lumma | 8972f78a13ce283e5e66aa5fda7757883cee93bc9002c456505c1dcfcfbb9204

Analysis

max time kernel
101s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20250313-en
submitted
27/03/2025, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
appFile_patched.exe
Size 36.5MB
Sample250327-rykvcstsg1
SHA256 8972f78a13ce283e5e66aa5fda7757883cee93bc9002c456505c1dcfcfbb9204
MD5 9407b38f6c8d6b4afabbc6f597b35e1f
SHA1 ff140526b06570c7172347e783e9053aa37b1962
SHA512 efbe5bc617618df9987417f12ff645684dc170b60d2823be81234c1bb68d6bd9c5bb5a7c807366739fd81cac168bd25e11089badd052701130ba7efc6c8a4a08
SSDEEP 786432:IbGpKdgptIcuhmdBs04e5XBJ9JzXnlhdDUekq6Yf8ki:I4K2ptMhmbL5v9JzXnlhdf6YfNi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://steelixr.live/aguiz
https://oreheatq.live/gsopp
https://castmaxw.run/ganzde
https://weldorae.digital/geds
https://advennture.top/GKsiio
https://targett.top/dsANGt
https://smeltingt.run/giiaus
https://ferromny.digital/gwpd

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
3600	Consumers.com

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
248	tasklist.exe
3156	tasklist.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\EligibleTactics	appFile_patched.exe
File opened for modification	C:\Windows\DesignedSusan	appFile_patched.exe
File opened for modification	C:\Windows\ChuckCombo	appFile_patched.exe
File opened for modification	C:\Windows\ControlledAb	appFile_patched.exe
File opened for modification	C:\Windows\TiedCohen	appFile_patched.exe
File opened for modification	C:\Windows\BronzeDaughter	appFile_patched.exe
File opened for modification	C:\Windows\TermsExpressions	appFile_patched.exe
File opened for modification	C:\Windows\EconomyButterfly	appFile_patched.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Consumers.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	appFile_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3600	Consumers.com
3600	Consumers.com
3600	Consumers.com
3600	Consumers.com
3600	Consumers.com
3600	Consumers.com
3600	Consumers.com
3600	Consumers.com
3600	Consumers.com
3600	Consumers.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	248	tasklist.exe
Token: SeDebugPrivilege	3156	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3600	Consumers.com
3600	Consumers.com
3600	Consumers.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3600	Consumers.com
3600	Consumers.com
3600	Consumers.com

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 3096	428	appFile_patched.exe	78
PID 428 wrote to memory of 3096	428	appFile_patched.exe	78
PID 428 wrote to memory of 3096	428	appFile_patched.exe	78
PID 3096 wrote to memory of 248	3096	CMD.exe	80
PID 3096 wrote to memory of 248	3096	CMD.exe	80
PID 3096 wrote to memory of 248	3096	CMD.exe	80
PID 3096 wrote to memory of 4880	3096	CMD.exe	81
PID 3096 wrote to memory of 4880	3096	CMD.exe	81
PID 3096 wrote to memory of 4880	3096	CMD.exe	81
PID 3096 wrote to memory of 3156	3096	CMD.exe	83
PID 3096 wrote to memory of 3156	3096	CMD.exe	83
PID 3096 wrote to memory of 3156	3096	CMD.exe	83
PID 3096 wrote to memory of 1260	3096	CMD.exe	84
PID 3096 wrote to memory of 1260	3096	CMD.exe	84
PID 3096 wrote to memory of 1260	3096	CMD.exe	84
PID 3096 wrote to memory of 2560	3096	CMD.exe	85
PID 3096 wrote to memory of 2560	3096	CMD.exe	85
PID 3096 wrote to memory of 2560	3096	CMD.exe	85
PID 3096 wrote to memory of 4616	3096	CMD.exe	86
PID 3096 wrote to memory of 4616	3096	CMD.exe	86
PID 3096 wrote to memory of 4616	3096	CMD.exe	86
PID 3096 wrote to memory of 1068	3096	CMD.exe	87
PID 3096 wrote to memory of 1068	3096	CMD.exe	87
PID 3096 wrote to memory of 1068	3096	CMD.exe	87
PID 3096 wrote to memory of 4376	3096	CMD.exe	88
PID 3096 wrote to memory of 4376	3096	CMD.exe	88
PID 3096 wrote to memory of 4376	3096	CMD.exe	88
PID 3096 wrote to memory of 1040	3096	CMD.exe	89
PID 3096 wrote to memory of 1040	3096	CMD.exe	89
PID 3096 wrote to memory of 1040	3096	CMD.exe	89
PID 3096 wrote to memory of 3600	3096	CMD.exe	90
PID 3096 wrote to memory of 3600	3096	CMD.exe	90
PID 3096 wrote to memory of 3600	3096	CMD.exe	90
PID 3096 wrote to memory of 684	3096	CMD.exe	91
PID 3096 wrote to memory of 684	3096	CMD.exe	91
PID 3096 wrote to memory of 684	3096	CMD.exe	91

C:\Users\Admin\AppData\Local\Temp\appFile_patched.exe
"C:\Users\Admin\AppData\Local\Temp\appFile_patched.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\SysWOW64\CMD.exe
  "C:\Windows\system32\CMD.exe" /c copy Tu.docm Tu.docm.bat & Tu.docm.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:248
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4880
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- - C:\Windows\SysWOW64\findstr.exe
    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1260
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 33845
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2560
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Conducting.docm
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4616
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "DETECTIVE" Puzzle
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 33845\Consumers.com + Period + Passes + Vegetation + Performs + Powerful + Distinct + Underlying + Address + Referring + Guarantees + Pvc 33845\Consumers.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4376
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Vacancies.docm + ..\Katrina.docm + ..\Recipients.docm + ..\Excellent.docm + ..\Sisters.docm + ..\Operators.docm + ..\Preservation.docm + ..\Reverse.docm O
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1040
- - C:\Users\Admin\AppData\Local\Temp\33845\Consumers.com
    Consumers.com O
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3600
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Consumers.com

Path C:\Users\Admin\AppData\Local\Temp\33845\Consumers.com
Size 92KB
SHA256 948e8664319d88075c2bf28d6cd767f3d032f6fdab8acd82701cb901facc10a8
MD5 8d35781cbd92b89e775f1a72a37d3237
SHA1 6e7d1e7909e2694577a4c189d4e01ba0f9f224d6
SHA512 96dfcd273fee089d806791244bc7a738d2a2aa9c8d554cd09c22a7e09b5d0a4aab2acd9f1472415ae2e1d0740c976a4b0cc1789c54af930ff6ab618fa038a7d3
SSDEEP 1536:11/AD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdlDfFgQa8BpDzdZPp7HEY:1Zg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Consumers.com

Path C:\Users\Admin\AppData\Local\Temp\33845\Consumers.com
Size 925KB
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
SSDEEP 24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\33845\O
Size 518KB
SHA256 063dd8a0ad2484cf280bf51f7f2103f0e7aabbea951f015bb06327228cf66126
MD5 eee5fb38b1f07657ab7e377aa9fc4db8
SHA1 f484c4911ebabacc65b761651f0a4395d2e443c9
SHA512 ffcae9ff0de479b86004161d48e56bf99f38e2c1e5aab27b4507f56347136a553a4a7a855107370586f6220f279594ebaea811ef1b4ebb03d705ef436adac9a3
SSDEEP 12288:pmyWFjqri4sIbAUvHuiOPyaL3T3hEtUI8LRH3jTWHBFcj9N:pmDRqri4sp/iOPyaL3rhEtUlRT5N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Address

Path C:\Users\Admin\AppData\Local\Temp\Address
Size 123KB
SHA256 6c308d3229b5641f13adf3e72d5589ebc7d58522b0b6fd29ad9fe68f14ab6d69
MD5 295d4ebf54d97ad604c9f879254ca45b
SHA1 b8ba41dc75940cadeacf74a8413ea8b5593fae68
SHA512 d89384ab6070edf009d54fffa8e0fe57206346776a2264def7b1e7cedf3a3db6fb1c7e4ab6f09e68b1593e08155eae78179cdf4ceebd131f909459f6390252b7
SSDEEP 3072:XDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvL:uO5bLezWWt/Dd314V14ZgP0JaAOz04D
MD5 SHA1 SHA512 SSDEEP

Submit Download

Conducting.docm

Path C:\Users\Admin\AppData\Local\Temp\Conducting.docm
Size 476KB
SHA256 5c005ae7afd586c938fb13ae9911f625fa54dd98340eb1ef2983844ce0a16c90
MD5 96200f432a7b3fade86b7b9d58bcce48
SHA1 806f1b52792d7cb84a4b41f8f1f5a528da4a795f
SHA512 6845839071a3e1eff25dc3eb52cce91cfcb9df4602cb113c0dcc7ece331916d979ff16c9038350de5e784e2cdcfa62f5348f9cd40560de970320f29a6af20f8b
SSDEEP 12288:vYR/DbM9/tpqhIrH/4DAs+ON+XleGv+4My1K:2/DWXqhIf4D+ON+XleGvW/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Distinct

Path C:\Users\Admin\AppData\Local\Temp\Distinct
Size 55KB
SHA256 9b80897b79744672f5f803e6b5130b18a47f87fed7235b2e238c9d95984c1751
MD5 0f9e2baf469810b1244de24f61562eb1
SHA1 e5fbb9cd1e43a1fae81a31a71c74f6acbd0a38f2
SHA512 3413ae4b7ea7551f960abf1df30407c6fd1700ccc91b1aa19af6db25a06cd15b71705a1b173473d27e1dd825358179f1429b366cf25325cb5bd416d679bcbe4b
SSDEEP 1536:u2ukC5HRu+OoQjz7nts/M26N7oKzYkBvRmLORuCYm9PrpmEX:u2u5hVOoQ7t8T6pUkBJR8CThpmEX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Excellent.docm

Path C:\Users\Admin\AppData\Local\Temp\Excellent.docm
Size 55KB
SHA256 5d7a466980cb8b71cb130901bed9c5e1d845f59b1f0e4d389eea4315801fa177
MD5 0d5628d68fd08197bc9d7ece13b9034a
SHA1 60e4a6c1ec0f06561a40c1d919dab0773755db6b
SHA512 58755c85a9c9991cdc1da649c5ee0acb527302df3b738dce80b4b5823e664141e9fd11a8f895b96ce80734211703cab699addbaae2e85b0d463cf0732d16fd1e
SSDEEP 1536:BDeoEsYD+9OhRjPy8/qqoB6puTY+pdZv0zv7mD7s:BDeo/YD+9OhRj6mpoB6pf+pdZsXmc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Guarantees

Path C:\Users\Admin\AppData\Local\Temp\Guarantees
Size 63KB
SHA256 454f08f6fd428e549b85f0b9ac9cc7645b8dc0b0a45c0a176aee655589ba252c
MD5 c25fcaab9c8ca078fb7f699e1617a09b
SHA1 ac5a35253469621c85e9e87c79422d38f6b6ac3a
SHA512 1ddadabd6817f5ef6ca0c125742d74ce8e5102f491fa75da53b881b5c7b3ea4603eed129405c1608fdfb6c40753317df201d41be3801ef7032cd137c2321e7fb
SSDEEP 768:WKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R:WKaj6iTcPAsAhxjgarB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Katrina.docm

Path C:\Users\Admin\AppData\Local\Temp\Katrina.docm
Size 70KB
SHA256 2c967e8ac256f3faa5effdb316af1cf291666ab6aaee621b07ae029d8ca58bf9
MD5 6511f098d77dc109488b53cace8db111
SHA1 c0c6bd05767becfbc30a67308c2a596e9006628d
SHA512 ee429155306e97a45c30ea1f94d2619d98ac0cf47ef8e03a9fe10a5a4ae9d9d51c960a50e452e5c8ef517bc2c526b7f99aade565b41922d77be2e28af9c6e0d5
SSDEEP 1536:UZGXrDQhMQ/VdO81qn6ZhApLy9Ehj+s+TDVKAKbat15Ys8P:U8XriMQ/jO8VZ/Eh4BZKGT5YsK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Operators.docm

Path C:\Users\Admin\AppData\Local\Temp\Operators.docm
Size 88KB
SHA256 ccea178ae66b31ac0e185acc71c47c500776c7aebfd674b1c1725ba7eff93820
MD5 ea3d04199dd012d7fce8545e25836a78
SHA1 fb95d8152fbaba9a5bd6b0987dde1b26426d06f4
SHA512 2cc35a579ad16ec4229c57fff6e8fa1a7048ca7b8b4603fe405df28e4badb99d6a81c8b9df1da5ab2e317b936a994e47808b8534633c935957381b5e27a07a51
SSDEEP 1536:rez9rbrUIS3z10qm9lGVbPwgnvBL97kCi7m3XAfgdlxt8w9QAkeUi:UnUI81q9lG1oCrkdS3XFlxtSGUi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Passes

Path C:\Users\Admin\AppData\Local\Temp\Passes
Size 112KB
SHA256 a714cf775080e4163217342019d071e42377d2431a2a1c0802cabd9ebe8b91d4
MD5 c3c5b9e2266f55c65879a4cac16a9995
SHA1 bd9efed107321a1ac89eb7f03bce6bda8057ccb5
SHA512 37aa2ed24ad32ac3892f6152c4556e3e6fbc71dd2ff9e7534e0f321e88261dc923d41881e628674d919604e32836a413379a02a77f62a82edd0c5c0bd0dd9216
SSDEEP 3072:qA3laW2UDQWf05mjccBiqXvpgF4qv+32eOyKODOSR:7loUDtf0accB3gBmmLsiSR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Performs

Path C:\Users\Admin\AppData\Local\Temp\Performs
Size 67KB
SHA256 fc840d61581074226e43c1874b77a13750cd57a0ba899d73ff6124b13a84de2e
MD5 6a211846474d5b4a9a38327edbe731f6
SHA1 678435196152a3dca595077e7eba23a0204b3c10
SHA512 7f884659678ee798582f74283109049f24f7a09bb68aeef1fae0032c5e4ea4d848202408ffe7ff1a8622df4db491c3f24447063c7f4d8c2384299991643805f8
SSDEEP 1536:p8yDGVFE5gOHu1CwCMIBZwneAJu7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6Ldc:p80PtCZEMnVIPPBxT/sZydc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Period

Path C:\Users\Admin\AppData\Local\Temp\Period
Size 91KB
SHA256 f7080e03fba22423182243d3f9c76d804681e200907c4050e243e3797a27c311
MD5 ac3a0b8ab9c95deb20242a981140abd9
SHA1 fc92fab2e6ba8c0d243bf4953d19b71b6886e906
SHA512 2025870818fc8997f812f27b17ac8b7e9fcb92ee478be60389c6f6b0ed3df2442f68f7ec827a6d000866a236313a0c8359912250596ace056c7f74c9add73506
SSDEEP 1536:X/AD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdlDfFgQa8BpDzdZPp7HEY:vg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/L5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Powerful

Path C:\Users\Admin\AppData\Local\Temp\Powerful
Size 99KB
SHA256 ca54c4c41478f79a28d5c797e07f94b577faabf6fff1062f6669233679b54604
MD5 b18a9e486642cc9887339636185572ea
SHA1 944808da4b1ce8c5776f4786d2eff2006d47ad9b
SHA512 ad1266410b1c267aa1c2291b60a1585cebbe9da20d2f0a72fff1c7a06adfc631d4aa7cd60c5cbc1c563b4c46c47ecc109415c9fec039ea1c5e321e99e261b170
SSDEEP 1536:CmHwANUQlHS3cctlxWboHdMJ3RraSXL21rKoUn9r5C03Eq30BcrTrhCX4aVmoJiR:CmRxlHS3NxrHSBRtNPnj0nEoXnmow7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preservation.docm

Path C:\Users\Admin\AppData\Local\Temp\Preservation.docm
Size 55KB
SHA256 2ce90e79656cec167082fbdcd05054e6011f6823ad4e0d06bd5307045e67674d
MD5 8ca4beff6aff7c4129ed3a1c7e419b09
SHA1 18e9cf997b8c6a75ef5bb03639a34ea2600cc85b
SHA512 4f0c229c3801e6f13fab231b9d5eaaeee7ff2337e02dcf8fdf61e3afe63b864432c126dfbd8a4655f6d79fadf7efc5495e3b3fc55915476213ae8b5ac62343a8
SSDEEP 1536:7PSHeQQJgLcM9ogsBaKjk318SzRBFJfPo:DSHeTJA19pnKgaSzPF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Puzzle

Path C:\Users\Admin\AppData\Local\Temp\Puzzle
Size 1KB
SHA256 68aa8bd38aaa985cae52912e3f8c6e9aaec7569e27ad2e2cd8dbdc19c2da22e2
MD5 5b99b749affe49cfec9c63ff3167dc14
SHA1 fe72ef281ac2651db5e3f8c33c2acfc58bdc20c2
SHA512 96c634fc7122209fc4bd5210f929f098738e7d85d4f93b0eeeb9c22440f4bb715e592dd182716eb19228b296cd0f1fdd43fa340ae3b176acff84e95512d81af4
MD5 SHA1 SHA512

Submit Download

Pvc

Path C:\Users\Admin\AppData\Local\Temp\Pvc
Size 104KB
SHA256 e6961864fb45f8de59124c41d6bdd26f36b2b23416591eb57a57de3f2ffd6952
MD5 075cd03d6b68ed71ab06e1395052c1a8
SHA1 ffdad8c366b272483f61ec023b6f961be0936c99
SHA512 60218ae65dbc4950e3844894889367a8e73d093715b3d082e22bbd41c2ad4ca2a1183bb519981bb41635a42a77f0d4654892123e0d2bf6487d9664d2e102fd49
SSDEEP 1536:Z5el3EYrDWyu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:Z5elDWy4ZNoGmROL7F1G7ho2kOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Recipients.docm

Path C:\Users\Admin\AppData\Local\Temp\Recipients.docm
Size 69KB
SHA256 85e9c2f1047c066003f3bd62b141e627edc369cfa14e489f982ad1f41b75a262
MD5 b96774f4fbaf41fef538f13f13e211f7
SHA1 17a5fd166ae50c4a008c049a5afd0677200a4576
SHA512 1031b59cf8a9ec06ec5cccc1b0436c6038380fed75b71de852616a98d9aa4b03338496f363540863a87fdd8438a2460a01187a127eabde5024bde8483b17c7a1
SSDEEP 1536:3JkrlvAZud6INTukOB8/JvH88UnpkJly/UyH969+:3Al6jd9cJ08Uulu09+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Referring

Path C:\Users\Admin\AppData\Local\Temp\Referring
Size 73KB
SHA256 60185c8a23816cbd6d54465e7659a3ee65849a5d1bea1fdc3dbaf6059cdf461e
MD5 4ff9f6abe9e62054e2abff19ed1845f3
SHA1 60d9a8d2a3b926306af495a9538eafca8b2a9a0e
SHA512 829cb637914d55c1a1891a38e4a5e64110f6cf4cea3bf494a45419844c459e18a0ce98b4b7ec04fe63a8efc5443e2a765a8249f4d5c70aa7dfa3ddd173d28fbc
SSDEEP 768:vduPbOU7aI4kCD9vmPukxhSaAwuXc/mex/SX:vIimuzaAwusPa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Reverse.docm

Path C:\Users\Admin\AppData\Local\Temp\Reverse.docm
Size 43KB
SHA256 94ffa0ab6c75641adda19b3f6cf53bc16a73e9b3a2f05a0068988628dc7f65a7
MD5 facda68219167a38acb149c0e85c16da
SHA1 ffcd9cb5bd8e8d701b92b48ae1925306defc9b3c
SHA512 eb2ce123c40c349fec999ef0c64411428c5e51994da3b5aaede697cb819294d558873d4ec451414b13c8d0b64c66c2e3fa7e012dcc2b15c6dfe342730389f360
SSDEEP 768:RN0sgCS71spIl6qIcSiwhzWm0st/sPkngYVrdT9dJTIjs:R9qxz6RJ0sRVZT9fTIo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sisters.docm

Path C:\Users\Admin\AppData\Local\Temp\Sisters.docm
Size 60KB
SHA256 a7fa65ceaba7e37558ef89825b4d499596d1801e42a0d78b715786d5c2a0006a
MD5 c85c3755858af3c5fa1b17c4dde239fb
SHA1 a943196499f858f6bdae6a5040cb5618bca33cb5
SHA512 a8d31ba506eca7768f618c8e16ff572d9f8cd1fb35a14938ade2f2be1d2112beed9cca701f459f6c00e37450d8a829df930fd4a470324a4a86daddced10677c7
SSDEEP 1536:kLIiYdM2LR+3a+EhrEerzP762zh1GxI38uvP/f9+DJ+iR3PvbH+b2m:kLIiYh+qJrxT62zcI38uvP/YDJHR3PA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tu.docm

Path C:\Users\Admin\AppData\Local\Temp\Tu.docm
Size 27KB
SHA256 a599cc839786c2b54ffba36c0edbdeb0c4378c90ff9a952c9aae8c9720421805
MD5 47932724e92c5c8274fff2278bef79c9
SHA1 163bb4eec5f8086a6a99ede107aa25db0130c027
SHA512 71a5e9adad7ae0b59af25732ad9882c6ca2dbef94a9e8aecad220f19a47995c0244b52770213f0f232ac19c1fe9d5ccf393ea150050f37981e097f29fe698c65
SSDEEP 768:Uhd92VB76WO8Fl8xLJb46EL/ZWAyDd1XSk:UB8iHLx1EjGDdtSk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Underlying

Path C:\Users\Admin\AppData\Local\Temp\Underlying
Size 76KB
SHA256 7c076c215ffe35c968cf15dc431230f45a429d7ba7e37ae85176437077f7669f
MD5 ad15ad8add7c396c4bd76c107c7185d2
SHA1 afeaa3edb4e3bf6c3bb57639211bfda2cc2e7baa
SHA512 5b580dfdf38f566b9db4e32b9a42d6921cf382f41ffa32a069601561e2244a6ec50bd3130b570fff3b2af44fad06173ca052326aaa481d15af3db4314b732e44
SSDEEP 1536:Cvn+pqFqaynB6GMKY99z+ajU1Rjv18fRQLTh/5fhjLueoMmOrr2:Cv+AqVnBypIbv18mLthfhnueoMmOW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vacancies.docm

Path C:\Users\Admin\AppData\Local\Temp\Vacancies.docm
Size 78KB
SHA256 6f31679d60fd8a755a7bab7669185b4ea100671c638bd8c7309313c3b9247ddd
MD5 5339704f2ad1f1260236297e4eda25a9
SHA1 d829ea24b2d51dffe433947ef43767c385241107
SHA512 18544a6ad1868bc93b0940fba9d2c77decad6aeed7ab20e443b76d04aaa2a241b678d78474193c9f925c200c9c7020c5b00f2774a18bfdf27c351fd2f05fa8f8
SSDEEP 1536:h/gIejiFIu6RcjUSV/NrVxTnB1lSSUfFvirIhLHzInorq1XibWPb4/lFRF3a:pgmIu6VS3nHYbFaPor4XiN9jF3a
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vegetation

Path C:\Users\Admin\AppData\Local\Temp\Vegetation
Size 60KB
SHA256 c69331622c4c716e9394666c1112bd8702fb63742ae56c914d68ff42cefe578b
MD5 5fdd6bd298beececb2550ca9acf02471
SHA1 bcc53b7108808691d5aecb69ad8bb3e2d60eb731
SHA512 efd0855258ae37c55fa08df64ac18d0a3b8f80bb492d56902e651cec00cfb549995d58e05a947d6cbbf539b09d1457fe149488aa78adc374fdd2ab19307fd326
SSDEEP 768:TDNFoDu+XdoXSMf17+sVXnQkdFLILu8rbPDmhdimkIXqURPN2mldrfa04VQv7Qfr:3Z+Sh+I+FrbCyI7P4Cxi8q0vQEcmFdno
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3600-653-0x00000000001D0000-0x0000000000232000-memory.dmp

Download

memory/3600-655-0x00000000001D0000-0x0000000000232000-memory.dmp

Download

memory/3600-656-0x00000000001D0000-0x0000000000232000-memory.dmp

Download

memory/3600-657-0x00000000001D0000-0x0000000000232000-memory.dmp

Download

memory/3600-654-0x00000000001D0000-0x0000000000232000-memory.dmp

Download