lumma | a61429e1a6c650e93a69cc0726ba124c4006fc1953321ff486952c45723d1047

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_c9655459a12ecc399f051186e72cf1e1_amadey_darkgate_elex_glassworm_luca-stealer_lumma-stealer_njrat_remcos_stop.exe
Size 36.3MB
Sample260822-gl11psec68
SHA256 a61429e1a6c650e93a69cc0726ba124c4006fc1953321ff486952c45723d1047
MD5 c9655459a12ecc399f051186e72cf1e1
SHA1 bdfad7c9c5d976acc9e29f1c059f08a6cba2c325
SHA512 8aa1cb6db1d9a2f0277ce4d2db1ebdc669a6a42a78c27fa49895e3467af703d3fcacb7bf51dcf3092d104e2c2e001c8ec9f6f38af942c252a857f6d0337ac134
SSDEEP 393216:heR+iD1s8Z71NcfPn+ny6MK5xpMyVUflJDwdYC+Tvg:heXDq8Z71NcH+nDvXMqdYfTI
TLSH
T183879E02A7F84125F1FB973059B686A6593EBE605B31C2CF024A795E28717A0EF30777
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution lumma stealer

Malware Config

Extracted

Family

lumma

https://t.me/sjksjcisjcjd
https://handluifow.run/altk
https://narrathfpt.top/tekq
https://escczlv.top/bufi
https://caitraohvi.bet/adks
https://galijd.shop/anbf
https://ordntx.top/pxla
https://strejqt.bet/mbnj
https://citellcagt.top/gjtu
https://maxmtsq.bet/xzid

Attributes

build_id
87efbe32b502ed3208a739bf700b223891fb442c15

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 1 IoCs

pid	Process
6268	Tune.com

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2020	tasklist.exe
1264	tasklist.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\CourageUps	2026-08-21_c9655459a12ecc399f051186e72cf1e1_amadey_darkgate_elex_glassworm_luca-stealer_lumma-stealer_njrat_remcos_stop.exe
File opened for modification	C:\Windows\ControversialFormation	2026-08-21_c9655459a12ecc399f051186e72cf1e1_amadey_darkgate_elex_glassworm_luca-stealer_lumma-stealer_njrat_remcos_stop.exe
File opened for modification	C:\Windows\ManufacturePhiladelphia	2026-08-21_c9655459a12ecc399f051186e72cf1e1_amadey_darkgate_elex_glassworm_luca-stealer_lumma-stealer_njrat_remcos_stop.exe
File opened for modification	C:\Windows\EmotionsIllustration	2026-08-21_c9655459a12ecc399f051186e72cf1e1_amadey_darkgate_elex_glassworm_luca-stealer_lumma-stealer_njrat_remcos_stop.exe
File opened for modification	C:\Windows\FeedLbs	2026-08-21_c9655459a12ecc399f051186e72cf1e1_amadey_darkgate_elex_glassworm_luca-stealer_lumma-stealer_njrat_remcos_stop.exe
File opened for modification	C:\Windows\DisclaimerWork	2026-08-21_c9655459a12ecc399f051186e72cf1e1_amadey_darkgate_elex_glassworm_luca-stealer_lumma-stealer_njrat_remcos_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2640	cmd.exe
2164	cmd.exe
6408	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tune.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_c9655459a12ecc399f051186e72cf1e1_amadey_darkgate_elex_glassworm_luca-stealer_lumma-stealer_njrat_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6268	Tune.com
6268	Tune.com
6268	Tune.com
6268	Tune.com
6268	Tune.com
6268	Tune.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	tasklist.exe
Token: SeDebugPrivilege	1264	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
6268	Tune.com
6268	Tune.com
6268	Tune.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
6268	Tune.com
6268	Tune.com
6268	Tune.com

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2640	1188	2026-08-21_c9655459a12ecc399f051186e72cf1e1_amadey_darkgate_elex_glassworm_luca-stealer_lumma-stealer_njrat_remcos_stop.exe	90
PID 2640 wrote to memory of 2020	2640	cmd.exe	92
PID 2640 wrote to memory of 4680	2640	cmd.exe	93
PID 2640 wrote to memory of 1264	2640	cmd.exe	95
PID 2640 wrote to memory of 4640	2640	cmd.exe	96
PID 2640 wrote to memory of 2164	2640	cmd.exe	97
PID 2640 wrote to memory of 6720	2640	cmd.exe	98
PID 2640 wrote to memory of 7148	2640	cmd.exe	99
PID 2640 wrote to memory of 6408	2640	cmd.exe	100
PID 2640 wrote to memory of 6268	2640	cmd.exe	102
PID 2640 wrote to memory of 4452	2640	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-21_c9655459a12ecc399f051186e72cf1e1_amadey_darkgate_elex_glassworm_luca-stealer_lumma-stealer_njrat_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_c9655459a12ecc399f051186e72cf1e1_amadey_darkgate_elex_glassworm_luca-stealer_lumma-stealer_njrat_remcos_stop.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c copy Flush.wms Flush.wms.bat & Flush.wms.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4680
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- - C:\Windows\SysWOW64\findstr.exe
    findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 129450
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2164
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Reading.wms
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6720
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "estate" Transition
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7148
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Venezuela.wms + ..\Specials.wms + ..\Dept.wms + ..\Icon.wms + ..\Desperate.wms + ..\Target.wms + ..\Gibson.wms s
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6408
- - C:\Users\Admin\AppData\Local\Temp\129450\Tune.com
    Tune.com s
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:6268
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tune.com

Path C:\Users\Admin\AppData\Local\Temp\129450\Tune.com
Size 925KB
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
SSDEEP 24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
TLSH
T160158C0333918062FEA7A5331F5FF7265B7C6D2A0223A52F13981E79B9705B1162E673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\129450\s
Size 502KB
SHA256 db7adc3da2c4d03e82770188077193d1003b19bd3dd29231e961db6699a8510c
MD5 9fbc98d4379293a6972fa9559fdb1dfb
SHA1 782cce91e67edb0ab1a98993d45e684123a532bd
SHA512 b426541bd107fac24e9bef55dc7475623931aed5187ca84d26ae343129540db186484dfff537419db8f5e3cdd55a443a23c13ee4fb94b77b51907431d31398d6
SSDEEP 12288:Bta7BwjdglaJpCvG3LGCT5s1vHeYHo7atVlHfsXHVLdfphp4LEIy1O:BMKdgCcG3LGCTA+YIQlEXHhdxhpWEhO
TLSH
T1ABB4231BE2613C9FB1EE99A78A00BA88D524C90B8B7477D53DDA4B0B34FD0B54584EF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Anybody

Path C:\Users\Admin\AppData\Local\Temp\Anybody
Size 138KB
SHA256 60a4837438b5b48a261b9025023f6da656c28b7b8b81dc62b4d477a5169a9016
MD5 f4de063a889d73e900802d3d85f75bce
SHA1 4cd01ba06335483d0a65dd0f44aecdfa81725db7
SHA512 6d867ea7bc8cfaeff5e7445b9da338f269cd86a4fd3333c4a94c1babc101e0b28f324fec8c1a87c0da5bdbaa75f44096ae34a4605c14b7a63b0bb1175d42c816
SSDEEP 1536:7h6R8anHsWccd0vtmgMbFuz08QuklMBNIimuzaAwusPF:Vq8QLeAg0Fuz08XvBNbjaAtsPF
TLSH
T189D3A5046366C63BFFE6E53B5382C6164B3A2AEE9193443F15746BB9BC702700B7D861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Assumes

Path C:\Users\Admin\AppData\Local\Temp\Assumes
Size 149KB
SHA256 dc039878c3daf8a442278991b33eb9d7f6740598784c8be30dce3939a0a4b15a
MD5 c55c60701fcde6a52547df0b1b569430
SHA1 3667bc5a1498fe06d32981f9cd3b0f1fa71e5d5e
SHA512 4d3b5a82a93b82f417dc0906a370ead6a768db7b4ad450ccbf1f824d924f75842f9877d8ca5e7c1dd08b72ada3768d0c184e60ca4cb55d664a3f31d1b7539e2d
SSDEEP 3072:7xlHS3NxrHSBRtNPnj0nEoXnmowS2u5hVOoQ7t8T6pUkBJR8CThpmESB:jHS3zcNPj0nEo3tb2j6AUkB0CThp6B
TLSH
T159E3BFA7394100A3EB6302A14D1FB22AF7FDEA270135FB665B9D0C44FAD1495615F3A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Assuming

Path C:\Users\Admin\AppData\Local\Temp\Assuming
Size 129KB
SHA256 e0539930b7b1189175ee35be44ef75b1bdf0b02d78318eef88f5ab5673269626
MD5 f70dca1e23b0f620fa4e618533438717
SHA1 6e643c02947478e9340aacb7a74ab92c05bf3b85
SHA512 75223bd7c432125bb453a56547291ee087921afadfd7bd001a7247614da94dc9041bd9cf374d4f683935711e1949d1e88bf4c35ddbc7101bedaf1a7a7e95c32a
SSDEEP 3072:PaW2UDQWf05mjccBiqXvpgF4qv+32eOyKODOSpQSAs:PoUDtf0accB3gBmmLsiS+SAs
TLSH
T16BD3AF12BC828032C5622830097AA5725F7C9A34163DBEDF9BD95D358FB44D0B7367AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chevrolet

Path C:\Users\Admin\AppData\Local\Temp\Chevrolet
Size 91KB
SHA256 b59a4ec42235c7ab19092a537b9be8fbc2cfe87f4a8b178edb878bd136693cb1
MD5 8d0f021665f83e40cf2f28a870e3e51e
SHA1 d2e446a980de1183a063d9419449519d8ba0aaf8
SHA512 b7abc24aa78ddddc50b00cfb54d36aaf5aac268f9eb798027836a0bbfb6ba05562f4157936861bddd34beba2f42cb2543859c25502bc8fbaf92b64f8a798ab75
SSDEEP 1536:3Kaj6iTcPAsAhxjgarB/5el3EYrDWyu0uk:f6whxjgarB/5elDWy4k
TLSH
T1C2938153B6FD940BE0B26B715EB6C67586E1BCAD9E31C20F31940A4FF964B809D60732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Controller

Path C:\Users\Admin\AppData\Local\Temp\Controller
Size 61KB
SHA256 0c47fd900197fa7e13890cfaf45c5aaccd0e838a11f6869966e708916d423779
MD5 80f844a85ccf72306e61bf414dd0b2df
SHA1 c686dcf2de63b14b0db7acc67c5e2442478f86c3
SHA512 cbbacaae8b4ce1531dcd7a9da96ee88888fcebb2302a09d56ac49d7ba4ec2a617cf2221aa0304b88afe0c828492c15effd34fa1b4137408542aeea969da41cb9
SSDEEP 1536:qo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:qNoGmROL7F1G7ho2kOb
TLSH
T1E0537A62192125A3D227797CB09FFB1F4ABC9DAF93A93836430C7FD314523166998237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dept.wms

Path C:\Users\Admin\AppData\Local\Temp\Dept.wms
Size 75KB
SHA256 9fd79c29f93cf19e8a19c223c2cb78b164aff263422f73853aff2b38282c06bd
MD5 7726f66dddbfe792cac5ecff515f16b9
SHA1 28f152d80a377394207d2816bc80824748be7269
SHA512 246f0510c34f0e5eb0919617fa2cf548542d6af586d2533bfd4879fec4cbd2506b7550fe3bb195b9d9a86c1dc00cd7a5662eada991078ca691f92676cc78ad08
SSDEEP 1536:6fTGmatsETiz7Nsn1ZL0Oq6Z1A9/wTeMXx5zUTGTJcDSCohBzXG+g:myftjQ5sn1e6TAtwTrB5zvhBNg
TLSH
T1D5730229F1B5BCDE67AABF521B4C798562A0175C9F603382147E4D0B687027A21C3F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Desperate.wms

Path C:\Users\Admin\AppData\Local\Temp\Desperate.wms
Size 74KB
SHA256 5c26a05729454d9e9d69a8e69bed408900b9734964bc84e83267777a4d473971
MD5 2ca347b0505594e8481ea74e74590108
SHA1 21546224d089611ffdef666ad630d8ab0c2f9ffe
SHA512 97f19fcad57badfebc1b814542cf48830842c1a01a98a89273f576849fff674325738c2581665852f5897c3d46b94c6763a463ad5c8c2d8eab1ee6de31d24fab
SSDEEP 1536:1T+me2V2lJu6zh/j9CKQOE/5CJie90h9r9hVqgsFA68A6dcc2q9VxcyOVuZt5Rop:+2V2juSdxVQRMv9w9rggwbKWzq5UVYH8
TLSH
T12373023346DA6C085AB8DCDAD775154D6880EC4552A0B2D86E8777AA743C0F38A47FF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Flush.wms

Path C:\Users\Admin\AppData\Local\Temp\Flush.wms
Size 20KB
SHA256 70a0b851ac358c4f0d466e740d5acecc06bcd5c28e6f91433cc071440a2e1ea5
MD5 6471d1d7235538a9f023259f6534f2db
SHA1 6c0ba04d9bc73274cb824074d825c8d42f6abb1d
SHA512 77588525f1eb4716035f82450dc627324f345141d4e419b4e49e61701691d823a0434317d31ba7e91dff290920ef42d042f31d1d132c91d1321cee15bea25e07
SSDEEP 384:Z+asgw3CkauyNJHojxKW2GHdgCBMccm5mmOrnEA1Of6Tu1P3cGeEHKBH6:Z+asgODyNJFC0m5TOzL1Kz1vc6HKBa
TLSH
T1C3923CF4E18C1C67174776639DD4C1C5FA65D3262A22102FEEAB985CD64881C273EFB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Gibson.wms

Path C:\Users\Admin\AppData\Local\Temp\Gibson.wms
Size 56KB
SHA256 0ac906160d7e32f986108c0be5c0b65ef740f12979ec75d96fcc33cb117520be
MD5 7101cfde67014ce7cd480c0c86e6c6b7
SHA1 a06ba971a809114d4efeaa576c3ec98d76f1d5b5
SHA512 780a7f20a48024c004f9977ce13fbffaa96a7148db6eafe27144c260e845d78618d95fe4d168b362570dfa7ad0dace7cc0414adf2e8cf86ce985415a2144598c
SSDEEP 1536:ShqdABmMYFWbSHfYBbANrEuF52Nb9buG5SO:ShqmBsgS+OrEuF58buGEO
TLSH
T1404301365A641EEF4589E38794828316D26E4957C3247F8B64A1131C3C7F8ED32F8AB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Icon.wms

Path C:\Users\Admin\AppData\Local\Temp\Icon.wms
Size 97KB
SHA256 fa20218572e66a707ea7ea4ab46a4fb36fe3b4f601e9bb29061a0cd0e8be70e5
MD5 37ddd77d56dd1c6544a6479ed9aef9eb
SHA1 653e0eb1760448b05312a6c62996ffc95911e7f3
SHA512 c585253499aaf70a253106e1b5aeabef6444221557a9801ffe752ac7ccceab1bf7f041841fde5c5f95b2f06eb4dd7b458787de35c4d4d567f318323ba509ad5b
SSDEEP 1536:cjM9EhSKf3lAj6Ea1MD5nMJ+37NNFvPvW67nKXEuCf7urycyDgmMvISN7T08DK:cYASKR1MlCuvPP7O+urRy8mMvtN3G
TLSH
T1A9A3120FF01727CFB07D0854B6C8F908516881471A6952FDBEB46C561AFF4DAC8A9CAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reading.wms

Path C:\Users\Admin\AppData\Local\Temp\Reading.wms
Size 477KB
SHA256 df912f995aa36fd892168c451996256df5f381596c647fe4f3393a39faf6e778
MD5 c48724679701fb04c6741c1545b4dbfa
SHA1 f55ad49937ac3ca3c20053707f932bd9f79d0543
SHA512 70849ba377fee29fb590afa190215120322f5df10ac7518a198d838b36669babd19d7ce4288a1d5b660f8e211046c5b192e9d0c2f0958b467c467205a492898b
SSDEEP 12288:5fIHE8LUlA13MSrExQ31kcZ363ltI00CwmaXQq:F4g5SrQQ3WTE7
TLSH
T144A4230FE4A00D765F78B42DC2CF8720C465F94B0DBB4A54023AE959B2795A3F5CBD8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shield

Path C:\Users\Admin\AppData\Local\Temp\Shield
Size 145KB
SHA256 01db07813435482fefe78a3235fea517e99a701f428cf19d029064967059db8a
MD5 f500b76bb4abcb413b25c81f558c33ba
SHA1 26315332370407ffada89bdb5b7923064d358457
SHA512 2b3d4899169569274c264ae43cc35672c35bbadd386b854c258836a3eecf406fef5eb8606fd2482e1535e5dedf0f8a89a1997d90a68ade5c6156d1bf0ca22a28
SSDEEP 3072:1+AqVnBypIbv18mLthfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9con:1mVnjphfhnvO5bLezWWt/Dd314V14Zgv
TLSH
T14FE37D137AC20092DD5323B1CFADF616F76DAA1B0156BB2F135E0CA9FBC0412656A1B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Specials.wms

Path C:\Users\Admin\AppData\Local\Temp\Specials.wms
Size 69KB
SHA256 e74ed568a12d3fb45f16e43dc91f21d89dca076af04edae3831e38fda6270e08
MD5 72437e9ee540e1cb4349d2ae64ab26a5
SHA1 1f12a4e448e902169f17c49f9d676938951cb6f7
SHA512 d237caaeb65fc8f24b05d4a9c7f045869bed967203155782e1329f88e35834357a2ae02c378ae2979f629f8dbc645aa19e2e2c40415a10e2e61f8ddea37578ae
SSDEEP 1536:w/MguTXDt+CmlkDkU1ivGZvBJN72yu5NefsRULSQrqX:wraJpHivGBBL2yu5N3S1u
TLSH
T16063121B831050ADF2C700694A10AD90AA7F5AA3535DC2CD5FCB43BE35918294BB8BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Target.wms

Path C:\Users\Admin\AppData\Local\Temp\Target.wms
Size 65KB
SHA256 49d2c2e9f1d38947937b5fa8787c013f00c8a65aeab11733e392f60bac310c7f
MD5 cd17b5a325eefc90ba7e40b1243b465b
SHA1 c5b8835e7d1fda01fb3e1e89fd96555950187022
SHA512 ff94407f0c870c5672f548463d0cbe94c964d0e5b4827e4950818fa19b7965c0ef5930e76709f3e9a28bbfbfbf9250295ad5ca5ddfb613a6db0ab9964a326a37
SSDEEP 1536:5SRVXY6ynazcQM7eKiGCzVMY8XqnvKXHz8zrsMKgBYrHE2cr:kLynazcQdKM5rnSj8nKSEHk
TLSH
T15A53F202B6716D6DB07A9AF7962082A3DE01AD1AE9B72F71ED464FE512DDB204C14CE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Transition

Path C:\Users\Admin\AppData\Local\Temp\Transition
Size 1KB
SHA256 673571c939ef325fefa098ec147a63daaa423c8cbb5af769811e03c86b906091
MD5 e243556b06c30fec0774ad462628c8ce
SHA1 0d3fec935aec6a965f5942bffcc59f9e76e0c6fd
SHA512 190842cf66ff729a94ea399cd957718442bef65106b92fc56ecaea086fcba6e819ca09a01c05a7260d6f1c539619ab08dbbd0e744f60b83ed6534d4e67c9fe0d
TLSH
T107419607329D27F7CDE40B76C46EA033179625A70B4F291B7F3A1D997421C92F116300
MD5 SHA1 SHA512 TLSH

Submit Download

Trust

Path C:\Users\Admin\AppData\Local\Temp\Trust
Size 110KB
SHA256 117dc7ecaa369375f05103223487a682424f322483bb4bf1bc92918626633241
MD5 6f8a60199b9f0e46f1543a50faacb35d
SHA1 c889b49a197817f4f122e8cf7d94d0ad62b3c4a5
SHA512 19fac48ce9ca742dd38ac35dce6f68b87f7412e864248ee0ec4d5b286bb0c78e5c3dfc4fa9cac65d213c5135aef1baea1c4ec359bf149c3fbb53825ad03826d5
SSDEEP 3072:74CE0Imbi80PtCZEMnVIPPBxT/sZydTml:MClbfSCOMVIPPL/sZP
TLSH
T172B37D53B582A4A6C89309B11A1BFAD23D3C9A750538BD874AE03C76FF648D2176F7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Venezuela.wms

Path C:\Users\Admin\AppData\Local\Temp\Venezuela.wms
Size 66KB
SHA256 d110e11ca21f10b1a882f81c7d10e8f467ad900fa0af8f7e8a8c21b4d1a8686a
MD5 61680cfdfbfc27647554967f82d5f85a
SHA1 24e9bde3d8aeb28bbfdd9fb1615cf0731cb05ef6
SHA512 653e115fed95733c291f72bed957043c464e28ec2f24415bb61218e7463eea0535a1408a435e8f458da4faf28a12477a29c54b3178b2eba8538234366a351fd4
SSDEEP 1536:F/8NpDAFQzwaljntkDiBEqpBSKqC8Ux8DI8/Sd9YVFDrFe43Y6tFFgM:F/TtalntkDiBEM8Kqea1BXd5HFgM
TLSH
T16D63018EE0936A2701CE8E3F98447FFC8EB9D29A5E77CCD61C7DD00BB969614D940588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Zip

Path C:\Users\Admin\AppData\Local\Temp\Zip
Size 100KB
SHA256 1530ddc5bb0e952700898b3b7e51a4bcaa317d52f40d8a908710a7e47742d98c
MD5 198df9dd19105435db8188c039ec01e3
SHA1 44c3c97f8b5040e07d0e884b66102bb6b7b2673e
SHA512 4718652897c3414596947b583fb25f9a73dd08d49f5e4907e7802ca41534b3cc2b6ece8aff9fdf6f3e6c50c0c121a272ddc3b4d5994cef8b0c012f6a723a1ae3
SSDEEP 3072:QZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3l:QK5vPeDkjGgQaE/l
TLSH
T159A35A916480F3D8C45E0C32AF55EF62A8BCADE7436A64C9B3E80D4B4E64DD31271F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6268-65-0x0000000004DC0000-0x0000000004E23000-memory.dmp

Download

memory/6268-66-0x0000000004DC0000-0x0000000004E23000-memory.dmp

Download

memory/6268-69-0x0000000004DC0000-0x0000000004E23000-memory.dmp

Download

memory/6268-68-0x0000000004DC0000-0x0000000004E23000-memory.dmp

Download

memory/6268-67-0x0000000004DC0000-0x0000000004E23000-memory.dmp

Download