Analysis

  • max time kernel
    14s
  • max time network
    17s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 17:30

General

  • Target

    launcher.exe

  • Size

    58.2MB

  • MD5

    1c3909bb429348cea2730f439c29f298

  • SHA1

    39f9f86a92be55e33873f9673a704d57f2a25850

  • SHA256

    1ac16f35f80fbb7e9db66957c297adfbcf1822291e0c324b78193ac921e22854

  • SHA512

    235db4e08251518d68e60bedcecdff6cdd7e922419abe61753ca91d49022e09fc7238bffc164706438ea57baf5e2e8d5018d691d1988551da67db09a412e12a1

  • SSDEEP

    1572864:IIB7vFQqMrlpA+Ql4Jd2xTivfSioqidrTPo:IIBJyklm2xen1o9r7

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Loads dropped DLL 53 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Users\Admin\AppData\Local\Temp\launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:8
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:4352
        • C:\Windows\SYSTEM32\netsh.exe
          netsh wlan show profiles
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:2964
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
          3⤵
            PID:4212
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic os get Caption
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:644
          • C:\Windows\System32\Wbem\wmic.exe
            wmic cpu get Name
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2772
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            3⤵
              PID:468
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                4⤵
                • Detects videocard installed
                PID:1556
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
              3⤵
                PID:4492
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            1⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3840
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8203dcc40,0x7ff8203dcc4c,0x7ff8203dcc58
              2⤵
                PID:1904
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,15187840290166707407,11443188229226105789,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1904 /prefetch:2
                2⤵
                  PID:3440
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2136,i,15187840290166707407,11443188229226105789,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2156 /prefetch:3
                  2⤵
                    PID:4500
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,15187840290166707407,11443188229226105789,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2280 /prefetch:8
                    2⤵
                      PID:4360
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,15187840290166707407,11443188229226105789,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3140 /prefetch:1
                      2⤵
                        PID:5040
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,15187840290166707407,11443188229226105789,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3188 /prefetch:1
                        2⤵
                          PID:2240
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4520,i,15187840290166707407,11443188229226105789,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4500 /prefetch:1
                          2⤵
                            PID:1600
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4512,i,15187840290166707407,11443188229226105789,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4688 /prefetch:1
                            2⤵
                              PID:1540
                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                            1⤵
                              PID:4700

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\VCRUNTIME140.dll

                              Filesize

                              116KB

                              MD5

                              be8dbe2dc77ebe7f88f910c61aec691a

                              SHA1

                              a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                              SHA256

                              4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                              SHA512

                              0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\VCRUNTIME140_1.dll

                              Filesize

                              48KB

                              MD5

                              f8dfa78045620cf8a732e67d1b1eb53d

                              SHA1

                              ff9a604d8c99405bfdbbf4295825d3fcbc792704

                              SHA256

                              a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

                              SHA512

                              ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_asyncio.pyd

                              Filesize

                              37KB

                              MD5

                              d9f56d51d32bcbade2d954a9427337dc

                              SHA1

                              d0e5cee77d5038193580335e3271bb5f1fb6bfc4

                              SHA256

                              1b6c23b6f235ad58e4062b1dc4ce2c36f031f1469bf9e60c11e07603ca4656e3

                              SHA512

                              fc18968a319c11b2d9f20a376b93cc74503139506b1c9f9ee3dd226edc1ba753cad85c20368e162c14d26cf2f75f70ae7e82b2b9881088235f5eaca66e8dad66

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_bz2.pyd

                              Filesize

                              48KB

                              MD5

                              9da23eb807a43a954d40048b53a98e6f

                              SHA1

                              e639bd9a27409fc72f36b4ec3383eeecdacb9dc5

                              SHA256

                              02d0d3c0163f69a7e6713742ab98e73321c5298976089fe9a03b6d91d3293ebb

                              SHA512

                              c8d164c8d4722dcd04f13aa11307fddd655e73fd03b15c8056b34252bce925ca679b48032313b8587369500d03574213da20e513c3b4c155099a84de9ac0bba8

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_cffi_backend.cp312-win_amd64.pyd

                              Filesize

                              71KB

                              MD5

                              e8204fbeced1bbe02489cfee909d573e

                              SHA1

                              7625ee886d50ffa837db6e2ade9c74e86f0d4fa2

                              SHA256

                              d0aa34b160311a35ca2b888dbb9423e8990962b7c89655a5e9c1ba97324ace6b

                              SHA512

                              3638126cc76adb7c4aa23c2d62219dfe8a04cffb3dafac50adbd1f53fc603084f48b9240f10fcd92681bc7fb1f0a54159149e4c90f7ee8043a64c3a5c50bd05a

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_ctypes.pyd

                              Filesize

                              59KB

                              MD5

                              78f5225e986641eaebfe2bef27865603

                              SHA1

                              118ac80fdf764f5bfbaad2d803420087b854817d

                              SHA256

                              ae55ad9ad1f4cbc398cd0c87556f1f263505cde025c7c7f2c43ce4ae818eb183

                              SHA512

                              70e18ea660120d60d6bfa17883c2aced276aa858c5da4dca1e1d56203891d996da4f349596c911cb16497db81b42af4ad85e473c3e80f8932557d967c9dad0e4

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_decimal.pyd

                              Filesize

                              107KB

                              MD5

                              c67548fec576c79aa4c7d829ebbcb8fd

                              SHA1

                              3c1dd3daf407257ded9717dadcf017fdd8a2c07c

                              SHA256

                              31c2c5200f59969c7078a5a913067dfcdf326cb0d43754e38893239774286fab

                              SHA512

                              696d76f6baf739aa2a0d1d057df6d3f8cba1008c0528c8060bb3808a775393bf5e61578154e0d1bd0f3162195b108fbe51daf005d29d368447b5c8fe844a338b

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_hashlib.pyd

                              Filesize

                              35KB

                              MD5

                              121f21e4c072b1307ec96e26dbb54f48

                              SHA1

                              fd7ffeb22377db68bd6abce8ea526afa14faad0f

                              SHA256

                              8dac9aa352bfcb960501682d412a9eeebea5d1cdde3771ba9b70a0ae2e08e883

                              SHA512

                              bec606d0b9c4cabc263a4eda3b8cd403e2486a4e3369fe99117386c4d1969248c54d762b465ab5bdf87fdcc7a08bf90aa873064c65063db8cd4dc437e7e1e6c5

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_lzma.pyd

                              Filesize

                              86KB

                              MD5

                              24a598b2caa17caee2e24d2bb97b445d

                              SHA1

                              262f07406e170284fea0c1e41093bfe1c4a25eab

                              SHA256

                              af4ae25b17c7cf23d06e1f37fdefe903a840073266d4314e410a4acec2af6270

                              SHA512

                              7bdf0a599c488436c118523a67ab154a37ffc5aab0ecec95c463bd068d1121b197c0ebb91dc7db3cf2a3db913abaffd0a60aedb373c0e670c63cd8d85f716f3a

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_multiprocessing.pyd

                              Filesize

                              27KB

                              MD5

                              3cba83d3acab104d0237ca3fd0fda954

                              SHA1

                              6fd08494729a6f3bef6b908365268bdac1e170f1

                              SHA256

                              a50471d9a065b2e4f0fa61fb88c2dcaa04b7f104fae9ea4bc981d0f6fe39e5fc

                              SHA512

                              09105f6e6ad13d8d89ef81f9d8c6273c0c540d29227d653d3e3a86d210030b1737f3779839088bc3ea1e08aaf2de70cf55d5288f34b7441bfbd8999a33b6e2d9

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_overlapped.pyd

                              Filesize

                              33KB

                              MD5

                              ab8d1617e9c0c43c1683a567498c1441

                              SHA1

                              69ee6500c1bb30b437693283075165dec0861433

                              SHA256

                              7779b8fc61da810db720956b3d49c0d1c8cd4e05cc662f767fc8f0088cf923d4

                              SHA512

                              f1f79c4499b135c56eef659b82fc46e3869519c1adf0704c0e5fab34f593c741549c236c0c62610f4c9ee2ea10e9acbccb39474a518b66f41c84b3466c133b01

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_queue.pyd

                              Filesize

                              26KB

                              MD5

                              52e8135f08c61f94b536d1a1c787bf23

                              SHA1

                              6ea0d2bd42d3293273b27ea5fb64abef3361ba3f

                              SHA256

                              fdcd6416bcbaddc8d0e3b029d2c5f621956066cb95c5fa06c948e7eec25152b8

                              SHA512

                              06e75181a0831d1493ecc28a02f2f52fd30c1b53a4053e94a974b577ace6cdc912f1cb7223059cdacecf5fabfff1f2fff2955b1ba8f54ce5b15b7a6eec77c452

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_socket.pyd

                              Filesize

                              44KB

                              MD5

                              886d68f020a8a2232fbcb8ab431ff9f8

                              SHA1

                              65db84d574e9e38281475cb6d86acb94c74ce5b9

                              SHA256

                              199c490b67f4364a78c6ba7df595e13e483e110345d067bf57b3826d3bf06715

                              SHA512

                              bb33bb67ee0204817282373f72a2666aa32e8e47a717e443247bd493853f804949bb59ae3b4a213fcad306d1ced123cd1377e05df3e353400120928597ed34da

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_sqlite3.pyd

                              Filesize

                              57KB

                              MD5

                              4381c00145ed565ed992f415aa4e33da

                              SHA1

                              378be370c2290e9d6a9dee406f989c211cf0efe2

                              SHA256

                              d81d61074ed8a476af01a46eefb32a908eb8ab34f7cf7d4f53dcfd8274a163be

                              SHA512

                              57b527e0a2f55c45e1aaee147adb67933b6f6acd5f8eebe6efe97fc5f8c23f20a1303972b45076565d0bff880b751fc039a85673ee88a77a17f969e17ec0a3a7

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_ssl.pyd

                              Filesize

                              66KB

                              MD5

                              e5353f0aa2c35efd5b4a1a0805a6978c

                              SHA1

                              d92f1066fe79dc1a1afe7ca3c0b9e803aced7e9f

                              SHA256

                              908a3938b962132f3f4429badad0e26a8b138de192a060ca1c1067e2b2ce128a

                              SHA512

                              11c632e69c982a77053fefb22e764dfdb30f6d10abe6c88e2512aa7daf26a0ef59dcc109d262cdb58875f2fba46312027b6e180dc7f0fa24ddc02b78a55c0c28

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_uuid.pyd

                              Filesize

                              25KB

                              MD5

                              8f5402bb6aac9c4ff9b4ce5ac3f0f147

                              SHA1

                              87207e916d0b01047b311d78649763d6e001c773

                              SHA256

                              793e44c75e7d746af2bb5176e46c454225f07cb27b1747f1b83d1748d81ad9ac

                              SHA512

                              65fdef32aeba850aa818a8c8bf794100725a9831b5242350e6c04d0bca075762e1b650f19c437a17b150e9fca6ad344ec4141a041fa12b5a91652361053c7e81

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\_wmi.pyd

                              Filesize

                              28KB

                              MD5

                              9ba21832765a278dfc220426e9c6a2e3

                              SHA1

                              b82716b165f3094b70e41a01b4785ca1b1e2c2de

                              SHA256

                              aa23361fc26c1b91fcc458156eeca0ee869c6f9eca30182ceb2b83c810cfaab4

                              SHA512

                              a9232b7593c29543091c0f7d1043cc1b39ff0b7c324362fe860d3ee0674ca069c93a85d0a8c2bb6133904318f67e448c1fd99e491f0ddda57d8d9f984ed106a3

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\base_library.zip

                              Filesize

                              1.3MB

                              MD5

                              763d1a751c5d47212fbf0caea63f46f5

                              SHA1

                              845eaa1046a47b5cf376b3dbefcf7497af25f180

                              SHA256

                              378a4b40f4fa4a8229c93e0afee819085251af03402ccefa3b469651e50e60b7

                              SHA512

                              bb356dd610e6035f4002671440ce96624addf9a89fd952a6419647a528a551a6ccd0eca0ee2eeb080d9aad683b5afc9415c721fa62c3bcddcb7f1923f59d9c45

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\certifi\cacert.pem

                              Filesize

                              284KB

                              MD5

                              181ac9a809b1a8f1bc39c1c5c777cf2a

                              SHA1

                              9341e715cea2e6207329e7034365749fca1f37dc

                              SHA256

                              488ba960602bf07cc63f4ef7aec108692fec41820fc3328a8e3f3de038149aee

                              SHA512

                              e19a92b94aedcf1282b3ef561bd471ea19ed361334092c55d72425f9183ebd1d30a619e493841b6f75c629f26f28dc682960977941b486c59475f21cf86fff85

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\charset_normalizer\md.cp312-win_amd64.pyd

                              Filesize

                              9KB

                              MD5

                              e4fad9ff1b85862a6afaca2495d9f019

                              SHA1

                              0e47d7c5d4de3a1d7e3bb31bd47ea22cc4ddeac4

                              SHA256

                              e5d362766e9806e7e64709de7e0cff40e03123d821c3f30cac5bac1360e08c18

                              SHA512

                              706fb033fc2079b0aabe969bc51ccb6ffaaf1863daf0e4a83d6f13adc0fedab61cee2b63efb40f033aea22bf96886834d36f50af36e6e25b455e941c1676a30a

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

                              Filesize

                              39KB

                              MD5

                              5c643741418d74c743ca128ff3f50646

                              SHA1

                              0b499a3228865a985d86c1199d14614096efd8a0

                              SHA256

                              2d86563fdfdc39894a53a293810744915192f3b3f40a47526551e66cdb9cb35c

                              SHA512

                              45d02b854557d8f9c25ca8136fa6d3daed24275cc77b1c98038752daed4318bd081c889ff1f4fa8a28e734c9167f477350a8fa863f61729c30c76e7a91d61a97

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\libcrypto-3.dll

                              Filesize

                              1.6MB

                              MD5

                              63eb76eccfe70cff3a3935c0f7e8ba0f

                              SHA1

                              a8dd05dce28b79047e18633aee5f7e68b2f89a36

                              SHA256

                              785c8dde9803f8e1b279895c4e598a57dc7b01e0b1a914764fcedef0d7928b4e

                              SHA512

                              8da31fa77ead8711c0c6ffedcef6314f29d02a95411c6aacec626e150f329a5b96e9fdeae8d1a5e24d1ca5384ae2f0939a5cc0d58eb8bdbc5f00e62736dcc322

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\libffi-8.dll

                              Filesize

                              29KB

                              MD5

                              be8ceb4f7cb0782322f0eb52bc217797

                              SHA1

                              280a7cc8d297697f7f818e4274a7edd3b53f1e4d

                              SHA256

                              7d08df2c496c32281bf9a010b62e8898b9743db8b95a7ebee12d746c2e95d676

                              SHA512

                              07318c71c3137114e0cfec7d8b4815fd6efa51ce70b377121f26dc469cefe041d5098e1c92af8ed0c53b21e9c845fddee4d6646d5bd8395a3f1370ba56a59571

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\libssl-3.dll

                              Filesize

                              222KB

                              MD5

                              7e87c34b39f3a8c332df6e15fd83160b

                              SHA1

                              db712b55f23d8e946c2d91cbbeb7c9a78a92b484

                              SHA256

                              41448b8365b3a75cf33894844496eb03f84e5422b72b90bdcb9866051939c601

                              SHA512

                              eceda8b66736edf7f8e7e6d5a17e280342e989c5195525c697cc02dda80fd82d62c7fd4dc6c4825425bae69a820e1262b8d8cc00dbcd73868a26e16c14ac5559

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\luna.aes

                              Filesize

                              74KB

                              MD5

                              8d854534ccbc91424955a9a6fa06da13

                              SHA1

                              fe5db5ac6c56953dc6965da6a484984177de7e23

                              SHA256

                              0b8df7e04dd5868da88c526a574c646276acea6c994b34964362177cdb899fa7

                              SHA512

                              18b962dd584896c7f17aab751a16c06cf33592e62110b78465ab0eacc96cd4681b5da2ec0c1c4b9dd8e33aa73644135864e4de0f4c947656673be50dfbaea5ad

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\psutil\_psutil_windows.pyd

                              Filesize

                              31KB

                              MD5

                              3adca2ff39adeb3567b73a4ca6d0253c

                              SHA1

                              ae35dde2348c8490f484d1afd0648380090e74fc

                              SHA256

                              92202b877579b74a87be769d58f9d1e8aced8a97336ad70e97d09685a10afeb3

                              SHA512

                              358d109b23cf99eb7396c450660f193e9e16f85f13737ecf29f4369b44f8356041a08443d157b325ccb5125a5f10410659761eda55f24fcc03a082ac8acdd345

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\pyexpat.pyd

                              Filesize

                              88KB

                              MD5

                              cfcb1a1159cc2aadba3c62ac44dc2363

                              SHA1

                              e19df1a6c3dfa545c6b2c20355b24584933d7f9f

                              SHA256

                              279aac95d765000d7b3b09b75e66a311a03833a0e28361683cf41161f37e3331

                              SHA512

                              f7f42bc3eb6a2db706f784e2b772c3ce5d0f87b4b3ff6bda6d2f934aecce0174d52623aad0a082dd1efc0f70c990a07fa9768ac96d42ddb52ea5be594198b447

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\python3.DLL

                              Filesize

                              66KB

                              MD5

                              8dbe9bbf7118f4862e02cd2aaf43f1ab

                              SHA1

                              935bc8c5cea4502d0facf0c49c5f2b9c138608ed

                              SHA256

                              29f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db

                              SHA512

                              938f8387dcc356012ac4a952d371664700b110f7111fcc24f5df7d79791ae95bad0dbaf77d2d6c86c820bfd48a6bdbe8858b7e7ae1a77df88e596556c7135ed4

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\python312.dll

                              Filesize

                              1.7MB

                              MD5

                              ca67f0baf3cc3b7dbb545cda57ba3d81

                              SHA1

                              5b4e36aef877307af8a8f78f3054d068d1a9ce89

                              SHA256

                              f804ed205e82003da6021ee6d2270733ca00992816e7e89ba13617c96dd0fba3

                              SHA512

                              a9f07dd02714c3efba436326425d443969018ace7ebd7cc33c39d43e3d45480a4fcd4c46c09ad132b4f273888f13e9f598de257130429fcb2519c000e4fab6f7

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\select.pyd

                              Filesize

                              25KB

                              MD5

                              6c123b56f3a37c129eff6fc816868b25

                              SHA1

                              ac6b6e3bdc53870ba044a38b9ae9a067b70e7641

                              SHA256

                              99687f9b1648ac684dfb7937c75e3e50dc16704abd4c4c19601c40ec6971c5ee

                              SHA512

                              b840871278a6cc32d5ab0cc6d9c129da0ba2d08b93c3c6c000e3989fe1ab8b09ed82ca547a1057690f52f22e44b203f424e2ccd9655be82a1094547a94ddc3c2

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\INSTALLER

                              Filesize

                              4B

                              MD5

                              365c9bfeb7d89244f2ce01c1de44cb85

                              SHA1

                              d7a03141d5d6b1e88b6b59ef08b6681df212c599

                              SHA256

                              ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                              SHA512

                              d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\setuptools\_vendor\jaraco.text-3.12.1.dist-info\LICENSE

                              Filesize

                              1023B

                              MD5

                              141643e11c48898150daa83802dbc65f

                              SHA1

                              0445ed0f69910eeaee036f09a39a13c6e1f37e12

                              SHA256

                              86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741

                              SHA512

                              ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL

                              Filesize

                              92B

                              MD5

                              43136dde7dd276932f6197bb6d676ef4

                              SHA1

                              6b13c105452c519ea0b65ac1a975bd5e19c50122

                              SHA256

                              189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714

                              SHA512

                              e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

                              Filesize

                              1KB

                              MD5

                              4ce7501f6608f6ce4011d627979e1ae4

                              SHA1

                              78363672264d9cd3f72d5c1d3665e1657b1a5071

                              SHA256

                              37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b

                              SHA512

                              a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\sqlite3.dll

                              Filesize

                              644KB

                              MD5

                              132614956f138f3594d1053e3fac4779

                              SHA1

                              95115f866a87db308ff00af0273e04e31a3fdaae

                              SHA256

                              2a4ae8ca681fa6f8de3b6dbcc3d32652ea3ab3ee7e2be80b7aff822a382ca8ff

                              SHA512

                              5b12b51c78bd72f410e2f53c086322557591d9d66b6d473264fa731763ec2317470009c13cbb9d0985c9006c7f62c4eed14c263295bd7ef11db0bc492c2ca5a0

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\unicodedata.pyd

                              Filesize

                              296KB

                              MD5

                              3d5cb46d212da9843d199f6989b37cd5

                              SHA1

                              ce5e427d49ea1adba9c941140f3502c969b6819e

                              SHA256

                              50a55bc145b1f43e5125ef0b09e508946221d02d5fea1b7550a43d8c8c41c970

                              SHA512

                              c52014c96578db4c7f97878a13ca8c2a4574cc6671689bb554382ad0e593eb87fac55961c7c11ef82b04627fb851ac44848bac9ec91fca0afaa965e4f1f24aa5

                            • C:\Users\Admin\AppData\Local\Temp\_MEI24882\zstandard\backend_c.cp312-win_amd64.pyd

                              Filesize

                              167KB

                              MD5

                              2f12da584a362bad45c6b9b3ddd2445c

                              SHA1

                              86adc05435a9a7dc0b0c676456b15f64d7df6f44

                              SHA256

                              da95d86762fb4ea6a479990e1b91591ccad7d0f88072a7805052cd71168db115

                              SHA512

                              6113292936ea39c45764c240e04a92479403ef6c64aa959922e94f990f8d405299793acbdeb8a4c924d81857e12b3d83e7c8c93c261e8101f4eee44ab77dc92e

                            • C:\Users\Admin\AppData\Local\Temp\muJeJeMWXJ\Browser\history.txt

                              Filesize

                              23B

                              MD5

                              5638715e9aaa8d3f45999ec395e18e77

                              SHA1

                              4e3dc4a1123edddf06d92575a033b42a662fe4ad

                              SHA256

                              4db7f6559c454d34d9c2d557524603c3f52649c2d69b26b6e8384a3d179aeae6

                              SHA512

                              78c96efab1d941e34d3137eae32cef041e2db5b0ebbf883e6a2effa79a323f66e00cfb7c45eb3398b3cbd0469a2be513c3ff63e5622261857eefc1685f77f76b

                            • C:\Users\Admin\AppData\Local\Temp\muJeJeMWXJ\Common Files\BackupPublish.ps1xml

                              Filesize

                              450KB

                              MD5

                              c90235c5fe5e52f3735ba73df7d1d661

                              SHA1

                              df82b722bb987f6756a412b433d34503fc7fd73d

                              SHA256

                              da42ad790fc68b5e852d9bf28a2c0d05e543e42b98507ab156b861e8f1ea81a5

                              SHA512

                              3757d0a197076de35e7093d2eb446449577d940b768b8052d290029ec84f063a5ade9f8af6092160796f15474812ab21bf8ee1071eab036e7e9df345bce6d8b6

                            • C:\Users\Admin\AppData\Local\Temp\muJeJeMWXJ\Common Files\CloseAdd.docx

                              Filesize

                              14KB

                              MD5

                              285dd1889455f6c9145fc573ccd915af

                              SHA1

                              9b7bbb30940f8d41b967f850185f4fabc6bb2342

                              SHA256

                              9641eb054d656939881834370cfb015967fd1fa173540202bac392221ddca35b

                              SHA512

                              61068bf1fe645f763a9ff43886c7f5bb2ffbbde454277c4b5b5e100f110c8ec9bcef02ea3008dcfb5dc0b7375dfd21655321dc07dee12e250970082e3d2c252d

                            • C:\Users\Admin\AppData\Local\Temp\muJeJeMWXJ\Common Files\ConvertExpand.docx

                              Filesize

                              14KB

                              MD5

                              45fc4e86f02942a9e3a7eeb0d557a5dc

                              SHA1

                              49f51dcd92c424fd4ceb5ce1a13aeea36ebd36e4

                              SHA256

                              1d314a5c2a93b81f2df6bfb95a6663480f362028c59f04cc2ecc6e91d1bea42d

                              SHA512

                              63c8c4bd591947a4c080ed83dab8ea8e2c6387bfc8692d7f0d6efa28d3210095f124f29ffd9413341bbb8898507163727c7f3bd06ff8bd30d0448e89b0d66f06

                            • C:\Users\Admin\AppData\Local\Temp\muJeJeMWXJ\Common Files\ExportInstall.doc

                              Filesize

                              842KB

                              MD5

                              20154d159c30cc88e0b96c9b78932c3f

                              SHA1

                              0489249354ccc254402709a276228282134219e4

                              SHA256

                              7cb556cb0ac8a96f121e5615bb2b83f4bc30251bb6e744074ae5e073b18ac2b7

                              SHA512

                              2432aefa68ff612d686717590168d054ab0f85ac4edad5b4c636ec17c7f7c7465dbff17040958579d27b92ab025f77cec30556a4f6cb1b8f5eacf1d5df4befcf

                            • C:\Users\Admin\AppData\Local\Temp\muJeJeMWXJ\Common Files\MountEdit.pdf

                              Filesize

                              587KB

                              MD5

                              8779cd43ef18bef7a2fcc3a7586d9094

                              SHA1

                              209ed6b6bd61f9c2e79064fe05639cca7a479862

                              SHA256

                              a48c15b079bcd8fb790f0660c90af7119d8eededf3b7fb2bae2edd325e351d0d

                              SHA512

                              a702a1c6d3551eee853b7aa1a1a7cf61f0422bc0cd4308547ed3ee8b292bd20ee26e1348b0f0cbfdf2d6bae71818cb1620543d1fea43ab04b73ba0fdb74d5fe2

                            • C:\Users\Admin\AppData\Local\Temp\muJeJeMWXJ\Common Files\RemoveNew.docx

                              Filesize

                              286KB

                              MD5

                              570c4c4c76070497c08f370c96e56583

                              SHA1

                              8889c599756bed08550fcc08431002f527252d17

                              SHA256

                              69a5f861dfd0ea0c554c2ce760031719fecb4af7b5937a4e539492596097ad51

                              SHA512

                              82895af718829df635509c43e1c7230f82b7b332f98f201bb966f358e91f5d04d14dcc436cdfda63ebe2929f121d1256d93ca673116ecd66251834b9cf6efe21

                            • C:\Users\Admin\AppData\Local\Temp\muJeJeMWXJ\Common Files\UnblockUninstall.docx

                              Filesize

                              18KB

                              MD5

                              70056630d612d8682f337f3f68bff8c8

                              SHA1

                              ce86259105f0398b78fcbbc2ed7c47c05e81dce7

                              SHA256

                              a6d1f04ee8bcbdabbb9cef24a9a17a615f5eb2479de1b2f6fe87fccbf2239980

                              SHA512

                              3be9b63c3345646095f0a6423e7f6f63167f45da066a8d334ab405b471f48d082009aa7f47c58e1c0b15b8dd4b4a41a43f3dcb53db06f2ff2d197023994cb930

                            • memory/8-885-0x00007FF82F5E0000-0x00007FF82F5ED000-memory.dmp

                              Filesize

                              52KB

                            • memory/8-939-0x00007FF81F840000-0x00007FF81F84C000-memory.dmp

                              Filesize

                              48KB

                            • memory/8-912-0x00007FF81F910000-0x00007FF81FA2A000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/8-893-0x00007FF826E40000-0x00007FF826E73000-memory.dmp

                              Filesize

                              204KB

                            • memory/8-911-0x00007FF826E10000-0x00007FF826E37000-memory.dmp

                              Filesize

                              156KB

                            • memory/8-910-0x00007FF82F150000-0x00007FF82F15B000-memory.dmp

                              Filesize

                              44KB

                            • memory/8-909-0x00007FF81FA30000-0x00007FF81FAB7000-memory.dmp

                              Filesize

                              540KB

                            • memory/8-889-0x00007FF81FB90000-0x00007FF8200B9000-memory.dmp

                              Filesize

                              5.2MB

                            • memory/8-888-0x00007FF8205B0000-0x00007FF820C75000-memory.dmp

                              Filesize

                              6.8MB

                            • memory/8-870-0x00007FF82FF90000-0x00007FF82FFAA000-memory.dmp

                              Filesize

                              104KB

                            • memory/8-918-0x00007FF82C0B0000-0x00007FF82C0C8000-memory.dmp

                              Filesize

                              96KB

                            • memory/8-917-0x00007FF82FC70000-0x00007FF82FC89000-memory.dmp

                              Filesize

                              100KB

                            • memory/8-923-0x00007FF81C370000-0x00007FF81C4EF000-memory.dmp

                              Filesize

                              1.5MB

                            • memory/8-922-0x00007FF821C30000-0x00007FF821C54000-memory.dmp

                              Filesize

                              144KB

                            • memory/8-920-0x00007FF830100000-0x00007FF83010F000-memory.dmp

                              Filesize

                              60KB

                            • memory/8-933-0x00007FF81F8D0000-0x00007FF81F8DE000-memory.dmp

                              Filesize

                              56KB

                            • memory/8-932-0x00007FF81F8E0000-0x00007FF81F8EC000-memory.dmp

                              Filesize

                              48KB

                            • memory/8-931-0x00007FF81F8F0000-0x00007FF81F8FC000-memory.dmp

                              Filesize

                              48KB

                            • memory/8-930-0x00007FF81F900000-0x00007FF81F90B000-memory.dmp

                              Filesize

                              44KB

                            • memory/8-929-0x00007FF821B30000-0x00007FF821B3C000-memory.dmp

                              Filesize

                              48KB

                            • memory/8-928-0x00007FF821C20000-0x00007FF821C2B000-memory.dmp

                              Filesize

                              44KB

                            • memory/8-927-0x00007FF8274C0000-0x00007FF8274CC000-memory.dmp

                              Filesize

                              48KB

                            • memory/8-926-0x00007FF8274D0000-0x00007FF8274DB000-memory.dmp

                              Filesize

                              44KB

                            • memory/8-925-0x00007FF82DE50000-0x00007FF82DE5B000-memory.dmp

                              Filesize

                              44KB

                            • memory/8-924-0x00007FF82DE60000-0x00007FF82DE74000-memory.dmp

                              Filesize

                              80KB

                            • memory/8-934-0x00007FF81FB90000-0x00007FF8200B9000-memory.dmp

                              Filesize

                              5.2MB

                            • memory/8-943-0x00007FF81C310000-0x00007FF81C32C000-memory.dmp

                              Filesize

                              112KB

                            • memory/8-944-0x00007FF81BEE0000-0x00007FF81C305000-memory.dmp

                              Filesize

                              4.1MB

                            • memory/8-942-0x00007FF81C330000-0x00007FF81C33B000-memory.dmp

                              Filesize

                              44KB

                            • memory/8-941-0x00007FF81C340000-0x00007FF81C36E000-memory.dmp

                              Filesize

                              184KB

                            • memory/8-940-0x00007FF81F810000-0x00007FF81F839000-memory.dmp

                              Filesize

                              164KB

                            • memory/8-894-0x00007FF81FAC0000-0x00007FF81FB8D000-memory.dmp

                              Filesize

                              820KB

                            • memory/8-938-0x00007FF81F850000-0x00007FF81F862000-memory.dmp

                              Filesize

                              72KB

                            • memory/8-937-0x00007FF81F870000-0x00007FF81F87D000-memory.dmp

                              Filesize

                              52KB

                            • memory/8-936-0x00007FF81F880000-0x00007FF81F88C000-memory.dmp

                              Filesize

                              48KB

                            • memory/8-935-0x00007FF81F890000-0x00007FF81F89C000-memory.dmp

                              Filesize

                              48KB

                            • memory/8-945-0x00007FF8164F0000-0x00007FF817897000-memory.dmp

                              Filesize

                              19.7MB

                            • memory/8-948-0x00007FF81F8A0000-0x00007FF81F8AB000-memory.dmp

                              Filesize

                              44KB

                            • memory/8-947-0x00007FF81F8B0000-0x00007FF81F8BB000-memory.dmp

                              Filesize

                              44KB

                            • memory/8-946-0x00007FF81F8C0000-0x00007FF81F8CC000-memory.dmp

                              Filesize

                              48KB

                            • memory/8-950-0x00007FF81BE10000-0x00007FF81BE32000-memory.dmp

                              Filesize

                              136KB

                            • memory/8-949-0x00007FF81FAC0000-0x00007FF81FB8D000-memory.dmp

                              Filesize

                              820KB

                            • memory/8-871-0x00007FF82FF60000-0x00007FF82FF8D000-memory.dmp

                              Filesize

                              180KB

                            • memory/8-966-0x00007FF826E10000-0x00007FF826E37000-memory.dmp

                              Filesize

                              156KB

                            • memory/8-972-0x00007FF81F910000-0x00007FF81FA2A000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/8-1002-0x00007FF821C30000-0x00007FF821C54000-memory.dmp

                              Filesize

                              144KB

                            • memory/8-1001-0x00007FF82C0B0000-0x00007FF82C0C8000-memory.dmp

                              Filesize

                              96KB

                            • memory/8-879-0x00007FF830430000-0x00007FF83043D000-memory.dmp

                              Filesize

                              52KB

                            • memory/8-886-0x00007FF82DE60000-0x00007FF82DE74000-memory.dmp

                              Filesize

                              80KB

                            • memory/8-880-0x00007FF830100000-0x00007FF83010F000-memory.dmp

                              Filesize

                              60KB

                            • memory/8-881-0x00007FF82C880000-0x00007FF82C8B6000-memory.dmp

                              Filesize

                              216KB

                            • memory/8-873-0x00007FF82FC70000-0x00007FF82FC89000-memory.dmp

                              Filesize

                              100KB

                            • memory/8-844-0x00007FF830440000-0x00007FF830465000-memory.dmp

                              Filesize

                              148KB

                            • memory/8-845-0x00007FF8306F0000-0x00007FF8306FF000-memory.dmp

                              Filesize

                              60KB

                            • memory/8-835-0x00007FF8205B0000-0x00007FF820C75000-memory.dmp

                              Filesize

                              6.8MB

                            • memory/8-1068-0x00007FF81C370000-0x00007FF81C4EF000-memory.dmp

                              Filesize

                              1.5MB

                            • memory/8-1049-0x00007FF826E40000-0x00007FF826E73000-memory.dmp

                              Filesize

                              204KB

                            • memory/8-1037-0x00007FF8205B0000-0x00007FF820C75000-memory.dmp

                              Filesize

                              6.8MB

                            • memory/8-1038-0x00007FF830440000-0x00007FF830465000-memory.dmp

                              Filesize

                              148KB

                            • memory/8-1070-0x00007FF81BEE0000-0x00007FF81C305000-memory.dmp

                              Filesize

                              4.1MB

                            • memory/8-1071-0x00007FF8164F0000-0x00007FF817897000-memory.dmp

                              Filesize

                              19.7MB