lumma | 3ae8545a744e512e12f11a6e32b0dae9fa3e03e025dce4f1ca5b943bff4760a8

Analysis

max time kernel
210s
max time network
165s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-03-2023 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Need for Speed Most Wanted Trainer Setup.exe
Size

141KB
MD5

eb55b093cf221b1b9b6ae6d5340ea857
SHA1

2a3b43d3bcd24efefcc42d565e9ff1a3d8b8492b
SHA256

3ae8545a744e512e12f11a6e32b0dae9fa3e03e025dce4f1ca5b943bff4760a8
SHA512

36293d2a212af3e22c5f9c643e447ca010c44468842f857e41fecc49013f6409e9a829e54ca586f62b20973c098b1213ce3522735db51d74d9cc1ff0f23f9f13
SSDEEP

3072:Bojm4ILlCI+4COHCyhaEtHZkOpk97oc4ILlCI+4TOHHSafx:Bd+bwaEtHLhiHt

Score

10^/10

lumma discovery stealer

Malware Config

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Downloads MZ/PE file
Executes dropped EXE 7 IoCs

Processes:

WeMod-Setup-638150482199886000.exeUpdate.exeSquirrel.exeWeMod.exeUpdate.exeUpdate.exeWeMod.exe

pid process

1616 WeMod-Setup-638150482199886000.exe
900 Update.exe
1336 Squirrel.exe
1452 WeMod.exe
528 Update.exe
2012 Update.exe
1740 WeMod.exe
Loads dropped DLL 4 IoCs

Processes:

WeMod-Setup-638150482199886000.exeWeMod.exeWeMod.exe

pid process

1616 WeMod-Setup-638150482199886000.exe
1452 WeMod.exe
1452 WeMod.exe
1740 WeMod.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1616	WeMod-Setup-638150482199886000.exe
900	Update.exe
1336	Squirrel.exe
1452	WeMod.exe
528	Update.exe
2012	Update.exe
1740	WeMod.exe

pid	process
1616	WeMod-Setup-638150482199886000.exe
1452	WeMod.exe
1452	WeMod.exe
1740	WeMod.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

Need for Speed Most Wanted Trainer Setup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DOMStorage	Need for Speed Most Wanted Trainer Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "35"	Need for Speed Most Wanted Trainer Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DOMStorage\api.wemod.com	Need for Speed Most Wanted Trainer Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DOMStorage\api.wemod.com\ = "35"	Need for Speed Most Wanted Trainer Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	Need for Speed Most Wanted Trainer Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DOMStorage\wemod.com	Need for Speed Most Wanted Trainer Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DOMStorage\wemod.com\NumberOfSubdomains = "1"	Need for Speed Most Wanted Trainer Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	Need for Speed Most Wanted Trainer Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DOMStorage\wemod.com\Total = "35"	Need for Speed Most Wanted Trainer Setup.exe

Modifies registry class 7 IoCs

Processes:

WeMod.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\wemod	WeMod.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\wemod\URL Protocol	WeMod.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\wemod\ = "URL:wemod"	WeMod.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\wemod\shell\open\command	WeMod.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\wemod\shell	WeMod.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\wemod\shell\open	WeMod.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\wemod\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\WeMod\\app-8.5.0\\WeMod.exe\" \"%1\""	WeMod.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Update.exeWeMod.exe

pid process

900 Update.exe
900 Update.exe
1740 WeMod.exe
1740 WeMod.exe

pid	process
900	Update.exe
900	Update.exe
1740	WeMod.exe
1740	WeMod.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Need for Speed Most Wanted Trainer Setup.exeUpdate.exeWeMod.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	1408	Need for Speed Most Wanted Trainer Setup.exe
Token: SeDebugPrivilege	900	Update.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: 33	1552	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1552	AUDIODG.EXE
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: 33	1552	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1552	AUDIODG.EXE
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe
Token: SeShutdownPrivilege	1740	WeMod.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Need for Speed Most Wanted Trainer Setup.exe

pid process

1408 Need for Speed Most Wanted Trainer Setup.exe
1408 Need for Speed Most Wanted Trainer Setup.exe

pid	process
1408	Need for Speed Most Wanted Trainer Setup.exe
1408	Need for Speed Most Wanted Trainer Setup.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

Need for Speed Most Wanted Trainer Setup.exeWeMod-Setup-638150482199886000.exeUpdate.exeWeMod.exeUpdate.exeWeMod.exe

description	pid	process	target process
PID 1408 wrote to memory of 1616	1408	Need for Speed Most Wanted Trainer Setup.exe	WeMod-Setup-638150482199886000.exe
PID 1408 wrote to memory of 1616	1408	Need for Speed Most Wanted Trainer Setup.exe	WeMod-Setup-638150482199886000.exe
PID 1408 wrote to memory of 1616	1408	Need for Speed Most Wanted Trainer Setup.exe	WeMod-Setup-638150482199886000.exe
PID 1408 wrote to memory of 1616	1408	Need for Speed Most Wanted Trainer Setup.exe	WeMod-Setup-638150482199886000.exe
PID 1408 wrote to memory of 1616	1408	Need for Speed Most Wanted Trainer Setup.exe	WeMod-Setup-638150482199886000.exe
PID 1408 wrote to memory of 1616	1408	Need for Speed Most Wanted Trainer Setup.exe	WeMod-Setup-638150482199886000.exe
PID 1408 wrote to memory of 1616	1408	Need for Speed Most Wanted Trainer Setup.exe	WeMod-Setup-638150482199886000.exe
PID 1616 wrote to memory of 900	1616	WeMod-Setup-638150482199886000.exe	Update.exe
PID 1616 wrote to memory of 900	1616	WeMod-Setup-638150482199886000.exe	Update.exe
PID 1616 wrote to memory of 900	1616	WeMod-Setup-638150482199886000.exe	Update.exe
PID 1616 wrote to memory of 900	1616	WeMod-Setup-638150482199886000.exe	Update.exe
PID 900 wrote to memory of 1336	900	Update.exe	Squirrel.exe
PID 900 wrote to memory of 1336	900	Update.exe	Squirrel.exe
PID 900 wrote to memory of 1336	900	Update.exe	Squirrel.exe
PID 900 wrote to memory of 1452	900	Update.exe	WeMod.exe
PID 900 wrote to memory of 1452	900	Update.exe	WeMod.exe
PID 900 wrote to memory of 1452	900	Update.exe	WeMod.exe
PID 900 wrote to memory of 1452	900	Update.exe	WeMod.exe
PID 1452 wrote to memory of 528	1452	WeMod.exe	Update.exe
PID 1452 wrote to memory of 528	1452	WeMod.exe	Update.exe
PID 1452 wrote to memory of 528	1452	WeMod.exe	Update.exe
PID 1452 wrote to memory of 528	1452	WeMod.exe	Update.exe
PID 1408 wrote to memory of 2012	1408	Need for Speed Most Wanted Trainer Setup.exe	Update.exe
PID 1408 wrote to memory of 2012	1408	Need for Speed Most Wanted Trainer Setup.exe	Update.exe
PID 1408 wrote to memory of 2012	1408	Need for Speed Most Wanted Trainer Setup.exe	Update.exe
PID 2012 wrote to memory of 1740	2012	Update.exe	WeMod.exe
PID 2012 wrote to memory of 1740	2012	Update.exe	WeMod.exe
PID 2012 wrote to memory of 1740	2012	Update.exe	WeMod.exe
PID 2012 wrote to memory of 1740	2012	Update.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe
PID 1740 wrote to memory of 1372	1740	WeMod.exe	WeMod.exe

C:\Users\Admin\AppData\Local\Temp\Need for Speed Most Wanted Trainer Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Need for Speed Most Wanted Trainer Setup.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408

C:\Users\Admin\AppData\Local\Temp\WeMod-Setup-638150482199886000.exe
"C:\Users\Admin\AppData\Local\Temp\WeMod-Setup-638150482199886000.exe" --silent
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --silent
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900

C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\Squirrel.exe
"C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
4⤵
- Executes dropped EXE
PID:1336

C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\WeMod.exe
"C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\WeMod.exe" --squirrel-install 8.5.0
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1452

C:\Users\Admin\AppData\Local\WeMod\Update.exe
C:\Users\Admin\AppData\Local\WeMod\Update.exe --createShortcut WeMod.exe
5⤵
- Executes dropped EXE
PID:528

C:\Users\Admin\AppData\Local\WeMod\Update.exe
"C:\Users\Admin\AppData\Local\WeMod\Update.exe" --processStart "WeMod.exe" --process-start-args "wemod://titles/29214?_inst=z3ZFI7uQvfcwc3TD"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012

C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\WeMod.exe
"C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\WeMod.exe" wemod://titles/29214?_inst=z3ZFI7uQvfcwc3TD
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740

C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\WeMod.exe
"C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\WeMod.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\WeMod" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=996 --field-trial-handle=1068,i,13737949379859882023,12359080327947342640,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
4⤵
PID:1372

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x570
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" SYSTEM
1⤵
PID:1956

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Filesize
76B

MD5
0b90c6926befa5dbf6d2d8d97e650ea5

SHA1
0c8e2327f01a4c6455a42d5f18e56242d2658082

SHA256
18fc2d9a4c3405043bcd54b2c8193f1fd110a531b83177b168ba3d25bac8ed11

SHA512
24da3d6bddf930d80e04798f5fe60db73748eeeae8238de5bb5a5b7d98df73d66a456159be819d574d5ff5fc6f0663c57ea3044892b810549c26aca168ce8491

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Filesize
1.8MB

MD5
1f4c7ac0f30d95edbe542b77bbdb5ed2

SHA1
f95163ed631e57fc478fa74f5d31ca5106b5c95b

SHA256
6d38745793e383f922f90719d5a9444ddaf9d8a25ae7ad83450a58e4564fe41c

SHA512
e9b9aab1dfbef58a1bf6228e3e820f5b8673c73d53ea28b1519f1ba66fe9dab7c8dc3ba78315e73cfc7f28fce04167c6c4badbf191d9ee5df48d306483d7238a

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Filesize
1.8MB

MD5
1f4c7ac0f30d95edbe542b77bbdb5ed2

SHA1
f95163ed631e57fc478fa74f5d31ca5106b5c95b

SHA256
6d38745793e383f922f90719d5a9444ddaf9d8a25ae7ad83450a58e4564fe41c

SHA512
e9b9aab1dfbef58a1bf6228e3e820f5b8673c73d53ea28b1519f1ba66fe9dab7c8dc3ba78315e73cfc7f28fce04167c6c4badbf191d9ee5df48d306483d7238a

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\WeMod-8.5.0-full.nupkg
Filesize
98.1MB

MD5
660861f1171364698499519c06c22d57

SHA1
30142d06e585bfc832f7fe2b9afbb933f928ac6f

SHA256
4fe7046f9e17618013c0f8038d607ddac3738cf814ace553724bb20a24e4a34c

SHA512
1bc16c595db7f6b7408de8d46c8ba0f2a7869442875624f530ca13c8685c5ddcbb8448c738f1c97c0f2905dc9383689fb7351e4f55df646fe552de664e1a4c6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\WeMod-Setup-638150482199886000.exe
Filesize
98.9MB

MD5
0a79ca5414d0b397ed93437a694622bc

SHA1
882ce3a09f39a9f2b72b7187d92d37fb9d7de57a

SHA256
af93691dcdacad747705b4fd30685b2a3c87edaf30b95db44151905678e3c934

SHA512
8d8abe9214e1fd4cbdccb5d51e0b19be6767b915a44aa15dccbfe3770a07cb6d806a35b7ac0cfeb276b21e15189869ac02aaf5938e42e3dbd931c89c81e21dac

Download Submit
C:\Users\Admin\AppData\Local\WeMod\Update.exe
Filesize
1.8MB

MD5
1f4c7ac0f30d95edbe542b77bbdb5ed2

SHA1
f95163ed631e57fc478fa74f5d31ca5106b5c95b

SHA256
6d38745793e383f922f90719d5a9444ddaf9d8a25ae7ad83450a58e4564fe41c

SHA512
e9b9aab1dfbef58a1bf6228e3e820f5b8673c73d53ea28b1519f1ba66fe9dab7c8dc3ba78315e73cfc7f28fce04167c6c4badbf191d9ee5df48d306483d7238a

Download Submit
C:\Users\Admin\AppData\Local\WeMod\Update.exe
Filesize
1.8MB

MD5
1f4c7ac0f30d95edbe542b77bbdb5ed2

SHA1
f95163ed631e57fc478fa74f5d31ca5106b5c95b

SHA256
6d38745793e383f922f90719d5a9444ddaf9d8a25ae7ad83450a58e4564fe41c

SHA512
e9b9aab1dfbef58a1bf6228e3e820f5b8673c73d53ea28b1519f1ba66fe9dab7c8dc3ba78315e73cfc7f28fce04167c6c4badbf191d9ee5df48d306483d7238a

Download Submit
C:\Users\Admin\AppData\Local\WeMod\WeMod.exe
Filesize
536KB

MD5
17d0bc5867eb50fcb4ccc3462615822c

SHA1
f37cdbaf0e5325a7a3c81ff23060c1ef40d113bf

SHA256
490772e36140b29c8eaebdaf5476cadc0ac6d88786c801a87cc5752047595b38

SHA512
945a09949cbd545558982627c0175a7f4b161dac0d2af931206e768ca182d02df254921ac2b05db18cbdfa81183fe10ee6e319e21bce8be79466cb59cf846cc5

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\Squirrel.exe
Filesize
1.8MB

MD5
72d640aa4ca25f2e9bb6bf63433a2808

SHA1
bc03640081764bf26c9888a252126bf5fa150595

SHA256
e5eb13cd6018bfb0b8576f37f1f9001e299a33f95d0fb59366c57cadb4d1afc7

SHA512
ad37209d607076706d3eb14d12e3b2b371d4ebe14ecce4a602e9e670f22af7e0de422b3bfab75452ee9ec1619fb4e2856edef3a4ab31bd343be15a8b9ea8ab5f

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\WeMod.exe
Filesize
127.9MB

MD5
f663c2b81feb82e55f4bb297116dae17

SHA1
6b210465569dc0081950c390b96fb4dcdd79bcbe

SHA256
10df644e3ba80f0628e02ab1a102d65d949940fe6b2bb4afe1d43d29b92dcf8f

SHA512
73e8fc4b663fdd82c5fc6a61c860dd8cde6c754b7995200e018eaf76c56b51743d53c60b5ab18fedeaea2a380eb49822d2af767c10588203961099b2406c7efc

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\WeMod.exe
Filesize
127.9MB

MD5
f663c2b81feb82e55f4bb297116dae17

SHA1
6b210465569dc0081950c390b96fb4dcdd79bcbe

SHA256
10df644e3ba80f0628e02ab1a102d65d949940fe6b2bb4afe1d43d29b92dcf8f

SHA512
73e8fc4b663fdd82c5fc6a61c860dd8cde6c754b7995200e018eaf76c56b51743d53c60b5ab18fedeaea2a380eb49822d2af767c10588203961099b2406c7efc

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\WeMod.exe
Filesize
127.9MB

MD5
f663c2b81feb82e55f4bb297116dae17

SHA1
6b210465569dc0081950c390b96fb4dcdd79bcbe

SHA256
10df644e3ba80f0628e02ab1a102d65d949940fe6b2bb4afe1d43d29b92dcf8f

SHA512
73e8fc4b663fdd82c5fc6a61c860dd8cde6c754b7995200e018eaf76c56b51743d53c60b5ab18fedeaea2a380eb49822d2af767c10588203961099b2406c7efc

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\WeMod.exe
Filesize
127.9MB

MD5
f663c2b81feb82e55f4bb297116dae17

SHA1
6b210465569dc0081950c390b96fb4dcdd79bcbe

SHA256
10df644e3ba80f0628e02ab1a102d65d949940fe6b2bb4afe1d43d29b92dcf8f

SHA512
73e8fc4b663fdd82c5fc6a61c860dd8cde6c754b7995200e018eaf76c56b51743d53c60b5ab18fedeaea2a380eb49822d2af767c10588203961099b2406c7efc

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\chrome_100_percent.pak
Filesize
126KB

MD5
44a69827d4aa75426f3c577af2f8618e

SHA1
7bdd115425b05414b64dcdb7d980b92ecd3f15b3

SHA256
bca4401b578a6ac0fe793e8519fed82b5444972b7d6c176ec0369ed13beaad7b

SHA512
5c7bdf1f1deb72c79b860bf48f16c19cb19b4d861c0b6beb585512ad58b1bc4b64e24edfcd97233e5b91dcd0f63ed1c7b278d22ec062fd0dfe28fe49cae52049

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\chrome_200_percent.pak
Filesize
175KB

MD5
9c379fc04a7bf1a853b14834f58c9f4b

SHA1
c105120fd00001c9ebdf2b3b981ecccb02f8eefb

SHA256
b2c25fb30fee5f04ccdb8bf3c937a667502d266e428425feeb5af964f6167d48

SHA512
f28844dba7780e5f5c9d77ac3d29069dfcd6698447d5723886e510eadd51d6285e06adbda06bf4a69f841afc161c764cb2e5b9ad2c92f0a87176709b4acd2c13

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\ffmpeg.dll
Filesize
2.4MB

MD5
fe1bd381ac07068295f1990e794ada6c

SHA1
3a8c8cfa51d33453392f776be88b9bec50d561ad

SHA256
93f1c82567e50b17ae3270e748d3b1456b260cb718cd20f49b4197c864b1a464

SHA512
78ef7486cc8ddb940c4b3710dd567b9918daea06b4e86740a2fc51a0384638c0bafbadd40d3e37f99af1bf8e5bd1c951f1c1ea3d876494a4d323834f330c781f

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\icudtl.dat
Filesize
10.0MB

MD5
cf9421b601645bda331c7136a0a9c3f8

SHA1
9950d66df9022f1caa941ab0e9647636f7b7a286

SHA256
8d8a74ca376338623170d59c455476218d5a667d5991a52556aa9c9a70ebc5e5

SHA512
bc9601e2b4ab28130bfadfd6f61b3ed500deb0bd235dc5ca94999c09f59d10bdcbf278869a9802f918830041f620c88e2c3b506608ade661db48ccd84c1977eb

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\locales\en-US.pak
Filesize
302KB

MD5
3fef69b20e6f9599e9c2369398e571c0

SHA1
92be2b65b62938e6426ab333c82d70d337666784

SHA256
a99bd31907bbdc12bdfbff7b9da6ddd850c273f3a6ece64ee8d1d9b6ef0c501c

SHA512
3057edfb719c07972fd230514ac5e02f88b04c72356fa4a5e5291677dcbab03297942d5ecdc62c8e58d0088aed4d6ea53806c01f0ea622942feb06584241ad2d

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\resources.pak
Filesize
5.2MB

MD5
f24c85d2b898b6b4de118f6a2e63a244

SHA1
731adfc20807874b70bda7e2661e66ff6987e069

SHA256
aca9267dd8f530135d67240aa897112467bae77cd5fe1a549c69732fdf2803c6

SHA512
b49f6a4eb870b01b48b4cfbf5a73c1727cf7847a9505f7c11ce6befdbef868484867f6e0ac66aea8177ca5cab2abba1cae5ac626a8e3f44fc001cac0fe820c61

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\resources\app.asar
Filesize
6.5MB

MD5
b74477056326a2c0e27a0da6c25422af

SHA1
d8f501d8b4c485f46fae9d9f80c0a2bb2afa912f

SHA256
ae7368363955d479f3afbd0c0d00c3e22cb0f32fa6b2dcf1a782a94a3dc21df8

SHA512
49f7e52847906baa40ba282efd227a2a649d548cdfb42476a9020ae9ad53f308d8aa6d487a194b9208b83bcf545cbea7ae0d3bcd9b294769f132adfde140bd4e

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\resources\app.asar.unpacked\static\unpacked\icon.ico
Filesize
279KB

MD5
34ee19ccd44f31cd831dc50920f19890

SHA1
24545d2f4741fb5a4649840486ffd3597b7ade5b

SHA256
136cf9b3a30268d1d439df7b9fd9104cb1d83be7fd2b562c3e9a47450ae0df3d

SHA512
ded8ade93c143dc8abc7a76b03b4015a8637b2ee13b85dd70655d5857289f19ebef76562eace56a3ad3c2418fab5305bb0b6cadd0a412ddb781b8f496e82c74a

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\squirrel.exe
Filesize
1.8MB

MD5
72d640aa4ca25f2e9bb6bf63433a2808

SHA1
bc03640081764bf26c9888a252126bf5fa150595

SHA256
e5eb13cd6018bfb0b8576f37f1f9001e299a33f95d0fb59366c57cadb4d1afc7

SHA512
ad37209d607076706d3eb14d12e3b2b371d4ebe14ecce4a602e9e670f22af7e0de422b3bfab75452ee9ec1619fb4e2856edef3a4ab31bd343be15a8b9ea8ab5f

Download Submit
C:\Users\Admin\AppData\Local\WeMod\app-8.5.0\v8_context_snapshot.bin
Filesize
590KB

MD5
dd9ca4878bba782613cba372de1c36f4

SHA1
2eefcb6fcaa4b2ed717c952895710be5701871a7

SHA256
ea33ca96024769386ae0ff100c2ae239507006d7340f1f8bbc5bcfb4195f9226

SHA512
0791d3827a6de5745d3424c562b16604cf311ed6fcb4cf62d2c7f54ec0b7f3535b1114e919d2ba6d144cbe9f45418a555ab3fd801078bd8d563a656796f5d4e6

Download Submit
C:\Users\Admin\AppData\Local\WeMod\packages\RELEASES
Filesize
76B

MD5
0b90c6926befa5dbf6d2d8d97e650ea5

SHA1
0c8e2327f01a4c6455a42d5f18e56242d2658082

SHA256
18fc2d9a4c3405043bcd54b2c8193f1fd110a531b83177b168ba3d25bac8ed11

SHA512
24da3d6bddf930d80e04798f5fe60db73748eeeae8238de5bb5a5b7d98df73d66a456159be819d574d5ff5fc6f0663c57ea3044892b810549c26aca168ce8491

Download Submit
C:\Users\Admin\AppData\Local\WeMod\packages\RELEASES
Filesize
76B

MD5
0b90c6926befa5dbf6d2d8d97e650ea5

SHA1
0c8e2327f01a4c6455a42d5f18e56242d2658082

SHA256
18fc2d9a4c3405043bcd54b2c8193f1fd110a531b83177b168ba3d25bac8ed11

SHA512
24da3d6bddf930d80e04798f5fe60db73748eeeae8238de5bb5a5b7d98df73d66a456159be819d574d5ff5fc6f0663c57ea3044892b810549c26aca168ce8491

Download Submit
C:\Users\Admin\AppData\Local\WeMod\packages\RELEASES
Filesize
76B

MD5
0b90c6926befa5dbf6d2d8d97e650ea5

SHA1
0c8e2327f01a4c6455a42d5f18e56242d2658082

SHA256
18fc2d9a4c3405043bcd54b2c8193f1fd110a531b83177b168ba3d25bac8ed11

SHA512
24da3d6bddf930d80e04798f5fe60db73748eeeae8238de5bb5a5b7d98df73d66a456159be819d574d5ff5fc6f0663c57ea3044892b810549c26aca168ce8491

Download Submit
C:\Users\Admin\AppData\Local\WeMod\packages\WeMod-8.5.0-full.nupkg
Filesize
98.1MB

MD5
660861f1171364698499519c06c22d57

SHA1
30142d06e585bfc832f7fe2b9afbb933f928ac6f

SHA256
4fe7046f9e17618013c0f8038d607ddac3738cf814ace553724bb20a24e4a34c

SHA512
1bc16c595db7f6b7408de8d46c8ba0f2a7869442875624f530ca13c8685c5ddcbb8448c738f1c97c0f2905dc9383689fb7351e4f55df646fe552de664e1a4c6f

Download Submit
C:\Users\Admin\AppData\Local\WeMod\packages\WeMod-8.5.0-full.nupkg
Filesize
98.1MB

MD5
660861f1171364698499519c06c22d57

SHA1
30142d06e585bfc832f7fe2b9afbb933f928ac6f

SHA256
4fe7046f9e17618013c0f8038d607ddac3738cf814ace553724bb20a24e4a34c

SHA512
1bc16c595db7f6b7408de8d46c8ba0f2a7869442875624f530ca13c8685c5ddcbb8448c738f1c97c0f2905dc9383689fb7351e4f55df646fe552de664e1a4c6f

Download Submit
C:\Users\Admin\AppData\Local\WeMod\update.exe
Filesize
1.8MB

MD5
1f4c7ac0f30d95edbe542b77bbdb5ed2

SHA1
f95163ed631e57fc478fa74f5d31ca5106b5c95b

SHA256
6d38745793e383f922f90719d5a9444ddaf9d8a25ae7ad83450a58e4564fe41c

SHA512
e9b9aab1dfbef58a1bf6228e3e820f5b8673c73d53ea28b1519f1ba66fe9dab7c8dc3ba78315e73cfc7f28fce04167c6c4badbf191d9ee5df48d306483d7238a

Download Submit
C:\Users\Admin\AppData\Roaming\WeMod\Local Storage\leveldb\CURRENT~RF6d26f2.TMP
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Filesize
1.8MB

MD5
1f4c7ac0f30d95edbe542b77bbdb5ed2

SHA1
f95163ed631e57fc478fa74f5d31ca5106b5c95b

SHA256
6d38745793e383f922f90719d5a9444ddaf9d8a25ae7ad83450a58e4564fe41c

SHA512
e9b9aab1dfbef58a1bf6228e3e820f5b8673c73d53ea28b1519f1ba66fe9dab7c8dc3ba78315e73cfc7f28fce04167c6c4badbf191d9ee5df48d306483d7238a

Download Submit
\Users\Admin\AppData\Local\WeMod\Update.exe
Filesize
1.8MB

MD5
1f4c7ac0f30d95edbe542b77bbdb5ed2

SHA1
f95163ed631e57fc478fa74f5d31ca5106b5c95b

SHA256
6d38745793e383f922f90719d5a9444ddaf9d8a25ae7ad83450a58e4564fe41c

SHA512
e9b9aab1dfbef58a1bf6228e3e820f5b8673c73d53ea28b1519f1ba66fe9dab7c8dc3ba78315e73cfc7f28fce04167c6c4badbf191d9ee5df48d306483d7238a

Download Submit
\Users\Admin\AppData\Local\WeMod\app-8.5.0\ffmpeg.dll
Filesize
2.4MB

MD5
fe1bd381ac07068295f1990e794ada6c

SHA1
3a8c8cfa51d33453392f776be88b9bec50d561ad

SHA256
93f1c82567e50b17ae3270e748d3b1456b260cb718cd20f49b4197c864b1a464

SHA512
78ef7486cc8ddb940c4b3710dd567b9918daea06b4e86740a2fc51a0384638c0bafbadd40d3e37f99af1bf8e5bd1c951f1c1ea3d876494a4d323834f330c781f

Download Submit
\Users\Admin\AppData\Local\WeMod\app-8.5.0\ffmpeg.dll
Filesize
2.4MB

MD5
fe1bd381ac07068295f1990e794ada6c

SHA1
3a8c8cfa51d33453392f776be88b9bec50d561ad

SHA256
93f1c82567e50b17ae3270e748d3b1456b260cb718cd20f49b4197c864b1a464

SHA512
78ef7486cc8ddb940c4b3710dd567b9918daea06b4e86740a2fc51a0384638c0bafbadd40d3e37f99af1bf8e5bd1c951f1c1ea3d876494a4d323834f330c781f

Download Submit
memory/528-259-0x000000001B290000-0x000000001B310000-memory.dmp

Filesize
512KB

Download
memory/528-256-0x0000000000BB0000-0x0000000000D86000-memory.dmp

Filesize
1.8MB

Download
memory/900-248-0x000000001A920000-0x000000001A9A0000-memory.dmp

Filesize
512KB

Download
memory/900-139-0x000000001A920000-0x000000001A9A0000-memory.dmp

Filesize
512KB

Download
memory/900-134-0x00000000008E0000-0x0000000000AB6000-memory.dmp

Filesize
1.8MB

Download
memory/1336-239-0x00000000013D0000-0x00000000015AC000-memory.dmp

Filesize
1.9MB

Download
memory/1372-299-0x00000000086D0000-0x00000000086D1000-memory.dmp

Filesize
4KB

Download
memory/1408-57-0x000000001B3A0000-0x000000001B420000-memory.dmp

Filesize
512KB

Download
memory/1408-55-0x000000001B3A0000-0x000000001B420000-memory.dmp

Filesize
512KB

Download
memory/1408-56-0x000000001B3A0000-0x000000001B420000-memory.dmp

Filesize
512KB

Download
memory/1408-54-0x0000000000110000-0x0000000000136000-memory.dmp

Filesize
152KB

Download
memory/1408-98-0x0000000022490000-0x0000000022C36000-memory.dmp

Filesize
7.6MB

Download
memory/1408-119-0x000000001B3A0000-0x000000001B420000-memory.dmp

Filesize
512KB

Download
memory/1408-120-0x000000001B3A0000-0x000000001B420000-memory.dmp

Filesize
512KB

Download
memory/1408-212-0x000000001B3A0000-0x000000001B420000-memory.dmp

Filesize
512KB

Download
memory/1740-346-0x000000000A790000-0x000000000A791000-memory.dmp

Filesize
4KB

Download
memory/2012-278-0x0000000000160000-0x0000000000336000-memory.dmp

Filesize
1.8MB

Download