lumma | cf2cb87ad7efe52b506124b259832d0e074deb3a77cff29a9dce8d4d7521e8b7

Analysis

max time kernel
101s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
04/07/2025, 18:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 1.1MB
Sample250704-xnavasxtgx
SHA256 cf2cb87ad7efe52b506124b259832d0e074deb3a77cff29a9dce8d4d7521e8b7
MD5 9feb3e2d8e0a1c5371348206ea32863c
SHA1 e7f23674c3167b07bba2b3188fa74a366def7834
SHA512 3823a6e4e8cdb983fe1774f933567ea01c4d424c0773ee6a66bc6644569ffca74899c96785a7801a468018fe42ad772f521d4dd3f76b946dcadcd9d4933acd84
SSDEEP 24576:a0aOhu3LZOzTCEbNs0UB+LQcHKMzqvaoXhg443tqasJ:aJ3IzTCEbN/q+L9TWaYhn430J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://flagowe.shop/xpal
https://ycvduc.xyz/trie
https://nbcsfar.xyz/tpxz
https://cbakk.xyz/ajng
https://trsuv.xyz/gait
https://sqgzl.xyz/taoa
https://cexpxg.xyz/airq
https://urarfx.xyz/twox
https://liaxn.xyz/nbzh

Attributes

build_id
0a163df940ad778a4ae2409ca751eb9976728ab6db11

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
5512	Trail.com

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5004	tasklist.exe
4632	tasklist.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\KeyPl	Setup.exe
File opened for modification	C:\Windows\PublishSent	Setup.exe
File opened for modification	C:\Windows\TollBoys	Setup.exe
File opened for modification	C:\Windows\MeasureCoverage	Setup.exe
File opened for modification	C:\Windows\DisPodcast	Setup.exe
File opened for modification	C:\Windows\BeatlesCooper	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trail.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5512	Trail.com
5512	Trail.com
5512	Trail.com
5512	Trail.com
5512	Trail.com
5512	Trail.com
5512	Trail.com
5512	Trail.com
5512	Trail.com
5512	Trail.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	tasklist.exe
Token: SeDebugPrivilege	4632	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5512	Trail.com
5512	Trail.com
5512	Trail.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5512	Trail.com
5512	Trail.com
5512	Trail.com

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 1932	5592	Setup.exe	78
PID 5592 wrote to memory of 1932	5592	Setup.exe	78
PID 5592 wrote to memory of 1932	5592	Setup.exe	78
PID 1932 wrote to memory of 5004	1932	cmd.exe	80
PID 1932 wrote to memory of 5004	1932	cmd.exe	80
PID 1932 wrote to memory of 5004	1932	cmd.exe	80
PID 1932 wrote to memory of 5244	1932	cmd.exe	81
PID 1932 wrote to memory of 5244	1932	cmd.exe	81
PID 1932 wrote to memory of 5244	1932	cmd.exe	81
PID 1932 wrote to memory of 4632	1932	cmd.exe	83
PID 1932 wrote to memory of 4632	1932	cmd.exe	83
PID 1932 wrote to memory of 4632	1932	cmd.exe	83
PID 1932 wrote to memory of 5992	1932	cmd.exe	84
PID 1932 wrote to memory of 5992	1932	cmd.exe	84
PID 1932 wrote to memory of 5992	1932	cmd.exe	84
PID 1932 wrote to memory of 2324	1932	cmd.exe	85
PID 1932 wrote to memory of 2324	1932	cmd.exe	85
PID 1932 wrote to memory of 2324	1932	cmd.exe	85
PID 1932 wrote to memory of 3716	1932	cmd.exe	86
PID 1932 wrote to memory of 3716	1932	cmd.exe	86
PID 1932 wrote to memory of 3716	1932	cmd.exe	86
PID 1932 wrote to memory of 5512	1932	cmd.exe	87
PID 1932 wrote to memory of 5512	1932	cmd.exe	87
PID 1932 wrote to memory of 5512	1932	cmd.exe	87
PID 1932 wrote to memory of 1052	1932	cmd.exe	88
PID 1932 wrote to memory of 1052	1932	cmd.exe	88
PID 1932 wrote to memory of 1052	1932	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c copy Systematic.wmv Systematic.wmv.bat & Systematic.wmv.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5244
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- - C:\Windows\SysWOW64\findstr.exe
    findstr "nsWscSvc ekrn bdservicehost SophosHealth AvastUI AVGUI & if not errorlevel 1 Set LVbgwERLdkrJzYKciUgOdMjmir=AutoIt3.exe & Set IHncGXFtXHZ=.a3x & Set NslOcZEAmkkmokTjYjWQZDmqfegKAbMXlziAZLp=300
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5992
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y Epinions.wmv *.*
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2324
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "mixed" Term
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3716
- - C:\Users\Admin\AppData\Local\Temp\222756\Trail.com
    Trail.com C
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5512
- - C:\Windows\SysWOW64\choice.exe
    choice /d n /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\222756\C
Size 451KB
SHA256 b4342717f95bdfcf57b68b69b4fe593516de2eb64366f0ddc850394107846995
MD5 6a723184f0121610fc8b6c87a0dd28a1
SHA1 22aa3dedf649e1a63f627221a8dab201a87ae491
SHA512 e5aa5b067d21341f45f45ebf80640cde2aa7207a6d1de2cf45fe7c866da2f40dc554689eed4abff88409c618a969dee5c33529af4951bd0a5e4fa883d7b13106
SSDEEP 12288:jLm9EdAkcssE/df1qEtKs0TS/yRwmNnG6TKlWo:WEdGE17Ks0TS/yRRNG8o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Trail.com

Path C:\Users\Admin\AppData\Local\Temp\222756\Trail.com
Size 925KB
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
SSDEEP 24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Adware

Path C:\Users\Admin\AppData\Local\Temp\Adware
Size 104KB
SHA256 0557971ee400e9c77ec2abfd9c14e2ff79dd8ea2ff27ee2a5d01f2a0edd1661f
MD5 39870986621d72f9403bb05dbc4b47f0
SHA1 335fb6a9b99c03c5b2282e9138e8451311123083
SHA512 8f7797ddb5210dc96892ccebfdf23949ff0ce7ebfebc6a32e9c6de77841760b19886b1a1522beb43bb4946fe2ee1ae24355ee9efb90e56110a1fd2bd80ce0b9d
SSDEEP 3072:ade6u640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBNb5:ad314V14ZgP0JaAOz04pP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ampland

Path C:\Users\Admin\AppData\Local\Temp\Ampland
Size 72KB
SHA256 9b0e59b0a8c21205f2e92e64612c46d7f3cdccb5a34796fd35cf308690d56c45
MD5 e2836316377fc5c360cf827922dc54be
SHA1 8fd684cad64d041b07bb6bd51019b409267470a9
SHA512 8c1e234d47da3924860cf9becff9818a50c135980152d9ac2f6ef4aa7acc90802ca96a9f1f0e60d73c7e762beb3f9b4598a0c6539ebb79dfaa45dc12dd89aebf
SSDEEP 1536:q1/AD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdlDfX:qZg5PXPeiR6MKkjGWoUlJUPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Approximately.wmv

Path C:\Users\Admin\AppData\Local\Temp\Approximately.wmv
Size 75KB
SHA256 45c993297505d2ae618b38530831846e82c6aeab83be089fcff631db46d97396
MD5 caaa4f6ac927a62ec92513abb8546213
SHA1 ad26c447a129937409402e7c68f3f72e80a3b94c
SHA512 185e24b5e4956d2ab25d0d7e19342a53d0a3492ccc09a1298f36676a827a24373273765fe7dccd0148524bd1353730f84e1ac93abd4b37c0d5f578b81d9a8474
SSDEEP 1536:oN8RkwetqJI8GrXy2cGKC/jbF56tid/YV1P1KSCcMJ4TS/yRZ:W8ujWArXy2pKs/hBYPtKBJ4TS/yRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Assess

Path C:\Users\Admin\AppData\Local\Temp\Assess
Size 77KB
SHA256 bee34e854ab0a7d18ed3320bda1b0b528db26fbca25086e6f0e1e0162e98ba50
MD5 d4bae8c5c49c42210d71db8441928f3f
SHA1 6a643aea4f9960ff77e1d5cb99cd651fd21eb0b3
SHA512 81db1f89e1c15aec8932b78c18605f8d74f142a45d116616a130603e62803e3e5cfff08205cc69bfca90ee7b6ff8e1696645c3a26aeb84e4e272001be3c70f07
SSDEEP 1536:qMIBZwneAJu7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6LdTmHwANUQlHS3cctlxZ:qtCZEMnVIPPBxT/sZydTmRxlHS3NxrHl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Boom

Path C:\Users\Admin\AppData\Local\Temp\Boom
Size 105KB
SHA256 607977efd8305269cb04208f0970594c142ea0c47ec2391ef22171591146da1e
MD5 f4b8c9c8e1413f32a61b9cc38593dfeb
SHA1 1f8a508f9e30489d69afd3720a39d43c5917dad9
SHA512 8a2c651892fd821f23a6efe9292e460e2ca4a44af3c5dddf3d1706d6327407d51c6e5c7acbc64da37a19f164405cebaa89f3d6110d5bb7a36233e534f9738c6e
SSDEEP 768:mhSaAwuXc/mex/SGKAGWRqA60dTcR4qYnGfAHE9AUsFx+:5aAwusPdKaj6iTcPAsAhx+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Counts.wmv

Path C:\Users\Admin\AppData\Local\Temp\Counts.wmv
Size 67KB
SHA256 ae328c994a2d8f5816a111c1100047fa6fc3c2b4fe75a447191f382ef186a8c6
MD5 ab70a1632256046f01f3748512b43311
SHA1 cc350aacdd54cf74795a926a4cd1c414001ae0a1
SHA512 dfddade99bd0da287c0e7febfb9e0eb7bbf29f8e99e44dbffae7ab898d75c39c2c7e4fc378cd61723a3d11fd86dd27896260da0fd4adaee327214f1b0bff05c8
SSDEEP 1536:UhmVVYjkkDmn7YzZ1i+d+tnI18cLs+U1KNVNcnpDMk:UhmVCjkkDNzRotn6fgOjqL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Diet

Path C:\Users\Admin\AppData\Local\Temp\Diet
Size 116KB
SHA256 338f792605efbbc6e73b4aec70b6345ff619d88476ddaeb2e4fb41c66d3761e8
MD5 b2835e5959662c323086f4d3c288f081
SHA1 f4e98549684ab49f5b4ee979b786c18ed1794d39
SHA512 6050e35f88253b18a8c1e5b787a10bb089c92c2cb932b06f633888ed03b28a16205f295efeaf7c4e010eb02580e34e5c570c7e886ecc3a54c9340846ce1ff46c
SSDEEP 3072:PpmESv+AqVnBypIbv18mLthfhnueoMmOqDoioO5bLezW9FfTut/y:Pp6vmVnjphfhnvO5bLezWWt/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Disable

Path C:\Users\Admin\AppData\Local\Temp\Disable
Size 70KB
SHA256 62c6cad4f514b89315ecf205eefd54b62c5ca86f005d7fb707442156e8b9c173
MD5 5a7f390c8e9e766cf2c5849dc237b763
SHA1 48660c36bdece60f371d2779ef2e065ca212108e
SHA512 087057e1dda1b549ed9b7cafbd6b840dad26b5d67eafb426144c4cce1b22d1ef27da33d4d6a4bd0c8f7e1ec36a7c82ecef76c47df5f41440b74537fe5e043107
SSDEEP 768:5LtVSQsbZgar3R/OWel3EYr8qcDP8WBosd0bHazf0Tye4Ur6:ogarB/5el3EYrDWyu0uZo6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Epinions.wmv

Path C:\Users\Admin\AppData\Local\Temp\Epinions.wmv
Size 477KB
SHA256 a55b1555e714b1babab8f9702bdfc1826e7a5dd641520108b8f9c3e149b9a83b
MD5 3cd4d802b3adbe4c32e0066cd2e87ac5
SHA1 02e17ea5362a4a8dd6a28bb78ca065d95338fff7
SHA512 50b04c7efaede3cf3f92c6545de7921477fe463770b06fc03142847d4d9e13eedcb559a4f075d30da3144d0f2c049d697dc4249d4ffce5d6ff6467804ad7aeb0
SSDEEP 12288:6HeezblnEfiH2YGzN1U06djX1MH5JzzMx7X36uGY5:6HeqhE6WBI06FXaH5925j5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Honest

Path C:\Users\Admin\AppData\Local\Temp\Honest
Size 50KB
SHA256 55680808f0b550403b7c88d2b18900a9db294a0e761109d70780eef07fb032c2
MD5 669a502c6d6ef85c8d4fd333d25ec26e
SHA1 f2241559c9968c5f73aa64a4aec683d8b7e4155d
SHA512 25aa53e6503d4aec04ad616cf7a59b45cbc6affc717ea55b9a2d46d9e04d6b9a06eb0655a24d3c5fdc6f5a71e0a008d23fad66ed6b0c9dd9c8420af4f3a10357
SSDEEP 768:X+9BGmd9OTGQ1Dv7sMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:X+9BGmdATGODv7xvTphAiPChgZ2kOE6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Leaf.wmv

Path C:\Users\Admin\AppData\Local\Temp\Leaf.wmv
Size 67KB
SHA256 079f4865c9a983f7dc5eaf7b3c2d43a2ef62715a63e22cc14bc7d776c5d87140
MD5 651b948f6eb1c8f79346ff9ddef9593e
SHA1 871fc6a5eba4b10d448c39d7791075a23095df1c
SHA512 4fcf6749cfe72351becf8a527f784ae43bc17d9cee8046e9983b6207b9bbe974671fcc8f6bd58b42005bdaa8d8bb93fed29a38aa4dec8da10817c7a0315f0cfa
SSDEEP 1536:CSaG0GBre8QaxDhzFX4HjtySUblJZJIEaDOXfgmXP5WXUsCtaPz:CJqJQunEB9aYIxkCtaPz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Macro.wmv

Path C:\Users\Admin\AppData\Local\Temp\Macro.wmv
Size 88KB
SHA256 a7fdd00d015b85f1889904dba0ee957665d2cc7035bec4316cf2d109a3fd6481
MD5 38c60f4f0faf1e878b6d416554f7add6
SHA1 fc3c8ab31f8fd19ffd9e80b47b2c13346700ac64
SHA512 5ef500b93379b52290ab60f49de6b193c4140fdd034564e0479e3c27d478f52be900a0b92b7713cab80c91c9373e18acca46dc8f59035b9ad5e818ad92bc62c7
SSDEEP 1536:uAO9dCaPe3fs74/jzsIl3PadfNpv5fyp2Kq2ibF1BDWYAFY4tQraSkFED9ClR:uAVaPePs7oE/dfjB6rq2ibF3CpFY4Cr2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mountains.wmv

Path C:\Users\Admin\AppData\Local\Temp\Mountains.wmv
Size 57KB
SHA256 227720511a9d48f20ce19393ac2de7863735ced825c18e294b28100ef3ec9028
MD5 e4e3277fe4d08897173168dcad6cd1a8
SHA1 87bd9f8bf13138984d7787f21ba024da82504f56
SHA512 8184ac2a9b81bf3b591a84a8a1a508526689efcdbf20c25926afafab41734f1df679db7a2f95378f51d12f079da1b9ee15e7555492d023a05936814f3e2399ba
SSDEEP 1536:QB5eS5eQ4Api6+aKiiIN/Zt0s86EpiB5QwcM/E+yiS:aeS5eQNi6nKi5RCdcB5Qw9sqS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nevertheless

Path C:\Users\Admin\AppData\Local\Temp\Nevertheless
Size 106KB
SHA256 84bf74aca94f07e7ca9354e21f1cd51fdd20977649e5840462340337ce33af98
MD5 5ba84e9ceeb196ba2939ec05735021d1
SHA1 5c69ae5cc200a69cf6d44c9363687be02119c154
SHA512 b6e21968804eaa9e95d425cc46be6d4aff8f5ec71cb8d2cf0f0b970b787538af4ad43e7c024b5d6c5b7f4f141c69d3c8c6ad1a8d407ca88c10d36b6181ef0398
SSDEEP 3072:VgQa8Bp/LxyA3laW2UDQWf05mjccBiqXvpgF4qv+3c:VgQaE/loUDtf0accB3gBms
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\O
Size 106KB
SHA256 ff31ab0e8a634dc76899fe44520658027cbe4933d0708b0b82ce86f8e29d6743
MD5 e7d090fb3bb9d5c3a0cf4b46ec6b0cd6
SHA1 550d589491ecbf8f9accfc7f4b303ce5db0e87f2
SHA512 c7682cdba85b6c648eea4201c355f266acf96b0cba8953b7b38a061eac9ea695c58034689b38c0582b58942e808b76ec416ee239a71ab72edbe5f922c6d048e9
SSDEEP 1536:9eOypvcLSDOSpZ+Sh+I+FrbCyI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1Cw/:9eOyKODOSpQSAU4CE0Imbi80G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Reduced

Path C:\Users\Admin\AppData\Local\Temp\Reduced
Size 117KB
SHA256 595146a5ce4072d6513ea719f05ade9e261f7b98931b170c07700306b7215439
MD5 23c0ad7c89b4a11148b9460d55e8aa29
SHA1 e26e3551393468060c97f398c52a22993082ce56
SHA512 f55d2c2d7a1072a5bf6fd69a17c08b427d23d504fdacae75eedb65ff14f287e97a68ad0540c9d3b59abcdf4a79daa694f92185d73d7847689dbadf0a9af22371
SSDEEP 3072:MBRtNPnj0nEoXnmowS2u5hVOoQ7t8T6pUkBJR8CTZ:GNPj0nEo3tb2j6AUkB0CTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Systematic.wmv

Path C:\Users\Admin\AppData\Local\Temp\Systematic.wmv
Size 9KB
SHA256 b83ec027f1c49746d95856087353d373b5e5692023e997fc2e0a4a022039d42a
MD5 116e3cd5929199ab5298834039ac02a1
SHA1 008e7af7415a3027089e9bb6e35e1880c383b00f
SHA512 94c7fcfe7693bf7d4a9a2f4b048984d5b93662d335f80cf31a8c5d6e78af2ea9c463597e613e99e70ec99f5768d71a164ba43153c6596f807f6e1f5f3665f88f
SSDEEP 192:FU3rBucNfA7v7RqaQ+c3aevtD9YFr03CpAnPPBmZZmepZBQHkRRDUOr:FUFucS5QBKeyr+BmPVQuDUOr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Term

Path C:\Users\Admin\AppData\Local\Temp\Term
Size 1KB
SHA256 23c323aa87406a0d8c73021a317dc726c639452a8635bb63a175af9b321834c6
MD5 222f8c6573013c15a82990a5f977c04b
SHA1 3144d6b126d1394695504ae042dc9f5065a5d305
SHA512 884ef1a632c0f0e6db721a53fd93a5d253e91da3752ab199c0a2c199094943ae5e5878777b78cde1beee0c8700452a3a3660692cabb944c21d25df190bedbc8c
MD5 SHA1 SHA512

Submit Download

Was.wmv

Path C:\Users\Admin\AppData\Local\Temp\Was.wmv
Size 97KB
SHA256 3231b2949e26099e2f454e6edf2e100950a0ccce70f3981165c5d504279f6c50
MD5 aee3d6907ff2df4f0700bf63f675cf8b
SHA1 880b35e01a06528e055ad945e75ba89ee5b7d7da
SHA512 8086ac93013e07a0bbb6e6033fa229392ab97b79a2c0763d1e2b4c5c90bf8e8fd4a64cff3efd977e82f61b83c012da84e5ee0e60e888dcc274d53b5ef291ea4a
SSDEEP 3072:y5nKJhxXU5FKFLFmBQhf+nM9BdA8enoTIPShK:hPxXmmxmSx+EdAfPUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5512-295-0x00000000041E0000-0x000000000423F000-memory.dmp

Download

memory/5512-294-0x00000000041E0000-0x000000000423F000-memory.dmp

Download

memory/5512-298-0x00000000041E0000-0x000000000423F000-memory.dmp

Download

memory/5512-297-0x00000000041E0000-0x000000000423F000-memory.dmp

Download

memory/5512-296-0x00000000041E0000-0x000000000423F000-memory.dmp

Download