lem[.]exe | Triage™

lem.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 d3b3da570c489317ccaa129c2c66cc8765afaf20b5e4ccc24a88dd6b90e64920
MD5 bb74165a5eb382a47e26f4efd8c2f151
SHA1 cb6f613025a9b8cf64bd90ae3813beb4e872e93f
SHA512 b7eee12ed05aed95d20b28fab96ab6f033efa2a70efe38f487a7f19783cd69097b3b0361b12f3a9ce68ee001da0a0a27d0ddfeff9c85b5c668d9b20a2ec153b9
SSDEEP 24576:1s2k09zcWIh8+6jQxF3jkwacXh9+Ip4S1P5v3:1k0Z/NaFzkeh9ES1P9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

bf:ad:0b:32:24:c2:8d:66:a0:19:c5:6b:b3:71:35:9c:17:e0:a4:db:51:3d:54:f9:12:64:d5:a9:8c:c9:a4:c6

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=VideoLAN,O=VideoLAN,L=Paris,C=FR

Chains

Jun 8, 2024

CN=VideoLAN,O=VideoLAN,L=Paris,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=VideoLAN,O=VideoLAN,L=Paris,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

d4:de:e9:64:39:66:7e:1b:48:70:55:68:a6:f0:60:db:fb:96:8f:cf

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=VideoLAN,O=VideoLAN,L=Paris,C=FR

Chains

Jun 8, 2024

CN=VideoLAN,O=VideoLAN,L=Paris,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=VideoLAN,O=VideoLAN,L=Paris,C=FR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=VideoLAN,O=VideoLAN,L=Paris,C=FR

Serial Number

09:d0:8e:bd:a0:6b:e0:7c:81:5e:a7:af:25:ef:68:75

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2024 - Jun 8, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=VideoLAN,O=VideoLAN,L=Paris,C=FR

Serial Number

09:d0:8e:bd:a0:6b:e0:7c:81:5e:a7:af:25:ef:68:75

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 7, 2024 - Jun 8, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Minor OS version

0

Major OS version

5

Entry point

14467

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/Advertising

SHA256 a5526dddd5e0ea2d1d4da2f1e02a1526e6a55a6659ac7188951caaf59355eb5e
MD5 ca91aa4b24fbf692074f6b7c3744b716
SHA1 9b10d76477dd84fe66e846f44bdbd08f5947dfa3
SHA512 80941620390c3f4830f03c72f7284be1c02fd361764b6537d84525be97035c908c68629b938e1bef2acb6ce64ce263521169db89683d3c159bc7c28c5d21dc50
SSDEEP 768:XnPml5Dhh/xGophpZddR6Bzyy3P8uMxworO4aIPxwW9iwczQqrQfy0cSoWtJyDTw:3PmfP/b/psgrO4aK9iwcznrQfy0c4cDM
MD5 SHA1 SHA512 SSDEEP

$TEMP/Ak

SHA256 10b792b6356593166d5c2d19c5ab78a5c4d88df13c2e5c9dc21519c403f18a44
MD5 6f2b48a711ed46bfdbff1f757796bb7f
SHA1 5e25902829f80f4466374f5ea57e5c2882580d60
SHA512 61cae43f9f1f759a76da09d572b9031f9e580f77e7852d215562dbb593c304ab1c5a00b09ea2cfd63d999538f94da301468d3e9c2106398728e4d8f45d0d326c
SSDEEP 1536:rqqdGYynTDYL7Q+mr9R2VgjGpS2Ehkjxx:eaGdDqeb2Xo2IkVx
MD5 SHA1 SHA512 SSDEEP

$TEMP/Appendix

SHA256 f716cfd3992dedc91fd387460eef10278ed02a3712ecd4d44de47434d047b558
MD5 8dc888b7c0b738a1e0ab53d78beb987c
SHA1 e6a726461d4d982e6ff93ca43a3fc5bcc1e72024
SHA512 5cf1e4c43a04c8250b96e91fe2227fb91b949092ef26227d634e465ccc29e5e735a212b6ff0bbabbc394cab709fc873f6a87c576c79fe1e4255b800a5f46db47
SSDEEP 768:A2+9BSCVoyO15DuOKHnrxbxZiUCu2iPaLTQ7Q1tCwqVLwQVn8qT4O:A2+9BBVgCOa1ZBPaPQaEwo0yv
MD5 SHA1 SHA512 SSDEEP

$TEMP/Automobile

SHA256 1caec310bb5559f84c05061a93a7ec4ddd6d617192f7b8cf2f990913f23a4479
MD5 45ac61695010b494ac7753a47211a9a6
SHA1 87a75c97e7f99870aad40b8a5bd98edd453d4d5a
SHA512 b590bdabdd023a25ccfa0ab7d03860da962ce4dd8a484af5120bb8355fff306b6f02d68b82ca74554970d99afde896dd837d3fbdc77539267d4b1c51dc4192e1
SSDEEP 96:HunQmUO4IYoySAHbUJOfwq2QAyUHMqEP197gjV9kz76/IqRCH:H3LHPHTo1Q319sx9kaq
MD5 SHA1 SHA512 SSDEEP

$TEMP/Beverages

SHA256 183f0c5f3bcdc8cf4af78080681fe13d4ab8aac8c167dbb8c2b8a440983b5ee2
MD5 afe142fbaa8f964884b5e1b306e412f4
SHA1 1fd19640b044e83de5075b6320680307156ea217
SHA512 cb217fd62a4d0dce5bba5304cde352ca3ed0d731381bb47e93633acc7fcff634eb4995a284a5b683a6bf1a90630f1d795e9b7d06ffc09c1d7d1e14412641dde3
SSDEEP 768:y9Qywqp9sK1xhNGE0psu0nM8+aZKINulI1r:gMK1zN90psu0nMOKzlW
MD5 SHA1 SHA512 SSDEEP

$TEMP/China

SHA256 5542fd17fd4199d8bbaef1d82115a9e1f1f17c5e6409b17c1de92f00077e3557
MD5 a7d0496a90e3889a464f0860183e2570
SHA1 9299475084edb0361e1fe026afbe3d2bed906001
SHA512 43093e7a6dd6acaf6128e82439880f69d0676512d6951a7d2628964fd10b153de59549bb97a1a9506366a16c871e00f3715695cf7ca7c6da976ce05511870e52
SSDEEP 384:eM1geStviK3YDejvRb0IyyZxSNBtFuskTdKvMxGHr4skzqs8cEaRYIbrHr1beQ+g:eM1gHYqj51rZxSNnLUshL5kf87wYeHZb
MD5 SHA1 SHA512 SSDEEP

$TEMP/Failing

SHA256 b6b2ac5a581567cb095a6519cf0ac50d20bfb5b0d95b69cccacc84714a925c8a
MD5 83cc36e7d1f024e855da1721f42edebe
SHA1 8d958775289d4c52bb7035a7f6ab5c97ad47053c
SHA512 b0f0b6100580b5a4ad7c506f8d6f797f7d8aad8d1016983bae0f0abf10a54d60caa74c4ad95272282cce46dd8609c1babbb8652d0f7e2c3383d35946e7c0811d
SSDEEP 384:ZUi4kBM+bYXcqmjw0YhIR6s6bMkx875rLk+fBDsOc/WY7Jx2pQ44Gkvm:Q5eqMw0jR6s6bvx875rLjDsOc/WY7JxE
MD5 SHA1 SHA512 SSDEEP

$TEMP/Gamma

SHA256 acf7387994a2158a43ce481fe01f854af5e43f7e4acd078c5a0dabad9891e43d
MD5 f68968cd4fa1d7d4466a5dce6f4c84f6
SHA1 ea8c31da0fc2b05e7cdd63aff5901d44d238d037
SHA512 9bb47d45fbfb03990f2a795e9f14a5082e00e30543a4a03c4853f8d181fe6a58755fcfdd70bd213c3df547f72ab2b54c71a0dbfebab429036435b51223211e38
SSDEEP 384:4mE5lTbyuT2sWjtudNIDvFQC7VkxhPfp2hu9i09PrOa3Hww8:4mEusWjcd+DvFQC7VkrHpIu9xhSaAw8
MD5 SHA1 SHA512 SSDEEP

$TEMP/Granted

SHA256 a16af249569396606bcc03f0e2b828187e40e1f507ef07e8150ca1a439d47c20
MD5 12599d2a0d8467dbc2722468687e36fd
SHA1 f35f416fed0a6edde8329b90c89fb139338efe6c
SHA512 7e17c23fee183b223e5017d89fdaf15064ded3dd242c7153e8526c579a521862eaef63e014dc48f392718fa9138546d75137c5c0680f6eacbd711a69ad2df43a
SSDEEP 384:g6HDyOpbM136KeBzC6GFe46JRoGWbHkdzfkfiCbwHmAjesFUpa:gcDP8WBosd0bHazf0Tye4UA
MD5 SHA1 SHA512 SSDEEP

$TEMP/Hi

SHA256 9949938d88359593913780498287069b7b8147d59afc036ee9d9df39237008c9
MD5 e7a924ff527bd91ca864a5e47d7d57d7
SHA1 e989789dc0f5ee0d5edb7cc99af17ef937328ff6
SHA512 137b75cc4d24fb03a03a2b4cacb74b054e5cf075d4c8957387c689614d2bc4cda1935fe4635f3512f268c6558c82dc8b55da92d11a7564ec0818eba2b6d55f2c
SSDEEP 768:9RH7ACViIeTxYEhqHGnqA1sojvqt0hDthFb0GuCsuYCV5mhzw4NKCFOsQW+Bfm4G:96CV21YEsmnq7Cv/+/Coc5m+4Xf8O46t
MD5 SHA1 SHA512 SSDEEP

$TEMP/Immigrants

SHA256 443a1e33174c5f6c5afb73e58dbf6d7cd9957f96af924478c13d13fcaba4bb1c
MD5 1852895869138ca95c88b6d2acaf35e4
SHA1 bf4665e82c3d713305ee890f92c4622dc42bf31e
SHA512 34296090d08a68fde2397c010755c668a63736046c4d2a10b0490c75893dfd9b1cc300be6261479ed692d4ed202c1cca474010b162aedd82511fc2bd632889d2
SSDEEP 768:KlRKw4sWGuv6crjQAVlvZEx2zinQD2tR/i01g:Klao/RIs2ziQD2tR/i0+
MD5 SHA1 SHA512 SSDEEP

$TEMP/Insulin

SHA256 ac6c5c42c7b866e196c00d91d38c105ce1ec6ceb9d42ed42d19966d3a25c3c5b
MD5 0b03ec2247369d1c12c3358dc8ca446d
SHA1 f91e66ef206ac9281c0cb01dc2edad35b44ad370
SHA512 622241f99d3f6560793b9a63f2ea3ffd877b2c33c4557dd910f46a097ff3b04ce637fd7348b67bb412e5dce4f5206043da73f35f87afdd6fde2bf99196a9c1de
SSDEEP 1536:v0w9/5Sh4ztrgWVrZ+In23SwFc1vtmgMbFuU:v0g/bZaUAg0FuU
MD5 SHA1 SHA512 SSDEEP

$TEMP/Likewise

SHA256 866f7ffbbfc2f00f20b89c4a00e2ad55f1f89747f85facd0a0fcacf897d2ab95
MD5 14dbcdca4a0dad5c96a0aec4ab29a13d
SHA1 33ce868fa8300564119606c55bd4f335300c72f8
SHA512 5b976f18b18fadc24c44620442f45dc05f9104b6b12f943d8243b171425ca733e8fe1d89f4e2a1b7a8f5983a3b45bb398c328d3fdc08779dfed8325839d81265
SSDEEP 96:wxaWKdRfSTxmJg4kbqkaTbaxTHqQhx/quRzsJ5zz1jpC82mW+hiclKJRe/fKQ1rJ:kCV6qTb4Ph5qRtFpC82rcx/hQ4v3U+n
MD5 SHA1 SHA512 SSDEEP

$TEMP/Manufacturer

SHA256 a14dfc374ae5b1aa23702639b30cb774fa4ed45366491bcff8bba53146561657
MD5 bdfd7b1313ddf10521838be73e198a18
SHA1 c45fbb6b497053e245844753d624ca496fd584eb
SHA512 d31e67184c1419a612191460f3bb7075733b04ffdf51c7f1c574d686936fb3bbe91211beb6fe7abd4dbdf9e71096669457b1ffa38e0d343b89c6a1581c12894f
SSDEEP 768:p/ES4KY2lfwMwstd7t+Jv/awuUw1Q37iehoxQeU3ecejLixwghYEYP3iSRWG7O:Z27EM/awuUwU7KxQefixl2vqWWGC
MD5 SHA1 SHA512 SSDEEP

$TEMP/Middle

SHA256 f8d6c90704462addd02518d5d8d083456f9484370a40def5697317f191b74399
MD5 1847c2e6afd6cd4511a3c7dd95956b87
SHA1 a81fcc1110c17e38dae6aebea798e104d270bd26
SHA512 c64c170a7e15d61f4ad5b596aadb91b82adeb08be6fa073b0ad2d289cbbf4ba15feedbfb1b2b017462e83f6250bb404f890cab6b65cbb75cf6223b3d87d72543
SSDEEP 192:f0HbCNULZhogkx5SgM/L5ORg3BLjtHroiH0uRAFb9gOWZb6njvI8SxvG7boQNsHb:fkXRK5S7njBH0ZngxvkubnOaRCY
MD5 SHA1 SHA512 SSDEEP

$TEMP/Mines

SHA256 a8f6b1f27110519663b2ce7f918f64f43884a6619700621445ba3723d7b965b4
MD5 98163f9b1635664a49e5202d477e9f93
SHA1 6a518b4fb02672762f0f773f0a79971eafee129e
SHA512 1981ce403cd8be44ba0d9d174316fc93c2935f07698b71c0a8eae15a830920a790c6b083c88779aeecd6294bc9d15d839d223802f3d45ed8411a81277bfd00b6
MD5 SHA1 SHA512

$TEMP/Myspace

SHA256 9696688f7ee46d7a1fb80792c3929b248cca9780782aae863d429704639d8703
MD5 94384f6bc21724f7cce78a08293a804c
SHA1 e6cbd084645381e8a799024f450997a3d3970a0b
SHA512 857881eae72d465d9f82871176a56f015e7d170fd206af4b2de8d9b305b8a99e0b0c815c12bdc1f57ae9874fa290b51804c415b32acbb445c04da6262743daee
SSDEEP 192:Db5LNS6gCDZT5Bztld8f93tXjRwzHBkt615q/vcEeQblls0Hn30w+r:Db5LKC/B5lyxtX1wzS61I/vHhH30wW
MD5 SHA1 SHA512 SSDEEP

$TEMP/Nutritional

SHA256 8e50c6305afc5d826d84a45f3770f452191c1e29c4b1a9b9f6b7d8b3fce31c28
MD5 d0421aaff28c59b66bbd9bcb2d7665d3
SHA1 aa93e409b032e0bad51d981fe9c2398a52c257ea
SHA512 e4c60f30ea7869a91b342653da7bae4f649b379ee3e63b8000ebd9f55e0e306b50f64835e72f678a5b921bd169b9319603ae79b14d4d89c401df07d90d78b4ff
SSDEEP 1536:Gjvj5PiuzNvt5DfExgYR5yiPl/UQ6JP04vDcmrIEVi:mPNGR5yiPlcQ4NvoWVi
MD5 SHA1 SHA512 SSDEEP

$TEMP/Optimum

SHA256 04bd58ba9616cc3a1d8a4cff1abc6d1ba6215c06269812951792d380750da8a0
MD5 e2979780e0c920b9bf4d6c8d4a2f2795
SHA1 ec266375f488085f768ebb57c4dfd820675eb871
SHA512 646618cbd5b38c712bbc11ea073266042620f9a47b4dc68ae0efcb30a8c6bbaad2d479ffc8a0caaafb41a0ef3619d71eb844c1b17e2e8fdfef20313d71ab4cf1
SSDEEP 192:5PV1Anp9RpPooYgb7xhTMxkcEVIRBKoA/ieLO9jEPp0s:5PV1E9RDr7bQxqIGoAJSts0s
MD5 SHA1 SHA512 SSDEEP

$TEMP/Pending

SHA256 57b5e786156cafd3ccfe670dd1f6d73c755e5215af9b06046e66c8091315f789
MD5 48bbd312b082b9720023f8f01c53e277
SHA1 36f60723dfc30bd7837f4f8668897ae41951cbb9
SHA512 315fcc0786caab40b08b0bf3e47c73ae87d56df0b4fff49351a33d344e404f9b2add0486860fa1fac95a638406737eece2b10f6f6c1678b77c504244b8591bf7
SSDEEP 3072:jV5Bbus+egRlqu9uPKp4GUatTtqJYHFduC7:x3mfBFUatTLlUC7
MD5 SHA1 SHA512 SSDEEP

$TEMP/Plastics

SHA256 da5fb20b02246a2a1c167321579d3ae997de9d9a23e6b8d898e6446962893068
MD5 a908dd9a60b70d5fc683238ca024b902
SHA1 b208e336519e64908a25bd68513452344a64ff72
SHA512 df24d066d3083cc78ebedb15ed355faf3c7d07a45149c39fca8e4701fcec9703a9c84f4e9a1dcc9b3c9b5f6394b45b315cd3e57190c64b153f41e86eefc68dd3
SSDEEP 384:CSkXDylnffltltZZzz11ppz9KvLoXM4INduLbbOxiVnoXM4INduLbbOxidDQxah0:CSdK8M4INduPbOUGM4INduPbOU+aI4kB
MD5 SHA1 SHA512 SSDEEP

$TEMP/Race

SHA256 b0450f34cbd94fc1c17f8a5e3d8a55b2dd176558e6bdc89655eedf557322019b
MD5 2cabd94c5e53cc162389389819ba859c
SHA1 bb2662dec236636a462e6347ba492b5de68c6c49
SHA512 4a32de9ea1a96033da46a0b65339ef46d18b5b87125f5cd4406d8cee2cda3b9facd3299f9efa379f1ac1d8b1f197aacccfbd33a4f55f3a5be410fdf0ab3c170c
SSDEEP 192:EEMazNFZqTAHCTfN1BvzTK1/7jLjtWwIf5uoDwoQADgGk7ql20MLkKc93i3L3:EEMa1qTdpjvz+ZvNWvfQoEoQvGkwLMwm
MD5 SHA1 SHA512 SSDEEP

$TEMP/Reached

SHA256 f726d7a85b020f63bc9d6d35333b1a90fbf71313197251b328c9ba17d70ed7af
MD5 1621df8276c2401cb9232edc0c203186
SHA1 c30b091a82310ebff8569fdcf7f3ed5826a8184a
SHA512 7b245bf6fbde87475deb30aee362eefde764d6fe7ed94232ba54624548fb1e90294766c28c175642e4a4faa056cbed0104b5b972d7d64ffcc9bf80bd97516e6d
SSDEEP 768:qLQEGBoAyGcjXB2SCursGHv7mlHW7nIhp/lNVi6dFiwc/RGNul1Eovu86eV3QKY/:aRGDox2S3hPt8gNpkU5uG3xYwC
MD5 SHA1 SHA512 SSDEEP

$TEMP/Resident

SHA256 76ea29bcb320600e55703872119912dd0135050aaa0680ca01aadc514e5f02ea
MD5 448fedc2a81e25a6d6d0cace5d7a98f7
SHA1 db6a9ddd0cccbca4c7811dcee2e455a4292ba433
SHA512 9c66c61e7aadf2bf8b8d8bcad20c50c8c24fc1e71fe02e66329f5318815404af18e08a5cf5b034c97a12583bffc9d2fe085a7a2819bef9cd17490a6b82ca83e4
SSDEEP 768:3HxbUsrB0QIY1CKrUtXFDgJjdazaQuPQCAeLb0DE:3Hx56tXFojd6aQuPQCMw
MD5 SHA1 SHA512 SSDEEP

$TEMP/Residents

SHA256 e0dc90c531c6863d456fa03dbfac4153f95c7841c898f9d8841c5a909a09ddac
MD5 eddfb49b0a039b165efe06e33edf37ad
SHA1 7e8c72b8cdb6806ef869c6bca371b937dd3738b8
SHA512 b4b66592864d00448ae3e343a5676ebad5a8fa5f6398ccf936d4cf9c24e8ae0dda0c51d119661ce0217aa1ea8ddfeeb97b384022acbb94dd9fb828ae6fe534f7
SSDEEP 768:n+AGWBA60iPTcf4qSq25N8EH/i6mxyyM0Dj2Bmgari07L:n+l6JPTcUNx6/xhgariw
MD5 SHA1 SHA512 SSDEEP

$TEMP/Secret

SHA256 995d1b705d45492bd720b1dbe3f74d37f6e0d700b65b28febb13bb3fa3f96daa
MD5 80fe93ba081bcd2ec189d029501878ca
SHA1 6f7c3c2dd53899273c87869f237f928b469e48e0
SHA512 e5c3cc83afdfefa1d1ed81d08767e5d37860ccc7ca98633bfd76e958e016d7f911e554f32af4d747f98ea33aa8e235359711fcf3564c0ae2b00d9cbcd76bde59
SSDEEP 384:0QXoSpu88888888888888888888888888888zv888888NfU84444QnoooooooooT:Dx/SW
MD5 SHA1 SHA512 SSDEEP

$TEMP/Slovakia

SHA256 bb24d79db3fd448cca16c1db1fd30e97b2eb4013719e7234b4eb1b028db76172
MD5 77ba11af3b0ac1e81a97c07cd6af2f81
SHA1 3cb0307e64ad3c95bfa6c557e7d9f578e4715e70
SHA512 cb995b1137070b1243429208c4a19f4517a9dc396c06c572239a4e2b24c85cbd55b2bef559961b25c0443fb3c2455de3b2e1588fd388a6a7b61812a1938b3203
SSDEEP 1536:phPc5pLW5N1c+d9YUtq5YdzhtD4RLGki26nWRgRPaM+:ph8p65Nu+dVtqi/x4Rqf21RgaN
MD5 SHA1 SHA512 SSDEEP

$TEMP/Smith

SHA256 df32a06032474cb11913b8ce9b94cf26ca6f2caa6397a0fbfe83342e6e1ef150
MD5 6c691518457f3209eec799c6f9671aef
SHA1 c75d7327295b5e4483e3177a7a605009d97ecdd5
SHA512 be761ce05cb72b7191c55725b6529ad667ba25164c06004398104d4261d2c0e5712efcd65ca5441dc753ae8855469dabcf11aab93cb15f83c6c13c0fce58093b
SSDEEP 1536:ZF/2Zb58naQOect9dKgJfOEtmIcPcDOSnPnKXAMuPt6iziT7qg4AbsV2wn60ptiy:/eZ18naQOecxKA2EtmFPchP1tkT7nbs1
MD5 SHA1 SHA512 SSDEEP

$TEMP/Specifications

SHA256 8f7c5e402d4d76c19c42b46f0debcfdd99c6b2403c4284218ef39a14c042bdc9
MD5 a351ea814b97d581b6f6df357899a8a1
SHA1 0f054f7b2e965db4b0603ccab99eb560d82a2cda
SHA512 8a1a3adc0cde5eb39df0b94c015c93eb605ba1074a8214ebe9c39d10fa1ad59f38b0b0f021f2534e88c29a3923218262b765d9729bcf400907e329e2f2b66a0b
SSDEEP 1536:r4FKJB620g24UpULrX9sEUf6dXCMwOSUx6QLl3GPhimmooLs7ioPUNeinbZcpkss:r4Ezt0ibLrSpkiWx3IhiKogwn9cxH1m
MD5 SHA1 SHA512 SSDEEP

$TEMP/Stats

SHA256 3471829a3c70d0871a10543bbe7becf3e5eaba32bbc274da9f2325bf0b3a7df3
MD5 ad520f194518a11c7447187b8619fd04
SHA1 51dee54b1ac28cb2d388707b6fb032e88638b1b2
SHA512 3bc1c286641b03272048ad77e236d985d7ae42a754ecd46a04d67c926c1ac916fbdf54d91f7eae47e23f902ba9f0e5ccad40b952988cb3ab229049e43c955d12
SSDEEP 192:hHhOmbnnnnn6EkGwuvCbCC99qpF9DAgFKPS/gkh888888SS8888888888888888D:hBcEZbvlF2c/mwft7
MD5 SHA1 SHA512 SSDEEP

$TEMP/Surfaces

SHA256 df5e4a5572729cd7d99c2d4575d2dc97515d4e2ab07f5b2bffc49650de0a8a3d
MD5 739ea96042fc7cd86384ba367a9279bd
SHA1 79d5a3c1ca8a3a15d6e98da095b6b6a64a18edca
SHA512 9750a92feb02a7dea2881e9b15177578ee2115283e0314f174dadb7ba9dc56e101b95560e3f451d681f8908292ef0d7db54e6221a264d9d1e140e360ff639997
SSDEEP 384:vrfCcU0oSMFHEQs4NyYLYeQVuMt2FoLglQRrJZC8w4WxqlVGQl3DPCyR:vjrUTSu7YeQ0p4pZP40VLhDPC+
MD5 SHA1 SHA512 SSDEEP

$TEMP/Uniform

SHA256 b8f7bfd9621c81f65f9194d7f1cb2c3e91716c0478385380fb3cb219937af8e3
MD5 6e17c40514125af32038c0515e080676
SHA1 85fa858d2a5cf7f1036278f5ddb75eb4e6740faf
SHA512 fdb0278b2428454b7617972022865c68bcd64198f44b9cb6105320b34849963667f24c0629cf2a2f0e9d789e281bde9a82b5d7bb8dcd1df348dd973003888fb3
SSDEEP 384:LhU1m2ba7+CG/72va+HHb1GvpCMuECB7GvAd3:dULEGqy+GpxLCB6vm
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

lem.exe

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$TEMP/Advertising

$TEMP/Ak

$TEMP/Appendix

$TEMP/Automobile

$TEMP/Beverages

$TEMP/China

$TEMP/Failing

$TEMP/Gamma

$TEMP/Granted

$TEMP/Hi

$TEMP/Immigrants

$TEMP/Insulin

$TEMP/Likewise

$TEMP/Manufacturer

$TEMP/Middle

$TEMP/Mines

$TEMP/Myspace

$TEMP/Nutritional

$TEMP/Optimum

$TEMP/Pending

$TEMP/Plastics

$TEMP/Race

$TEMP/Reached

$TEMP/Resident

$TEMP/Residents

$TEMP/Secret

$TEMP/Slovakia

$TEMP/Smith

$TEMP/Specifications

$TEMP/Stats

$TEMP/Surfaces

$TEMP/Uniform