lumma | 211ad44d25b13d0a7b3bdb3c6a0d61ecc2ce4ce17b26522f55f5be4d6ce2ad9e

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_71ddac95eec37aa6061d2b2803f3020b_agent-tesla_amadey_darkgate_elex_glassworm_lumma-stealer_metamorfo_smoke-loader.exe
Size 39.8MB
Sample260822-p2twbsvbjc
SHA256 211ad44d25b13d0a7b3bdb3c6a0d61ecc2ce4ce17b26522f55f5be4d6ce2ad9e
MD5 71ddac95eec37aa6061d2b2803f3020b
SHA1 39493c828915edd687fccae488b891d831aa401a
SHA512 2016e06a5aebbd702942ab818cc8a55529e7f3aa40825c6b03c0ee1e465d0c535d1573ee1cc50bc61deec9d6244dfee10a704ec5e60f62f2b82b3de4e59dce59
SSDEEP 393216:OXEIFyT0acBTOe4d+SFQ9TQoOEBkCawIoOJvdVRAw6D5i6ytSMpy:OXV14d5FQlNOlCRIoOJ1VRAE6Etpy
TLSH
T1C597D002B7E84065F1F726301979EA26693EBEB51F6082DF1255665E2CB27C1DF3032B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lumma spyware stealer trojan

Malware Config

Extracted

Family

lumma

https://bashfulacid.lat/api
https://tentabatte.lat/api
https://curverpluch.lat/api
https://talkynicer.lat/api
https://shapestickyr.lat/api
https://manyrestro.lat/api
https://slipperyloo.lat/api
https://wordyfindy.lat/api
https://walkyvulgari.click/api

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 1 IoCs

pid	Process
5760	Preparing.com

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4148	tasklist.exe
3400	tasklist.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\RepublicModem	2026-08-21_71ddac95eec37aa6061d2b2803f3020b_agent-tesla_amadey_darkgate_elex_glassworm_lumma-stealer_metamorfo_smoke-loader.exe
File opened for modification	C:\Windows\PartlyMagic	2026-08-21_71ddac95eec37aa6061d2b2803f3020b_agent-tesla_amadey_darkgate_elex_glassworm_lumma-stealer_metamorfo_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5516	cmd.exe
5812	cmd.exe
3652	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_71ddac95eec37aa6061d2b2803f3020b_agent-tesla_amadey_darkgate_elex_glassworm_lumma-stealer_metamorfo_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Preparing.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\DA6D0400641B45AECC595D24E5037AA6BC09C358	Preparing.com
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\DA6D0400641B45AECC595D24E5037AA6BC09C358\Blob = 030000000100000014000000da6d0400641b45aecc595d24e5037aa6bc09c358140000000100000014000000540cbcec18f77df103e284be34644467cf751f656b0000000100000020000000ac8ea9f2874fd368a3e778b1a0b165ee898db9b9687c17edcdc76908ab58c82c0f0000000100000030000000328449c5fee65f44c3fb7ba1560fb1d18a5e82527c31f47a33cb8937b3868ff662207cbaa21b7e69e623f113bcb627f919000000010000001000000001f3df139c9b07ad46a8dd01190294f25c0000000100000004000000001000001800000001000000100000007a3313065037973cd918f1d646af966a2000000001000000bc070000308207b8308205a0a0030201020213330000000b13e5667d4a9b558000000000000b300d06092a864886f70d01010c05003051310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31223020060355040313194d6963726f736f667420544c532052534120526f6f74204732301e170d3235303830313230303235395a170d3239303630333230303235395a3057310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420544c5320473220525341204341204f43535020303430820222300d06092a864886f70d01010105000382020f003082020a02820201009c3a24085a1892f29ed560cde2e6fb8047db44ae2bdd6d107021154529aad2c7dce6c442b1a08d52e04f5c395506364d17c1586634e285529fe2a4fec6dec2c23b86bfcaad872906eb1d491d5f81dbb7a4ac561ad61287fd5f4049e2a00c6a84c64e6fdf24b89a95745a597fade93c13157840ccecdaef88364a90deea630794c3836a1aae98e6f164805a296704e856f421a6c5468dc8dd02abbc06f06c477823bb38b0bbfb4d71b0df22c37f1a7ef99daa412ad1de68dd9574253866c91611c5593d2ab168b9933b66e83ce1fca7ff2c6b50e0c0b9c8717393b177bfedaa4d0e0a55db139c72e069ad814cda23f906cb3fed428a868c0dd20c1525d08668eb7856aa2e5c08b34d33804eee353c2fc37a7dc16672606890f4ebf608ec13d789925f5c52f4879578b136e1b342536e3a373707c873751ebb5d6e67c99a7ccb4af3c6cdf04ef586fb143519463d97867264dd4336efd4578200220ca33aedb3657065f982a5bab8d2eac0688a3537a040f5fe028966a830f89447625747b27b9b8cc795bceb9af6c68c4489db16e61efde789fc81353530ea2f7d896452b3461934e33b574f0a182031efc5fdb9b127f6975935fb0ac244d6d0b2ed554d1d57487512d7f29860169ec4069cd4ae7e2e65c753e422251830636a9057c594b4f7e54d4c0d54c71fa93d4d0a460962d0232251e38e374cc5f40140990582d3a2b0530203010001a38202813082027d300e0603551d0f0101ff040403020186301006092b06010401823715010403020100301d0603551d0e04160414540cbcec18f77df103e284be34644467cf751f6530130603551d20040c300a3008060667810c01020230130603551d25040c300a06082b06010505070301301906092b0601040182371402040c1e0a0053007500620043004130120603551d130101ff040830060101ff020100301f0603551d23041830168014de918648b7a1315931f14b5f07a9dc8879daa8763081ab0603551d1f0481a33081a030819da0819aa081978649687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d6963726f736f6674253230544c53253230525341253230526f6f7425323047322e63726c864a687474703a2f2f63726c322e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d6963726f736f6674253230544c53253230525341253230526f6f7425323047322e63726c3082011006082b06010505070101048201023081ff306306082b060105050730028657687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d6963726f736f6674253230544c53253230525341253230526f6f7425323047322532302d253230787369676e2e637274306906082b06010505073002865d687474703a2f2f6361697373756572732e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d6963726f736f6674253230544c53253230525341253230526f6f7425323047322532302d253230787369676e2e637274302d06082b060105050730018621687474703a2f2f6f6e656f6373702e6d6963726f736f66742e636f6d2f6f637370300d06092a864886f70d01010c050003820201007c4871c2b6c045ab740fc63f49e2fc0fd675fdcd50d1e04bb3b3d1a8995ffe5d350d6c0bddd0ad6160188938e2f0b735d2b5213a0c0e5899387cd4d7dd024dd4dcf5ee90e37b6793a8acd41b50bbc54fe6d3f1b51ef0ff99bc2333b0c8a8a627d6d15bed6f14de4b071a0c50fd0edfbeeb4fb29810cb222ae61dd74ba7ae15d10136090b86434f4ee7c57e5ca36b832e493e9488998b52d3963f7198242f3782fa6c74f2bcdb0621bbb85067702415b60b228ff7b927e4037c8495b76604a99255c2bd11c7210a727f65c060a65049e9f62348203a8e9226a8178c98af14a73dce4cadc08e8c3c44f17ffb13f914d77b333d105e64e7273d0c4ce271d766ceaef74eb664ba542bb7fd03d798679837b20a6320e5b0fbd8a48d3a2e42229a22f42655833015c7a242b3bfd036c53652a773677a736e54acbce989d8a5eb1f6dac2750c4c8ebd41c54294dbbb6deabd7c7f11f1464ba7f473165ef797d14c4f019e48076e73b28009b446f2457f507dc8e5ab400589756b10bfa087571de1b53c8eebdf0ab224cbd6bba5d8a44593c246baabce97d8b5f4a4dd78c54b0ab769b80284d457465106021f98e795fda92fb178400dbc4ae8259813c27779e56f707c8bdbe3d91c5978ae69c0f591658486c7da41632ed16c92da796f5e4fdc5cf65a4ddd700e8c90ef49db2a40280cc1bf028ebb03177349ec3ccd7c89b36bbc525e2	Preparing.com
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184	Preparing.com
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\SystemCertificates\CA\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184\Blob = 030000000100000014000000b5ee89e77326ab2bf1775bd99c19a28947ff8184140000000100000014000000de918648b7a1315931f14b5f07a9dc8879daa8766b0000000100000020000000ddcd1e8a20638d4aaff7201bb1d56452acd2c759f1686bdc38f73dd15732bdc20f000000010000003000000086a8cab49724c4dc183b07f383b4e29f93939bdafc40c1cf8396320f734bd585b00363cd979b85341813a145537033f91900000001000000100000007a3313065037973cd918f1d646af966a5c00000001000000040000000010000018000000010000001000000014c3bd3549ee225aece13734ad8ca0b820000000010000008d0500003082058930820471a00302010202100b0c6b2c466917b04773c647d4afc0c8300d06092a864886f70d01010c05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3235303532313030303030305a170d3239303631393233353935395a3051310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31223020060355040313194d6963726f736f667420544c532052534120526f6f7420473230820222300d06092a864886f70d01010105000382020f003082020a0282020100dfea8b9f47e1281071af41d619db9257de6babe62edead3a6083b71398ac5bb9320b7beb9f72276b5d40abbe180693b20dd212edb874f57f2feaa81794f63316578ade207c21ddb7daacde4e64b05acd4b75f3ef02644ded52daa38f04e891f8d7fb3f19fd4e45395ee829c3d6f267afb30094c18de1f04a189839fac009843341050305abf475e153a521925c444ce66057a4900297c7d5d89304324aed8551edd6c5baa03f368a2f6f4c39a8046922843b7514f7d93eb4a9d0074138817e46481de819e670b8a0aa18dd72bf7e7db56c4e19701184041381d462fd9c6bf11cddffeca7e0e6c78d314bbff26b33ccd18cb6feb11ba34aa85f0e7f3176383f07476c01a8aca514da82b05f1f6cbc891ac0122acb7b971f282e31168a534c7566f97d01d6c260aa658f319e72cbcc9b2de544199357ab6e8ec2d92e65b0722de7a1c3a17e491d5967d609d418126dc0954578c9f1606ae4f6ee06243b734a5a11c23e9761c078eeef13a730e24a382dee58171320b7362adf0b32b4c238b191dd12b045b67cc0b11d62a19ddd71121596019d0a09f5b1ddb3d9e0384234f669b6c3af1673fed443f843e458f94fb3f3ecd63d943a403815ab0c86d064ce1a63e8849455095ab604b6d13e9a15c7641180d01b820e4dff459eb26507251fdb9ac8c6ecd65b8550049f1ccb5d2082679e79e2dfe8f2e86fc420723086e59d7527350203010001a382014b30820147300f0603551d130101ff040530030101ff301d0603551d0e04160414de918648b7a1315931f14b5f07a9dc8879daa876301f0603551d230418301680144e2254201895e6e36ee60ffafab912ed06178f39300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070301307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7447322e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7447322e63726c30130603551d20040c300a3008060667810c010202300d06092a864886f70d01010c050003820101000bbcb42b3774c54ba7360236c6afe113cc8a9a971bfce3448cee5400e5e4411a46f00b7634ff99556235aaad8a9c0c5a62cc43c0cbea4a1dbd6b1dafb11925669cf7796e5b2580248185c7792d355f420978ed9fe265d5c4205082108f6a3aed188e4889aba609f8e180fc06751627255a8fb83a706c1847f063f4530ed9153520f3913d1301a0e2fa2408455677d167a93142d057ff1a26bec543d857a963ffaff33ad8f67b4b10a297a1cf66be676709f9b54ce7ab192bbf223d7ddec6f7ef63382cdd56c4f90952dadfe3886fd56d6bf708412f8e3e86319ff17c4af5d661a4464628ef57bab06f92d8d27725ed7ba629ce3b727911d4e0a7546d352ba47a	Preparing.com

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5760	Preparing.com
5760	Preparing.com
5760	Preparing.com
5760	Preparing.com
5760	Preparing.com
5760	Preparing.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	tasklist.exe
Token: SeDebugPrivilege	3400	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5760	Preparing.com
5760	Preparing.com
5760	Preparing.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5760	Preparing.com
5760	Preparing.com
5760	Preparing.com

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 3652	5032	2026-08-21_71ddac95eec37aa6061d2b2803f3020b_agent-tesla_amadey_darkgate_elex_glassworm_lumma-stealer_metamorfo_smoke-loader.exe	89
PID 3652 wrote to memory of 4148	3652	cmd.exe	91
PID 3652 wrote to memory of 5208	3652	cmd.exe	92
PID 3652 wrote to memory of 3400	3652	cmd.exe	94
PID 3652 wrote to memory of 1204	3652	cmd.exe	95
PID 3652 wrote to memory of 5516	3652	cmd.exe	96
PID 3652 wrote to memory of 3692	3652	cmd.exe	97
PID 3652 wrote to memory of 5592	3652	cmd.exe	98
PID 3652 wrote to memory of 5812	3652	cmd.exe	99
PID 3652 wrote to memory of 5760	3652	cmd.exe	100
PID 3652 wrote to memory of 1748	3652	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-21_71ddac95eec37aa6061d2b2803f3020b_agent-tesla_amadey_darkgate_elex_glassworm_lumma-stealer_metamorfo_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_71ddac95eec37aa6061d2b2803f3020b_agent-tesla_amadey_darkgate_elex_glassworm_lumma-stealer_metamorfo_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Reveal Reveal.cmd & Reveal.cmd
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5208
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3400
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1204
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 340983
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5516
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Polyphonic
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3692
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "Leeds" Cialis
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5592
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Choosing + ..\Deutsch + ..\Bag + ..\Kelkoo + ..\Oakland + ..\Independent k
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5812
- - C:\Users\Admin\AppData\Local\Temp\340983\Preparing.com
    Preparing.com k
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5760
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Preparing.com

Path C:\Users\Admin\AppData\Local\Temp\340983\Preparing.com
Size 925KB
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
SSDEEP 24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
TLSH
T160158C0333918062FEA7A5331F5FF7265B7C6D2A0223A52F13981E79B9705B1162E673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\340983\k
Size 441KB
SHA256 1842fd6ab27603c7f988815996245ffe00d2faee3eb94b39f6466b9d43d5f63b
MD5 c2502af9822d0c3ec40493d6e5d9ef9c
SHA1 434ec8029929aef7421c918d56cebe1b45d083bb
SHA512 eb71126033511d2fb88adb6dea718e1f7cf1caecfb9b611325ca866e5eb909821336a3203dce32156f355c1f7a40c4c16e8753f36db778c6165ba1c67a57a72f
SSDEEP 12288:aYEtbcHBF5lBLUEJX0t209sJxAUX+H0eV5R/njR:EJczBLhXc2ssJxDc/V
TLSH
T10BA4238B05038C8C511BE8753EB78A74E657AB57BD7B3FE8B5A313E50AFD5852023902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Admissions

Path C:\Users\Admin\AppData\Local\Temp\Admissions
Size 131KB
SHA256 e072c753b4f0bc27c1700f3ea994bdc4cd18cc130605a3111d0052829b7144ad
MD5 8bbc245fc04a0ad6cbd55d98eba618d8
SHA1 2f96ef2463d912ff683dd1a7eb7d7ea7a32444b8
SHA512 07584c0bd3c283d5f7242add546ee2557ed59538865a99db156cda8fce587dc1a9396660c66d06738c9438cca700fd89fad1bf7c48263c7ad7ec00517b35ee6a
SSDEEP 1536:hKaj6iTcPAsAhxjgarB/5el3EYrDWyu0uZo2+9BGmdATGODv7xh:96whxjgarB/5elDWy4ZNoGmROL7T
TLSH
T1E2D3600366F85007E063767979AFE77F46E5BC5F5B21A13A235C2F8FA864B808914732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bag

Path C:\Users\Admin\AppData\Local\Temp\Bag
Size 58KB
SHA256 8062c84fca56ea7bd055641c85240cf26ab9244568c47233b4e68b646884c106
MD5 97451105d316894fa678be375141d863
SHA1 0e901d73236916d783b7a1a31227f6bfebd15fd6
SHA512 78ad937c9da2810674b496a6b406c67af9e836891e2c5a0a2aceaecd9b163b3d918877ceac001d51893cd24d56b1bce384c8c2834ec99cf8aaa5cf649eac8f19
SSDEEP 1536:YTMigQVfTvKbG5iL0jCLertZYzBP7DrjM3M:xozKbG5iLhQtSJ7Droc
TLSH
T1DA4302C738189D446070CD22ADAB0A7641BBC5861E9B7269B7731FC0977DE8A53237F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Choosing

Path C:\Users\Admin\AppData\Local\Temp\Choosing
Size 78KB
SHA256 ec53a7a7a52a764c658b353bd5ecbbac9a024c1f78fc7952732adf6040be290b
MD5 eb5d2eb99e043840b10a7cc79f074aac
SHA1 25a178ca7ce324f7d5a5918a39d324db95a6961f
SHA512 5686c65a3c9fd240534c078158c607fd65065564cf10d23ab716988b7ae63798d3060cb65132de9a76e9d10d0f4e3b32055914a2fa3b4e87a1ec74f263eed775
SSDEEP 1536:axiBrmwFGVn2xDdJ4OEjGPR8Ar0PPCQ8Ay7t0qJGGyDopCKwO:axk4Vn2vE26ArEPCQbc06g8pCnO
TLSH
T1627312E852060DCC97EF991335F362A499573662CD2F756C4A97A0724BE340F8D62C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Church

Path C:\Users\Admin\AppData\Local\Temp\Church
Size 104KB
SHA256 3d2c4220e2f16442047e564cc5138d5fc5521358f5e95f1fdd5b4952f3bc4d38
MD5 c5a6b46115c73cc1564d91e097597809
SHA1 8ade3a06c3386a50ef05bcd2c6195a55bb1f22bc
SHA512 bea0baa465816decb645878c0c24b6da1659177f899dfa14973aab2eddc357b1a74216b4b64f66492f01408f720ce24ec0f41588bb08318206c6ec8fdca8c435
SSDEEP 3072:Gg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laF:p5vPeDkjGgQaE/lY
TLSH
T171A35B506480F3D8C55E0C32AF59EF62A8BCADA7436A64C9F3E80D4B4E64DD35271F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cialis

Path C:\Users\Admin\AppData\Local\Temp\Cialis
Size 2KB
SHA256 ddf02e22d826fee4f6833496fb0e4e4b635fff300fa1ec92f6c38275207d6e43
MD5 abaf3b07ae579e85396045c9d8a36f8c
SHA1 c4d2eac631a1cd8e4905cbdb2ea5c498a988b5e2
SHA512 caf73986efcc501ebe6f9585d29312e616afd440f97a34e64a146f6dde9b4e39aad04f293f3e3ad2977c554187051899fe68b7d965f59248a75c08549e2b8cc1
TLSH
T18551C81B35AD2AF6CED41F32C42FB5331B9D556B0BAD262B5BFA0C4460A1C62B087648
MD5 SHA1 SHA512 TLSH

Submit Download

Demonstration

Path C:\Users\Admin\AppData\Local\Temp\Demonstration
Size 119KB
SHA256 0493017fdbad791e1c70ceaf952b069da0838bec5bb9641bfe2526935ebf3450
MD5 0b406b0dc73a87cb81b68a39769ff99d
SHA1 6d75122c0c4ad82fa2dbd3e86bd60863d2e6f9f1
SHA512 22fcec46396a2599f5f5411f066a8123c18bda83b16f41f837d21ac06e1c5a9c0d32008f16c253f92c06637ea54ba516072593864dba325f3f3658322aefa675
SSDEEP 3072:rAU4CE0Imbi80PtCZEMnVIPPBxT/sZydTo:rAhClbfSCOMVIPPL/sZj
TLSH
T169C38D53B58294B6C8930971461BFA923D38DA720638BE874AE53C36FF644C25B6B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Deutsch

Path C:\Users\Admin\AppData\Local\Temp\Deutsch
Size 85KB
SHA256 cbfa79201db9d737f3062029c3e0ead336d53a224534867dab627147337f93b6
MD5 2c88eb590f4c4a338e728c1ce0438196
SHA1 1eaba84043e1dc3b561a3226e7f9520442ac1667
SHA512 1ba2f887a7cd2f985bfbf954ebe265480a6e463e05d757b235827dbf5e947e075561bbfdb37a2a7e65932c2bec5dd82c69d6f0755bde069837cbd73277923ae1
SSDEEP 1536:rKCHjqwzOR5jkKcATNlAdP2QWcnDnJhNtjmyB4n7Kpd1UqAI+6qBrHEEsX:rKyjqwavlZZad+QWcnDfjmyB4n7+deL6
TLSH
T16E8312B92B0354AA4156192D3AFF903CA4DABBCE675B7EFEBA6191E84C5C14870118C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eat

Path C:\Users\Admin\AppData\Local\Temp\Eat
Size 107KB
SHA256 52bf893cf3fbc2906ade980508e5b5d0dc7f72682017be5c0919a7fc525cbae7
MD5 a1e27fa32dcab33ee86efc8dd27b63d1
SHA1 c6a2047846550551b35afea9a39a62b85af1a60e
SHA512 b155b60d644eaf1bcbb94ca7cc25a7975a569a3ccf785c8bcdbcb7e6ce8aec998dd05a0d1943bb9f81063e05e8c78dbe93be13d1e24af31de3976d37145a03a6
SSDEEP 3072:02UDQWf05mjccBiqXvpgF4qv+32eOyKODOSpQ6:xUDtf0accB3gBmmLsiS+6
TLSH
T15DB39F12BC828032C162283009BB96725FBC5A341A397ADF97D95D359FB88D077357BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Independent

Path C:\Users\Admin\AppData\Local\Temp\Independent
Size 86KB
SHA256 c0b72e7504355d537e86497c6ad3d0620b5ccf056a5053cafe1b44fbd8a06fc0
MD5 99bff504652cc1737b632a6342f777c3
SHA1 538ae6e7f6aeabb3fe880ab941e7c8a92b9855f1
SHA512 572b16d0580416276fe42b26f6d162b06a80b922ca0028313cafab643d4779cf74689f7a09977118a81516cfc5c67a040e04bd7b74c869da991ae83799dd4d00
SSDEEP 1536:B0Hbu7mAlzBFjSeZApPab2zuRQI9fshRbPA8DwgB5C0aBOScWXovwczT+3uH6DAd:+uJ1BFupySzueyYFPAiBB5C8CIw6SuHR
TLSH
T110831246080DD5DDBB62A5FAF525AFA0E700851AE2B2EF90D6F5193C02FE4FD901DA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Integer

Path C:\Users\Admin\AppData\Local\Temp\Integer
Size 121KB
SHA256 a81feadf87dceaf6920763c9a6e778e1ac11203100067407b2fefd6ccac94cdc
MD5 4de0df64a65625c30aac28f72822bebe
SHA1 ca820874a7ac2d0a5bc8c7853647be173101db8a
SHA512 c60fee62574b6fb57b52d4322e8e897a1c7f5483013993c496d80c3a86dbc3515c0c152167f39357057ef1a3ca67510743ec1ee1693174b31c6ec478bd0666d6
SSDEEP 3072:5RxlHS3NxrHSBRtNPnj0nEoXnmowS2u5hVOoQ7t8T64:HHS3zcNPj0nEo3tb2j6x
TLSH
T104C3AFA338460097D66301605E2F762ABBFDF9360134FEB66BDC1C09F6A1895615F3A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kelkoo

Path C:\Users\Admin\AppData\Local\Temp\Kelkoo
Size 84KB
SHA256 324aefe28f96f076964b4c357dc97fc0ed61685af1dcc6b7ee1d624a06852fd3
MD5 833c1cfb141ee676c952c040e3f56f7d
SHA1 ada1bc57562355c844f136ab6f81c8f88518343d
SHA512 feff5ce9b91766c58b2969496e28b6d473cb7b7ae6fa95aa150af25a7ac553488d903713f46976855fd65612d7bc960febf23ecbd0a19c14fb9dce31f9f95ef2
SSDEEP 1536:sH9QeyeU+DF+Rd6z8sPCLeR7/QJAYLQIP0zLXppSbibafbctTzDsSV0BZGwQE819:sHtBwEzb9Q+YLQW0zbbaf49Ds73Qn
TLSH
T1C783020A4E138C14F11AE9947B6BCDB63B2BFF6739BAAD647C8A07CF94266513C17104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Oakland

Path C:\Users\Admin\AppData\Local\Temp\Oakland
Size 50KB
SHA256 0a771b739117cb3e55b9d75cced156958fcb36629322de39c1c26eb0030d3ac1
MD5 783c7295a4ad5ccb847bddcd0db47d9e
SHA1 8b9d727cc151bfc3bf8779005c5dab68ba823ca2
SHA512 1126e043eec8fcfdba0e90c5b960f7870bfcb0597ba32b19fc6f95707a4694f861a2d399c996a7f84a20819d86f66a8827791419f4a2eda6b334b8030e892c2f
SSDEEP 1536:J6zgeRhtikIuZ5OU9BQgIgMTEvDEJcWqhJ3:J8rDtxIuZ4ULTI5T/G
TLSH
T1533301FF1201AF290D1F75D49C6F8A46C5DA2B75544A27C0B03AA3C935D8BD87934A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Parents

Path C:\Users\Admin\AppData\Local\Temp\Parents
Size 83KB
SHA256 5f2c9b618b0a48e53b7c94de6f10ab7495ab4f927ebea9eac8eaff450520b8a9
MD5 c3455f3c8a5da63a8251060fc1fdcfda
SHA1 e95dab25f61740a4cf40a7abe599bfa9c87aa27f
SHA512 ca63cb144556e51eeac15f0bc4cf07752249d7e35386bc9e06510c90baaea7b1d3b55ab493f0920fbd9b2365a61bc7f2b93c004c58df02ad5c3787f1f52ac89f
SSDEEP 1536:k7oKzYkBvRmLORuCYm9PrpmESvn+pqFqaynB6GMKY99z+ajU1Rjv18fRQLThT:CUkBJR8CThpmESv+AqVnBypIbv18mLtT
TLSH
T12D836D133B420062DE6743A2CD1DF227B7AC8A270145FB2B572F0CE4FB9556661AE1DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pepper

Path C:\Users\Admin\AppData\Local\Temp\Pepper
Size 25KB
SHA256 0fce043f69d1185e033bc4846066ced3357955724c663e963aa79b1edf9028e5
MD5 dee7303df5650e145fd8422c74286075
SHA1 4f0f07c13ca9edf525eab9c624fa55a0b9d6ce80
SHA512 6215ab7df356a873068972b41219c0cb59f0c2c9a1e45ae96b5b77adac3a28490ce30000dc76cbcd68f75750f787075fd0df8f34fbd27d83ed50453587575036
SSDEEP 768:JLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:JTphAiPChgZ2kOE6
TLSH
T120C28D631A365663DB208DBCE6DCBF131EFCD3E2E5CE446780128AE055123927AE461F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Polyphonic

Path C:\Users\Admin\AppData\Local\Temp\Polyphonic
Size 478KB
SHA256 c6ec9e5400568fd0aacc0506191e78644fe08960ca85d3a98754c972157b845d
MD5 05634fdfb4577ddf0278d347164198fc
SHA1 01362e24d0319d687fe4422e7e9ae7c81d51cdc6
SHA512 d1ee1dcd9ac6e1f09f63bace42e2956122ba3cb62a16fcdd13a0a13ed7f60db0f159ac5d0857ee5e8fbb33114133fb05505ce9621bfb3f2a681935f39cd1dc85
SSDEEP 12288:tUAi3XYm4lcA1sNR3VSJ1CDPSb1SOuKLnNrXP0f:yAinolcAmNTu6PotLnlXPw
TLSH
T183A4237B69351AB9D01936809BFF16C010C02BD9B4AE6016CB949DD3B1FC671BEC276A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Protocols

Path C:\Users\Admin\AppData\Local\Temp\Protocols
Size 143KB
SHA256 119fe20202a3b637e3f0125359ca52888dbb5b7fb5b951d975f9691f046ceaa8
MD5 217cfc6bb45916c27f66e3eb76632952
SHA1 dfe42302b68550a1e845a32808ebf1f757402592
SHA512 0ab98aff9667543501bb0856f99fcf2b73074fe88711bd3a8cac5e5b8b205fdd5c241b720cf241e89bbfd977a60e116d1381738619254021893cb99ed930bf30
SSDEEP 3072:FfhnueoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0FuzX:FfhnvO5bLezWWt/Dd314V14ZgP0JaAOz
TLSH
T1B6E35A5372E34093DC7332B14EACF965E72ABA164172BE3F139C1A5EBAD05005E26672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reveal

Path C:\Users\Admin\AppData\Local\Temp\Reveal
Size 9KB
SHA256 781c86797feaf9e4717ad2030c8d85226963f538d0d05d71e93de3d84b843ce7
MD5 727fb52b78b74e26fe5d09ac1902aa07
SHA1 7d2dcc1b23c58210b7850c2946f71733c826522f
SHA512 62dce57820c07671770c5e0f7df0fab5e5c71125e034f1679da27379bcc6a1e8630f367e805fc8a1fed8b04b6ee0821a8cfc0fd5b36751095a6f153b5277dfd7
SSDEEP 192:Jq6H+vKqPTqBEQ6zgNebEmdmUWXl81133pFYoh4GWWiodxA6NVORD:cvKqPDbgNeldmUEuD3HYoh43nodOOERD
TLSH
T166126DE09B011430E76B579B02E0A952D63299C2C27A595C643F71191EEFF2C03379BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Zambia

Path C:\Users\Admin\AppData\Local\Temp\Zambia
Size 89KB
SHA256 7f478a3b6eb6e91514df49a176e81bcd0a93c90a081e0d48103c8a5ed397d3a8
MD5 9a3179af206b88c4ee05447603c34009
SHA1 6687996a328bb33a2a0b9bef953deb64edd181a8
SHA512 39729878502929bc6d3708d4e1b265417c7fb60f7007f93cbf1cf007448af5bba1243e2c94ac1310d3159245b537ff8313ab8cc036737c230e84606eaa66b9b7
SSDEEP 768:P7Vkr5M4INduPbOU7aI4kCD9vmPukxhSaAwuXc/mex/Ss:BklMBNIimuzaAwusPT
TLSH
T15F93EC096315CA3BFFCAE53B5382C6564B3E5AEE9183413F2434BAB4B8711B513BE461
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5760-67-0x00000000055E0000-0x0000000005634000-memory.dmp

Download

memory/5760-69-0x00000000055E0000-0x0000000005634000-memory.dmp

Download

memory/5760-68-0x00000000055E0000-0x0000000005634000-memory.dmp

Download

memory/5760-70-0x00000000055E0000-0x0000000005634000-memory.dmp

Download

memory/5760-71-0x00000000055E0000-0x0000000005634000-memory.dmp

Download