lumma | e75cbce2a288aa6042ec19d11616d5fd4f7cdb25aa284c7ea5bdb5fbfe7930fb

Analysis

max time kernel
101s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250411-en
resource tags

arch:x64arch:x86image:win11-20250411-enlocale:en-usos:windows11-21h2-x64system
submitted
16/04/2025, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bca968bba9c5b5e046823ccfea196e2a.exe
Size 1.2MB
Sample250416-sshngswrw8
SHA256 e75cbce2a288aa6042ec19d11616d5fd4f7cdb25aa284c7ea5bdb5fbfe7930fb
MD5 bca968bba9c5b5e046823ccfea196e2a
SHA1 e0b46d402ce5dcff8c75407382f29fe0ef3758a9
SHA512 91ab9bfed72ad1941b3a392a699f1598cce7347c31b24d5f28c3ef4f1f575ef852b7463d1eae6a6b2e08fe5d55ddb99794d8761114348b7af353a5318282c13e
SSDEEP 24576:L0aOtLJEh/0Lg4lDDrde3wI/XfmutdHGivSTDfKlyyFgI9BWZYmiMN8sf8l6GH96:L4tBPl3rde3wIHm04ikDSlyyFaZZiMN5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://agroeconb.live/bayz
https://jawdedmirror.run/ewqd
https://changeaie.top/geps
https://lonfgshadow.live/xawi
https://liftally.top/xasj
https://nighetwhisper.top/lekd
https://salaccgfa.top/gsooz
https://zestmodp.top/zeda
https://owlflright.digital/qopy

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
2292	Hk.com

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2684	tasklist.exe
4588	tasklist.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\MwUtc	bca968bba9c5b5e046823ccfea196e2a.exe
File opened for modification	C:\Windows\IndiansEngineers	bca968bba9c5b5e046823ccfea196e2a.exe
File opened for modification	C:\Windows\FridgeWarehouse	bca968bba9c5b5e046823ccfea196e2a.exe
File opened for modification	C:\Windows\KwRacial	bca968bba9c5b5e046823ccfea196e2a.exe
File opened for modification	C:\Windows\AssessmentsSons	bca968bba9c5b5e046823ccfea196e2a.exe
File opened for modification	C:\Windows\AcrylicAlgorithms	bca968bba9c5b5e046823ccfea196e2a.exe
File opened for modification	C:\Windows\TaPlasma	bca968bba9c5b5e046823ccfea196e2a.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hk.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bca968bba9c5b5e046823ccfea196e2a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2292	Hk.com
2292	Hk.com
2292	Hk.com
2292	Hk.com
2292	Hk.com
2292	Hk.com
2292	Hk.com
2292	Hk.com
2292	Hk.com
2292	Hk.com
2292	Hk.com
2292	Hk.com
2292	Hk.com
2292	Hk.com

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	tasklist.exe
Token: SeDebugPrivilege	4588	tasklist.exe
Token: SeImpersonatePrivilege	2292	Hk.com
Token: SeImpersonatePrivilege	2292	Hk.com

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2292	Hk.com
2292	Hk.com
2292	Hk.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2292	Hk.com
2292	Hk.com
2292	Hk.com

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 4544	2524	bca968bba9c5b5e046823ccfea196e2a.exe	83
PID 2524 wrote to memory of 4544	2524	bca968bba9c5b5e046823ccfea196e2a.exe	83
PID 2524 wrote to memory of 4544	2524	bca968bba9c5b5e046823ccfea196e2a.exe	83
PID 4544 wrote to memory of 2684	4544	cmd.exe	85
PID 4544 wrote to memory of 2684	4544	cmd.exe	85
PID 4544 wrote to memory of 2684	4544	cmd.exe	85
PID 4544 wrote to memory of 2804	4544	cmd.exe	86
PID 4544 wrote to memory of 2804	4544	cmd.exe	86
PID 4544 wrote to memory of 2804	4544	cmd.exe	86
PID 4544 wrote to memory of 4588	4544	cmd.exe	88
PID 4544 wrote to memory of 4588	4544	cmd.exe	88
PID 4544 wrote to memory of 4588	4544	cmd.exe	88
PID 4544 wrote to memory of 3708	4544	cmd.exe	89
PID 4544 wrote to memory of 3708	4544	cmd.exe	89
PID 4544 wrote to memory of 3708	4544	cmd.exe	89
PID 4544 wrote to memory of 4600	4544	cmd.exe	90
PID 4544 wrote to memory of 4600	4544	cmd.exe	90
PID 4544 wrote to memory of 4600	4544	cmd.exe	90
PID 4544 wrote to memory of 2460	4544	cmd.exe	91
PID 4544 wrote to memory of 2460	4544	cmd.exe	91
PID 4544 wrote to memory of 2460	4544	cmd.exe	91
PID 4544 wrote to memory of 1724	4544	cmd.exe	92
PID 4544 wrote to memory of 1724	4544	cmd.exe	92
PID 4544 wrote to memory of 1724	4544	cmd.exe	92
PID 4544 wrote to memory of 5424	4544	cmd.exe	93
PID 4544 wrote to memory of 5424	4544	cmd.exe	93
PID 4544 wrote to memory of 5424	4544	cmd.exe	93
PID 4544 wrote to memory of 6100	4544	cmd.exe	94
PID 4544 wrote to memory of 6100	4544	cmd.exe	94
PID 4544 wrote to memory of 6100	4544	cmd.exe	94
PID 4544 wrote to memory of 2292	4544	cmd.exe	95
PID 4544 wrote to memory of 2292	4544	cmd.exe	95
PID 4544 wrote to memory of 2292	4544	cmd.exe	95
PID 4544 wrote to memory of 4884	4544	cmd.exe	96
PID 4544 wrote to memory of 4884	4544	cmd.exe	96
PID 4544 wrote to memory of 4884	4544	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\bca968bba9c5b5e046823ccfea196e2a.exe
"C:\Users\Admin\AppData\Local\Temp\bca968bba9c5b5e046823ccfea196e2a.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Jamaica.mui Jamaica.mui.bat & Jamaica.mui.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2804
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- - C:\Windows\SysWOW64\findstr.exe
    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3708
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 779002
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4600
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Opportunity.mui
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2460
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "indie" Movie
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 779002\Hk.com + Regard + Trips + Camel + Dried + Dolls + Apt + Bring + Canon + Caring 779002\Hk.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5424
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Rec.mui + ..\Difference.mui + ..\Resolutions.mui + ..\Flows.mui + ..\Dl.mui + ..\Admit.mui k
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6100
- - C:\Users\Admin\AppData\Local\Temp\779002\Hk.com
    Hk.com k
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2292
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hk.com

Path C:\Users\Admin\AppData\Local\Temp\779002\Hk.com
Size 2KB
SHA256 4d3258f2d633a38259b581666c05a6eba707aedbcc104da58e1532672f9fbf2a
MD5 a3f1856c937818b83bd266d90fbe00d6
SHA1 b9b676bbda5d404b01bf7f5098c82202d7b0e40f
SHA512 d8e151110ba2192fb981792d098b5c99f7a7d4b9c3e57a154bfb36d6bc64dc6e01def83be328a072966836d817e478e3e2a7d00bb62e0262be80ce02d0002f9c
MD5 SHA1 SHA512

Submit Download

Hk.com

Path C:\Users\Admin\AppData\Local\Temp\779002\Hk.com
Size 925KB
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
SSDEEP 24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\779002\k
Size 531KB
SHA256 b981510efa563bb22dead04d1e019e9cc9f73e2f13a43e274e01317acd64d4aa
MD5 bf8e69d111afbab657f60a81f54ae4ce
SHA1 e49846e6468fa6b62910d448672a65efc9717317
SHA512 f5556ae6959342073e1e6d18298e5928b7a919f20194681d20b16f1d701239c86b95c1f39cda1abc3261e7d164f8becd5301551d9f594364e7888bb632ca06cd
SSDEEP 12288:ByNGbxwd8J4eN6pLz1BSx08KpmV+CeRWdkkc6+:Byum8J4ymSxw2+iq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Admit.mui

Path C:\Users\Admin\AppData\Local\Temp\Admit.mui
Size 81KB
SHA256 e30722811e63be8ddfeffc85ee9842a3896b4a330d7e6166045fafd77407be90
MD5 7b4abc719a85e18ef03da8e83b6b72f5
SHA1 2b9b356948d7788d3eb3f3c2867082574170d19b
SHA512 266784814a07f1be271c55c475bee253ad05ee7d1e0472c0c1c5821fb6ed398c304f4c3f047f77efdee3accbc01ee4b71416ee937424fe8b2140f4ee33646697
SSDEEP 1536:EtoYMIzO57auSgIZG6zA2Ke9jyEqycVs3nV1/eFER9A:MMI6BNhIG0A2Jq/s3n/QER9A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Apt

Path C:\Users\Admin\AppData\Local\Temp\Apt
Size 130KB
SHA256 fc59d035769ca385b7c16f40f881594a50b900bcec6ae505f74ab5b4895fb5f8
MD5 32f645485c051aa0bc4975cfb10b5433
SHA1 0bab2461faffcdfbf08d2647b22a5815954e936e
SHA512 86ac7fc37411f0122c4759697a54320866c4dfed1378ad84cc9f182d3f1779d4dfc0bc86877a3c189def7e343efaabe09a13de539ec37e6b75047cb70fccbec1
SSDEEP 3072:VpmESv+AqVnBypIbv18mLthfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4i:Vp6vmVnjphfhnvO5bLezWWt/Dd314V1v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bring

Path C:\Users\Admin\AppData\Local\Temp\Bring
Size 112KB
SHA256 416c3140a813113b2f9ea21ef3aa2050c7058e2bbf9206508ea027e827f23d9c
MD5 9231318e12a589bf7ac21d1dba9857dd
SHA1 21588472948137359b2635dbee64c1973d44daa3
SHA512 5723c670f8d2f445f4b80b7e8bc8e00b6fa5c6e81fcd7e97be540b208231f1e6b15ae1ff422b8fe12fcf9f7f6fe5759650bc844959725afe0613b97b10efd349
SSDEEP 1536:43YRYfv2j62SfuVGHj1vtK7h6R8anHsWccd0vtmgMbFuz08QuklMBNIimuzaAwu8:4oRC2jfTq8QLeAg0Fuz08XvBNbjaAtst
MD5 SHA1 SHA512 SSDEEP

Submit Download

Camel

Path C:\Users\Admin\AppData\Local\Temp\Camel
Size 134KB
SHA256 adcdd1fc578dcb7e1efa8e43d62bfa011c9d1ec3e00f4b5ee1a28e7d00646cf4
MD5 7e0a738800cccaf9f52636093659f69b
SHA1 d5e756d97694e517e303f759e9f7fa2d9e940eeb
SHA512 f445917973421a5db77a067aa0171755e764ba8a4ee68dd541cf408ad8860ebf387660c0e1264ce66e7c65bff0def14c472a54e32ff4d6cc80d7a4d60ea7d246
SSDEEP 3072:wqv+32eOyKODOSpQSAU4CE0Imbi80PtCZEMnVIPPBI:pmmLsiS+SAhClbfSCOMVIPPi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Canon

Path C:\Users\Admin\AppData\Local\Temp\Canon
Size 94KB
SHA256 80e8d1b0f69d93c96395ed9d0faed817ee88a699547ec2e578c6353690a987e9
MD5 918fd79030129cda4a7752eaf56be204
SHA1 fa129735a4ecff16c3399543647a31d591b38f73
SHA512 9dd3d7421493fbeb04b7f2cdac6345f87491c006806ef3448461120046ca52de0d1f0d9663496177fb4ca8591a74f1794f9f1e31988f8af49b296c2a6f1fbf9d
SSDEEP 768:1x/SGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R:1dKaj6iTcPAsAhxjgarB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Caring

Path C:\Users\Admin\AppData\Local\Temp\Caring
Size 108KB
SHA256 7f5aad1dcbe39d6e04f222faf915fa42bd8621b543c7a4b7766b911bc4fe4af9
MD5 153cf24d9b978a70b97a44c2ec54aba0
SHA1 e960ad86bc2bbc79da03dd0fece982fed1ff9578
SHA512 ce76cd6633abc38eb53780957ec5d81f4776ac6c0fee8e5096d858995d742aa6f1624436d3e6bf8423c217a789a5c234077ea371ac3365443eae8747d85a685a
SSDEEP 1536:J5el3EYrDWyu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:J5elDWy4ZNoGmROL7F1G7ho2kOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Difference.mui

Path C:\Users\Admin\AppData\Local\Temp\Difference.mui
Size 95KB
SHA256 19b184c00c9ee82e95957723f3b619c08d4b6bef42fa9ab89ef7a1d4098761bd
MD5 157d089a834de25cd68736c0f1294376
SHA1 e2c7d6a6dc1f342bd78149d09a402940de0ab60a
SHA512 d21536f71081b68e2d23035a58516f98e809f1a26437c3f40d581efc19360e478b921438170f329efe451470d8a75430459b51df9dd697f238d3f3be6ae66734
SSDEEP 1536:Oi2Kra7DnTVNhmh8sTrWrEMoQuG+pWfdu6bgsUU38Fdxbgqv17QpE4T7yNTAXK:B4zRb2rWr/PLVpoUsFdpv176E4PUAa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dl.mui

Path C:\Users\Admin\AppData\Local\Temp\Dl.mui
Size 94KB
SHA256 7f461a7834cccd960f7598603fc2c0667d17942c5de5df22a9a383fd177bf5d3
MD5 2fcc4974fae75ffbaf1e5df9c1c5d914
SHA1 8e9f1fdc8dddf9e1803a458c1648803d656cf303
SHA512 41a9773cb9c36f2f9c284ed3ec869cab8c55b1ff372433b55a4b587d46b6db8b2ce5db4456b115249eb6221002227f615aa3eac9d715db34db6105861204eec4
SSDEEP 1536:0C2BryilYFZWChf4rUMmuw2xYt6fU2gdtn/YOnNZEBL5RiAQHJo6HLVd6BUCOFA:0CcllYFN1oZw2xVfU2YnNiL5RdCdHz6r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dolls

Path C:\Users\Admin\AppData\Local\Temp\Dolls
Size 109KB
SHA256 39c637a10144830ec33d6095bd4e94db8edc4d4e975ea3843203d95b96084952
MD5 b8ee6547d706296510b3ffd87981211d
SHA1 78db170d1f011872e416e28774880d2cd079b2df
SHA512 b36e88cc70d6f83cdde3d952f2bb085d8c2febc4ae2ffee260aba824d957300ffeab0d778275b5136cc3e52f2bbbab5d9b6f5aeeddce7f7fbabbe9a2b8f746ba
SSDEEP 3072:8tNPnj0nEoXnmowS2u5hVOoQ7t8T6pUkBJR8CTr:iNPj0nEo3tb2j6AUkB0CTr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dried

Path C:\Users\Admin\AppData\Local\Temp\Dried
Size 65KB
SHA256 2e2409cf71c8862842c504f2a64b6c9f60043548e307589830bca9488463f519
MD5 ce29d04f921bb2bc5cac93e5047d9a07
SHA1 b6385fe9a0384d1785c121658f21224f3be355f3
SHA512 fbfacee787ede8a47791b9c661da240fee3367688afc1d517257ab036aff056ded5e3ac03b3802792dc7b32e320bc10be891d6223d019b80feb0fdb25e487436
SSDEEP 1536:EZxu6/sPYcSyRXzW8/uC6LdTmHwANUQlHS3cctlxWboHdMJ3RA:ET/sZydTmRxlHS3NxrHSBm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Flows.mui

Path C:\Users\Admin\AppData\Local\Temp\Flows.mui
Size 86KB
SHA256 1ebef32f24dbe072a06aaea994f1174065396fd53656e9ec27436640bc951fcf
MD5 a938e62e8807972ba3fb5b27d161fcf0
SHA1 25748eaa61c44a8a70d00506f8aa4a5fd9bcd71f
SHA512 f5d4f39e7ede54e8e434ecbb8d3a32637c6885cf47f596917494aa6b63ef6c0f0fb34563b3881b730c6f425bc36dcdf631c77d68a49d9f5a939ae7d6c7ccd7f8
SSDEEP 1536:f0/7HRKXGNmI2IRaI+V+C3vPqa9hduNr9GQMHEvEwjqQdR5/c7NOhyXkKV:M7HR7mI21FPqa9h4N9G95wDd5AV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jamaica.mui

Path C:\Users\Admin\AppData\Local\Temp\Jamaica.mui
Size 16KB
SHA256 0bc4e41cb927039eec9bf3ce81ed1a729f4e32a867d921ee282834fbfd6fc3bc
MD5 06cc479507cbd4506abd7fa3c125eb7f
SHA1 40197493052e229735dd9b1824c48271d84daf59
SHA512 9e50bf64a2579bad120046454f4c99af820e33c92739993a0cba46d70d580ff8ae68ca6331ad3f4e1ec170d7346910dfe187acc1b7fc713c813dce5bcdaf712d
SSDEEP 384:QkKi3q14TBnNaeWiAGgC5BGY+REyO8ZDd1tIFFMSBvSLP8mB2MF:QkFk4qjiwd7ZO81d1tIISYLP8mFF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Movie

Path C:\Users\Admin\AppData\Local\Temp\Movie
Size 2KB
SHA256 157863eace9a2a8601afc5ab239ab376526786810066f219dafd1e1f717d3b62
MD5 207decf18650b061775529e65808cbfb
SHA1 51d4e0acb2de670ed3ad790e1781a8a9da2daf96
SHA512 b6160ddfda8931dc9e0ffdec103acdee8ab725e251a14b691eeaa1419560ddc3e8370a1d520b2c64d6aff75e7678bdea9478c86a5f3263e43f48bb45e35e6f1d
MD5 SHA1 SHA512

Submit Download

Opportunity.mui

Path C:\Users\Admin\AppData\Local\Temp\Opportunity.mui
Size 478KB
SHA256 8de87feab378f18f90c08befb0a72cb1de72d4e05073cd84181a673a8d253a6d
MD5 0b27e03bfcd49f9cb004a3a6c8a67f67
SHA1 869af987902a5ec5dfaeeb1e2b5b3608fe48c492
SHA512 f033b2b27fd64f259071b4ee010ad735b3954d48745a3d0a2d5e678c840ff7fd57085ca614d7659e16bbc4f28c55da46a0d9db5b785ce561d8ecc7e57a4b4ae7
SSDEEP 12288:4DI50+QsE8uw0jV6diTI5yIoh67d9bEiPOa6ewK/1Av:4DI5tQUWjV6gTLIoA7zEimtL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Rec.mui

Path C:\Users\Admin\AppData\Local\Temp\Rec.mui
Size 99KB
SHA256 10900d14eb9fb0ba4db759a4f0234b939b7bac8d8bb5f91840bbda3c839c6377
MD5 c05db4ae6e6febdd44ee8566a8f14822
SHA1 638a416749c36a94ee55a8567ade6a39296d0010
SHA512 4e7b2256902bd97fb7f4a29c1e3932a1999be2e4893ca35c0e5c0509a1ff5e33a4557dea3e831a0394ba0c03dd5fbaea595d6919ee6afc1ee2f88808e71562a6
SSDEEP 1536:BXz9oZnaxoJGCeqaYXBSNL5uBC+6MP7w4EEd63zeEOE21SCCMmf4DI8SDC8r:Bj9oZlJGCmLxwC+P7wId6qEOE27Cf9r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Regard

Path C:\Users\Admin\AppData\Local\Temp\Regard
Size 75KB
SHA256 c664fbf6ef5e59cc3cd0f27e38650fd92c40d8373e78fc45e39cf7e95e99df93
MD5 7af8bd69d3170f575caa20adbead0dcd
SHA1 58db35e087afd147c81c6b0345f425fc6673d8c7
SHA512 da3f7f877660462b21605b9bb6027bf70100acad185f1cca9621710873f3a820a14da33aa2a689b885357d2f5da80f1191d69534666eb7ccb7feb7c16377b306
SSDEEP 1536:XAD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdlDfFgQt:Xg5PXPeiR6MKkjGWoUlJUPdgQt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resolutions.mui

Path C:\Users\Admin\AppData\Local\Temp\Resolutions.mui
Size 76KB
SHA256 5efc06d3427e5eecec438a2908e33367bd7647e6aa27677f8c12bf8b674b7436
MD5 7d7d5bee540495164a32d85dcf335d51
SHA1 ff90aff4e909bbb9e98a994291f7523b4df35242
SHA512 2809511448d0cdd07dc2eb0be74b77556369567b8c922a0f40f7a884f4c8fb8f9f143a67f8bc441bf8ee17084298d3bb4fa41aa0686378ef03dc065e52385a87
SSDEEP 1536:BxsAJAiEQwOALLyaXZ16k1pfSbNye12IAAu5vCmhnVQgM1d:BbJsOALLRp1tKbX2IAAb5gSd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Trips

Path C:\Users\Admin\AppData\Local\Temp\Trips
Size 95KB
SHA256 d350d23dce7a93d68ca2d27498be290a07484a613a782a467d07bf444803de54
MD5 83578709ddb5ddb58870b48039d4ad77
SHA1 a2ce97c16f61d6a3dac470fe733149a94b4d3739
SHA512 e3393f1a43dbe4381a0c05ff05e3caae96bbe47f9322746e183348f29bcce533f74076f73fab2dec894f3722eb3e34429eec360581d8d01668d0380bf0e2a47e
SSDEEP 1536:Q8BpDzdZPp7HE+tKA3QkvyNf7Xw2U0pkzUWBh2zGc/xv5mjKu2IwNnPEBiqXv+Gi:Q8Bp/LxyA3laW2UDQWf05mjccBiqXvpi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2292-423-0x0000000004290000-0x00000000042F2000-memory.dmp

Download

memory/2292-422-0x0000000004290000-0x00000000042F2000-memory.dmp

Download

memory/2292-424-0x0000000004290000-0x00000000042F2000-memory.dmp

Download

memory/2292-426-0x0000000004290000-0x00000000042F2000-memory.dmp

Download

memory/2292-425-0x0000000004290000-0x00000000042F2000-memory.dmp

Download

memory/2292-429-0x0000000004160000-0x0000000004166000-memory.dmp

Download

memory/2292-430-0x0000000004160000-0x0000000004166000-memory.dmp

Download

memory/2292-428-0x0000000004290000-0x00000000042F2000-memory.dmp

Download