lumma | e2ba20a7a72a6d83bde9effedcb28c0afd58ed93584c2ecce5a87dd5a1b27e56

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/02/2025, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
𝙎𝙚𝙩𝙪𝙥.exe
Size 69.0MB
Sample250214-s1prrssqbx
SHA256 e2ba20a7a72a6d83bde9effedcb28c0afd58ed93584c2ecce5a87dd5a1b27e56
MD5 14b923295431fb3bc23d68de4486e5a9
SHA1 43253d069ea559dc3df23833223a0a2889975129
SHA512 676cef0705f505b65f257cc7931f74d88a417909056c81be33a604910799b3297e6d5c728d38eee2f3b0e2688921a9c93f45f4a1a07bd94b633be440e450623e
SSDEEP 24576:UflgyQbA3RC3s/VmOAdcUUqjq3sofJG6X4Dh9j8Xnvh:EC643s/cfc7qjq3soh4DzIXnvh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://clerarhorizon.cyou/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
2532	Bible.com

Loads dropped DLL 5 IoCs

pid	Process
2164	cmd.exe
1532	WerFault.exe
1532	WerFault.exe
1532	WerFault.exe
1532	WerFault.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2264	tasklist.exe
2396	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DramaticFunding	𝙎𝙚𝙩𝙪𝙥.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1532	2532	WerFault.exe	41

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	𝙎𝙚𝙩𝙪𝙥.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bible.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2532	Bible.com
2532	Bible.com
2532	Bible.com
2532	Bible.com
2532	Bible.com
2532	Bible.com
2532	Bible.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2264	tasklist.exe
Token: SeDebugPrivilege	2396	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2532	Bible.com
2532	Bible.com
2532	Bible.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2532	Bible.com
2532	Bible.com
2532	Bible.com

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2164	3008	𝙎𝙚𝙩𝙪𝙥.exe	28
PID 3008 wrote to memory of 2164	3008	𝙎𝙚𝙩𝙪𝙥.exe	28
PID 3008 wrote to memory of 2164	3008	𝙎𝙚𝙩𝙪𝙥.exe	28
PID 3008 wrote to memory of 2164	3008	𝙎𝙚𝙩𝙪𝙥.exe	28
PID 2164 wrote to memory of 2448	2164	cmd.exe	30
PID 2164 wrote to memory of 2448	2164	cmd.exe	30
PID 2164 wrote to memory of 2448	2164	cmd.exe	30
PID 2164 wrote to memory of 2448	2164	cmd.exe	30
PID 2164 wrote to memory of 2264	2164	cmd.exe	31
PID 2164 wrote to memory of 2264	2164	cmd.exe	31
PID 2164 wrote to memory of 2264	2164	cmd.exe	31
PID 2164 wrote to memory of 2264	2164	cmd.exe	31
PID 2164 wrote to memory of 2280	2164	cmd.exe	32
PID 2164 wrote to memory of 2280	2164	cmd.exe	32
PID 2164 wrote to memory of 2280	2164	cmd.exe	32
PID 2164 wrote to memory of 2280	2164	cmd.exe	32
PID 2164 wrote to memory of 2396	2164	cmd.exe	34
PID 2164 wrote to memory of 2396	2164	cmd.exe	34
PID 2164 wrote to memory of 2396	2164	cmd.exe	34
PID 2164 wrote to memory of 2396	2164	cmd.exe	34
PID 2164 wrote to memory of 2400	2164	cmd.exe	35
PID 2164 wrote to memory of 2400	2164	cmd.exe	35
PID 2164 wrote to memory of 2400	2164	cmd.exe	35
PID 2164 wrote to memory of 2400	2164	cmd.exe	35
PID 2164 wrote to memory of 1936	2164	cmd.exe	36
PID 2164 wrote to memory of 1936	2164	cmd.exe	36
PID 2164 wrote to memory of 1936	2164	cmd.exe	36
PID 2164 wrote to memory of 1936	2164	cmd.exe	36
PID 2164 wrote to memory of 1992	2164	cmd.exe	37
PID 2164 wrote to memory of 1992	2164	cmd.exe	37
PID 2164 wrote to memory of 1992	2164	cmd.exe	37
PID 2164 wrote to memory of 1992	2164	cmd.exe	37
PID 2164 wrote to memory of 2332	2164	cmd.exe	38
PID 2164 wrote to memory of 2332	2164	cmd.exe	38
PID 2164 wrote to memory of 2332	2164	cmd.exe	38
PID 2164 wrote to memory of 2332	2164	cmd.exe	38
PID 2164 wrote to memory of 2660	2164	cmd.exe	39
PID 2164 wrote to memory of 2660	2164	cmd.exe	39
PID 2164 wrote to memory of 2660	2164	cmd.exe	39
PID 2164 wrote to memory of 2660	2164	cmd.exe	39
PID 2164 wrote to memory of 3016	2164	cmd.exe	40
PID 2164 wrote to memory of 3016	2164	cmd.exe	40
PID 2164 wrote to memory of 3016	2164	cmd.exe	40
PID 2164 wrote to memory of 3016	2164	cmd.exe	40
PID 2164 wrote to memory of 2532	2164	cmd.exe	41
PID 2164 wrote to memory of 2532	2164	cmd.exe	41
PID 2164 wrote to memory of 2532	2164	cmd.exe	41
PID 2164 wrote to memory of 2532	2164	cmd.exe	41
PID 2164 wrote to memory of 2488	2164	cmd.exe	42
PID 2164 wrote to memory of 2488	2164	cmd.exe	42
PID 2164 wrote to memory of 2488	2164	cmd.exe	42
PID 2164 wrote to memory of 2488	2164	cmd.exe	42
PID 2532 wrote to memory of 1532	2532	Bible.com	46
PID 2532 wrote to memory of 1532	2532	Bible.com	46
PID 2532 wrote to memory of 1532	2532	Bible.com	46
PID 2532 wrote to memory of 1532	2532	Bible.com	46

C:\Users\Admin\AppData\Local\Temp\𝙎𝙚𝙩𝙪𝙥.exe
"C:\Users\Admin\AppData\Local\Temp\𝙎𝙚𝙩𝙪𝙥.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c expand Pack.bmp Pack.bmp.bat & Pack.bmp.bat
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\SysWOW64\expand.exe
    expand Pack.bmp Pack.bmp.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2448
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2264
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2280
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2396
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 34843
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1936
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Al.bmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1992
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "bernard" Cleared
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2332
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 34843\Bible.com + Settle + Attacks + Establishing + Aluminum + Witness + Javascript + Sf + Downloaded + Whale 34843\Bible.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Startup.bmp + ..\Heather.bmp + ..\Utility.bmp + ..\Root.bmp + ..\Assumptions.bmp + ..\Reference.bmp + ..\Heater.bmp G
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3016
- - C:\Users\Admin\AppData\Local\Temp\34843\Bible.com
    Bible.com G
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 1164
      4⤵
      Loads dropped DLL
      Program crash
      PID:1532
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bible.com

Path C:\Users\Admin\AppData\Local\Temp\34843\Bible.com
Size 2KB
SHA256 de8da503d226492cef30dc58b5585caf91627a6390cbc7285c04b304b596549f
MD5 4affc5dcda1c786cf4693dd88833f089
SHA1 61176801c1a7c136482d140aae483f081f68f965
SHA512 f0c590a058cc2cfaaa35f24d4fb08c5a73176b8d4704e5ab9c72959093a648ba6c56101cd1d2a6a418651e0207c786533ec001b2372262ebec9b07f9e7b4ff47
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\34843\G
Size 501KB
SHA256 ce52dd6cf4af5be1dda2bbd8c98aaf03fdb1b8649c93ac58c670116708748e30
MD5 0ef80349a5686d87a8ed10e55971049f
SHA1 08894546dc6f41a513853facb0cabde67a4e966f
SHA512 9553dc7c642bdddbd4941d2aa76bf50f31995e188de71479d2a790428dd65de42b0d0c2242737c7cd26fc8c1571dcb4ada4346e8e3d7ffe074b286ace1d830dd
SSDEEP 12288:xvX467Ajv3m1o6BCRNhmiQdN4sreVv7buWtxLqD6rGr:RX4vjv3Kofjhmj8TbjHLq+Gr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Al.bmp

Path C:\Users\Admin\AppData\Local\Temp\Al.bmp
Size 477KB
SHA256 a76ecc85245e6d0b4a040968dfa1291cc456a4989235a993d2d3dfd033545983
MD5 e8b38b5adf04c2423ac6c311079b064a
SHA1 57832f4d49590fadce31fb3e7df25f3a63df264a
SHA512 c2e0f51b8f5121ad93433099aef59b6b66144f101d156b4cdaf7d05f7241bf57b734b99a0e925d293005419551f1856859d4b24ccf86ee5b13c3ad958541ca4a
SSDEEP 6144:PUbVox6VzWCY4IrpNk09rRNPjcSwmqKRtJFw/r1ER2w8bHIPAv7BcQal8yAK:PUb/qBTkEjsMtH0mjxUdc5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aluminum

Path C:\Users\Admin\AppData\Local\Temp\Aluminum
Size 113KB
SHA256 6bf4bb1b11dd9cb31833b8941b0b7e61b92cfac7f0141eed6ada09fb94a4c4fb
MD5 9b479189400975474b7e457862273570
SHA1 61f6a401dc8245072b731332f1329a5b53474810
SHA512 3c97e393be2634e77d391f5ef3573d87c2044a1b98bfc12c7d2c837efc1d079192389f7bac956610d6ac81eb803ac94d5f78aaa091d7df61e8cfa5375975d51a
SSDEEP 3072:3BxT/sZydTmRxlHS3NxrHSBRtNPnj0nEoXb:3L/sZ7HS3zcNPj0nEor
MD5 SHA1 SHA512 SSDEEP

Submit Download

Assumptions.bmp

Path C:\Users\Admin\AppData\Local\Temp\Assumptions.bmp
Size 82KB
SHA256 3a56706f4d9604d2ae0c39ba6ce7d7406fe60fd95b9561e8ff0ce0fde6c82dfe
MD5 3ff967a8f90a60316d6372adb992a6da
SHA1 0607ec263e72d1ad327690bc0d96edaa0d9a7ea8
SHA512 668680cd769ca2ccf7c4bb73650ed95ab0edd3fb9f74555d4702afbde0ae70c3e72734b09581e065a8b47732bc6358394126733617f58f04ff6539c6271d16a5
SSDEEP 1536:kZ6gsajjbhtpbgJru3YsrhL8Lr94oi2/CdCc2HS0+7Cps2/SZxNkhs:rAv/Stbslwr94/ay0+7ePyxNGs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Attacks

Path C:\Users\Admin\AppData\Local\Temp\Attacks
Size 104KB
SHA256 128904bcf91b945a59184bc13fc9fc03019634fd26fb6d431dfcdfeb712fe891
MD5 84403f3cba7011dee07acd44ce6bf759
SHA1 745769f3d68ea8e233c819dceb24b4ee8d353703
SHA512 956a0ae7c7c2922dbc1fff64d08610aade28b5ca2b1e6bc03c97d06f049242d9cf6c5d8f504f68cc7367cddfe9cb995e36f8ce92e7d152cf69633bc97101d3c2
SSDEEP 3072:LxyA3laW2UDQWf05mjccBiqXvpgF4qv+3R:dloUDtf0accB3gBmh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleared

Path C:\Users\Admin\AppData\Local\Temp\Cleared
Size 2KB
SHA256 f6011a1a9faaff57cd54b2053e425378c40e699402bba7342deacdd915dc5e80
MD5 ba7818436d5bb2cc24c38700e11cfce0
SHA1 76eb191e97e14ffea57ec62f537346c48fb4365f
SHA512 66fc5fb9a9ff9ea24d4bf45b4008ee2eecbda8cd5869ca93cac99b434fb257c63fefd988ace29b5604093c843e4f2624974b27b251f08a50d598b7785c258b86
MD5 SHA1 SHA512

Submit Download

Downloaded

Path C:\Users\Admin\AppData\Local\Temp\Downloaded
Size 108KB
SHA256 f7f393be2c8dfb2378e3b3c4dfa79c96ede404b021ce40fdbb75de1d84cf0b6c
MD5 3c63e2850f2e1189da53bbfbc279fc90
SHA1 ab1878457be6f2d42e25e876499b09093f75713a
SHA512 f824092049e48d2305da8473c86d419370670ce476655612c86451b5edee27e4b3f0277969645ce7db2694d26456e8f168ac75a3248c1e8426946315c86be488
SSDEEP 768:uGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWel3EYr8qcDP83:nKaj6iTcPAsAhxjgarB/5el3EYrD3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Establishing

Path C:\Users\Admin\AppData\Local\Temp\Establishing
Size 113KB
SHA256 815ddf3e79bcdf848fa133fe2ef77b8ee297ead8d64e6c2412164912f5965d3f
MD5 0c96f3cd47df73e235bad3c97bcd3f0b
SHA1 77f4071eccecd7a33c32888b66a18b91b543ebda
SHA512 dc6fe3ed8aaf97b1835d03246367c0784d6e6b14f8fe449738d40d0c880168da2ccea74f3670733366c881cefe1e42f2dfc1376f0cf8f1abebd951328a0334b9
SSDEEP 3072:8eOyKODOSpQSAU4CE0Imbi80PtCZEMnVIPP:8LsiS+SAhClbfSCOMVIPP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Heater.bmp

Path C:\Users\Admin\AppData\Local\Temp\Heater.bmp
Size 43KB
SHA256 6afcf69fdd5903cdbcd4a074912b6c9c7bf10f1e9b91ef7a146d316230685092
MD5 2e4223a368ee8645464a28665862b358
SHA1 c9147946f4caec7a597beb28609df1ac58f73619
SHA512 160ec3fd02b6ecbd2035b5952881df25474561fab1a0a2d401109428a46e37eee741ebec0fd1d81d20b3c0037255bac5b1fd0f7c7f7d4f029675e01b66ba0453
SSDEEP 768:aZOepbcA7UXwz+s63Tj+vpda/4ng6Q9Ph629nmD3C3xVA4qUR4mtks:aZnbmPTj+vpPnRG6298UVNRxks
MD5 SHA1 SHA512 SSDEEP

Submit Download

Heather.bmp

Path C:\Users\Admin\AppData\Local\Temp\Heather.bmp
Size 96KB
SHA256 ca1083e92a59299d01e083661125cf84fbd2adbdc442ffd46a84a6c763157b38
MD5 91f3b745bc0e12a062ac03c3702a85f4
SHA1 84d0636fc023c2c06615dff6c737c7cec4b1eb5d
SHA512 5640795600e9a32458d133310a6e2585d49b9fb0063e0832d81f8809a373f0e6e3a6dd1fd76f31d835a6bbf6bd9e083fdee86e54d738511f349a6a4e9be6b9de
SSDEEP 1536:1rM+y+zZfJAueR7ocjzNImFDUXOWeF6CbXLfGmGgzx+iDaVLy9Job36LeD/6cwfy:xLy2xAue+cjBjUXOnFNfGm5V+jym36ir
MD5 SHA1 SHA512 SSDEEP

Submit Download

Javascript

Path C:\Users\Admin\AppData\Local\Temp\Javascript
Size 107KB
SHA256 8eb473b1c6fa200cef55e67cabfbb9375b227ad53b349a7a74c2e2dd18746940
MD5 274c71b18a11f3a2945b23b6c21a95cf
SHA1 379799cba23aefa9c532f52470aeaf90bb155943
SHA512 bdbdc710242aebb0ef200fb8a99e812fae33c0a7cfb4074cb5b3ff2f5b47422c6726def7d796cf7eaa584125acdf6377d572f10aa60e9c9be49ea1342c0f311a
SSDEEP 3072:/hfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTm:/hfhnvO5bLezWWt/Dd314V14ZgP0x
MD5 SHA1 SHA512 SSDEEP

Submit Download

Reference.bmp

Path C:\Users\Admin\AppData\Local\Temp\Reference.bmp
Size 59KB
SHA256 795e6a7e95fd821aac55f5c26cbc3e108a68eed7ec7a582d6fae98f3b64edbb3
MD5 34e6c5a3fc7e01e85d42d829740acb28
SHA1 d82aecd2e142a246f42605dd8b33d1d8590f9901
SHA512 4e797a501a06bfedb9be77746bd8828e2580d872fcc391467f9e0b9144404bcd8000851582502aa8df4a26f8507c59a7129bc33359a08380a0fe9b0a15fbf0a5
SSDEEP 1536:Vf+lqbdyc+hHujTGn0Or/I1LD/93z3DoZd:BknaiIx3/6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Root.bmp

Path C:\Users\Admin\AppData\Local\Temp\Root.bmp
Size 68KB
SHA256 3a56b4a444e3f172bbfc356e40c3241768c6450397bb981eb8ef22d7a49c07f5
MD5 2fdfbbf77cff01f6d57752ea286ca632
SHA1 d2ef64222ea443c0ae2389fbdd9b1891d1db5118
SHA512 96ae29b78382ba0f422c4719ea424251c694013ad61c470db9a0a2473e86f96f15548b39c85c3b90848f92eb23be88029e3b4d91c25d1663b5c88bd54fc9fe34
SSDEEP 1536:e8vICF04RZppzYHydoMIpQD7X/BIc/n0IIPhyUv:bvIMZjzYSbuQDLWcHMhyc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Settle

Path C:\Users\Admin\AppData\Local\Temp\Settle
Size 83KB
SHA256 06a6764a338fca46f0123c46091ce041d39b3bd681330fd0bcece36801632c08
MD5 59f80003c826493aee17a0d2ef71e7be
SHA1 8b3e87e20de2823ac971533655cbe2c82e4689ea
SHA512 0628952b9008b644e7d32c5cd0beb92f39b288ffa9a962461ba44b497f59d90a4ef87d57f9247da103aa9e252b3159cb89707e6d64c0da085c41635dcbd9bd32
SSDEEP 1536:BAD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdlDfFgQa8BpDzdV:Bg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Sf
Size 105KB
SHA256 42c85e90a58dfadc59ef6806e13431b86dce8f5f5583581c8a1f6f6029e17457
MD5 dc8a20f14ea652fdeb3970ed74dcebbd
SHA1 05ec7c5b117b687cac24710071ce6c0b006d3651
SHA512 66b3e4d66a817aaef9a034753ea7b313aa4bba13df99ae44dbe0eadfa415240b9adfbd9dc2e2ed50c1fc870a33db2996e978e91dc852bf34617920329ae87acc
SSDEEP 1536:F8anHsWccd0vtmgMbFuz08QuklMBNIimuzaAwusP5:F8QLeAg0Fuz08XvBNbjaAtsP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Startup.bmp

Path C:\Users\Admin\AppData\Local\Temp\Startup.bmp
Size 82KB
SHA256 bbde4745a805923e78d8aeda23ea3cbf23118cb35a4429253e6b010e70d4f868
MD5 710fc3f75dee7d793d3e448a23904587
SHA1 28009b2da20ed26b688f909fc0df1700fdf2102e
SHA512 272250a6b6b8d18aa2ca5543da6175f653046a8c7a7ad8153cc9b9f03ac1b833fc055388690875d78cd8c3daa87ac184626017289d9e07f323b3a16c96ab3d64
SSDEEP 1536:wEmLRT8b0OUkeqZopSuNWpu1JYJx6csPf6wA9BXO1a0+H41lHeZ:wEmLRYbxAqZoRsqw2pA9Byaj4jA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Utility.bmp

Path C:\Users\Admin\AppData\Local\Temp\Utility.bmp
Size 71KB
SHA256 6d5a95cb9a9b0b922832985b5e83f36b14785a529cf1c3117c39272ee63e92ee
MD5 24e8dbf289942f813f5a446d82fac17f
SHA1 bb027ea17bdb8af91a76a67868199070ca2d16a3
SHA512 9de823e3077e396283ef412ef055405256fab9f847d6fc5442413b30e0d01076b09d74222ec039fb77ef4261393cde6b560471597198e363043856c040bdab9f
SSDEEP 1536:u6MdrrJLCZcRQ8wrJkPahi5HVmkFGGwTc1zK6Hmb1DTOsoyeirP2Fs78lOg/:u6Orr1mcRQfJThFiGGHtK6HK9TOsrei+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Whale

Path C:\Users\Admin\AppData\Local\Temp\Whale
Size 68KB
SHA256 161c5a4374790c32f5535db191a22e00b6525fbaa2d3d4390f30ee2ed21ad83d
MD5 d6c5a73e13a813f5d2b8848d3e68bb38
SHA1 dadbd4963e5487145f89a539743075b154ee1fb5
SHA512 9221827a2cbb82f595e0b8510e5cf02e0b47715944a0ab04385942efada38caea3536129bf555a7747a4086e1483e151f3f7af669a879da590cc670be1eaadc3
SSDEEP 1536:myu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:my4ZNoGmROL7F1G7ho2kOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Witness

Path C:\Users\Admin\AppData\Local\Temp\Witness
Size 121KB
SHA256 e796a2ac03ea9743aca56b12af2458c1e6e608d12bc02fa59225c21088a0ccf8
MD5 11125e0e64d2a319a93c1b076e3a3895
SHA1 c9346cc1a7158fb55e42781484d4764068fae06b
SHA512 8120c3e79512a08c7f185ce6e1e7cbe35849ba88016ce2bd9ae0b6b6ad1aa0ab7fffd678af22fe854a994063dbb3d0bf568643e4dbaaa1548e1ef19ba3dee951
SSDEEP 3072:DmowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbv18mLZ:Dtb2j6AUkB0CThp6vmVnjF
MD5 SHA1 SHA512 SSDEEP

Submit Download

pack.bmp

Path C:\Users\Admin\AppData\Local\Temp\pack.bmp
Size 10KB
SHA256 cb2b6f46eaa05c6354c2c1978f9a69d930e4e3c55b70a484e03aca804179be3d
MD5 45918458df1fa3e8ec67e7340546caac
SHA1 fca02a5bf542bcdaacdcc8f3b8ddda99c50952cb
SHA512 6c0637ca1411481a5dc49ce375e528f510fd7b8c6f366bdbf1a3ef2a27bb57bb3399fe833836cff5258cc7058b57b395b26e2076ebcd50f9eebf139bc5f4d5bc
SSDEEP 192:lkjeZPm7dIgiS14xR8DDMEAOWCaFNCx0w9yzzQCwvpOh78+h/J1hOQ2yYv:mjeJm5I+47iMEUCTiwwxN7j33Cv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bible.com

Path \Users\Admin\AppData\Local\Temp\34843\Bible.com
Size 925KB
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
SSDEEP 24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2532-70-0x00000000037B0000-0x000000000380F000-memory.dmp

Download

memory/2532-69-0x00000000037B0000-0x000000000380F000-memory.dmp

Download

memory/2532-73-0x00000000037B0000-0x000000000380F000-memory.dmp

Download

memory/2532-72-0x00000000037B0000-0x000000000380F000-memory.dmp

Download

memory/2532-71-0x00000000037B0000-0x000000000380F000-memory.dmp

Download