lumma | e2ba20a7a72a6d83bde9effedcb28c0afd58ed93584c2ecce5a87dd5a1b27e56

Analysis

max time kernel
149s
max time network
152s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
14/02/2025, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
𝙎𝙚𝙩𝙪𝙥.exe
Size 69.0MB
Sample250214-s1prrssqbx
SHA256 e2ba20a7a72a6d83bde9effedcb28c0afd58ed93584c2ecce5a87dd5a1b27e56
MD5 14b923295431fb3bc23d68de4486e5a9
SHA1 43253d069ea559dc3df23833223a0a2889975129
SHA512 676cef0705f505b65f257cc7931f74d88a417909056c81be33a604910799b3297e6d5c728d38eee2f3b0e2688921a9c93f45f4a1a07bd94b633be440e450623e
SSDEEP 24576:UflgyQbA3RC3s/VmOAdcUUqjq3sofJG6X4Dh9j8Xnvh:EC643s/cfc7qjq3soh4DzIXnvh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://clerarhorizon.cyou/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Downloads MZ/PE file 1 IoCs

flow	pid	Process
41	4880	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4002483208-3304649696-3162246273-1000\Control Panel\International\Geo\Nation	𝙎𝙚𝙩𝙪𝙥.exe

Executes dropped EXE 1 IoCs

pid	Process
2680	Bible.com

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
32	pastebin.com
33	pastebin.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4692	tasklist.exe
3704	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DramaticFunding	𝙎𝙚𝙩𝙪𝙥.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bible.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	𝙎𝙚𝙩𝙪𝙥.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1796	MicrosoftEdgeUpdate.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2680	Bible.com
2680	Bible.com
2680	Bible.com
2680	Bible.com
2680	Bible.com
2680	Bible.com
2680	Bible.com
2680	Bible.com
2680	Bible.com
2680	Bible.com
444	powershell.exe
2308	powershell.exe
2308	powershell.exe
444	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	tasklist.exe
Token: SeDebugPrivilege	3704	tasklist.exe
Token: SeDebugPrivilege	444	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2680	Bible.com
2680	Bible.com
2680	Bible.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2680	Bible.com
2680	Bible.com
2680	Bible.com

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 3960	1500	𝙎𝙚𝙩𝙪𝙥.exe	85
PID 1500 wrote to memory of 3960	1500	𝙎𝙚𝙩𝙪𝙥.exe	85
PID 1500 wrote to memory of 3960	1500	𝙎𝙚𝙩𝙪𝙥.exe	85
PID 3960 wrote to memory of 2784	3960	cmd.exe	87
PID 3960 wrote to memory of 2784	3960	cmd.exe	87
PID 3960 wrote to memory of 2784	3960	cmd.exe	87
PID 3960 wrote to memory of 4692	3960	cmd.exe	88
PID 3960 wrote to memory of 4692	3960	cmd.exe	88
PID 3960 wrote to memory of 4692	3960	cmd.exe	88
PID 3960 wrote to memory of 4212	3960	cmd.exe	89
PID 3960 wrote to memory of 4212	3960	cmd.exe	89
PID 3960 wrote to memory of 4212	3960	cmd.exe	89
PID 3960 wrote to memory of 3704	3960	cmd.exe	91
PID 3960 wrote to memory of 3704	3960	cmd.exe	91
PID 3960 wrote to memory of 3704	3960	cmd.exe	91
PID 3960 wrote to memory of 3872	3960	cmd.exe	92
PID 3960 wrote to memory of 3872	3960	cmd.exe	92
PID 3960 wrote to memory of 3872	3960	cmd.exe	92
PID 3960 wrote to memory of 2432	3960	cmd.exe	93
PID 3960 wrote to memory of 2432	3960	cmd.exe	93
PID 3960 wrote to memory of 2432	3960	cmd.exe	93
PID 3960 wrote to memory of 3180	3960	cmd.exe	94
PID 3960 wrote to memory of 3180	3960	cmd.exe	94
PID 3960 wrote to memory of 3180	3960	cmd.exe	94
PID 3960 wrote to memory of 3736	3960	cmd.exe	95
PID 3960 wrote to memory of 3736	3960	cmd.exe	95
PID 3960 wrote to memory of 3736	3960	cmd.exe	95
PID 3960 wrote to memory of 4432	3960	cmd.exe	96
PID 3960 wrote to memory of 4432	3960	cmd.exe	96
PID 3960 wrote to memory of 4432	3960	cmd.exe	96
PID 3960 wrote to memory of 1760	3960	cmd.exe	97
PID 3960 wrote to memory of 1760	3960	cmd.exe	97
PID 3960 wrote to memory of 1760	3960	cmd.exe	97
PID 3960 wrote to memory of 2680	3960	cmd.exe	98
PID 3960 wrote to memory of 2680	3960	cmd.exe	98
PID 3960 wrote to memory of 2680	3960	cmd.exe	98
PID 3960 wrote to memory of 2928	3960	cmd.exe	99
PID 3960 wrote to memory of 2928	3960	cmd.exe	99
PID 3960 wrote to memory of 2928	3960	cmd.exe	99
PID 2680 wrote to memory of 444	2680	Bible.com	103
PID 2680 wrote to memory of 444	2680	Bible.com	103
PID 2680 wrote to memory of 444	2680	Bible.com	103
PID 2680 wrote to memory of 2308	2680	Bible.com	105
PID 2680 wrote to memory of 2308	2680	Bible.com	105
PID 2680 wrote to memory of 2308	2680	Bible.com	105

C:\Users\Admin\AppData\Local\Temp\𝙎𝙚𝙩𝙪𝙥.exe
"C:\Users\Admin\AppData\Local\Temp\𝙎𝙚𝙩𝙪𝙥.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c expand Pack.bmp Pack.bmp.bat & Pack.bmp.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\SysWOW64\expand.exe
    expand Pack.bmp Pack.bmp.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2784
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4212
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3704
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 34843
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2432
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Al.bmp
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3180
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "bernard" Cleared
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 34843\Bible.com + Settle + Attacks + Establishing + Aluminum + Witness + Javascript + Sf + Downloaded + Whale 34843\Bible.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Startup.bmp + ..\Heather.bmp + ..\Utility.bmp + ..\Root.bmp + ..\Assumptions.bmp + ..\Reference.bmp + ..\Heater.bmp G
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\34843\Bible.com
    Bible.com G
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -exec bypass -f "C:\Users\Admin\AppData\Local\Temp\TH0T12YK3XDD9SKS3XZA.ps1"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:444
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -exec bypass -f "C:\Users\Admin\AppData\Local\Temp\Y0Q7R3PL84MO839SGII8UIO06P3BHKS.ps1"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2308
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2928

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OTQyMzc3NkMtNzA3OS00RDU1LUJBN0QtNDZDNDgyNEJDMkExfSIgdXNlcmlkPSJ7NUUyRURCRjYtQkJCRi00OUUzLUE0OTctN0I0NjAxRDVGNEI1fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QjlGQTAyODAtRTRDNy00NTQ5LTg2QzktOTcxOTUzQTA3NzFFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMyIgaW5zdGFsbGRhdGV0aW1lPSIxNzM5MjcwOTQwIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM3NDE5ODQwNzIwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQ5NTQ2NTI1OSIvPjwvYXBwPjwvcmVxdWVzdD4
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 897ddf1b26598ad52324983b92317d2985de2ce11f547173d53e96d86a801dab
MD5 02c62cc19a0c82072d9595d998c85fc0
SHA1 0e51fcbc7fd399e304f56f6b743b954607a63d83
SHA512 43b93b2fe401108e842d5e656d70869bd5ac7166a3558dcd6bc57a219c8dc7b2ceac26114a82497e8f5a2b2ffc9f5523e36ab61911fb759b3cc607d09f3a2858
SSDEEP 384:QafQiOOsx0Wn2v+1AVcs2dul4aOTUPgPqD6nKH70fHR1+SW:nfjOjx0Wn2p2AlthCqOKHQpk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bible.com

Path C:\Users\Admin\AppData\Local\Temp\34843\Bible.com
Size 2KB
SHA256 de8da503d226492cef30dc58b5585caf91627a6390cbc7285c04b304b596549f
MD5 4affc5dcda1c786cf4693dd88833f089
SHA1 61176801c1a7c136482d140aae483f081f68f965
SHA512 f0c590a058cc2cfaaa35f24d4fb08c5a73176b8d4704e5ab9c72959093a648ba6c56101cd1d2a6a418651e0207c786533ec001b2372262ebec9b07f9e7b4ff47
MD5 SHA1 SHA512

Submit Download

Bible.com

Path C:\Users\Admin\AppData\Local\Temp\34843\Bible.com
Size 925KB
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
SSDEEP 24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\34843\G
Size 501KB
SHA256 ce52dd6cf4af5be1dda2bbd8c98aaf03fdb1b8649c93ac58c670116708748e30
MD5 0ef80349a5686d87a8ed10e55971049f
SHA1 08894546dc6f41a513853facb0cabde67a4e966f
SHA512 9553dc7c642bdddbd4941d2aa76bf50f31995e188de71479d2a790428dd65de42b0d0c2242737c7cd26fc8c1571dcb4ada4346e8e3d7ffe074b286ace1d830dd
SSDEEP 12288:xvX467Ajv3m1o6BCRNhmiQdN4sreVv7buWtxLqD6rGr:RX4vjv3Kofjhmj8TbjHLq+Gr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Al.bmp

Path C:\Users\Admin\AppData\Local\Temp\Al.bmp
Size 477KB
SHA256 a76ecc85245e6d0b4a040968dfa1291cc456a4989235a993d2d3dfd033545983
MD5 e8b38b5adf04c2423ac6c311079b064a
SHA1 57832f4d49590fadce31fb3e7df25f3a63df264a
SHA512 c2e0f51b8f5121ad93433099aef59b6b66144f101d156b4cdaf7d05f7241bf57b734b99a0e925d293005419551f1856859d4b24ccf86ee5b13c3ad958541ca4a
SSDEEP 6144:PUbVox6VzWCY4IrpNk09rRNPjcSwmqKRtJFw/r1ER2w8bHIPAv7BcQal8yAK:PUb/qBTkEjsMtH0mjxUdc5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aluminum

Path C:\Users\Admin\AppData\Local\Temp\Aluminum
Size 113KB
SHA256 6bf4bb1b11dd9cb31833b8941b0b7e61b92cfac7f0141eed6ada09fb94a4c4fb
MD5 9b479189400975474b7e457862273570
SHA1 61f6a401dc8245072b731332f1329a5b53474810
SHA512 3c97e393be2634e77d391f5ef3573d87c2044a1b98bfc12c7d2c837efc1d079192389f7bac956610d6ac81eb803ac94d5f78aaa091d7df61e8cfa5375975d51a
SSDEEP 3072:3BxT/sZydTmRxlHS3NxrHSBRtNPnj0nEoXb:3L/sZ7HS3zcNPj0nEor
MD5 SHA1 SHA512 SSDEEP

Submit Download

Assumptions.bmp

Path C:\Users\Admin\AppData\Local\Temp\Assumptions.bmp
Size 82KB
SHA256 3a56706f4d9604d2ae0c39ba6ce7d7406fe60fd95b9561e8ff0ce0fde6c82dfe
MD5 3ff967a8f90a60316d6372adb992a6da
SHA1 0607ec263e72d1ad327690bc0d96edaa0d9a7ea8
SHA512 668680cd769ca2ccf7c4bb73650ed95ab0edd3fb9f74555d4702afbde0ae70c3e72734b09581e065a8b47732bc6358394126733617f58f04ff6539c6271d16a5
SSDEEP 1536:kZ6gsajjbhtpbgJru3YsrhL8Lr94oi2/CdCc2HS0+7Cps2/SZxNkhs:rAv/Stbslwr94/ay0+7ePyxNGs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Attacks

Path C:\Users\Admin\AppData\Local\Temp\Attacks
Size 104KB
SHA256 128904bcf91b945a59184bc13fc9fc03019634fd26fb6d431dfcdfeb712fe891
MD5 84403f3cba7011dee07acd44ce6bf759
SHA1 745769f3d68ea8e233c819dceb24b4ee8d353703
SHA512 956a0ae7c7c2922dbc1fff64d08610aade28b5ca2b1e6bc03c97d06f049242d9cf6c5d8f504f68cc7367cddfe9cb995e36f8ce92e7d152cf69633bc97101d3c2
SSDEEP 3072:LxyA3laW2UDQWf05mjccBiqXvpgF4qv+3R:dloUDtf0accB3gBmh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cleared

Path C:\Users\Admin\AppData\Local\Temp\Cleared
Size 2KB
SHA256 f6011a1a9faaff57cd54b2053e425378c40e699402bba7342deacdd915dc5e80
MD5 ba7818436d5bb2cc24c38700e11cfce0
SHA1 76eb191e97e14ffea57ec62f537346c48fb4365f
SHA512 66fc5fb9a9ff9ea24d4bf45b4008ee2eecbda8cd5869ca93cac99b434fb257c63fefd988ace29b5604093c843e4f2624974b27b251f08a50d598b7785c258b86
MD5 SHA1 SHA512

Submit Download

Downloaded

Path C:\Users\Admin\AppData\Local\Temp\Downloaded
Size 108KB
SHA256 f7f393be2c8dfb2378e3b3c4dfa79c96ede404b021ce40fdbb75de1d84cf0b6c
MD5 3c63e2850f2e1189da53bbfbc279fc90
SHA1 ab1878457be6f2d42e25e876499b09093f75713a
SHA512 f824092049e48d2305da8473c86d419370670ce476655612c86451b5edee27e4b3f0277969645ce7db2694d26456e8f168ac75a3248c1e8426946315c86be488
SSDEEP 768:uGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWel3EYr8qcDP83:nKaj6iTcPAsAhxjgarB/5el3EYrD3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Establishing

Path C:\Users\Admin\AppData\Local\Temp\Establishing
Size 113KB
SHA256 815ddf3e79bcdf848fa133fe2ef77b8ee297ead8d64e6c2412164912f5965d3f
MD5 0c96f3cd47df73e235bad3c97bcd3f0b
SHA1 77f4071eccecd7a33c32888b66a18b91b543ebda
SHA512 dc6fe3ed8aaf97b1835d03246367c0784d6e6b14f8fe449738d40d0c880168da2ccea74f3670733366c881cefe1e42f2dfc1376f0cf8f1abebd951328a0334b9
SSDEEP 3072:8eOyKODOSpQSAU4CE0Imbi80PtCZEMnVIPP:8LsiS+SAhClbfSCOMVIPP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Heater.bmp

Path C:\Users\Admin\AppData\Local\Temp\Heater.bmp
Size 43KB
SHA256 6afcf69fdd5903cdbcd4a074912b6c9c7bf10f1e9b91ef7a146d316230685092
MD5 2e4223a368ee8645464a28665862b358
SHA1 c9147946f4caec7a597beb28609df1ac58f73619
SHA512 160ec3fd02b6ecbd2035b5952881df25474561fab1a0a2d401109428a46e37eee741ebec0fd1d81d20b3c0037255bac5b1fd0f7c7f7d4f029675e01b66ba0453
SSDEEP 768:aZOepbcA7UXwz+s63Tj+vpda/4ng6Q9Ph629nmD3C3xVA4qUR4mtks:aZnbmPTj+vpPnRG6298UVNRxks
MD5 SHA1 SHA512 SSDEEP

Submit Download

Heather.bmp

Path C:\Users\Admin\AppData\Local\Temp\Heather.bmp
Size 96KB
SHA256 ca1083e92a59299d01e083661125cf84fbd2adbdc442ffd46a84a6c763157b38
MD5 91f3b745bc0e12a062ac03c3702a85f4
SHA1 84d0636fc023c2c06615dff6c737c7cec4b1eb5d
SHA512 5640795600e9a32458d133310a6e2585d49b9fb0063e0832d81f8809a373f0e6e3a6dd1fd76f31d835a6bbf6bd9e083fdee86e54d738511f349a6a4e9be6b9de
SSDEEP 1536:1rM+y+zZfJAueR7ocjzNImFDUXOWeF6CbXLfGmGgzx+iDaVLy9Job36LeD/6cwfy:xLy2xAue+cjBjUXOnFNfGm5V+jym36ir
MD5 SHA1 SHA512 SSDEEP

Submit Download

Javascript

Path C:\Users\Admin\AppData\Local\Temp\Javascript
Size 107KB
SHA256 8eb473b1c6fa200cef55e67cabfbb9375b227ad53b349a7a74c2e2dd18746940
MD5 274c71b18a11f3a2945b23b6c21a95cf
SHA1 379799cba23aefa9c532f52470aeaf90bb155943
SHA512 bdbdc710242aebb0ef200fb8a99e812fae33c0a7cfb4074cb5b3ff2f5b47422c6726def7d796cf7eaa584125acdf6377d572f10aa60e9c9be49ea1342c0f311a
SSDEEP 3072:/hfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTm:/hfhnvO5bLezWWt/Dd314V14ZgP0x
MD5 SHA1 SHA512 SSDEEP

Submit Download

Reference.bmp

Path C:\Users\Admin\AppData\Local\Temp\Reference.bmp
Size 59KB
SHA256 795e6a7e95fd821aac55f5c26cbc3e108a68eed7ec7a582d6fae98f3b64edbb3
MD5 34e6c5a3fc7e01e85d42d829740acb28
SHA1 d82aecd2e142a246f42605dd8b33d1d8590f9901
SHA512 4e797a501a06bfedb9be77746bd8828e2580d872fcc391467f9e0b9144404bcd8000851582502aa8df4a26f8507c59a7129bc33359a08380a0fe9b0a15fbf0a5
SSDEEP 1536:Vf+lqbdyc+hHujTGn0Or/I1LD/93z3DoZd:BknaiIx3/6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Root.bmp

Path C:\Users\Admin\AppData\Local\Temp\Root.bmp
Size 68KB
SHA256 3a56b4a444e3f172bbfc356e40c3241768c6450397bb981eb8ef22d7a49c07f5
MD5 2fdfbbf77cff01f6d57752ea286ca632
SHA1 d2ef64222ea443c0ae2389fbdd9b1891d1db5118
SHA512 96ae29b78382ba0f422c4719ea424251c694013ad61c470db9a0a2473e86f96f15548b39c85c3b90848f92eb23be88029e3b4d91c25d1663b5c88bd54fc9fe34
SSDEEP 1536:e8vICF04RZppzYHydoMIpQD7X/BIc/n0IIPhyUv:bvIMZjzYSbuQDLWcHMhyc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Settle

Path C:\Users\Admin\AppData\Local\Temp\Settle
Size 83KB
SHA256 06a6764a338fca46f0123c46091ce041d39b3bd681330fd0bcece36801632c08
MD5 59f80003c826493aee17a0d2ef71e7be
SHA1 8b3e87e20de2823ac971533655cbe2c82e4689ea
SHA512 0628952b9008b644e7d32c5cd0beb92f39b288ffa9a962461ba44b497f59d90a4ef87d57f9247da103aa9e252b3159cb89707e6d64c0da085c41635dcbd9bd32
SSDEEP 1536:BAD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdlDfFgQa8BpDzdV:Bg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Sf
Size 105KB
SHA256 42c85e90a58dfadc59ef6806e13431b86dce8f5f5583581c8a1f6f6029e17457
MD5 dc8a20f14ea652fdeb3970ed74dcebbd
SHA1 05ec7c5b117b687cac24710071ce6c0b006d3651
SHA512 66b3e4d66a817aaef9a034753ea7b313aa4bba13df99ae44dbe0eadfa415240b9adfbd9dc2e2ed50c1fc870a33db2996e978e91dc852bf34617920329ae87acc
SSDEEP 1536:F8anHsWccd0vtmgMbFuz08QuklMBNIimuzaAwusP5:F8QLeAg0Fuz08XvBNbjaAtsP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Startup.bmp

Path C:\Users\Admin\AppData\Local\Temp\Startup.bmp
Size 82KB
SHA256 bbde4745a805923e78d8aeda23ea3cbf23118cb35a4429253e6b010e70d4f868
MD5 710fc3f75dee7d793d3e448a23904587
SHA1 28009b2da20ed26b688f909fc0df1700fdf2102e
SHA512 272250a6b6b8d18aa2ca5543da6175f653046a8c7a7ad8153cc9b9f03ac1b833fc055388690875d78cd8c3daa87ac184626017289d9e07f323b3a16c96ab3d64
SSDEEP 1536:wEmLRT8b0OUkeqZopSuNWpu1JYJx6csPf6wA9BXO1a0+H41lHeZ:wEmLRYbxAqZoRsqw2pA9Byaj4jA
MD5 SHA1 SHA512 SSDEEP

Submit Download

TH0T12YK3XDD9SKS3XZA.ps1

Path C:\Users\Admin\AppData\Local\Temp\TH0T12YK3XDD9SKS3XZA.ps1
Size 3KB
SHA256 464507f2c132da0b5aaa45f95372871dd14c42d1a156ac746f602aa41ccfbb2e
MD5 9ef303f48303b543c7dea68f560fe795
SHA1 5a6f91757e10df8f07077ec9ab463f0f67bb582f
SHA512 7f16fbfac763bb940fab1083a990c0b1527c3e9e38276e8c1cb13b3622c6b426f129d6c79d7d42cffe5ec7e3490f0afef41a154c85baf503b3b27b26f8e66f0d
MD5 SHA1 SHA512

Submit Download

Utility.bmp

Path C:\Users\Admin\AppData\Local\Temp\Utility.bmp
Size 71KB
SHA256 6d5a95cb9a9b0b922832985b5e83f36b14785a529cf1c3117c39272ee63e92ee
MD5 24e8dbf289942f813f5a446d82fac17f
SHA1 bb027ea17bdb8af91a76a67868199070ca2d16a3
SHA512 9de823e3077e396283ef412ef055405256fab9f847d6fc5442413b30e0d01076b09d74222ec039fb77ef4261393cde6b560471597198e363043856c040bdab9f
SSDEEP 1536:u6MdrrJLCZcRQ8wrJkPahi5HVmkFGGwTc1zK6Hmb1DTOsoyeirP2Fs78lOg/:u6Orr1mcRQfJThFiGGHtK6HK9TOsrei+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Whale

Path C:\Users\Admin\AppData\Local\Temp\Whale
Size 68KB
SHA256 161c5a4374790c32f5535db191a22e00b6525fbaa2d3d4390f30ee2ed21ad83d
MD5 d6c5a73e13a813f5d2b8848d3e68bb38
SHA1 dadbd4963e5487145f89a539743075b154ee1fb5
SHA512 9221827a2cbb82f595e0b8510e5cf02e0b47715944a0ab04385942efada38caea3536129bf555a7747a4086e1483e151f3f7af669a879da590cc670be1eaadc3
SSDEEP 1536:myu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:my4ZNoGmROL7F1G7ho2kOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Witness

Path C:\Users\Admin\AppData\Local\Temp\Witness
Size 121KB
SHA256 e796a2ac03ea9743aca56b12af2458c1e6e608d12bc02fa59225c21088a0ccf8
MD5 11125e0e64d2a319a93c1b076e3a3895
SHA1 c9346cc1a7158fb55e42781484d4764068fae06b
SHA512 8120c3e79512a08c7f185ce6e1e7cbe35849ba88016ce2bd9ae0b6b6ad1aa0ab7fffd678af22fe854a994063dbb3d0bf568643e4dbaaa1548e1ef19ba3dee951
SSDEEP 3072:DmowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbv18mLZ:Dtb2j6AUkB0CThp6vmVnjF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Y0Q7R3PL84MO839SGII8UIO06P3BHKS.ps1

Path C:\Users\Admin\AppData\Local\Temp\Y0Q7R3PL84MO839SGII8UIO06P3BHKS.ps1
Size 474B
SHA256 300c5bfa2b54a6c48fb592ba9f2a164dc92d796688f3e43112e696e68a09ed88
MD5 108a846fce8e14bec7a3a8c2850d8ed1
SHA1 44075cdd5403feadd753986ce39fbc672ca9c69a
SHA512 c2f03dad5d470b779de7e2fe36e26c3b112b4f82db76cd5ebd30da71649f1f26326db0632b1dc2bcbe7b80804d4dc8d878b058ce9798bd5d35b722212f6c78da
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ihcoq2mp.fzu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ihcoq2mp.fzu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

pack.bmp

Path C:\Users\Admin\AppData\Local\Temp\pack.bmp
Size 10KB
SHA256 cb2b6f46eaa05c6354c2c1978f9a69d930e4e3c55b70a484e03aca804179be3d
MD5 45918458df1fa3e8ec67e7340546caac
SHA1 fca02a5bf542bcdaacdcc8f3b8ddda99c50952cb
SHA512 6c0637ca1411481a5dc49ce375e528f510fd7b8c6f366bdbf1a3ef2a27bb57bb3399fe833836cff5258cc7058b57b395b26e2076ebcd50f9eebf139bc5f4d5bc
SSDEEP 192:lkjeZPm7dIgiS14xR8DDMEAOWCaFNCx0w9yzzQCwvpOh78+h/J1hOQ2yYv:mjeJm5I+47iMEUCTiwwxN7j33Cv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/444-76-0x0000000004870000-0x00000000048A6000-memory.dmp

Download

memory/444-77-0x0000000004FA0000-0x000000000566A000-memory.dmp

Download

memory/444-79-0x0000000005770000-0x0000000005792000-memory.dmp

Download

memory/444-81-0x0000000005880000-0x00000000058E6000-memory.dmp

Download

memory/444-100-0x00000000058F0000-0x0000000005C47000-memory.dmp

Download

memory/444-102-0x0000000005F10000-0x0000000005F5C000-memory.dmp

Download

memory/444-101-0x0000000005EC0000-0x0000000005EDE000-memory.dmp

Download

memory/2308-80-0x0000000006110000-0x0000000006176000-memory.dmp

Download

memory/2680-70-0x0000000000840000-0x000000000089F000-memory.dmp

Download

memory/2680-71-0x0000000000840000-0x000000000089F000-memory.dmp

Download

memory/2680-72-0x0000000000840000-0x000000000089F000-memory.dmp

Download

memory/2680-69-0x0000000000840000-0x000000000089F000-memory.dmp

Download

memory/2680-68-0x0000000000840000-0x000000000089F000-memory.dmp

Download