lumma | d28fb0737213a89d3afc456a8735eeea48209d4d5ef31f8ec71a2c1796c660a3

Analysis

max time kernel
146s
max time network
108s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
17/04/2025, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
v.en.Setup_patched.exe
Size 7.8MB
Sample250417-ydtebszyay
SHA256 d28fb0737213a89d3afc456a8735eeea48209d4d5ef31f8ec71a2c1796c660a3
MD5 ffa9beeadb7d9dfd101952a13ec83a2e
SHA1 6bc4f8abd23cfc57db29c468c25ba226b6d67551
SHA512 b37b5ad1367ade0c6c66ef61c951888bb5a3c0bdd20d8ff3244333edd241e20653e68552d29b1ae2ed240fafa54e554a22a8f715aacf02a1ab215148adb4fce6
SSDEEP 24576:W0a+pudmj9RpRR3jgv6ABGWwAdJpWVM0f4+dP7XiMzLfPDYVBBRRhe2k:WvdI/BjOkWwAda3biILDYnKl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://franecont.run/tqbd
https://jawdedmirror.run/ewqd
https://changeaie.top/geps
https://lonfgshadow.live/xawi
https://bliftally.top/xasj
https://nighetwhisper.top/lekd
https://salaccgfa.top/gsooz
https://zestmodp.top/zeda
https://owlflright.digital/qopy

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
4452	Presidential.com

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1448	tasklist.exe
3972	tasklist.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SixOffshore	v.en.Setup_patched.exe
File opened for modification	C:\Windows\KyleBlow	v.en.Setup_patched.exe
File opened for modification	C:\Windows\FramedShipping	v.en.Setup_patched.exe
File opened for modification	C:\Windows\FurtherCenter	v.en.Setup_patched.exe
File opened for modification	C:\Windows\PlacementHc	v.en.Setup_patched.exe
File opened for modification	C:\Windows\GreekMalpractice	v.en.Setup_patched.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Presidential.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v.en.Setup_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4452	Presidential.com
4452	Presidential.com
4452	Presidential.com
4452	Presidential.com
4452	Presidential.com
4452	Presidential.com
4452	Presidential.com
4452	Presidential.com
4452	Presidential.com
4452	Presidential.com
4452	Presidential.com
4452	Presidential.com

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	tasklist.exe
Token: SeDebugPrivilege	1448	tasklist.exe
Token: SeImpersonatePrivilege	4452	Presidential.com

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4452	Presidential.com
4452	Presidential.com
4452	Presidential.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4452	Presidential.com
4452	Presidential.com
4452	Presidential.com

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 4152	3128	v.en.Setup_patched.exe	78
PID 3128 wrote to memory of 4152	3128	v.en.Setup_patched.exe	78
PID 3128 wrote to memory of 4152	3128	v.en.Setup_patched.exe	78
PID 4152 wrote to memory of 3972	4152	cmd.exe	80
PID 4152 wrote to memory of 3972	4152	cmd.exe	80
PID 4152 wrote to memory of 3972	4152	cmd.exe	80
PID 4152 wrote to memory of 1008	4152	cmd.exe	81
PID 4152 wrote to memory of 1008	4152	cmd.exe	81
PID 4152 wrote to memory of 1008	4152	cmd.exe	81
PID 4152 wrote to memory of 1448	4152	cmd.exe	83
PID 4152 wrote to memory of 1448	4152	cmd.exe	83
PID 4152 wrote to memory of 1448	4152	cmd.exe	83
PID 4152 wrote to memory of 2376	4152	cmd.exe	84
PID 4152 wrote to memory of 2376	4152	cmd.exe	84
PID 4152 wrote to memory of 2376	4152	cmd.exe	84
PID 4152 wrote to memory of 4776	4152	cmd.exe	85
PID 4152 wrote to memory of 4776	4152	cmd.exe	85
PID 4152 wrote to memory of 4776	4152	cmd.exe	85
PID 4152 wrote to memory of 4228	4152	cmd.exe	86
PID 4152 wrote to memory of 4228	4152	cmd.exe	86
PID 4152 wrote to memory of 4228	4152	cmd.exe	86
PID 4152 wrote to memory of 2740	4152	cmd.exe	87
PID 4152 wrote to memory of 2740	4152	cmd.exe	87
PID 4152 wrote to memory of 2740	4152	cmd.exe	87
PID 4152 wrote to memory of 2432	4152	cmd.exe	88
PID 4152 wrote to memory of 2432	4152	cmd.exe	88
PID 4152 wrote to memory of 2432	4152	cmd.exe	88
PID 4152 wrote to memory of 3268	4152	cmd.exe	89
PID 4152 wrote to memory of 3268	4152	cmd.exe	89
PID 4152 wrote to memory of 3268	4152	cmd.exe	89
PID 4152 wrote to memory of 4452	4152	cmd.exe	90
PID 4152 wrote to memory of 4452	4152	cmd.exe	90
PID 4152 wrote to memory of 4452	4152	cmd.exe	90
PID 4152 wrote to memory of 2064	4152	cmd.exe	91
PID 4152 wrote to memory of 2064	4152	cmd.exe	91
PID 4152 wrote to memory of 2064	4152	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\v.en.Setup_patched.exe
"C:\Users\Admin\AppData\Local\Temp\v.en.Setup_patched.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Physical.csv Physical.csv.bat & Physical.csv.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3972
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1008
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- - C:\Windows\SysWOW64\findstr.exe
    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2376
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 107124
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4776
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Rocks.csv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4228
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Defined" Twin
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 107124\Presidential.com + Weighted + Booking + Gloves + Potential + Stuart + Monica + Her + Twelve + Aberdeen + Fastest + Single + Judicial 107124\Presidential.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2432
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Excerpt.csv + ..\Nyc.csv + ..\Negotiation.csv + ..\Satin.csv + ..\Mounting.csv + ..\Cable.csv + ..\Crafts.csv g
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3268
- - C:\Users\Admin\AppData\Local\Temp\107124\Presidential.com
    Presidential.com g
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4452
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Presidential.com

Path C:\Users\Admin\AppData\Local\Temp\107124\Presidential.com
Size 151B
SHA256 d23e36954c320c07b80a80fa3e7d8234b59eb2ffac883b87975c110c436767de
MD5 a1e7750fb7eb84fd03d9fed29311b9eb
SHA1 af4dd5b55c8ca6dc3e7f58a9832bfacce08d97fa
SHA512 1e83bd77c168a6076f974159e7dbe2ae5b43c54950c2bd6e9ce08443730db6844e5101ec6e6ca0eeb90b6bd746d9a598b25928d30b7a6c112b8c06d86932dddf
MD5 SHA1 SHA512

Submit Download

Presidential.com

Path C:\Users\Admin\AppData\Local\Temp\107124\Presidential.com
Size 925KB
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
SSDEEP 24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\107124\g
Size 527KB
SHA256 d2ab94af92106243925725ba52d910ccfbbf8d03ecea52ebaecc42cb87c4b799
MD5 581e8d349930877160c9b1b58e9fa91e
SHA1 c340a0d5e84b3cad13d67da8ec6a4f538bb1e952
SHA512 87dd2c6951c4e14e78e62eeaf660abc77870353b2ef6bba13c281c6dd01d18ae470577858e03b69e732ff1fdf3db3c967eee97b3b13642ade2e82f23b6eae7e1
SSDEEP 12288:mvXpr1QLupbOgxSxHn6Qktu+No7XAVP6WmA2I/oWM7kEEQG7Qk:yZ6NHntkM+o4qI/ogJx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aberdeen

Path C:\Users\Admin\AppData\Local\Temp\Aberdeen
Size 50KB
SHA256 92fb21b2f3dc51afb89b5503b2819842e81aea4a43e89d82034eb3b742b829ec
MD5 acfd92f0b35231a61db0edea1cc96745
SHA1 324a457d864d77f537095f10df9d0eff56b43b27
SHA512 a29d7605734800713a51472aadfe8fe0dd606cd5713b9cd77cadb73d877835e209fb01c8b2c3afe7006c81b44f5a63d66606ecaa35554ab66a1ab949a8b06276
SSDEEP 1536:PsWccd0vtmgMbFuz08QuklMBNIimuzaAwuy:jeAg0Fuz08XvBNbjaAty
MD5 SHA1 SHA512 SSDEEP

Submit Download

Booking

Path C:\Users\Admin\AppData\Local\Temp\Booking
Size 118KB
SHA256 6f6ab1b1124558dd190c8ac60fdf826376f2c42651d71f4f1c578a5a9c05196e
MD5 b2cc737541578eb098f93e41aab61c5c
SHA1 28b061489b1e622992137d4c1f3957383923e307
SHA512 446f3a58a6cffb02e31fc160dfe1dd01a8439b8f109fc04c4cd2e2ef0112752f8d11e806f32c752fabfb506ab669d428c620737d429048bef52e5f603840f883
SSDEEP 3072:UcBiqXvpgF4qv+32eOyKODOSpQSAU4CE0Imbe:UcB3gBmmLsiS+SAhClbe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cable.csv

Path C:\Users\Admin\AppData\Local\Temp\Cable.csv
Size 89KB
SHA256 fb32abcffc8ac739c337362cbbc35add6a1e875d5980a1991abc6406a74b8ba0
MD5 7e6f11ac505377ee9a5e07115a08abad
SHA1 8b1a733222a9427538e7d5e30212a71a161075a7
SHA512 c4742966f90463aff15e2f2bbcd96b43019b1145fe49d0be95b182b9305af44c9566ffbf71eff60af8624b91809fb7be45b316a5c8f909d692df51db70b0f336
SSDEEP 1536:tXV4hHWVyNW1u7SDkkWdSIQNotIHX4XiHJHUlKmrz6kOnBXcuEJ+:tXAHWVQWM7kklWNotIHIiHJ0lLGkOn5x
MD5 SHA1 SHA512 SSDEEP

Submit Download

Crafts.csv

Path C:\Users\Admin\AppData\Local\Temp\Crafts.csv
Size 11KB
SHA256 19067f440305988a542412c54b951c4c62d14ee2a8e40d815c522c0389286b03
MD5 85a26395d7a923eac0d1636309ba2090
SHA1 ae38fcd4904434f37c8029b5ca5af93e3e325d3f
SHA512 ea74ef2bd27e8edf616bffee583c24bdcb8679c80fc4b4b4aa2f69627844fd577a040c1584c2bb001dd90f579543543732baa66e820782d3e40110e7a86576c7
SSDEEP 192:RSxf7OKcAxsNvYNUVEs9ASvpb1cleRJ/GFN4a9nniXNxCqMukNCvWozpk4p:RSxyNAaR9RvJ1jav9nniXNxLhjj9dp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Excerpt.csv

Path C:\Users\Admin\AppData\Local\Temp\Excerpt.csv
Size 87KB
SHA256 3feed230c063f307d48e85a633c16844cdf63feba1bae59d78218b987e12a2f5
MD5 92a833bacac04e7d96d03f875cfab5da
SHA1 128314ca6b76a7b59b6b3b154d0afff7fa949de8
SHA512 d1b80ff74df8be65dab49996679b278171069838350a75432a0f9ea86e5fcbdbb6d9c86c550774c59c8bebe665784598c5e0d5e34d28759a4500353dfd32b056
SSDEEP 1536:08vauX7OhNdHpSmNk8gm2yX+2vLIbLjjZ1IV5WyMz6OwMExjv5:DauX7sXpSmNk8VDFvLIbLIV8yMz6zt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fastest

Path C:\Users\Admin\AppData\Local\Temp\Fastest
Size 139KB
SHA256 483938e0c7210ddf3ee63ca065e6de0f357e8e12040868cfb3ed6ec38e669b07
MD5 42b9169221560bbdcfcced7e9ed76747
SHA1 5631e45747017e8903a89d8d5c9e6c9d73406c7f
SHA512 d834547d1ee4dd75145ee83f700259ae8f51d5fa5d2ed0e419b73f265d87c8ac37d8265555bb3c33b770adcc8ef0c63263b05673882880a0b40985e63bcc9016
SSDEEP 768:+c/mex/SGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWel3EYr8L:dPdKaj6iTcPAsAhxjgarB/5el3EYre
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gloves

Path C:\Users\Admin\AppData\Local\Temp\Gloves
Size 53KB
SHA256 035428cd4c096a8a62049c427c36e705e9240efc1ff609dfa6e8f6ff50aa1bd3
MD5 eeb685125d0825fe1c7f6d4d070cf326
SHA1 5340c44f5b2134b134ab60db8cc43e6b4ae071f7
SHA512 d18748e431021809596738a4695dafa5040e9c9e032a2a33a1fe08190c1f2d3d49ac03d21cb06389027f4ae2ca9ddb6d614cbffd8ee9d76643542bf0300830c1
SSDEEP 1536:Z8yDGVFE5gOHu1CwCMIBZwneAJu7QnswIPumV3BxZxu6/sPYcSyRXE:Z80PtCZEMnVIPPBxT/sZi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Her

Path C:\Users\Admin\AppData\Local\Temp\Her
Size 64KB
SHA256 0081883ebe276d9527e87c4c7ef9702eade9afc13040b3ccfb9ebce56b74590d
MD5 356bacf9f8b5b9112725765a2b28f1c2
SHA1 6a33eb3be2f539663d2182078531ccd8a6f6e14e
SHA512 9bf7d8bffe36e0e1239a9a8a3d00f1e297c50c62dc563c7e8ab48bd2194b5b6ee67649e10412557e9cef740fe39a615a58b59ff0c4d3fb257f113b5ca134baaf
SSDEEP 1536:zB6GMKY99z+ajU1Rjv18fRQLTh/5fhjLueoMmOrrHL/uDoiouK+rd:zBypIbv18mLthfhnueoMmOqDoioOd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Judicial

Path C:\Users\Admin\AppData\Local\Temp\Judicial
Size 11KB
SHA256 163f0859e7b7d45612e1971224684bb5f4cf85b266b81624fbdf8141f508c727
MD5 65b4b2ddf5ecd0460c3161c9d7a8f8d9
SHA1 146df6e30069368aa07481ce939e91fe61c6b404
SHA512 e5f5d7e5cf1721181fea44e23b55bb562290748844386588f0eb0830fa573f947e8f13fe0e2cc420e2081d4fd1642119b641bf2b1b0ca9026235a050f8502c46
SSDEEP 192:enyqsxvhLuBgfMvSVZPkZeCeAH6N8VEVFJ84kcGNq4/C+Q3ISVSWMZMQ3rw:eZGhLdXVaeCVrVEVFJ8ZcGwGBk7/UMQs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Monica

Path C:\Users\Admin\AppData\Local\Temp\Monica
Size 74KB
SHA256 01e2bad1b8e18260e02fab74bff14d1de7bec5fc985e9f1e29f5527951dc1f2e
MD5 3f8af1e2d7536074d5fe7e3a95ae559f
SHA1 d1ed1741405568b82d4c4c955680289519351acc
SHA512 ad1b41a27d37e1cbfe845a5b315caf58af4a10455c2dba8330ee9b2c676b1625a11893815f167c8e78d7b7510410fada819b214035f10dcafc8cbcb2ed5b6e6b
SSDEEP 1536:VHRu+OoQjz7nts/M26N7oKzYkBvRmLORuCYm9PrpmESvn+pqFqayD:FVOoQ7t8T6pUkBJR8CThpmESv+AqVD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mounting.csv

Path C:\Users\Admin\AppData\Local\Temp\Mounting.csv
Size 82KB
SHA256 9461e3af6b0ece19b01780edc449aad7a7dabccb2e83463efcd89e621333bb21
MD5 47cbb5c5a6110fd19effd64ede03ef29
SHA1 6aec779953eabc5c19fd9603f473feac9e2156ee
SHA512 4fc361c530940d789f3eef4cee7cef77ce1f77f2ba3f1eebe5183e393937b2ec266e5f002b0a8826741aec59fa4bb2367d4cdf1a3d475e0c89ab3fcd5acca5dd
SSDEEP 1536:7cF2+JJgsAhGHvZdQasNZL3hwj1+d2ZXYzNGIC5V2lmcOCFfDSiGg:QloYZWbw5+d2ZXKjlvOS2y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Negotiation.csv

Path C:\Users\Admin\AppData\Local\Temp\Negotiation.csv
Size 97KB
SHA256 a1c98fae61a5f7f594dbd25f58b220c050cbd0552167b0c18f094f5894706e40
MD5 6459321dc189647814a670b5d0838955
SHA1 e89dd0536e96a14eeab2f9759064cb0fb7deb21c
SHA512 baf51221edb19865a33efa8e5bacdf30a20841f537701434afdcf84c2c56daf2b4433d9364a29f8b0c0c124cacf739e7e463dc1e9fa359a3410c7f964122303b
SSDEEP 3072:GkuVwffs5gF94mCj/pm2wGW8wX+gS4slU:GktHs5fmWgR8w4lU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nyc.csv

Path C:\Users\Admin\AppData\Local\Temp\Nyc.csv
Size 93KB
SHA256 33b4bbf93c261e806e95d0d555d89323efbd937b9513212b4ba22ab30fe99dfb
MD5 5b80b08f6b82d6d60d6adab4659234db
SHA1 8c316fb3b9753e209e8992197f082b6450f28179
SHA512 83467d6a32308c310d8da63302e42f76cb10151c11e188936e818f58b957bf8ca9682a0901edec2e9f9596e96559f65d830139f2e57f6049049e87f0a4d5fe38
SSDEEP 1536:gyKh07uNOefezVwg9TRctKF0gVkJyGjB/kgpzp3Gc5n9VOQrwE+S+I2JEnRc:jKei4OgiXKFSwU/BhjV9z+1IZna
MD5 SHA1 SHA512 SSDEEP

Submit Download

Physical.csv

Path C:\Users\Admin\AppData\Local\Temp\Physical.csv
Size 22KB
SHA256 9742d66708f4715aef0b7f6d934948105eef10ec146f1db08f5265601f81a0ad
MD5 1aa33891402bdb072ce4bc86603fab5e
SHA1 a1bf2129aa53efa5e9d17690b3a076f0a0ad9a00
SHA512 71ca12297db474c7a9bbac6bda3d2716d5b20395b2f2c261c3505c118f30891fbd7f5db43317af036db2fc8db041176ec3bfcb81cf2b69b049a0b6df922936d0
SSDEEP 384:Hrdvng7QTGHjaLrruzIK9STqCwcFqC5C2RyACTAN79IoXasSmFf1Yhw9I7nVeddg:HpvI4GHj+VKkT1L5C2RlV9IoXasSmFfO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Potential

Path C:\Users\Admin\AppData\Local\Temp\Potential
Size 55KB
SHA256 73d9efb621356a3588794cce0d48ea094c8d0b5023d7d3367ad546d069debdde
MD5 9f29ceac2d168e27d2a6dcc8c0541990
SHA1 151d01432f3d9f125886036b95d52a5bed1aa1d5
SHA512 703b51d8ebb28adc056d4cb78c5b6668077096ae248976e84418fd84d4fd3b9adf9bf20f44199020209baa98ab1373f67ef0c1f8e8b8d5d7bbbafbac6bda5cbc
SSDEEP 1536:l2W8/uC6LdTmHwANUQlHS3cctlxWboHdMJ3RW:lVdTmRxlHS3NxrHSBw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Rocks.csv

Path C:\Users\Admin\AppData\Local\Temp\Rocks.csv
Size 478KB
SHA256 88ff465e1f73909b6d0ed7b3aaeb6c1ed95db2bab6ad3fd3c284c6bb2760ce3d
MD5 fcf84df212ac011e13d4b8319ed54c4e
SHA1 576ef173cd96d0668646956f382a179db90cd6b0
SHA512 e585221624bfebf4fb689aef146074d63fe212282a63aa3caae56e40c0f5d56697e849c3df6c77d2aadef32587f43ec04b21adf5a176e9ea2cb464fe4f86fa93
SSDEEP 12288:0pgqxmcLdcsYV5yIS5+SwpexEpicWkA/LiHgPPwAfILo9:EtBdcsYVkjwDXWkIeCPALo9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Satin.csv

Path C:\Users\Admin\AppData\Local\Temp\Satin.csv
Size 68KB
SHA256 38a2ec3ac2f11f64921593c50354d619e4d998432b7233c1696fc04910c71a18
MD5 6284972bd9f17bae5a094adc7f8f2fa6
SHA1 a3992dfb25d8c38b499e3c2badb9b53cb36e40b1
SHA512 bcd057af774074f424ff267c3dd92143ea540394c1b20c410b88a77901698564a9f5ebfad8016b885844d67682754065c981e1464abef142d6a3eb54da13925a
SSDEEP 1536:vtwa2zxbBQ643MOShvUgyCWvB6DdH8vz6qAiFRu41wo:1bsbS3Yv7yC20cvz6q1wo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Single

Path C:\Users\Admin\AppData\Local\Temp\Single
Size 69KB
SHA256 39ca3e1cfc4cdcaa45920f51948d247a9e4b4456072f4d206d3d8ef06538b166
MD5 9ca123b74935c80e5b9527a4a41e1cb9
SHA1 e3b1dea564fe27c861a648ad0fff04c13e8aba45
SHA512 e563429879df06365fa2e2744f4a49def0d9a6e9ff2cb02278e1db9e5c7c784848e71bd1fb4004672304a3aea1c85279a524133236b0f0c5897c3fd958d80dc8
SSDEEP 1536:sWyu0uZo2+9BGmdATGODv7xvTphAiPChV:sWy4ZNoGmROL7F1G7hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Stuart

Path C:\Users\Admin\AppData\Local\Temp\Stuart
Size 65KB
SHA256 231f665ef9a325232c7327e53ae9fce4817a721b9888d582d6720fdb3354e2da
MD5 4b4f9824a323faad30734c5b7874871b
SHA1 9ffca87bf435e4657888f6ac7e2466652af5b0d4
SHA512 884a47b86c92450ae8b9105ee63ff531fa897d1d129b9b8b58fbfa433141a8370224118d9e7a5fbba69d4a26d16a42fa3cb73b46db816187373877fa6554d24d
SSDEEP 1536:oaSXL21rKoUn9r5C03Eq30BcrTrhCX4aVmoJiKwtk2ukC7:otNPnj0nEoXnmowS2u57
MD5 SHA1 SHA512 SSDEEP

Submit Download

Twelve

Path C:\Users\Admin\AppData\Local\Temp\Twelve
Size 81KB
SHA256 03852433392c00dff9fb79f0cb9f06da925b3ffb452608dbaf29969e16a5a25a
MD5 4e036a2fa916d85894d18359d11852e7
SHA1 a0ba5510cb7c0fbcedbdc225249804d16937a49c
SHA512 8988db8ee7a354470c65435242adb4c1b5de9a66daf83b0449a863c16dab8ab56ed04e5a0e51052a0a9bdf13eeaebda3c6e37e0a95f5ceefd372732d42438625
SSDEEP 1536:PbLmbZzW9FfTubb1/Dde6YF640L6wy4Za9IN3YRYfv2j62SfuVGHj1vtK7h6R8af:PbLezW9FfTut/Dde6u640ewy4Za9coRu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Twin

Path C:\Users\Admin\AppData\Local\Temp\Twin
Size 158B
SHA256 de468fac0eef47a9776274e89f99de0e8662bb4ee4404151e50d77482344e590
MD5 9fff51a4b0ccf2700883c9d90bb442c0
SHA1 1bca3c991a5ddff37cff00394967f58a1bda0105
SHA512 8cfc7511291698254fb17d2593ec4e1037992d8756b18fcafd8c4fbf3a831c005a466f45e7bfa018f4a632f065230bc0b0e7ae504cdefd1bd9f5164c7e2e05a0
MD5 SHA1 SHA512

Submit Download

Weighted

Path C:\Users\Admin\AppData\Local\Temp\Weighted
Size 145KB
SHA256 3a1086af500bb059378a8dc855769db11c2b288e782eabc4efe8879096c72be8
MD5 1e16c57e112113a85cdca266f8fabff5
SHA1 b90f4b77c0bafa46e903c20556ddfd6ce876248c
SHA512 10536921b42574ac2f5460b43efbd8f69302c84b958cbc981b69ac5901490a6fb96a070ee38f3be9948507e1549abfc0f2c3185b7a4ba1aa08b232b49e9a023b
SSDEEP 3072:2Zg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWf05mjv:2K5vPeDkjGgQaE/loUDtf0av
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4452-572-0x00000000046B0000-0x0000000004712000-memory.dmp

Download

memory/4452-573-0x00000000046B0000-0x0000000004712000-memory.dmp

Download

memory/4452-574-0x00000000046B0000-0x0000000004712000-memory.dmp

Download

memory/4452-575-0x00000000046B0000-0x0000000004712000-memory.dmp

Download

memory/4452-576-0x00000000046B0000-0x0000000004712000-memory.dmp

Download