lumma | 6d2c14b76193cfe77c0c7047449dfa1668e7ba5784f17a8964fc80a73fcbb8a2

Analysis

max time kernel
101s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
04/07/2025, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Latesten-v.winx--Setup.exe
Size 1.1MB
Sample250704-xmervsdk61
SHA256 6d2c14b76193cfe77c0c7047449dfa1668e7ba5784f17a8964fc80a73fcbb8a2
MD5 2a897f05f2217690266588fb4214c819
SHA1 2c2a240a6b211e14f909bcd472fe83fc23931862
SHA512 813910bbf3c1f5e71951fb1df44cca7bc117083770e2b90c2001d9069f4ce3d87fad90b99695612d5510bd03254f2c7da95939968bba411ef8a26f43d0d40042
SSDEEP 24576:A0aNw7SGM9f7gx1zK/KAmoS2H6sGyE8T9SuUtJP99h+hBd3Ezu2FFl:AXGM9cx8r9lEGouuPvh+tol
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma defense_evasion discovery spyware stealer trojan

Malware Config

Extracted

Family

lumma

https://t.me/sadwq223123asdsad
https://giyewf.shop/gbtw
https://ycvduc.xyz/trie
https://nbcsfar.xyz/tpxz
https://cbakk.xyz/ajng
https://trsuv.xyz/gait
https://sqgzl.xyz/taoa
https://cexpxg.xyz/airq
https://urarfx.xyz/twox
https://liaxn.xyz/nbzh

Attributes

build_id
ff5ce2f397f8a727e97c26f03b0cf868aa5ce2a464

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Deletes itself 1 IoCs

pid	Process
1604	Chapters.com

Executes dropped EXE 1 IoCs

pid	Process
1604	Chapters.com

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4624	tasklist.exe
5496	tasklist.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\NbaWedding	Latesten-v.winx--Setup.exe
File opened for modification	C:\Windows\ProfileNon	Latesten-v.winx--Setup.exe
File opened for modification	C:\Windows\CupsRat	Latesten-v.winx--Setup.exe
File opened for modification	C:\Windows\ExpansysConf	Latesten-v.winx--Setup.exe
File opened for modification	C:\Windows\RevealedHandling	Latesten-v.winx--Setup.exe
File opened for modification	C:\Windows\FluidTribal	Latesten-v.winx--Setup.exe
File opened for modification	C:\Windows\ArthurFm	Latesten-v.winx--Setup.exe
File opened for modification	C:\Windows\NeonPresidential	Latesten-v.winx--Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chapters.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Latesten-v.winx--Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	Chapters.com
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	Chapters.com

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	tasklist.exe
Token: SeDebugPrivilege	5496	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1604	Chapters.com
1604	Chapters.com
1604	Chapters.com

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3348	1852	Latesten-v.winx--Setup.exe	78
PID 1852 wrote to memory of 3348	1852	Latesten-v.winx--Setup.exe	78
PID 1852 wrote to memory of 3348	1852	Latesten-v.winx--Setup.exe	78
PID 3348 wrote to memory of 4624	3348	cmd.exe	80
PID 3348 wrote to memory of 4624	3348	cmd.exe	80
PID 3348 wrote to memory of 4624	3348	cmd.exe	80
PID 3348 wrote to memory of 1104	3348	cmd.exe	81
PID 3348 wrote to memory of 1104	3348	cmd.exe	81
PID 3348 wrote to memory of 1104	3348	cmd.exe	81
PID 3348 wrote to memory of 5496	3348	cmd.exe	83
PID 3348 wrote to memory of 5496	3348	cmd.exe	83
PID 3348 wrote to memory of 5496	3348	cmd.exe	83
PID 3348 wrote to memory of 5344	3348	cmd.exe	84
PID 3348 wrote to memory of 5344	3348	cmd.exe	84
PID 3348 wrote to memory of 5344	3348	cmd.exe	84
PID 3348 wrote to memory of 5376	3348	cmd.exe	85
PID 3348 wrote to memory of 5376	3348	cmd.exe	85
PID 3348 wrote to memory of 5376	3348	cmd.exe	85
PID 3348 wrote to memory of 4644	3348	cmd.exe	86
PID 3348 wrote to memory of 4644	3348	cmd.exe	86
PID 3348 wrote to memory of 4644	3348	cmd.exe	86
PID 3348 wrote to memory of 1604	3348	cmd.exe	87
PID 3348 wrote to memory of 1604	3348	cmd.exe	87
PID 3348 wrote to memory of 1604	3348	cmd.exe	87
PID 3348 wrote to memory of 3100	3348	cmd.exe	88
PID 3348 wrote to memory of 3100	3348	cmd.exe	88
PID 3348 wrote to memory of 3100	3348	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\Latesten-v.winx--Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Latesten-v.winx--Setup.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c copy Bucks.ppt Bucks.ppt.bat & Bucks.ppt.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1104
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5496
- - C:\Windows\SysWOW64\findstr.exe
    findstr "nsWscSvc ekrn bdservicehost SophosHealth AvastUI AVGUI & if not errorlevel 1 Set baJBFjnQVTLCEgUreSUQpQkhV=AutoIt3.exe & Set aWxqKhuwhcrdkgUmLLAvnoYMMbZqM=.a3x & Set EDAAbyCHoQdgoFJDgTTeSKozs=300
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5344
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y Resistance.ppt *.*
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5376
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Freedom" Alto
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4644
- - C:\Users\Admin\AppData\Local\Temp\50795\Chapters.com
    Chapters.com D
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1604
- - C:\Windows\SysWOW64\choice.exe
    choice /d n /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Chapters.com

Path C:\Users\Admin\AppData\Local\Temp\50795\Chapters.com
Size 925KB
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
SSDEEP 24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\50795\D
Size 480KB
SHA256 339b53c792a924537707c8d31dfee994f716a29f62133c258fa954981614aba1
MD5 4d50b3412db82d5129d991b281fcc596
SHA1 675bee89d22beb2b6e1d2aa121512f8bb0e1b3f8
SHA512 2de7bef6ef4ee64bf22bff945cfc693df78d27d606df1860a944773a9aa39b73066dd9a23d67d4e957000cc51daccd8b78e6c32ee1aeb6e9473ce9b3c952abe0
SSDEEP 12288:akw+mgLk+8O4AFH+C5doIwlqGKCrhXGCyCmRp8Myv:akwuXb4g+CboT4DCrZt7shY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Accomplished

Path C:\Users\Admin\AppData\Local\Temp\Accomplished
Size 85KB
SHA256 97c1d9b0131d88ce2987025c88fed03bdaab4336bf2e702aa5b6a40150c3f679
MD5 652e3e72b2a6627431c06bc17c1b98b5
SHA1 30bb14fb7c218668dbf525bca993eee7be343257
SHA512 a2133958aff63a35787f011f5df456711421e8ad7b3ea1eadc50884f9b4682e5e0fa5fe2e7300da02fa1e57df0d6fa5c9af9dc23bf5368b0895167ecaee3f94b
SSDEEP 1536:ZJu7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6LdTmHwANUQlHS3cctlxWboHdMJ3l:ZEMnVIPPBxT/sZydTmRxlHS3NxrHSBRf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ages.ppt

Path C:\Users\Admin\AppData\Local\Temp\Ages.ppt
Size 39KB
SHA256 085674a0085d57fb888804bcbe06b1701da5e92cd11082a86267a8b4b2d73423
MD5 8b5805a0d2cdbaa93483dc6888997432
SHA1 f4aacab3216d934eef368557be2ded6401b04c0f
SHA512 8389cdfe09c10e79e927072dc9a6426e5d964afc04a3c6ff2dbe4257059b69d4a6be6a98579478969e3acf82773d6747b8b933aa4e12a476e6a155c614956e0b
SSDEEP 768:7UKIpXEZlT5z7NjwLAV01RRZY19hL+5/2Lfd/NQHHPtITY4KJS4W:4pwTFVGyMOgmTYlJS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Alto

Path C:\Users\Admin\AppData\Local\Temp\Alto
Size 1KB
SHA256 ab7056de9609c998cf24fb89094a66544505a85c56d8a64bc7a67fd81f2904fb
MD5 4eea3375b80689ca3410bdcb9e554712
SHA1 fe9b57293428628776a5f3c986212aac68db66cb
SHA512 6f2b9a563d4925f5b8a128ebd683e6b535f083df8d6e10f0bc77d981d636004dd4effd1d718a6d500ab64f615739da208877bfe550723c3c8b42cb2668cb875b
MD5 SHA1 SHA512

Submit Download

Bad.ppt

Path C:\Users\Admin\AppData\Local\Temp\Bad.ppt
Size 84KB
SHA256 146230651a8af2d571bcc7bf24b5abdd4c5bd36c87999a459ad85f1c5622432b
MD5 384b2a44d7ed2506175f7a8aee30681a
SHA1 8bef10b530122d2b0ab7127a1f29a5c95b867d3f
SHA512 65746bfe50792667ac27665faf4c338bf9522bd2c9cab794f0c8ff425e530076211815120ac767548f3992bc98f8d230db914c8f75ed0569b82d8a5947b97b04
SSDEEP 1536:Bgr4N/1iFYKiewSzXGyRSoaffIHay9MA/IQGTaYfbAVX2hRCn+BAmyPQ:Sr4x1iFYKbb7GyRKgH7ai8oX2hR73yPQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Beaver

Path C:\Users\Admin\AppData\Local\Temp\Beaver
Size 148KB
SHA256 0ae168273aaf36b39fff1be347f440fc915b1ce101d70abd5bd4b925cd4a1f90
MD5 41eefc3707268cf6c5a332684cb439fe
SHA1 3dba4f5e5aae811415aeec68f118d992283fcf6b
SHA512 c44539ed75c5aef80adcc9df06f5416939c1e7e5caf8e3ff0fffc081c744ea78798f575405f70d3e3ef2517842d4e29b70358dcda805aa3a12b598fb19a4ddc0
SSDEEP 1536:oKaj6iTcPAsAhxjgarB/5el3EYrDWyu0uZo2+9BGmdATGODv7xu:u6whxjgarB/5elDWy4ZNoGmROL7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bucks.ppt

Path C:\Users\Admin\AppData\Local\Temp\Bucks.ppt
Size 27KB
SHA256 941c214a10f3bccd6dbe7a4e90de7dfc7e46c42be8ef55a0600292a15428876a
MD5 43439e3e7dd1e89cd86207dd59b32228
SHA1 2f384788585932d782d1663cc6a587bd5cd93317
SHA512 5e1cb426c79e7c75302ec35e0b4b0e412a07303233b936261d93edfe0d5d49e4035f903e8a19fc53ac54d81154b9436f46da0851c81e79c07a75a1b2562cd1b8
SSDEEP 768:sLKU4FgXN4ExNnzBwVPfCrXHOtCsz0AEz:GQwbVwNqrXiQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Comfortable

Path C:\Users\Admin\AppData\Local\Temp\Comfortable
Size 92KB
SHA256 01f09807a3dfc6bc369149bed075f854ac235d188a130c8a5ebd88bf3e7f3686
MD5 11645e99f4c284df6d7afd0fe64ba43b
SHA1 49dd39b4425b7643d7ece2df972f3a72f98adc6d
SHA512 ed7a676113f1b470efeb362c68be836d77b4dbd9555087678b0815e0cfd43d884bd008da2921a613ead4a72d245694acc179bfd3b335ba39500605ada89571a7
SSDEEP 1536:uv18fRQLTh/5fhjLueoMmOrrHL/uDoiouK+r5bLmbZzW9FfTubb1/Dde6YF640LK:uv18mLthfhnueoMmOqDoioO5bLezW9Fd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Demonstration

Path C:\Users\Admin\AppData\Local\Temp\Demonstration
Size 117KB
SHA256 7ed3ffb64c3df2339bdf59c2e90078212dc79d72bbf098d304033371f0cb9508
MD5 d90408e80ef19b27f99ffaa30e125f7a
SHA1 3c4d1371ddff4b33792675c6bc9c67a129bc9037
SHA512 d7872b567044f970cc34367a170a114a683a40fcef462fd7f20de6ca2454803d36537acdbba2dee226eda9ca35a472a0563f2e69cacfd869083fdce36b52268e
SSDEEP 3072:O5mjccBiqXvpgF4qv+32eOyKODOSpQSAU4Cz:OaccB3gBmmLsiS+SAhCz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Desirable.ppt

Path C:\Users\Admin\AppData\Local\Temp\Desirable.ppt
Size 73KB
SHA256 dd2bfad6d773547e78be51ed5f104df27dd469fbd65f80155a1db8eda4c740df
MD5 923bf20a51d7ca0b1a005873a2831ba6
SHA1 788be0abbf388c65a6e2cca02fe117c244f72c0f
SHA512 083d70ff3447c1b8bbb14e96bf4bf4cc0d63a094ba59dca99039a0818d210137084e13e9e6c7fd25f94468956cf6b8db0736f749a6e4d810d153522e9b078718
SSDEEP 1536:O/suLGQl71Ck9h2ddMz7ckH/BlEzCoioWdYLln/rh0gW:+suLGo/h2vMzrH/7eCoc40gW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Diego

Path C:\Users\Admin\AppData\Local\Temp\Diego
Size 52KB
SHA256 08143592766cd5ff3e617c4747a40295679428f64a1304932574d22b58c0f787
MD5 03aabeb95963675bbe04a53b157aa7be
SHA1 947e36121cca27ecb74fb0d0d24850e9f8c5ee72
SHA512 cf48725cbe63a5f88305f81bcd710c0aeac955beb4441943ae105939f37dd9f7d328c3a6d43abf5d20346d8c2135a7285ea8df797e62b35a92d2c71294d5cde8
SSDEEP 1536:E8q0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwneI:w0Imbi80PtCn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fact

Path C:\Users\Admin\AppData\Local\Temp\Fact
Size 147KB
SHA256 633a71fa627cde562d69a668f1a411d18a2875f4c2d7926aacc31199204f42a1
MD5 98c0143fd87bc94695f568368bb4f248
SHA1 17b50317dc983fd7fb153461f2537afdbaa78d52
SHA512 73b3360eeb6a37d4c2c6aade27e4f8e43da8bc90f3e34fd0e391b7a263bd34797568fdae37672c24892b18149dcad6ea856dab13fd3d92fab2f6cfd243e6451a
SSDEEP 3072:LPnj0nEoXnmowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIW:LPj0nEo3tb2j6AUkB0CThp6vmVn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ghana.ppt

Path C:\Users\Admin\AppData\Local\Temp\Ghana.ppt
Size 64KB
SHA256 60eadc3277f9db0ae1bd29c570313ad1f7ad49123b5ef88a4d9c84f65b4ead7e
MD5 958c4549bde1b7306155984892a1f963
SHA1 8e98f68be41cc64f522c26f218142bcb0a29dc1d
SHA512 9e653c6ceebf117eabb8496edfac57707399ac84812614e841f4f7c16e683f42eb469f4bc9aeb7de2892b318ef7ed2fa77cd1c9de1e489a4fb85cf459c1f06aa
SSDEEP 1536:7Z+izhL5+QglMAPXrmtw9ojgiocM77QpjBeQLCyqDGQv1B2+OSlT:5zn+8Av3ug4g7GhLfoGOLOSlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Message.ppt

Path C:\Users\Admin\AppData\Local\Temp\Message.ppt
Size 79KB
SHA256 e389f2519234f4a52125369689256fd1ef3860f4239fa3126a5859824b369094
MD5 48c14f3a3c4619586b8c79ce5e41b34b
SHA1 59ef016c015152371fe475ddf784a80bc444719b
SHA512 64a3908f5319f9dc038acab83fc8b4049513a2d10d2630778fd0584d1571acf42d33dde81cb4afd3ced6976cc0089325702584fca58add339269c1435b4b074c
SSDEEP 1536:RiyingzFG3ex+7FF++DIbzvQm5KsMXUDkXzdLt4LatI+ZnZKieza1aR5oleTPUL:R2gzFG3eM7FUbbpMXUq5R4mtI+jIJ5op
MD5 SHA1 SHA512 SSDEEP

Submit Download

Regulations

Path C:\Users\Admin\AppData\Local\Temp\Regulations
Size 24KB
SHA256 4bc46c8b73d8f2b73d73cc4320e1ddc2ea41e3737fa22bee2ef0f549525256f3
MD5 1d395135ca8b921a48bb2416872cecbc
SHA1 3b3f9cf51a367adaa28c6a696be2bfbfa567de20
SHA512 48d2a443b5ef9a07d940eba914e9d4a86a68181d48c8a223230571a675e3ff916b1d6377e08bbb0a7f31678a32cb90ffd766b09154b9b17b2749c255c6a218cd
SSDEEP 768:YLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:YTphAiPChgZ2kOE6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resistance.ppt

Path C:\Users\Admin\AppData\Local\Temp\Resistance.ppt
Size 478KB
SHA256 41b0e3c801002943bfde4c3833d35e9ad66cedc8fdb7a754e8008d7859252ba1
MD5 7e97ce43fd0b39e5cb0afebf5c93211a
SHA1 4656713e9bbf651392c2dd8c341c40a203084f08
SHA512 f6af639c1f77b8a5f48c299caee19b24892caab33920376e75c46e951fdb7adf667c290873c9bee580a0d8a23b52f7619f8e9ad3b32861d648114b70a214bef0
SSDEEP 12288:Mu/Zl8KWvVjJiBoLG8wTfiJLBJlUfeWMLWsVjr4JErDCEPRpUS:3/0vVjJkoLG8yEFHUfm/VYJE/j/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sewing

Path C:\Users\Admin\AppData\Local\Temp\Sewing
Size 132KB
SHA256 5a46529c20ad20ace46273d2e9076214add33861d34e871c293cf0f9817c9adb
MD5 7c6b4eb5397e60bff8af6915dd63838c
SHA1 7035ccf70f945071fa057eb9e3e9e796edf6ec2f
SHA512 323bae509be0dd520b78e880fea0637b01b2933f7059e01d3f66a3344eab1a30f6cb4ef64677a107d6b04a15de6cc9b53709c008fc29c382e1800a3d48030765
SSDEEP 1536:5j62SfuVGHj1vtK7h6R8anHsWccd0vtmgMbFuz08QuklMBNIimuzaAwusPI:5jfTq8QLeAg0Fuz08XvBNbjaAtsPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Swimming.ppt

Path C:\Users\Admin\AppData\Local\Temp\Swimming.ppt
Size 78KB
SHA256 8fa96cfa014172b1f1607d24138e14a71d729f5b822c4ae843aa71e21307cdf6
MD5 e53f3ad596e37bc1ae6ca9ae26295e94
SHA1 2fc1fcb1c81ffb26aba38558ce6ad165af8f9ca6
SHA512 48948e3d282aefcb8d2ca32eca4548706fc2e43b1b32e3b6014e9ae6027ce5ab2e9b3b1671d6e39d04c926a635c312b9ea684ac5b045d202c2ec84f2fbd2433c
SSDEEP 1536:5n+d/+LX9ZmR408RYlivpp5xQBkbX9e3J76N2oTjT+qlJnW2:5n+l+HmRp8RhLjQsc35Y2oTjT7HW2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Talked.ppt

Path C:\Users\Admin\AppData\Local\Temp\Talked.ppt
Size 63KB
SHA256 6a2f63656e19a414d3869b88132d9f33f25fc680a5659f855b2f8dee19a25bfd
MD5 536a5999e7631789b886060127e3434f
SHA1 1c51f00ce8b7ecfc0248abf9a5a5ebff20821011
SHA512 043ff1d92c9bc8c5c4a2936dfd13d1255c321b4293be046ba2e3c2b34fc4510ecd005490ee2d3eeacc784f7332782b44b603d915c6687e08462ffa26766c3b91
SSDEEP 768:FEsmcN7UBeJEg/AgZjeQS/WE3JrdkQHADOibYMZDfV6uBww+l8Xem9SXhOk9Sys9:yPGUIJEgRhRSOE3bwqumPl8OkSHSy1U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Works

Path C:\Users\Admin\AppData\Local\Temp\Works
Size 126KB
SHA256 22cf3af5a0011f81d9f2a766d420fb1240f327f5199287cd746f1639d42414aa
MD5 7f94050c8ccb18d1d792d824b60e1df1
SHA1 9fbcc58823bc214f4dac0fdb0ae3aabd0df12fce
SHA512 a6cdbd6997c4c43479b39a756a21a74dca1ef5d9e209e2a648205f0dd176043aff1ccbc608720301abaa6607aad53639500c0335c6a86c85d18da6cabe2028d2
SSDEEP 3072:EZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWfx:EK5vPeDkjGgQaE/loUDtfx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1604-665-0x0000000003ED0000-0x0000000003F2E000-memory.dmp

Download

memory/1604-666-0x0000000003ED0000-0x0000000003F2E000-memory.dmp

Download

memory/1604-668-0x0000000003ED0000-0x0000000003F2E000-memory.dmp

Download

memory/1604-667-0x0000000003ED0000-0x0000000003F2E000-memory.dmp

Download

memory/1604-664-0x0000000003ED0000-0x0000000003F2E000-memory.dmp

Download