lumma | 92cbc9d11b1dac5ddc467b6a9004531f4619ca553ea7be2b930af78dde07a6db

Analysis

max time kernel
103s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2025, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
random.exe
Size 1.2MB
Sample250403-tapjrayvex
SHA256 92cbc9d11b1dac5ddc467b6a9004531f4619ca553ea7be2b930af78dde07a6db
MD5 81ae0c0c9eae396b19a71cf79eb99cff
SHA1 b84aea006668926b9cd3dfb27c764dfd69781f69
SHA512 d2a17932a5198516b44d32e7c71f6f3e30ddcf9d2e2928bfecb63175ac5a1cdaa837f873c38c6a01e2b7e299543e35c2aec553659513a6a55d2cfc0dadf4c0ca
SSDEEP 24576:utCeqEVdj/8IDu5wAqV86uaYraeMERA2/kWwZAna+SbY8MVkobanhMPMK86L4:ulqEVdjDu2TVFuaYralp2/kWCMlVjbwp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://unicornu.digital/nojh
https://jrxsafer.top/shpaoz
https://krxspint.digital/kendwz
https://rhxhube.run/pogrs
https://grxeasyw.digital/xxepw
https://advennture.top/GKsiio
https://targett.top/dsANGt
https://gxrfxcaseq.live/gspaz
https://ywmedici.top/noagis

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	random.exe

Executes dropped EXE 1 IoCs

pid	Process
1456	Cope.com

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
684	tasklist.exe
2760	tasklist.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\GuardNails	random.exe
File opened for modification	C:\Windows\ProudlyDevelopments	random.exe
File opened for modification	C:\Windows\PoorKansas	random.exe
File opened for modification	C:\Windows\DimensionalGreek	random.exe
File opened for modification	C:\Windows\BearCosmetics	random.exe
File opened for modification	C:\Windows\DependingWonder	random.exe
File opened for modification	C:\Windows\LeasingHours	random.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cope.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1456	Cope.com
1456	Cope.com
1456	Cope.com
1456	Cope.com
1456	Cope.com
1456	Cope.com
1456	Cope.com
1456	Cope.com
1456	Cope.com
1456	Cope.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	684	tasklist.exe
Token: SeDebugPrivilege	2760	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1456	Cope.com
1456	Cope.com
1456	Cope.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1456	Cope.com
1456	Cope.com
1456	Cope.com

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2456	2460	random.exe	90
PID 2460 wrote to memory of 2456	2460	random.exe	90
PID 2460 wrote to memory of 2456	2460	random.exe	90
PID 2456 wrote to memory of 684	2456	cmd.exe	94
PID 2456 wrote to memory of 684	2456	cmd.exe	94
PID 2456 wrote to memory of 684	2456	cmd.exe	94
PID 2456 wrote to memory of 4660	2456	cmd.exe	95
PID 2456 wrote to memory of 4660	2456	cmd.exe	95
PID 2456 wrote to memory of 4660	2456	cmd.exe	95
PID 2456 wrote to memory of 2760	2456	cmd.exe	97
PID 2456 wrote to memory of 2760	2456	cmd.exe	97
PID 2456 wrote to memory of 2760	2456	cmd.exe	97
PID 2456 wrote to memory of 2668	2456	cmd.exe	98
PID 2456 wrote to memory of 2668	2456	cmd.exe	98
PID 2456 wrote to memory of 2668	2456	cmd.exe	98
PID 2456 wrote to memory of 4488	2456	cmd.exe	100
PID 2456 wrote to memory of 4488	2456	cmd.exe	100
PID 2456 wrote to memory of 4488	2456	cmd.exe	100
PID 2456 wrote to memory of 4072	2456	cmd.exe	101
PID 2456 wrote to memory of 4072	2456	cmd.exe	101
PID 2456 wrote to memory of 4072	2456	cmd.exe	101
PID 2456 wrote to memory of 3644	2456	cmd.exe	102
PID 2456 wrote to memory of 3644	2456	cmd.exe	102
PID 2456 wrote to memory of 3644	2456	cmd.exe	102
PID 2456 wrote to memory of 3388	2456	cmd.exe	103
PID 2456 wrote to memory of 3388	2456	cmd.exe	103
PID 2456 wrote to memory of 3388	2456	cmd.exe	103
PID 2456 wrote to memory of 2600	2456	cmd.exe	104
PID 2456 wrote to memory of 2600	2456	cmd.exe	104
PID 2456 wrote to memory of 2600	2456	cmd.exe	104
PID 2456 wrote to memory of 1456	2456	cmd.exe	105
PID 2456 wrote to memory of 1456	2456	cmd.exe	105
PID 2456 wrote to memory of 1456	2456	cmd.exe	105
PID 2456 wrote to memory of 4860	2456	cmd.exe	106
PID 2456 wrote to memory of 4860	2456	cmd.exe	106
PID 2456 wrote to memory of 4860	2456	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Discrete.wbk Discrete.wbk.bat & Discrete.wbk.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:684
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4660
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- - C:\Windows\SysWOW64\findstr.exe
    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 48371
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4488
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Photography.wbk
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4072
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Handhelds" Handjobs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3644
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 48371\Cope.com + Positive + Wav + Stamp + Ed + Canon + Candy + Vitamin + Elections + Zip + Choice 48371\Cope.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Stomach.wbk + ..\Sales.wbk + ..\Inner.wbk + ..\Showtimes.wbk + ..\Earned.wbk + ..\Char.wbk + ..\Airports.wbk i
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2600
- - C:\Users\Admin\AppData\Local\Temp\48371\Cope.com
    Cope.com i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1456
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cope.com

Path C:\Users\Admin\AppData\Local\Temp\48371\Cope.com
Size 2KB
SHA256 4038986677e5ffce46d4a9dd585c8e9d542af419aee28e48505f5779e7e32178
MD5 a3a4e88c6263fe5f3cc2afbe77db42e8
SHA1 f8707782dc0438da44c6e06f503ea15a845421b2
SHA512 97e5022f8ae5e45967703f438a619cbfa686d26163b155306a62c8082f43fdc6e64ba88e9d9ae294cd583f6deb0e94da759301243ff63e03e7e10a2f0995774c
MD5 SHA1 SHA512

Submit Download

Cope.com

Path C:\Users\Admin\AppData\Local\Temp\48371\Cope.com
Size 925KB
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
SSDEEP 24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\48371\i
Size 544KB
SHA256 d91e55d2e22107db1ef4eb514993deaf65900572c475bd1a93e381598f7936a4
MD5 9e250f71351520687d571c90901817a2
SHA1 565af458afe208f87d6a3dbfc262947da0ea0ff5
SHA512 b56a908e5bbcd81a49b604d066aed3ad7e5938d2e784114b46d7eca27be14d90d4627169a290186de0b3ff97520a00f9175abc23de89b29285ac8e9a6ed409c7
SSDEEP 12288:DYN7Zsj5MWEYLV1y0xGtTkkyu1bHd/heVkZfuQiBcu13j:DYNZsj52YLFxGNDyu/O2QcuN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Airports.wbk

Path C:\Users\Admin\AppData\Local\Temp\Airports.wbk
Size 77KB
SHA256 a037d997a28db9976803b6a156b3670708a35ef7bf20dcf320230768e82a98f3
MD5 98ff23cae0b44c0004572741ac7e8e47
SHA1 123108263620d616101740bc8f33afae8843e250
SHA512 1a1a9369d1a79933c21329c1ad5241677f74dbff8701e3a81904f45bd10035cbc4dca3d179c75f38102d8f974a3c7e7a37cdd508c1c2fee4efc2922de2e11bbc
SSDEEP 1536:GyhDDWKbvnsEYlyqqADC+ZzG59ZKyTU0b3X3KQ0xZm8MY:tDxvs1bCLZZHKQ0xZmzY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Candy

Path C:\Users\Admin\AppData\Local\Temp\Candy
Size 148KB
SHA256 4ca9e8abc5a38bc1eece17b6f5259e7488394578488d40359ebd4c8e51a17648
MD5 0f352b74248a7adcf34d146276340bcf
SHA1 34138bd79cef3cd7e041d21387141a51c58a5a1e
SHA512 346e7f8e5922a889e3a65eeaea530048bb7f603aadfb3a71c99358670d44f3ee2d3019aeabed7df65fac3912b8e036b617f60639f6b851661b1d1069bdab7be5
SSDEEP 3072:hwS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbv18mLthfhnueoMmOqDoiou:hb2j6AUkB0CThp6vmVnjphfhnvu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Canon

Path C:\Users\Admin\AppData\Local\Temp\Canon
Size 96KB
SHA256 b35713a7ba90da3215e3ac83f41720826f91009b93b55be5447a87324af06513
MD5 ace6a5b199f7a4c75fe0a06152871a03
SHA1 7d85e47705e83f726feee98ed1e84c791f03b50b
SHA512 84b6d34ea5f432d0f85b0172884cf2da3465a4ad6054172428f67ddd44f715c10c79aeb26966fc599f2f7dd0b5b0571c0b8d3768d22b23ef95326c785b1093d3
SSDEEP 1536:JdTmHwANUQlHS3cctlxWboHdMJ3RraSXL21rKoUn9r5C03Eq30BcrTrhCX4aVmy:JdTmRxlHS3NxrHSBRtNPnj0nEoXnmy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Char.wbk

Path C:\Users\Admin\AppData\Local\Temp\Char.wbk
Size 78KB
SHA256 a2459811a245dd12d84003c5b70237a2c83cad2b0d6efa6eb4ee026188d44fad
MD5 24162cbcb6a006e958b5ac6695d712d2
SHA1 63c1034c7259f189448b35a2c1eac26bc24f57fc
SHA512 faa7f3f6e573710925457c917683eae16c7805278705175d4103e8fad678e9e40c7d634e2dc01c02ba08a50f2f9e08edcfc6606decb6038d4cef6f0e23b28bce
SSDEEP 1536:QyKSngwbcnP4oBS/rhJLkf8Tycvp0MekkA9gRfH8ZeJvTF9kqjb+DakOy5k8:xu4cSzh1E5IoRcWBQa2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Choice

Path C:\Users\Admin\AppData\Local\Temp\Choice
Size 40KB
SHA256 cb23d8c5d96fa049f2ba9a1478b5ebd9d94f956425c1122d4cbbb0a611c202dc
MD5 57617aae7945e8dbf39e8d055b93e53e
SHA1 e2d93981c00e7a267cc13636e05edcc884b65ade
SHA512 c1fcbb20570a088c61a8a65d1f74ed9a47b1eef64617dab1681c7e1e1754f43c54a18bc96ee36bc66c751bff736e235ee3cc499f186e055a7ff83b6afdee7059
SSDEEP 768:9Gmd9OTGQ1Dv7sMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:9GmdATGODv7xvTphAiPChgZ2kOE6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Discrete.wbk

Path C:\Users\Admin\AppData\Local\Temp\Discrete.wbk
Size 11KB
SHA256 6c70e2b497821c4e4e77ee25bce443ca53f4e1506831de06bd43e1d5cabb167f
MD5 c7611f73b61996cd23575fd75862a22a
SHA1 c4de3f9ec742ccadec34ac68e9f8d6ba13992299
SHA512 f93f6e30ac62992510ddbd9a40862c51f0a23f11beb8ec5f10c8aa5adc170988c489af46126328aa592cc067191f830700f9fdfaadf866fc1da40588244c10c6
SSDEEP 192:gA9spO0nh1QFUW3UR3PpI9qfLx1D/qdxU64TcHdQ7Gzsy00Nw4Sm1kv2IqHQT:9spTcUW3UnFLH/qzUNv7GzzBXh1kvPqs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Earned.wbk

Path C:\Users\Admin\AppData\Local\Temp\Earned.wbk
Size 75KB
SHA256 1e88ae4c745ee0c2e38c16319206f1b82094826121102e35bfc445463d91b22f
MD5 26b6527088ff41159ca2cac7a131d42d
SHA1 995a6d09418c49589e8334ac730282e6ff37fd34
SHA512 338482e3ffd30da1972ddbd9b3ab192c21b4b8dc47c62af4c85e3ddd52e1806582f0e070a207125c06d08cd4cab41ccb1a8e7dcf1f49bf63026c14a82528e099
SSDEEP 1536:UDs/YULj+vFuLluSLokj/gf3hHWaRvdAh/2RLpRtUoUxRAqqZMw+JdFaRY:bavmoIaJkU9HSoiFN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Ed
Size 105KB
SHA256 72bb7a36e2f6d44a33409a747dfa377b385cb1166079d4239a781f83ce16d186
MD5 597e7e4a7c85568433a1abef500d16ea
SHA1 abcbbc0924c4b838caa02c679a7061d81024708b
SHA512 089bba6fc55a59c80b946d291dbc3bcaa9b2eb6788466fc5bbf82f1971c58f058340557f90a91350a7d47e6a8ec2749c10a0e08a2223da073f8dba23f57a8ed6
SSDEEP 1536:SFrbCyI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwneAJu7QnswIPumV3Bj:SU4CE0Imbi80PtCZEMnVIPPBxT/sZS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Elections

Path C:\Users\Admin\AppData\Local\Temp\Elections
Size 109KB
SHA256 298a55c808e13473f3e0a3ee7e960b930cb8df6e3b793fb1bf55f627e7712ad8
MD5 1ba9b29eafc0d1407f7d4387a8ac0a40
SHA1 af2c13c9d266cdafee28e323e3419b4bb0910d31
SHA512 1bdab766bf23951a5dfe5c2aebc92136278bf26717c5d23070fc618e0ce2fbcd7ebaff1d0b35e7ce07b72457de17e5b964b8b9ba2810764a0aabc01a86f8a334
SSDEEP 768:Ivq6LqgaHbdMNkNDUzSLKPDvFQC7Vkr5M4INduPbOU7aI4kCD9vmPukxhSaAwuXf:IvtmgMbFuz08QuklMBNIimuzaAwusPe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Handjobs

Path C:\Users\Admin\AppData\Local\Temp\Handjobs
Size 2KB
SHA256 472b69cb4a9b04f72e512b88a39072f9da819ea84ac305bf8643f9fe4f3ad18d
MD5 a5daaa5cfb56922cc5ff8e42b8f720cb
SHA1 1482e9e6210652255e48f24fe5668018a1773ac4
SHA512 c1b411c958b15a539a93cca578664ffda9d521d094d5369559600fc651a9edf14045bec17884155593b005d204bc9a92ef30ebbf53ea1e86d5e5ca986808ee4a
MD5 SHA1 SHA512

Submit Download

Inner.wbk

Path C:\Users\Admin\AppData\Local\Temp\Inner.wbk
Size 72KB
SHA256 dc9a3786745d50630685028b1221cb5011390761c603088a6bf301a6c996812e
MD5 0c2b38b86907933d2a978c01247d54b9
SHA1 5095ab96b803021ea77bd5185553cd0590fcf285
SHA512 c14a5886414b24276cd7410500c33a0c3cb76706451d97f69f2c693d3f6daec947c00c971e334a879a9a39a35cb47fb6559cd45fc9775b9c99743cc12a4c7809
SSDEEP 1536:K5SbNt08uQ5chgXOrySjM+SffAxysDHhQxDItZPzyKJ0AlXr9NZP1654VA:KMbNtFcT+SjZHxV0ktRzpJnlXoOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Photography.wbk

Path C:\Users\Admin\AppData\Local\Temp\Photography.wbk
Size 476KB
SHA256 53cfb29c938c186b5aeb2a2a80d71a2d3fccedca2af5219f887e26104bd46106
MD5 27c3b43ee3421595b4fcaa40d827b870
SHA1 89ec42b87232a3989ea8bdd8b19344f8f107bc76
SHA512 e22fed62ff2a8a8427b23bda5bbc382dcf41004ae9e233fc650506f046b46d5f3ab3a37f2f96688cc21e437050635932e9171c3fb8a9961c1cd2a4fd58d49113
SSDEEP 12288:rWmz+ilwkWsysP6KNVloBlQw47IA1Rig1+If8TeXhWZh/XBY:r/yilwkLHw4VkGxcLfBY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Positive

Path C:\Users\Admin\AppData\Local\Temp\Positive
Size 67KB
SHA256 3b65d54d659046f3e357bb800cd28bc7f0ffb9a94b2b04d630b2a284ef4fb521
MD5 f9f71a2a81b5937f92ec714d41ad803a
SHA1 683aa55231e31ad776a2306993baf7c675826b61
SHA512 395cf6f643467d68caddd3c5fac063cb56a743bd72d791fc31ca3da4c60e75f895c06556ee83fd7bd68411c1bb9b51c9b13d1bcb64bf6905eea3604b62de0559
SSDEEP 1536:fAD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzO:fg5PXPeiR6MKkjGWoUlJUi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sales.wbk

Path C:\Users\Admin\AppData\Local\Temp\Sales.wbk
Size 99KB
SHA256 cb3b1ef84da7d1a2432cacbabeb4cc882105d5549cc177d5a256aa0a8eebe30e
MD5 8805d606a6cb1fe7c0b2cd98eb29de86
SHA1 fe9259520bd5025852717b8a865a69ad2cf92dc9
SHA512 ecbeedc4e16047aa52e9ffdf51df676ee73b343a639d2ea9b9f379888fe5f141780df2521e5dd842c8c38abbda75e7f143aef2bca869d9b9ce1269bc4ac4c26f
SSDEEP 1536:tFdLBbLq81RfC5Q7FnHBcfmmTtSCz0eAQ0rGlHJktqvr2BqvSxiY3mywctp9R8nx:tLVm81RK8F80e4Gbhz2QvLym+ynoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Showtimes.wbk

Path C:\Users\Admin\AppData\Local\Temp\Showtimes.wbk
Size 50KB
SHA256 12102b00da79794aa3fadcbc8bc9897508d8fb3cd12567de68e0a8e7f65b5e46
MD5 2a7a949d394cbdd28255ac04311f45cd
SHA1 a6015ef2984e5b6597c7e5df7a290a71117f76f5
SHA512 74f2675e8b24281e727fdc2559a0a87ae01ec79affc22301c446acf1e682fa126ba3bd8d7081acf7040644835da4509b38e574d18d663da57204d07bf7530e97
SSDEEP 1536:SCLbb1N22fFgSS4GcXBqSHGPERWonU1yAgg9A:SCLbb1BNrXm2WonUgAggA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Stamp

Path C:\Users\Admin\AppData\Local\Temp\Stamp
Size 55KB
SHA256 b6e85afd66cb95591db8a70c25e163116fb4165be7c1a576d5b455c437c00e07
MD5 6e01713d978ee8aed783ea0636033d9f
SHA1 a337692d37919cb77a37935829b5490c5b1c3ab0
SHA512 83ad0322e4d563f2ab9f138dd957721081fd343aa2cc428877fce171a881a2a7da8890ec75a3cf2c11b9d2bcaa66536dae6d513cb20103016e4cadd6c2704a64
SSDEEP 768:z6vY6rbybcdAqM4w85qviR93X0Z1IrvD19c1pQLiype/ehju5rWiq/DOSOlwRDN5:GvY464qvI932eOypvcLSDOSpZ+Sh+ID
MD5 SHA1 SHA512 SSDEEP

Submit Download

Stomach.wbk

Path C:\Users\Admin\AppData\Local\Temp\Stomach.wbk
Size 93KB
SHA256 bd646155cac302ab491ff52eafffda4970c6995872b56cd141a9cadac0ed8273
MD5 5fe9548f6a4ea2d7cfada7f50fd08b54
SHA1 6e7dfb3409dd76ec328a625e76571939550d46f1
SHA512 7b6233ac25f112b356843ac19f8f8da1a9e36a7df3f9b5faf5ef0b7e6a8a8d87d0bb0b71499a6faf265b4a474a52fc952210274162b9cba15bfd06c8015f54e6
SSDEEP 1536:1MqENG8MQP7vaF2bWEh1hwo67toQnmKz2c6jpiXjgyH+UGMlXDFMPBZlvKS4ZWhI:18s8MY7A2b7fhEtjRzEj0XjgyHJGezUc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vitamin

Path C:\Users\Admin\AppData\Local\Temp\Vitamin
Size 93KB
SHA256 551edebd9e4028056e9e3dfdcd1c1705da4ea3c6b6b43a52ae5408e9ecad7ca0
MD5 acaa40bd18092110ee8f16b09cf6f54b
SHA1 0ea2edf491788ccc47e442ded28a4728694e322f
SHA512 7da86c29924e58550f578415752c7aaecf6d72e1cc03e35d11561c48ebf2a1c0ffc97630febd8a30ffd56e9c05ced22f66558118743c900e886c62cecd9329e8
SSDEEP 1536:dK+r5bLmbZzW9FfTubb1/Dde6YF640L6wy4Za9IN3YRYfv2j62SfuVGHj1vtK7hE:f5bLezW9FfTut/Dde6u640ewy4Za9co6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wav

Path C:\Users\Admin\AppData\Local\Temp\Wav
Size 97KB
SHA256 6fc9f90f94c7825425f09629766faa3c8af0dc0ceb67cde16e82faecd625c9d3
MD5 bef40ce9a152b0af8cc3d993c6d1f86b
SHA1 7dafa3520bd0c5f2075f55033ac9a723c9eca2d8
SHA512 e75a4cf4b364b98b316bef52f2f06e348efd212ebaadae6594ca6e8b3058fe203b3634759ab354979eb299e75e50b7cf3151e98cf471661375c9adb3c033081a
SSDEEP 3072:qdgQa8Bp/LxyA3laW2UDQWf05mjccBiqXvpgr:egQaE/loUDtf0accB36
MD5 SHA1 SHA512 SSDEEP

Submit Download

Zip

Path C:\Users\Admin\AppData\Local\Temp\Zip
Size 112KB
SHA256 5e0ef098d201d2a3fc43ea5e27ce052eb0262bd89ed3df093bd1d2e53869c363
MD5 7258142e122b932d5f1d80dc9cf18233
SHA1 38581d8a8d714ae1878631acc8cced8fb5c1356b
SHA512 8827ac6619a39095f568183bf098167e9e53b883921d7a359bef5a5f1322827da7e0f78495fa1e38697d4a2a538e6aa20c79ca6fa3f0d74d59aa702a729bba48
SSDEEP 1536:yKaj6iTcPAsAhxjgarB/5el3EYrDWyu0uZo2+9j:M6whxjgarB/5elDWy4ZN2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1456-335-0x00000000043A0000-0x0000000004406000-memory.dmp

Download

memory/1456-336-0x00000000043A0000-0x0000000004406000-memory.dmp

Download

memory/1456-337-0x00000000043A0000-0x0000000004406000-memory.dmp

Download

memory/1456-339-0x00000000043A0000-0x0000000004406000-memory.dmp

Download

memory/1456-338-0x00000000043A0000-0x0000000004406000-memory.dmp

Download