964	2300	cmd.exe	38
PID 2300 wrote to memory of 2964	2300	cmd.exe	38
PID 2300 wrote to memory of 2964	2300	cmd.exe	38
PID 2300 wrote to memory of 2964	2300	cmd.exe	38
PID 2300 wrote to memory of 2980	2300	cmd.exe	39
PID 2300 wrote to memory of 2980	2300	cmd.exe	39
PID 2300 wrote to memory of 2980	2300	cmd.exe	39
PID 2300 wrote to memory of 2980	2300	cmd.exe	39
PID 2300 wrote to memory of 2624	2300	cmd.exe	40
PID 2300 wrote to memory of 2624	2300	cmd.exe	40
PID 2300 wrote to memory of 2624	2300	cmd.exe	40
PID 2300 wrote to memory of 2624	2300	cmd.exe	40
PID 2300 wrote to memory of 1432	2300	cmd.exe	41
PID 2300 wrote to memory of 1432	2300	cmd.exe	41
PID 2300 wrote to memory of 1432	2300	cmd.exe	41
PID 2300 wrote to memory of 1432	2300	cmd.exe	41
PID 2300 wrote to memory of 1896	2300	cmd.exe	42
PID 2300 wrote to memory of 1896	2300	cmd.exe	42
PID 2300 wrote to memory of 1896	2300	cmd.exe	42
PID 2300 wrote to memory of 1896	2300	cmd.exe	42

C:\Users\Admin\AppData\Local\Temp\Release\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Release\Xeno.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Sufficient Sufficient.cmd & Sufficient.cmd
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1688
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1852
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- - C:\Windows\SysWOW64\findstr.exe
    findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1816
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 720301
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2964
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "VegetarianBoobsProvinceApplications" Continuing
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2980
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Networks + ..\Immigration + ..\Cgi + ..\Insertion + ..\Headers + ..\Plastics Q
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\720301\Af.pif
    Af.pif Q
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1432
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\720301\Q
Size 473KB
SHA256 a9ab82ef3f7873f747adb0f83c72d2400758c88979c98997f5742d1714c3f967
MD5 492a40dc62f5c0c66b904bbfe7479433
SHA1 176e0292b637e5dbb12f2c51303a1ebea250ccb2
SHA512 cea5235a8a8d410a3c8fdb530adec2e7e8dd7519b85e236e541f3d725efefbd3aaff496a55625528ab167699976f2970f47bc182b7dd55cd3e82eab4e5fb391f
SSDEEP 12288:nrKIXYMEHkWQaK4exx7FuyM9QQXqHJ+2cIaK4UDUmILO:rZlEEWQaeH7IryUqHJ+zKbT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cab3F53.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab3F53.tmp
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cgi

Path C:\Users\Admin\AppData\Local\Temp\Cgi
Size 82KB
SHA256 c98c5bd18e9426a25e1f2c8d447a1467fb3146f020d2652be69317c3f062f29e
MD5 39620223462a6f9ce0752f5ca3c2f4aa
SHA1 22f3a0b4e7c0e9527cd56b76526cd2ead3365709
SHA512 f8ba5839645ce29d051f7ce6318aa3af573806f1b2d7d10e957b1b1ebed198f405c03fe6adb4a4b0edd0a5c307f49929f5106659ddedacee994a7a967b4450ea
SSDEEP 1536:5QdcN299x32X5Jtnfq56I9LEeCY2tpuGSVdsmwdDbFbVa0rU1Kh:56cEFGXZk9weCAPdsm2f7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Continuing

Path C:\Users\Admin\AppData\Local\Temp\Continuing
Size 17KB
SHA256 d80259d59d1e66a080af7f1d053e3640abebb8f6bfe2a5aab7612703eb9d1a85
MD5 510efb15198403472ea2c4f8a4d038f8
SHA1 1a92c910dfa5d0e1ea88d22b112fade0f3fc3a33
SHA512 3982f07260cdc57bb6d9124e61c14d1216c428309418e5f532649fd18e7820e6d172016b7677ac07bfa0386ce9c554959ae7cdcbc5643fe1b1d1c1578159e784
SSDEEP 384:HlFuOqohnWzR7NNilkEdpMMKAdbLPlUccucHU0f//+ddNEqCt7E9:FFxfhnWz8kETRZbRUccWk+3+e9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Headers

Path C:\Users\Admin\AppData\Local\Temp\Headers
Size 80KB
SHA256 90295dfd575ead9a4a8e95c850eae249300ab930d188a32378dbf5945c8a708c
MD5 7caa8114f6b6811129eaa1279455b788
SHA1 2dba419876bd031b990d40049c48bc916449f797
SHA512 0e6ac3ae43a258f76984b1a3224c9bc9e9ce4eeaa2824d73220bec0828bde0025bd5342df3384143ccde9768763a06b0f8f8506f648d54850fc171e9f37707e9
SSDEEP 1536:w/LY7g+8VGXuB2ZRRmrUkbBsRQ6EL9RED9zZrR2yXCU8RibjceZrANfzh7d:972VGXzWnqYu9zZIyXClRib1ratx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Immigration

Path C:\Users\Admin\AppData\Local\Temp\Immigration
Size 88KB
SHA256 725080ee2795da5d11778bfa65a3d4e6f5a2d5b23bd96877814aa2da4f410976
MD5 cb5b2c31ede8feb58e6abe2753a6c39a
SHA1 1a28c52a991247012f16a5b5869a7adfae08f104
SHA512 c312cdc9d56f0ecb4d411a6ee2fa0ae3edc7c8d8fbb05c967e5552052d35661f59aac21bb6538c954b0cb0a308e9ff6a3a122e87d7ce8c27f4b7984bc90b2a2e
SSDEEP 1536:XoxgzhLuA7KhgeoMgxGTTtuftugp0NyNRWiqjhTVtJ1mSzgtxd:XhzhXKqejgxwMftb0sV4TVL1mAgtxd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Insertion

Path C:\Users\Admin\AppData\Local\Temp\Insertion
Size 71KB
SHA256 8063f6b97a66957d5366d306e55584e6e8cd3801f46a4f69700addab78d3421f
MD5 c4758caf508433c8552e2e42b5b26703
SHA1 8e8c261160459aeff69a991bd9eadd0a0c5a8894
SHA512 088ace94863287fb82803bac41d4a17d77e6e23a65f1868204f46121aec70a3713368c35ca60fd392ca6e30dca5045eb70dad7fa53cb9e7d59e3d02f6eba9be0
SSDEEP 1536:xziGAEPhnYy9T5N+bUgDic1k8QxVQSqYh88o9tTJ7xKZ:xn9C6Q1TxQ8SqYhW7dN2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kentucky

Path C:\Users\Admin\AppData\Local\Temp\Kentucky
Size 903KB
SHA256 9367e8ba3dc3fe5c6062d501d3a881f163fb08d5ce07f9f77865b23278ceb1c9
MD5 dde5bab95c3f57d28b925532086d0556
SHA1 26fdd5fe71bfe0c149b2adc1696768e850258ce4
SHA512 4617154e1e2eda03ea5b07f1204b91b23edb160ab6ee7dca97df76450960374b85b8f23822e02ee87e37c2fe9583d37c2f1b3587ba77f16ba3ff0a5e5fc8fad3
SSDEEP 24576:QJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:QC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Networks

Path C:\Users\Admin\AppData\Local\Temp\Networks
Size 98KB
SHA256 2d600926f2bb72023f1e9330131f795a953ebfd8286ae9b36929e6e8b903bdd3
MD5 abda13de932bcb2c0f12f26b68599d7f
SHA1 a27f131dea283556e76849de070dc4df2a07e408
SHA512 b0b247841dc64cc65e35a2de29710faf96819e2aa639c17f1797cc735afb6e6671250669acc27e76ccc0c427b7826fce9b0ac2168020148e0efb9bdf74f12d9e
SSDEEP 3072:nKym/PfU20dKIXG1bPEvtXEMSr4wTPflHUfEme:nK2KIXG1T2UMSrZXlHkI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Plastics

Path C:\Users\Admin\AppData\Local\Temp\Plastics
Size 54KB
SHA256 6f133efcf577fc97e301992c9ef7ed3008ad6023403cd48960cc546632d62bc4
MD5 4a9d11868425359ae68808dd1354da69
SHA1 9446d29147e6538caef24faa4c63f3405e448eab
SHA512 35b8dc30d8cd1b30be893db7cdc719bdc149ebeaa9613c62acf67068cce2c22939767449739b8f03fa58806c1e6fe9fbfd21aa906f422d75d608e093b3d2f9e0
SSDEEP 1536:CZ4Vuu4ZdB0heACDyJOD2RM+EfTZRs5lPxF5UaQY+w3:TVORAQybILZS3Pv5UI+w3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sufficient

Path C:\Users\Admin\AppData\Local\Temp\Sufficient
Size 7KB
SHA256 f5774c1fa7c8bb8696f79f05aa7175e3bb7f7c01a1c8498576ba62ff69fb4722
MD5 b47f1e1763dca7643b4bd29057f2a3f7
SHA1 2212f08c6efa9549c0de09e1aa73e99adabb50f0
SHA512 39a1e0cee8ab3f2995dc9c20ddb48383b9eeca391d6f16e6596eff0aac0dbcc40b5d57cfbf60b559f00cd44f97d5114cc39c6fa8c3b211236cbaba806861a796
SSDEEP 192:VLQ9qRJv3NqDlgxNm5jYM/4aSfTLxsRB2fQK3swoQ3WjpxdHOYyaMs5tg/zXshFP:lLv3zm5jYM/4aS5fweaXC/mXf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar3F75.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar3F75.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Af.pif

Path \Users\Admin\AppData\Local\Temp\720301\Af.pif
Size 921KB
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
SSDEEP 24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1432-209-0x0000000003590000-0x00000000035E9000-memory.dmp

Download

memory/1432-208-0x0000000003590000-0x00000000035E9000-memory.dmp

Download

memory/1432-212-0x0000000003590000-0x00000000035E9000-memory.dmp

Download

memory/1432-211-0x0000000003590000-0x00000000035E9000-memory.dmp

Download

memory/1432-210-0x0000000003590000-0x00000000035E9000-memory.dmp

Download

memory/1432-207-0x0000000003590000-0x00000000035E9000-memory.dmp

Download