Overview

overview

8

Static

static

8

LuminaRead...85.exe

windows11-21h2-x64

5

Analysis

  • user interaction
    yes
  • max time kernel
    385s
  • max time network
    380s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/10/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LuminaRead_1.6738.85.exe
  • Size 5.0MB
  • Sample261022-sd9tesds5v
  • SHA256 921eb55037b19e1642ed60c4b95686a52b3d58ce58985b09a7573a77ba4395b2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
discovery

Malware Config

Signatures

  • Drops file in System32 directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 43 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LuminaRead_1.6738.85.exe
    "C:\Users\Admin\AppData\Local\Temp\LuminaRead_1.6738.85.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3052
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\PopCheckpoint.docx" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3892
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2604
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:4088
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        PID:3256
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        PID:4720
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3348
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92ec4c728,0x7ff92ec4c734,0x7ff92ec4c740
          2⤵
            PID:2840
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,4335537859160640546,239042858227128736,262144 --field-trial-handle=1928,i,13033221210500330452,15609714149324445131,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1924 /prefetch:2
            2⤵
              PID:1044
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,16731216567702422295,13345863791750062633,524288 --field-trial-handle=1928,i,13033221210500330452,15609714149324445131,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2252 /prefetch:11
              2⤵
              • System Time Discovery
              PID:1048
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,494618866317459874,7198975703587628140,524288 --field-trial-handle=1928,i,13033221210500330452,15609714149324445131,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2288 /prefetch:13
              2⤵
                PID:3272
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,15335110883420774765,13019732426920955644,2097152 --field-trial-handle=1928,i,13033221210500330452,15609714149324445131,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3412 /prefetch:1
                2⤵
                  PID:1264
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,10845675318763527306,3315422566986475280,2097152 --field-trial-handle=1928,i,13033221210500330452,15609714149324445131,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3488 /prefetch:1
                  2⤵
                    PID:2588
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,11515712324261552326,8964478436940089334,2097152 --field-trial-handle=1928,i,13033221210500330452,15609714149324445131,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4312 /prefetch:9
                    2⤵
                      PID:1916
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4700,i,18039567136506116686,6462099116047658621,2097152 --field-trial-handle=1928,i,13033221210500330452,15609714149324445131,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4640 /prefetch:1
                      2⤵
                        PID:3832
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,6056174907534900250,6762332395778836729,524288 --field-trial-handle=1928,i,13033221210500330452,15609714149324445131,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5492 /prefetch:14
                        2⤵
                          PID:3912
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5536,i,9515182219594208719,14865163166569105245,2097152 --field-trial-handle=1928,i,13033221210500330452,15609714149324445131,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5776 /prefetch:1
                          2⤵
                            PID:3008
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3604,i,17902355676319770378,17724258262577420092,524288 --field-trial-handle=1928,i,13033221210500330452,15609714149324445131,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3588 /prefetch:12
                            2⤵
                              PID:3472
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5928,i,9136073089588908766,13817484562117868240,2097152 --field-trial-handle=1928,i,13033221210500330452,15609714149324445131,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5964 /prefetch:1
                              2⤵
                                PID:724
                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                              1⤵
                                PID:3352
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                1⤵
                                  PID:2284
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                  1⤵
                                    PID:2168
                                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                    1⤵
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4848

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        0841681b-f12a-4a03-999e-4a05213106dc.tmp
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0841681b-f12a-4a03-999e-4a05213106dc.tmp
                                        • Size 270KB
                                        • SHA256 98ef58a63b2a84674e68e676edd3fb6c2030a35adda7090d948b6dee42b753d4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        47e2736a-10f3-44ca-a984-cc17b5dde124.tmp
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\47e2736a-10f3-44ca-a984-cc17b5dde124.tmp
                                        • Size 131KB
                                        • SHA256 b07975e91bf6a9b3d0aa0c6b9132774276f57bcd2beb790f2367ecae85634352
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        settings.dat
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                        • Size 40B
                                        • SHA256 4130e0b99e86f3920bf45678858961e6ffe859b5d71e51567dd608695e5513b9
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        0c80f3ca-66c3-4742-bfc8-ba8083eef54b.tmp
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0c80f3ca-66c3-4742-bfc8-ba8083eef54b.tmp
                                        • Size 13KB
                                        • SHA256 0ed2523153f00d937575e4ca2e02b15675ef62bccf86d6c758e4903c2c89d626
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        965adbd6-80d9-4d86-b6a4-aa2ec8954778.tmp
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\965adbd6-80d9-4d86-b6a4-aa2ec8954778.tmp
                                        • Size 13KB
                                        • SHA256 6051fa6e5ab20a851530b0653d379d7ad6f8f90770c020830b0e37ea52834432
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        9af13f87-c644-4b99-9dc5-26ba3f2264e6.tmp
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9af13f87-c644-4b99-9dc5-26ba3f2264e6.tmp
                                        • Size 6B
                                        • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        temp-index
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
                                        • Size 840B
                                        • SHA256 107cd8eed7e85e492f16eb1ce3b93be415034912da517851436d408c90c05d6b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        09d61224-1e2e-4b7e-9f2c-768c2369b108.tmp
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\09d61224-1e2e-4b7e-9f2c-768c2369b108.tmp
                                        • Size 7KB
                                        • SHA256 ef67e32e00a2672816adc566229b1f380e73c1ac10b7b036ce0fa77828ae8e10
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        26028c5b-991f-492f-9da8-d3ea5cd46a61.tmp
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\26028c5b-991f-492f-9da8-d3ea5cd46a61.tmp
                                        • Size 2B
                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        be703ae6-4996-4d9e-9bf4-f3bbdac64ddc.tmp
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\be703ae6-4996-4d9e-9bf4-f3bbdac64ddc.tmp
                                        • Size 523B
                                        • SHA256 c4150fd961d022efb028d7c90043d508160c34670c033e688aa7480ee99c9202
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        temp-index
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
                                        • Size 120B
                                        • SHA256 4bd628177d6918aa2efaa41d3937b4ee4e32a51c084b543d73c81639a13d0975
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        the-real-index
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                        • Size 96B
                                        • SHA256 2c6ae27d837e43409f064be6e8cc75849620b9c04b321f2e379c454a09543d0b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        temp-index
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
                                        • Size 96B
                                        • SHA256 4e1bdaad545a42e09ce16df9bf8f0c94586a1cd1fb2541dd07c9622b235bc2ce
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        a0d2f8f4-5866-4cfb-8e2f-62349ea42d09.tmp
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a0d2f8f4-5866-4cfb-8e2f-62349ea42d09.tmp
                                        • Size 17KB
                                        • SHA256 4bfbe324691a23a534db53a22993451495e8f99857a002d285586cc0fc8ed7a5
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        dbadbb63-6e89-4bfe-b4a8-a0b49819542d.tmp
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dbadbb63-6e89-4bfe-b4a8-a0b49819542d.tmp
                                        • Size 414B
                                        • SHA256 73c000153c031b6eec1b7ddd435cacd2c5d72a7e548b6fa19f702b40e5f7ceb5
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        data_1
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                        • Size 264KB
                                        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        ce0b3fbc-63f2-4070-94bb-cef1ebb8ad9c.tmp
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ce0b3fbc-63f2-4070-94bb-cef1ebb8ad9c.tmp
                                        • Size 270KB
                                        • SHA256 5bfcd23edb1670a2a557fc3cbad1921d1aee002b17c57b3a0afa0145c737679a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        45BB3CA5-40CF-4F29-877D-FA6B82EB937D
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\45BB3CA5-40CF-4F29-877D-FA6B82EB937D
                                        • Size 582B
                                        • SHA256 19693fd00585902de63888389d3d2f48f18ff0461b7f22ae7f2ef6462f4bbc40
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        D519A0F6-36E9-4A36-8703-895D020EEABC
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\odc.officeapps.live.com\D519A0F6-36E9-4A36-8703-895D020EEABC
                                        • Size 2KB
                                        • SHA256 a1b0b7b33e6818837aa403f7a73af14ae91ec1409cc76e312c712c8786c092f6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ~earchHoverUnifiedTileModelCache.tmp
                                        • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmp
                                        • Size 19KB
                                        • SHA256 291cf1a028ff4e346637ed779edc80756d7fbb93d470a52395f02f11bc604f4e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        sist02.xsl
                                        • Path C:\Users\Admin\AppData\Local\Temp\TCDA482.tmp\sist02.xsl
                                        • Size 245KB
                                        • SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA435.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA435.tmp
                                        • Size 30KB
                                        • SHA256 8077c92c66d15d7e03fbff3a48bd9576b80f698a36a44316eaba81ee8043b673
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA446.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA446.tmp
                                        • Size 31KB
                                        • SHA256 5d13f9907ac381d19f0a7552fd6d9fc07c9bd42c0f9ce017fff75587e1890375
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA447.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA447.tmp
                                        • Size 30KB
                                        • SHA256 e0100320a4f63e07c77138a89ea24a1cbd69784a89fe3bf83e35576114b4ce02
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA457.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA457.tmp
                                        • Size 30KB
                                        • SHA256 cebe759bc4509700e3d23c6a5df8d889132a60ebc92260a74947eaa1089e2789
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA458.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA458.tmp
                                        • Size 30KB
                                        • SHA256 7e1a90cdb2ba7f03abcb4687f0931858bf57e13552e0e4e54ec69a27325011ea
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA459.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA459.tmp
                                        • Size 30KB
                                        • SHA256 434576eb1a16c2d14d666a33edde76717c896d79f45df56742afd90acb9f21ce
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA45A.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA45A.tmp
                                        • Size 28KB
                                        • SHA256 da2f261c3c82e229a097a9302c8580f014bb6442825db47c008da097cfce0ee4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA45B.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA45B.tmp
                                        • Size 34KB
                                        • SHA256 23ccfb7206a8f77a13080998ec6ef95b59b3c3e12b72b2d2ad4e53b0b26bb8c3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA45C.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA45C.tmp
                                        • Size 45KB
                                        • SHA256 40e9af9284ff07fdb75c33a11a794f5333712baa4a6cf82fa529fbaf5ad0fed0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA46D.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA46D.tmp
                                        • Size 32KB
                                        • SHA256 df3fff163924d08517b41455f2d06788ba4e49c68337d15ecf329be48cf7da2d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA481.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA481.tmp
                                        • Size 34KB
                                        • SHA256 9e46b8ba0bad6e534af33015c86396c33c5088d3ae5389217a5e90ba68252374
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA484.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA484.tmp
                                        • Size 18KB
                                        • SHA256 e3be3f1e341c0fa5e9cb79e2739cf0565c6ea6c189ea3e53acf04320459a7070
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA485.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA485.tmp
                                        • Size 21KB
                                        • SHA256 557e0714d5536070131e7e7cdd18f0ef23fe6fb12381040812d022ec0fee7957
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA488.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA488.tmp
                                        • Size 42KB
                                        • SHA256 6f8ffb225f3b8c7ade31a17a02f941fc534e4f7b5ee678b21cd9060282034701
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA48A.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA48A.tmp
                                        • Size 32KB
                                        • SHA256 3c6f66790c543d4e9d8e0e6f476b1acadf0a5fcdd561b8484d8dddadfdf8134b
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA48C.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA48C.tmp
                                        • Size 30KB
                                        • SHA256 d250eb1f93b43efb7654b831b4183c9caec2d12d4efee8607fee70b9fab20730
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA4A0.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA4A0.tmp
                                        • Size 19KB
                                        • SHA256 16c08547239e5b969041ab201eb55a3e30ead400433e926257331cb945dff094
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cabA4E4.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\cabA4E4.tmp
                                        • Size 300KB
                                        • SHA256 3744bfa286cfcff46e51e6a68823a23f55416cd6619156b5929fed1f7778f1c7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        PopCheckpoint.docx.LNK
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\PopCheckpoint.docx.LNK
                                        • Size 1KB
                                        • SHA256 c27e38e3809004e96ea3e29cb3d23a577aece8fbadfc5b9f640ac617e2e46bc9
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        index.dat
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                        • Size 306B
                                        • SHA256 b80580045ac89f190ae69ad60d09f34b8c8316e49af3191e48ab6cc8db72bfe4
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        index.dat
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                        • Size 306B
                                        • SHA256 0cad517f8a1c25418bed55ee8ec2b9046a0f31a2fb2a9949b0802de49ab1f591
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        index.dat
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                        • Size 330B
                                        • SHA256 a63209ac25ed128ff3bad290f0da7d826bcc5e7d2ef50752ed0afee38f8456f6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        CUSTOM.DIC
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
                                        • Size 2B
                                        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        CUSTOM.DIC
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
                                        • Size 16B
                                        • SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        8YRL41EKDDSYVXQWT2J3.temp
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8YRL41EKDDSYVXQWT2J3.temp
                                        • Size 1KB
                                        • SHA256 0183889bba5fdd8385ea33c17c997795ff5e5bb0925353516e528e25a19287bf
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        U3NZ6FFCA6IO7TSZ54Y3.temp
                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U3NZ6FFCA6IO7TSZ54Y3.temp
                                        • Size 1KB
                                        • SHA256 477317d52ca53e72053a6eb6dac36f34ac008ffafba0bf54cf454df537fa489f
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        ~WRD0000.tmp
                                        • Path C:\Users\Admin\Documents\~WRD0000.tmp
                                        • Size 21KB
                                        • SHA256 88d6a715d3f2941124321113197efd96c25a798c811ee8690cacbe21e6ba4ba3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        ~WRD0002.tmp
                                        • Path C:\Users\Admin\Documents\~WRD0002.tmp
                                        • Size 21KB
                                        • SHA256 dec46580cff3c43156e5191613543739340e5e3dbac20db7711712dc1551f245
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        memory/3892-14-0x00007FF8F7EF0000-0x00007FF8F7F00000-memory.dmp
                                        Download

                                        memory/3892-13-0x00007FF8F7EF0000-0x00007FF8F7F00000-memory.dmp
                                        Download

                                        memory/3892-425-0x00007FF93A080000-0x00007FF93A289000-memory.dmp
                                        Download

                                        memory/3892-422-0x00007FF8FA110000-0x00007FF8FA120000-memory.dmp
                                        Download

                                        memory/3892-423-0x00007FF8FA110000-0x00007FF8FA120000-memory.dmp
                                        Download

                                        memory/3892-2-0x00007FF8FA110000-0x00007FF8FA120000-memory.dmp
                                        Download

                                        memory/3892-47-0x00007FF93A080000-0x00007FF93A289000-memory.dmp
                                        Download

                                        memory/3892-424-0x00007FF8FA110000-0x00007FF8FA120000-memory.dmp
                                        Download

                                        memory/3892-7-0x00007FF93A080000-0x00007FF93A289000-memory.dmp
                                        Download

                                        memory/3892-421-0x00007FF8FA110000-0x00007FF8FA120000-memory.dmp
                                        Download

                                        memory/3892-8-0x00007FF93A080000-0x00007FF93A289000-memory.dmp
                                        Download

                                        memory/3892-9-0x00007FF93A080000-0x00007FF93A289000-memory.dmp
                                        Download

                                        memory/3892-10-0x00007FF93A080000-0x00007FF93A289000-memory.dmp
                                        Download

                                        memory/3892-11-0x00007FF93A080000-0x00007FF93A289000-memory.dmp
                                        Download

                                        memory/3892-12-0x00007FF93A080000-0x00007FF93A289000-memory.dmp
                                        Download

                                        memory/3892-1-0x00007FF8FA110000-0x00007FF8FA120000-memory.dmp
                                        Download

                                        memory/3892-3-0x00007FF8FA110000-0x00007FF8FA120000-memory.dmp
                                        Download

                                        memory/3892-6-0x00007FF8FA110000-0x00007FF8FA120000-memory.dmp
                                        Download

                                        memory/3892-4-0x00007FF8FA110000-0x00007FF8FA120000-memory.dmp
                                        Download

                                        memory/3892-5-0x00007FF93A124000-0x00007FF93A125000-memory.dmp
                                        Download