lumma | 7feb04dd3086c567c461e43a682dd1bfdf1cde3c8f37338a87656fc81a23ba5d

Analysis

max time kernel
95s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/12/2024, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SET_UP.exe
Size 70.0MB
Sample241214-pff3catjem
SHA256 7feb04dd3086c567c461e43a682dd1bfdf1cde3c8f37338a87656fc81a23ba5d
MD5 3d7985d235dddd50133c9cb4d05e93cf
SHA1 f4760735fac36ee4453905208ee47589526a30c7
SHA512 be25290b5854a81f9b6a14dbdcf87dec08e8b569c65f48fcbca368875a09d95a25513e48597b0b85fc01947dc5993124ae3e52bb0970b9f3d377b7dcf11a1857
SSDEEP 24576:meXBEktOUHeuxZtAmTdNJDfbKs2h1D1riC2x8ev:Tt7TmmTd/fWv1rRaPv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://sordid-snaked.cyou/api
https://awake-weaves.cyou/api
https://wrathful-jammy.cyou/api
https://debonairnukk.xyz/api
https://diffuculttan.xyz/api
https://effecterectz.xyz/api
https://deafeninggeh.biz/api
https://immureprech.biz/api
https://futipoy.shop/api

Extracted

Family

lumma

https://futipoy.shop/api
https://immureprech.biz/api
https://deafeninggeh.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	SET_UP.exe

Executes dropped EXE 1 IoCs

pid	Process
2316	Stored.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
920	tasklist.exe
3984	tasklist.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ErpBrochure	SET_UP.exe
File opened for modification	C:\Windows\GenStress	SET_UP.exe
File opened for modification	C:\Windows\VotesSamples	SET_UP.exe
File opened for modification	C:\Windows\DeliciousCivilization	SET_UP.exe
File opened for modification	C:\Windows\SeniorsWarrior	SET_UP.exe
File opened for modification	C:\Windows\ComesAdvancement	SET_UP.exe
File opened for modification	C:\Windows\ConverterTargeted	SET_UP.exe
File opened for modification	C:\Windows\MemorialVegetation	SET_UP.exe
File opened for modification	C:\Windows\MissConsequences	SET_UP.exe
File opened for modification	C:\Windows\LemonDem	SET_UP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Stored.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SET_UP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2316	Stored.com
2316	Stored.com
2316	Stored.com
2316	Stored.com
2316	Stored.com
2316	Stored.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	920	tasklist.exe
Token: SeDebugPrivilege	3984	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2316	Stored.com
2316	Stored.com
2316	Stored.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2316	Stored.com
2316	Stored.com
2316	Stored.com

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2136	2408	SET_UP.exe	82
PID 2408 wrote to memory of 2136	2408	SET_UP.exe	82
PID 2408 wrote to memory of 2136	2408	SET_UP.exe	82
PID 2136 wrote to memory of 920	2136	cmd.exe	84
PID 2136 wrote to memory of 920	2136	cmd.exe	84
PID 2136 wrote to memory of 920	2136	cmd.exe	84
PID 2136 wrote to memory of 1248	2136	cmd.exe	85
PID 2136 wrote to memory of 1248	2136	cmd.exe	85
PID 2136 wrote to memory of 1248	2136	cmd.exe	85
PID 2136 wrote to memory of 3984	2136	cmd.exe	89
PID 2136 wrote to memory of 3984	2136	cmd.exe	89
PID 2136 wrote to memory of 3984	2136	cmd.exe	89
PID 2136 wrote to memory of 2596	2136	cmd.exe	90
PID 2136 wrote to memory of 2596	2136	cmd.exe	90
PID 2136 wrote to memory of 2596	2136	cmd.exe	90
PID 2136 wrote to memory of 1164	2136	cmd.exe	91
PID 2136 wrote to memory of 1164	2136	cmd.exe	91
PID 2136 wrote to memory of 1164	2136	cmd.exe	91
PID 2136 wrote to memory of 3508	2136	cmd.exe	92
PID 2136 wrote to memory of 3508	2136	cmd.exe	92
PID 2136 wrote to memory of 3508	2136	cmd.exe	92
PID 2136 wrote to memory of 2016	2136	cmd.exe	94
PID 2136 wrote to memory of 2016	2136	cmd.exe	94
PID 2136 wrote to memory of 2016	2136	cmd.exe	94
PID 2136 wrote to memory of 2316	2136	cmd.exe	95
PID 2136 wrote to memory of 2316	2136	cmd.exe	95
PID 2136 wrote to memory of 2316	2136	cmd.exe	95
PID 2136 wrote to memory of 2532	2136	cmd.exe	96
PID 2136 wrote to memory of 2532	2136	cmd.exe	96
PID 2136 wrote to memory of 2532	2136	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\SET_UP.exe
"C:\Users\Admin\AppData\Local\Temp\SET_UP.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Figured Figured.cmd && Figured.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:920
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1248
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3984
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2596
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 516983
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1164
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "ProposedKellyChampionCouldMinistryPhotographersNotFruit" Permitted
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3508
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Imposed + ..\Wellington + ..\Object + ..\Installations + ..\Loaded + ..\Hdtv U
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\516983\Stored.com
    Stored.com U
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2316
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Stored.com

Path C:\Users\Admin\AppData\Local\Temp\516983\Stored.com
Size 925KB
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
SSDEEP 24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\516983\U
Size 476KB
SHA256 2283d849d6be570bb6efaf7440f53b52ed9c8ace2844b838c98a53e0322764d0
MD5 76435283f8ec4f375a9d474dea552242
SHA1 983daea3635d8b1a749743e0cc7ede2280eceae2
SHA512 438853f8f33fedd0bb0e7db9ed5eee31637deb493d0b2b9439efe246a82c29d9f6f08621f96d56d487db42c639b334cb75b094458263f491bdfe049b47aee057
SSDEEP 12288:+UhRHuhxsrIOASmUPfbKPjUOP1uWyAwCv7btZ21LKXlZ:+Cux6INSPfbKyAO10
MD5 SHA1 SHA512 SSDEEP

Submit Download

Figured

Path C:\Users\Admin\AppData\Local\Temp\Figured
Size 23KB
SHA256 be21f7ca2001511fbc3e0e43312f8649e83037ebf098682d5fa1d290e62bf470
MD5 21350fccd60418b01cf83ac826aa31e9
SHA1 14c2664f26399c931e3cc74e4358c8df2525e5e1
SHA512 33450e57714815d281e30f2942d8e604eb64afc6160a3ca22b0b00664fbe3ee659eaeb04c310138e81c8c61bc2b9e37490bb845c2eb68302760d9e6af11db41f
SSDEEP 384:uSzXDgtToW86pYGAnttVrVrueL1z+nZvN3eKRiE3uleOxdYNxNa7KQ+XAfM:uKXmToW86LAzus+nZvNNRIWNxQU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ghana

Path C:\Users\Admin\AppData\Local\Temp\Ghana
Size 129KB
SHA256 1627a89c2d801544c1020462efb4d6c7d615a6407bc6097b7f7423fe79c383d9
MD5 3ab94bb43e76a8079d9a89259a3a49a4
SHA1 973f135651c5aea03f5f996765f8ce4701746c41
SHA512 c3ae798a3462348aa8af68329847acba313d9b52a6ddc56da7e0e076b2a5dd4e6d6acdf0f2194acd250d2c9bdef1320c09979a2b77e3cd86a22b34d793991b05
SSDEEP 3072:ZQWf05mjccBiqXvpgF4qv+32eOyKODOSpQSAU4C+:Ztf0accB3gBmmLsiS+SAhC+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Had

Path C:\Users\Admin\AppData\Local\Temp\Had
Size 95KB
SHA256 68b1859430203661f8d31a767909364f645da1944d6fd0c4cd4ea79c2f2c6212
MD5 8402510886c8ceb4fd093bbafa8f452b
SHA1 bbdfe8d3c2449f6d85aa63f33a1eca25b2b3fee4
SHA512 062c325a0cd30fea9d4b77e6968310e72c08c794c0b8cada0bedcc356c5d820bc4963ad5a6122db6ea4bb0180030511271f2e4b7dcd6ea263480a55c3537f8ca
SSDEEP 768:TSaAwuXc/mex/SGKAGWRqA60dTcR4qYnGfAHET:2aAwusPdKaj6iTcPAo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hdtv

Path C:\Users\Admin\AppData\Local\Temp\Hdtv
Size 77KB
SHA256 55cd25cc9644f9015c6996048c072ac40173284e80deeb745e4c4df37dd00a6f
MD5 287e05d580b456477fd557f23109e172
SHA1 f31c4b83e771f9a6006cfd6d4fa0ec28fe8cfed8
SHA512 78df659b67d0b75d0817b3fe8261a384f17b22c88b7446dfeab152e4a611f6de3f8c37687d4aebd04bebca5a1c83e949e199be61224391ba8745c7f3dc1e1b89
SSDEEP 1536:hJb+/lra0xRHTJSdGvxtQmN/GPQ1A8K1/1WUhGRVVATk4ng1WaoA8bMPp84yZ:fbOxJCSLEuK1/FGrVKk4nnA8op84g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Imposed

Path C:\Users\Admin\AppData\Local\Temp\Imposed
Size 66KB
SHA256 51fa83d962cc144e022b8684d2f000830f9de5d00662a97038566cf7a5b4ba63
MD5 0dd2c7509651f562da3416886397fbd8
SHA1 16d00833280b26b1f9d07a24eec40b498ca73a95
SHA512 6511be4acbb20bd98faa93dd37ef44cb2ab6f80f1e94f24a1c86760dc885bb96f1d6fa4d54b04834b776500ed71b6ab1ff13a2a55af5d9e73bb67263bec32877
SSDEEP 1536:ywgYb6XcCuYbv1NKYqJft+yVcuMvzsWfvafHV+88:+cxC2Xl2uUHafHEP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Installations

Path C:\Users\Admin\AppData\Local\Temp\Installations
Size 89KB
SHA256 7c1aa8ec4c791e4db7ce1d95db8c9df75baac3bfb0cb0f1ec56064c88d09bc0d
MD5 d028ba6b6939326c7bd30516e21e4ff4
SHA1 6227f32922c11d08a5a6bd1d6265d29f0942dc6d
SHA512 959a364c47e332bea15437e78b2c0b61d3ca180d945b40f4ef39b7602e10214aa223c8f66ff0ed4845903db914676d925defea641b2ab2c5063a63659553e656
SSDEEP 1536:FFVDvXde0a668izIUJdK06JFMnKxWk0srBy39gZb3jRKBvrM/ekyZ7cMgA/2Xo3z:FDnvVizR206J2UxBkgjkBvqekW71/2YD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Joel

Path C:\Users\Admin\AppData\Local\Temp\Joel
Size 99KB
SHA256 8cd6962716b0b9bf77f28d1a37238cbdcb09fdb97f0761ff224b78201227ccb3
MD5 fed092a988d0db96e611a27280dd05b7
SHA1 27eb42d8c7019acf97fb27c963bf641bff187f52
SHA512 8a04fda8f2a934d4b5479f0462864297e46ffb7b2f560eb8c9967f64036dabafeb31165aa5f60f188ef969bd5d288406db262a734da226c6ede07ddf0616af88
SSDEEP 3072:8UkBJR8CThpmESv+AqVnBypIbv18mLthfhnueoMmOJ:8UkB0CThp6vmVnjphfhn9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Loaded

Path C:\Users\Admin\AppData\Local\Temp\Loaded
Size 75KB
SHA256 346233781898fc1bd9b8187dbe79c86f50b51466340d398b8044f0f42b379a72
MD5 194d767a9bd549b3eff27db877ebd9ca
SHA1 602b5582f9672eee252acbc9dba175c174695eb1
SHA512 7505da251a8d45352486de6636115df1af0db44379b91583672a3b5a4a8e5fc01e995473a9403e04e56b44eed23a96b61bd9a90707aa0bcc2f99b37b38dd4df8
SSDEEP 1536:lOXB3HRnqx/8szm/1gGLKLNApV+1wEJKxYUVwoqwTpdi7bjIe4tuPgv15vT2QQdD:lOX5Rn/sC/1PLK8E5K7yoq8i7bjhhPgC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator

Path C:\Users\Admin\AppData\Local\Temp\Locator
Size 128KB
SHA256 0392e54997947d4e6ac2a5a919f18699db82524da641aa913b9e360bb2a1d7df
MD5 85e9fab9ab9a2ce1935f980078995c7b
SHA1 54ab704f374a89752fe5e9e389034d153a826bb1
SHA512 be9592884c9d88b3c371b3d9da27345451675e4fe56bf3358c53bc60478a70e9762e8395d3e74d0e10c82323dc8efe458d0a8f8e5bfa92b11707f0cae490a6d8
SSDEEP 3072:ChxjgarB/5elDWy4ZNoGmROL7F1G7ho2kOb:agarZ8aBZ2GmRq76tl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Object

Path C:\Users\Admin\AppData\Local\Temp\Object
Size 80KB
SHA256 17e34d987ec8e4f5da545b4ceb0b3e63bf3fa4035c5ef83bbb5546d50459aff9
MD5 4fe13fff6ab4f8420bec2abee0da58e8
SHA1 04ec6c48730903f376d4aa6eba2b6c5edf05739f
SHA512 c6ee337a0ab9ba6bc3792be8b7aa451495e77d45c9508549803c75950df606195af2076f8fc4db5803ff0f1f2d7152a56a699abc1f6b1bf486eccfbc9b317132
SSDEEP 1536:j/o1GymcwsZ4vCL+mrHHTbASmRdLvioeUHULdaoJDz/h0HkfctExoy91:j/o11YJg5nvASmRdHemgdaS3Tfbxoyn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Permitted

Path C:\Users\Admin\AppData\Local\Temp\Permitted
Size 55KB
SHA256 5339e4495d03b9301b7d15424db91b68b7e84b3dcf769b5f44b7caf7fab66de4
MD5 443f5628e48f754b7751d344b9c4c88a
SHA1 715270a168cecff24a2aa715031f9a7de42e9479
SHA512 3e76c051c2cd0faa653d1b8402050755ce1611ffe93b9eedff688389abd9d61f49ed84bd5d8c8102a8a3a802d597319f17806486c80a44a01ba9171b62d940ed
SSDEEP 768:AQ18OWrM81EyJqx9EdzGGXZVfmlqTmN5WAQIGK2ud5lS87uzh7JCQ/sE7mOB6XSY:T1/AD1EsdzVXnP94SGGLpRB6M28S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Quest

Path C:\Users\Admin\AppData\Local\Temp\Quest
Size 144KB
SHA256 0815c0efab440e5298f28fe5d266ad8dea60eadb3a82db46c95adbe2b6eeadb0
MD5 05c707c8f33e056405d5138d7cbac25b
SHA1 3f46a6841d44bac9f94746d82adc0adf27c10938
SHA512 b3dcddc09cc55c5cd10294155536d137610d71bc9b7803f880d1c49beba9beb8eed97b3704eee1a52faccd59c51500b9857a5c828cbd275442a8c23623f716fd
SSDEEP 3072:UDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBNb6:pO5bLezWWt/Dd314V14ZgP0JaAOz04po
MD5 SHA1 SHA512 SSDEEP

Submit Download

Returns

Path C:\Users\Admin\AppData\Local\Temp\Returns
Size 64KB
SHA256 8c6fa7cd083a01b4a76f96188be63e1e80657c45f0d85418b342c2580a45472c
MD5 299474aefc18f21a899289da0e9c20a5
SHA1 36182604bbfc778d8a8aaaec7f9a01838d12cf5a
SHA512 f05af61da4277e7fea1ab7c169e34ddb4318b55d60b6d1e38481288e216b2ee80c0faca418e997c7e3a0e17c3811fe3514f560b9c560e8ffcb47b9722a50cb16
SSDEEP 1536:7FvMVpYhWoXElJUzdlDfFgQa8BpDzdZPp7HE+tKA3QkvyNf7Xw2U0A:xkjGWoUlJUPdgQa8Bp/LxyA3laW2U5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Suicide

Path C:\Users\Admin\AppData\Local\Temp\Suicide
Size 110KB
SHA256 dab4963bcafda1a1e3fcee0678f1b77b8440da6e6f04a3cb858ad37101abfe3d
MD5 1ee9daeef21c43336ae8626e9335beb5
SHA1 4912b6022907c2a305811e1067695dcfed6a3e5d
SHA512 910c905e10f7a68128db0ff534c8b4d1d752d70ef2974eaad25bd4646dae3f3f79ccc563a58c53ce3d69c2c84174f4ddf3824e41ac36fde51f532b19528ed287
SSDEEP 3072:FNxrHSBRtNPnj0nEoXnmowS2u5hVOoQ7t8T6a:FzcNPj0nEo3tb2j6L
MD5 SHA1 SHA512 SSDEEP

Submit Download

Transport

Path C:\Users\Admin\AppData\Local\Temp\Transport
Size 101KB
SHA256 92572ff759f59420eb6ef712dc8db8469c63425f0b2ab5798ebb19370ffb61e1
MD5 29310511e646a9db8ec20112f750205a
SHA1 f619463ca33b224c1a8912ab74b802a4be395c6d
SHA512 0f408cdf76351545bbc880a0be2e21fc473a4ef9d954036975be9b6a598600ad42d1ae1dc2cd0726d79b7079f9f8560a967d4c6ecf028fce2149398c57194fb2
SSDEEP 3072:h0Imbi80PtCZEMnVIPPBxT/sZydTmRxlHSF:IbfSCOMVIPPL/sZ7HSF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wellington

Path C:\Users\Admin\AppData\Local\Temp\Wellington
Size 89KB
SHA256 c3727398b660769e90b49d96923f416fb392c866560a59cefc7f1aa7c2ece9ba
MD5 ab319d86c37b8a1b5047a79e81e84d68
SHA1 2a25c967325d3083e95d0710fadd3328f19e306a
SHA512 5cc65fc916189ad04df0d279e5de5857896e7d93cd5c4936b1cbd07b0ac7536552d3233bdf1adcd16e182b9c02227c54177d70b84556ecf5e51115bf325c7a7d
SSDEEP 1536:KuDiTGchEgtuQkDvJAh07UXFbF2My5moPozrze5Jo2z7UjdG:KuDKGcPtuhTu07UXJFWo8onKyG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2316-537-0x0000000004B30000-0x0000000004B87000-memory.dmp

Download

memory/2316-539-0x0000000004B30000-0x0000000004B87000-memory.dmp

Download

memory/2316-540-0x0000000004B30000-0x0000000004B87000-memory.dmp

Download

memory/2316-542-0x0000000004B30000-0x0000000004B87000-memory.dmp

Download

memory/2316-541-0x0000000004B30000-0x0000000004B87000-memory.dmp

Download

memory/2316-538-0x0000000004B30000-0x0000000004B87000-memory.dmp

Download