lumma | ad8d2d36547bb6c3fd44a137948dae585b9c66f7f3e6c36adcb0fd1f6a130a37

Analysis

max time kernel
104s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2025, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 1022KB
Sample250722-p8aq2ack21
SHA256 ad8d2d36547bb6c3fd44a137948dae585b9c66f7f3e6c36adcb0fd1f6a130a37
MD5 3fcc1f2d3fd73ceed67e604456f597b9
SHA1 68167a19174f4b8d672bc3a2bc2f2b921195c0e1
SHA512 a1d0373762bf468727d9b7881a782bd3965497081096b5337738ca166319b6e505685bd7bd1d60ad17da5d5a65caf604f76ce5f12cc56b7539d7c7b5b640330b
SSDEEP 24576:/lcTaUHHRdkL8+GGYC1uHk0zDvkA/L/prxs+4GbzEy0YXNQn:bUnvkLZ8Hk0zDvkAHs+4ry0YXNQn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma defense_evasion discovery spyware stealer trojan

Malware Config

Extracted

Family

lumma

https://t.me/lylajuipo
https://ummact.top/aktr
https://worlejrc.xyz/xaiw
https://permwgp.xyz/xlak
https://corronxu.xyz/xowq
https://ultracpj.xyz/apgk
https://vegemuoe.top/xauy
https://seruneqy.live/akiz
https://siniavzv.life/xajz
https://strujqwn.xyz/xkkd

Attributes

build_id
c4d08bd29c8b735e0a08e88338f784fc893efe41c59605a929

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
5020	Alleged.com

Loads dropped DLL 1 IoCs

pid	Process
5296	Setup.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3628	tasklist.exe
3020	tasklist.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\HbMeant	Setup.exe
File opened for modification	C:\Windows\AlgorithmsBanned	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alleged.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4548	PING.EXE

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	Alleged.com
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	Alleged.com

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4548	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5020	Alleged.com
5020	Alleged.com
5020	Alleged.com
5020	Alleged.com
5020	Alleged.com
5020	Alleged.com
5020	Alleged.com
5020	Alleged.com
5020	Alleged.com
5020	Alleged.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3628	tasklist.exe
Token: SeDebugPrivilege	3020	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5020	Alleged.com
5020	Alleged.com
5020	Alleged.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5020	Alleged.com
5020	Alleged.com
5020	Alleged.com

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5296 wrote to memory of 2820	5296	Setup.exe	84
PID 5296 wrote to memory of 2820	5296	Setup.exe	84
PID 5296 wrote to memory of 2820	5296	Setup.exe	84
PID 2820 wrote to memory of 3628	2820	cmd.exe	89
PID 2820 wrote to memory of 3628	2820	cmd.exe	89
PID 2820 wrote to memory of 3628	2820	cmd.exe	89
PID 2820 wrote to memory of 2100	2820	cmd.exe	90
PID 2820 wrote to memory of 2100	2820	cmd.exe	90
PID 2820 wrote to memory of 2100	2820	cmd.exe	90
PID 2820 wrote to memory of 3020	2820	cmd.exe	92
PID 2820 wrote to memory of 3020	2820	cmd.exe	92
PID 2820 wrote to memory of 3020	2820	cmd.exe	92
PID 2820 wrote to memory of 3484	2820	cmd.exe	93
PID 2820 wrote to memory of 3484	2820	cmd.exe	93
PID 2820 wrote to memory of 3484	2820	cmd.exe	93
PID 2820 wrote to memory of 1872	2820	cmd.exe	95
PID 2820 wrote to memory of 1872	2820	cmd.exe	95
PID 2820 wrote to memory of 1872	2820	cmd.exe	95
PID 2820 wrote to memory of 4768	2820	cmd.exe	96
PID 2820 wrote to memory of 4768	2820	cmd.exe	96
PID 2820 wrote to memory of 4768	2820	cmd.exe	96
PID 2820 wrote to memory of 5020	2820	cmd.exe	97
PID 2820 wrote to memory of 5020	2820	cmd.exe	97
PID 2820 wrote to memory of 5020	2820	cmd.exe	97
PID 2820 wrote to memory of 4548	2820	cmd.exe	98
PID 2820 wrote to memory of 4548	2820	cmd.exe	98
PID 2820 wrote to memory of 4548	2820	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /k move Validity.xlt Validity.xlt.cmd & Validity.xlt.cmd & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3628
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2100
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3020
- - C:\Windows\SysWOW64\findstr.exe
    findstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set UCEmMKcRisEUmSLaAwzguRUjQEkbhjUNBxiwK=AutoIt3.exe & Set oQCMoglnBswtpVNCqMpAxfVJtJXH=.a3x & Set RHvHINimBE=300
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3484
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y Completion.xlt *.*
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1872
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "GOES" Pride
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4768
- - C:\Users\Admin\AppData\Local\Temp\755164\Alleged.com
    Alleged.com J
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5020
- - C:\Windows\SysWOW64\PING.EXE
    ping localhost -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Alleged.com

Path C:\Users\Admin\AppData\Local\Temp\755164\Alleged.com
Size 957KB
SHA256 3ec9740bedc683021cc3e94e4a33b3a9d3d6f9b9e96b1f04cc6534f551dd58c1
MD5 f589c1095824c52a5ed3625d0d851b22
SHA1 2eac026b394548268cc8ee783de99c88cfb1e408
SHA512 f47f3bf4930191eb0d01b1a1bd737ccbe368266c99d5ee1c22d7db49125d7b3ca0685fb2c057f891e9240d215ddb96209db2e971c640592e1d487e794cc93e46
SSDEEP 24576:hMd+PsPy8Fv7yw56uX4Nw1ImcY3a2hrbBz:hzPsPy8Yw5EN62srb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\755164\J
Size 449KB
SHA256 e8d71e2dd4561421a2359f57bad3aa3a91dfd5c2a2afe23e93254ba5c6e5bb3b
MD5 b1ad1b12d5f4a8da9255743f83d6cc24
SHA1 8c2f1a0e8531df92068b4a81ea490266e263a1cf
SHA512 baa2624922dbe0e0831dd73ed7a25907086b3b68fb240e22cb68be25d768d5cfa6c8f4b0d5ab917241f6c41c105cc561e9efd24f0136cdb19e685972407e99e1
SSDEEP 12288:dha7o5NiN/RIxMuM+LdsalUuc235FQyVq:205Nizn+ialUaFQR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Across.xlt

Path C:\Users\Admin\AppData\Local\Temp\Across.xlt
Size 84KB
SHA256 dde1b79a07b28ecea89be08e243757317c21d9d44501702e2f1a6debab89b3ed
MD5 8efbd4df79ae0c26ac0192ebb220c6a1
SHA1 4b44008f1ebb167ba661ada9a00712322175fb76
SHA512 d28172ec0eedb75be254e581c935ebb3f323c11b0e2a03433ad7eca2705aa341f286e934d89e6e5ace5072ffa1ada8eae077c57231a8328d46c5f4f28856d330
SSDEEP 1536:CdW596rr4DCNYt/i7tqF3Ksm1yCu7pVvOOBiocsACoJTgqZsNARZUr7E:CsGrrqte8JKRy1ttBioc3dJcNl3E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cells

Path C:\Users\Admin\AppData\Local\Temp\Cells
Size 52KB
SHA256 000aa5bdb1eb1722eb0c3618519589c8b545c55c4c9f43cadac62073e39a87b7
MD5 ab7fbadca923c1fc6b902f0cedd70eb7
SHA1 26f69d8f03c5652e8fd95d0528f9923e5a737c4e
SHA512 783435e9963a94f6ca0d583ab5cc36f2e35b5fa9588767b2a959e0108463e198c498f4dfc8007923fac9b1958bb84ff0adfa268afb8c9b603fb3a8d1ed332d61
SSDEEP 768:6OGjyx489HDZ9t8JsRPPBvbCsOfE04GmvTQzMv/BnwwxWpAizWjg39Sv5:6+48918JsdVCsESNvmtpAi6Jv5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Completion.xlt

Path C:\Users\Admin\AppData\Local\Temp\Completion.xlt
Size 493KB
SHA256 d888940d5d1f87ec2e05904049822a1797876fbf7a0470da774b8905d86dbd44
MD5 e065b396eede89a1e3e34a0b9c85d556
SHA1 fd753447c507f4f97f2612e5e6b596490cf178d5
SHA512 90f59266d9f3cce4a99073b4cf0f18bbbb1fd6eb19c048da319fbb56becdefcce0d9d52c4b5e8a7753c9c87a1e6c33a829f63023d6f4441902f2b58e35b12aa1
SSDEEP 12288:f9NCaA+65Lls/X/5yioaODA3wdWs/LBP2pChiJSznnYJ6KO5lknElw:VN1A+UIAioaODww/VP2oi+nc6KMIT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Directed

Path C:\Users\Admin\AppData\Local\Temp\Directed
Size 110KB
SHA256 8b41cdb5718549fdf4ad7500638b547f82d57cdd7a33c524d310c5536adc3b24
MD5 53cb31dc4b4a6b56b3cfc0449c85b867
SHA1 dd5327337307113784b902c75f795e83057fc17b
SHA512 c21b8313d868dd9b30e9b3cb030269b655ff264891bc77e1d2514fd112ff13a91a772a7ecbfdf81121f7ec22e6dc47904dacf24eacb3f1d53abe2a698c08d5ec
SSDEEP 1536:+t0YwYwTkNJ3Rpref3ghV1SKOxqNdunCMfpfpJKgMPdkdux84SbL8R571Nf0xej:FeVzOqD1IGuTpMgKYbwR5Exej
MD5 SHA1 SHA512 SSDEEP

Submit Download

Drive

Path C:\Users\Admin\AppData\Local\Temp\Drive
Size 55KB
SHA256 457f0a5a7a631681c6a07a12fb58d82e57563451319b26ef0235c5ef619a07c2
MD5 7f84ba6e0d1dce9168692a6106e7942d
SHA1 bce8780875ae29969c4b661fea2daacbbb8fc389
SHA512 54d521380165c14144fcc91d7185d34b4510e9420020450510466605530a278f22cfe7755799cddc965591286d36b6e2a783b3384495699ff28c88d46a4e3508
SSDEEP 384:uu88888888888888888888888888888zv888888NfU84444Qnoooooooooooooos:u/SGJaGlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Fw
Size 107KB
SHA256 9aa19557e2e5b7a6c2505529ea86caf5ff949bc3073e1a4dbe3f5016e2a50a12
MD5 f34f5d673fac88fa0261e9d67de77e9c
SHA1 209b0ee90cb39fe9c3a5c2fc0d06946f529b4d81
SHA512 f9957fcb0845eb7308ed8b69ab9c00da0b1f81698826c9fa3996e18f3d4a6d2c2c6ca0f1eeedfb5dc89f7cf4a7ab1e650d2b7dab2e56239464bdebd8e25c18e5
SSDEEP 3072:y/RTX/4gxRuNkdKF0vYNyet+JQ+HcnkL8xCSVYvJ:y/RTggXuN2KFIyt+8ZUJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Grades

Path C:\Users\Admin\AppData\Local\Temp\Grades
Size 80KB
SHA256 9b12cc480c7485dd514ef40955bab190cf65f719e0b6149046725180830e0f02
MD5 ce49a120145d1ce590fb7698fe58c987
SHA1 059f6ec95beda3e360d92779e0a4f36983d7302c
SHA512 193e6bf7f783268bf5c679692d46ae89711c966d4ff50d49f7621ea7c0c07b9a3eb30a5d1b0849c769760b902db158ae3985c3c350c77e8660924e4d3747371a
SSDEEP 1536:9goJqvtmgMbFuz08QuklMBNIWPuwaAwu+1P4:9gc0Ag0Fuz08XvBN3vaAt+1P4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hotel

Path C:\Users\Admin\AppData\Local\Temp\Hotel
Size 86KB
SHA256 1d6d78d46f49e00a0a7c7ded87868199ddcda0711ed3d22cd91d1fca161e80b2
MD5 f6a3e7e10f19cbe43a73b997d8ccbf92
SHA1 a7c21d16bcd1568272a4daee0bb745f3682db5a9
SHA512 1df763367e5246b1f3d871cabbd8be13666047e7a06d6a0995aed22806f527472da1989764e8100eeca805e1dc46248d40bfe8e7abeaab5afb1b62aaf9f28905
SSDEEP 1536:Qohx6a+A3MDS661CZxbxY/jJHcUoNghHeqSkV4T2ubSWJKWNJELHW/EJlrZlP:rhx6vA3MD8jjJ8lghHzJi2ubSW4wC2mP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lauren

Path C:\Users\Admin\AppData\Local\Temp\Lauren
Size 6KB
SHA256 eea2286f49b96292d216c95895a554bdcf5532fb8434c2eb98a19e38e9e28331
MD5 0c0f57277641239d0f36ab291de2fe68
SHA1 73d1a6dde57388def5c21970d33f7f027f4cc1ca
SHA512 962714c1294309f93052c3363cb2b3b26397d615c5d381360a3705960e6fda7935d4eccc8a9271ec56eb0b69bfcc15fec4c9ccbe9f931651b6d996a5f7a0a86f
SSDEEP 96:0y1FRVJf6wsVWVFsx5oMDGoxc5yPm4/TOL+Q3IuzfeFFy4E7K9fC6jBbe:0yPRnf6wsVWVFTMDxc5r4/C+Q3I7VZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lending

Path C:\Users\Admin\AppData\Local\Temp\Lending
Size 107KB
SHA256 61c62a4f01f361d241ac8008625e27b4789f568cf98db9d80ac6a39193c2e4eb
MD5 138f4b636d071c9b0153e1fa69ff3708
SHA1 a68431036c8829c9576b5b2a06cc55aebb7a2d75
SHA512 d8012dd2564d16a4780a8891a75b7f4742f2af45750bc26d18055a357c6469ef68b14ae24752f1e0ecad0d04445a7499a6d4fc680b176407864aa8ebe51c0c44
SSDEEP 1536:wR+68cNk3smxUsb1yAwsc8MxqVbD61HOyU/CX2CdXibOT0EdQGQ9EtSijtNOK5:wR+HUDXOXT/CfXib+tSijp5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Muscles.xlt

Path C:\Users\Admin\AppData\Local\Temp\Muscles.xlt
Size 90KB
SHA256 9e7645c307f5f3f295167e75426d5f41c845f906cfc5ff525fee44bd3386e03b
MD5 42416693675fed7b97e100c3c1b90119
SHA1 d94979d6dade03d39373fc8a7865d58646d21d9c
SHA512 8f6d920af586d29c84457e6638b8963f44e8303572d5fb5f781614520ccac97b70911c6c34d9dc5e586b882642208a08c78baa9b8fdcbf11380d4a0e5dd3c958
SSDEEP 1536:Y1+vqlK2w+K9dG9Jm10l9FK/Q+2L6OrqB+lBN6rddSsrHBH4N:/qXbYYJt94/QFLbq9rhON
MD5 SHA1 SHA512 SSDEEP

Submit Download

Need.xlt

Path C:\Users\Admin\AppData\Local\Temp\Need.xlt
Size 51KB
SHA256 aaf6e939ce4f2f75c8c000878e80b734cd7ab4524a80d0039f9d591509a02b27
MD5 f782b1bccf3927e4a89c19a26d237eb5
SHA1 9180cd3442e507e157918ee4a835e4eaf377ad56
SHA512 8f97c7bcffcba07a27576b0546c398146daa5de43cd2425f19e3da6867c95d86284a4daaa555425769c273f2e2d347e8dc7ec1ea34702f0496e4253bfb85e7f5
SSDEEP 768:rhtMjJgRSc4WvXXuBjHJJDjzwp84g1nu64tmsOSUI8/+WfdYfVexLRXE9Jiex:rIOn4xHLDo84mnukr/JKfsbXa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Niger

Path C:\Users\Admin\AppData\Local\Temp\Niger
Size 95KB
SHA256 f732dac838407693376cfc374a524eccdea494b12497eadfc8864acfb263c2f4
MD5 5d769b09081fc873e17885f2d82b2d3d
SHA1 a286981d2c8c7d0be4d1b740bdc2fa02fd93cbc6
SHA512 beabde387a300efbf192018cc2245549b6b33f4aea9c9d43b917da0b0426684458264676b3ea9648b91f249ba1ad0fa9d81544a0dbbf5a21a7f382cc57ea8ce1
SSDEEP 1536:4C9jC0O2i94rqWJNm4Ql0/YUdzPrCtTRV5H4YL3KZ09kOJKnCIj4BZKaTb1nXu4p:T9jC0O2iSW4QlXUxPrCtTRVB4Y3I09J/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Premium

Path C:\Users\Admin\AppData\Local\Temp\Premium
Size 147KB
SHA256 2d471d046bc4b3f2d8c143c324b77a46c8b01c629705516fff87c60383e312bb
MD5 460233ea2eb58b86cc9fcb7e2ad21fcf
SHA1 93e649a9c20846033081638a83183ea607b6b752
SHA512 b656dadc062941beff584aae18953c8f4ec97935396b65b4d159ca269a08932c89adbc630e2663a07e62177a9228a26d1b5401910104ce153b2d5e9cf63a1852
SSDEEP 3072:l6OzmkrJrRj4h6DWy4ZNor+D62rqd2iXbvSS1:l6EhrRcAaBZ2re6T/XbH1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Prerequisite

Path C:\Users\Admin\AppData\Local\Temp\Prerequisite
Size 111KB
SHA256 d329a82dd3eceba51f85cff26dcc239cfd8837f740cd555d8975a0c5e246c26a
MD5 a8a72a3e9e08ff25863f5537f4f47ef3
SHA1 abc52beacc510d7bda38450de04e892f26d4e82a
SHA512 688b1f8e8dbc92e48b5bc01d119d908d8d1406b65ff7612805f8609e3bcd4dedaee70c65b2a7ac8973bf38fe6262fe1acdecc5987dde679940e1d834b5d76722
SSDEEP 3072:Oegz8StjOrOJGGMBwvqXQGYlawwBonasP:O8StQOAGlXuwwu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pride

Path C:\Users\Admin\AppData\Local\Temp\Pride
Size 684B
SHA256 27b2122e6cf89dd9d2868f6618c2e88c3ee3c483726ac9bd19637ca43597dd23
MD5 ff32cae146f9a4f8f46e3574a8f343df
SHA1 5e1061d83af2f19c6f5191b8dabae19d665dda4e
SHA512 339cbfa7fc86b2582d5195986d69cd31516c455958f884bd263d23b8458387bc05efc53048120b6fe9bdf9a85e9d6844c5d55d8f1211cd3bdc553a1418db5a93
MD5 SHA1 SHA512

Submit Download

Receives.xlt

Path C:\Users\Admin\AppData\Local\Temp\Receives.xlt
Size 91KB
SHA256 12f6973714d5f076a2edfc73d3ab8346eeb6d45904f7e94ddcfe9f392212af07
MD5 b9984ad3e5c19038466d4f465f9d4359
SHA1 67eaa06a259afa1a4eb35fc566938c9eac9d7f45
SHA512 4971f408677a419f407156ba3303b8ecdd3a40eec4b0febda30784e350a98f9dc8570154a3f140854909416278858d00ca650feba2b78aef87c1c3761724c38f
SSDEEP 1536:9UVahF9SyyrC9s42kW8vvgNorGZJZLOtm3m+NS9Xs20OkX/nEcDl:9Hh6F9kW8vJrGlL73mFNX0O8VDl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Steve.xlt

Path C:\Users\Admin\AppData\Local\Temp\Steve.xlt
Size 58KB
SHA256 051a93a1ee39b64d47157a6b4fb3803a1d086ea6be62d559786a71745ef52689
MD5 6c934b4aba707bb60acb7b1b0986f0a7
SHA1 12e21d687ae62e7e6f9ae09669ab345cde94eb57
SHA512 a1ea377631a269f2adcf9740e967e11ef2f2c56c36c17985a838b3c144033f13e8f4d80e4a043361b672e25e4f253fd4d59e70fd7f4a7c0809cef857861b8b8f
SSDEEP 1536:mEf5+B+omng4I7F56fUGzal+TvPtuiVjKPalbmDGZ:pf5+B+Rc6fU1sPtlVjYal6DE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Translated.xlt

Path C:\Users\Admin\AppData\Local\Temp\Translated.xlt
Size 75KB
SHA256 51580a3f3568bb6d8fd1b1b90ab4788e3ea084d914bc2693c40caa158767dbd7
MD5 360d34be3b88c4755856f7caab8e20ac
SHA1 a85b25fe3b06b185564bf58935a8296959055290
SHA512 935be2ae24c8d87932b03b87094f4a9e87ebc826cf38ef46052d7034d3983c055b0ed035aa5b378f2eb16a4df6d58a2341c401764c3abfce2c332dc421df2bb4
SSDEEP 1536:H8TIvDU/JyTR2Iup+q6zfG/aQ5CqDptpkmSE6qWXFW6pt6X0lPYQ:HCJyXZTKaYSEeXFzE0lPYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Validity.xlt

Path C:\Users\Admin\AppData\Local\Temp\Validity.xlt
Size 9KB
SHA256 8f8855d6437f78127f2d716ef66cac80f54e4a92a825b9064e897044ad6cb867
MD5 618f3638117abbd03d4abee9dc610981
SHA1 b236ebae3eb797c8f53a23b83f7a006a42430f67
SHA512 1e34a6dfdb61f1e9068eca81103c921b31693d10bccded5cf5c0e92ca5fd6f5f2de366eb80d7844e9fa7829a85a3ccd5a9611b8321327daca006edd4d6104fa0
SSDEEP 192:xsSQWeaZlqQ++h5sj88o9pcMblN3Ke7aY0D6NOU898ACRRkU:CSTdZE95IpflN3nJ02QfCR/
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg55A4.tmp\nsExec.dll
Size 6KB
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5020-80-0x0000000004AD0000-0x0000000004B2F000-memory.dmp

Download

memory/5020-82-0x0000000004AD0000-0x0000000004B2F000-memory.dmp

Download

memory/5020-81-0x0000000004AD0000-0x0000000004B2F000-memory.dmp

Download

memory/5020-83-0x0000000004AD0000-0x0000000004B2F000-memory.dmp

Download

memory/5020-84-0x0000000004AD0000-0x0000000004B2F000-memory.dmp

Download