Overview

overview

10

Static

static

5

arewedeaduzz.exe

windows10-2004-x64

10

arewedeaduzz.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/06/2026, 21:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    arewedeaduzz.exe
  • Size 61.5MB
  • Sample260623-1ffblagw2y
  • SHA256 b3f8576971e4ea72ee8b5f574667285f41035d2335b498b8b5da0691dab3743d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecredential_accessdefense_evasiondiscoveryexecutionluna_stealerpersistenceprivilege_escalationransomwarespywarestealerupx

Malware Config

Signatures

  • Family: LunaStealer

    LunaStealer is an infostealer written in Python and packaged with Pyinstaller.

    stealerluna_stealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion
  • Drops startup file 3 IoCs
  • Loads dropped DLL 64 IoCs
  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\arewedeaduzz.exe
    "C:\Users\Admin\AppData\Local\Temp\arewedeaduzz.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3516
    • C:\Users\Admin\AppData\Local\Temp\arewedeaduzz.exe
      "C:\Users\Admin\AppData\Local\Temp\arewedeaduzz.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:2020
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5840
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic csproduct get uuid
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3548
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2324
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic path win32_VideoController get name
            4⤵
            • Detects videocard installed
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4128
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‌​‎ .scr"
          3⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:1304
          • C:\Windows\system32\attrib.exe
            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ ‌​‎ .scr"
            4⤵
            • Drops startup file
            • Views/modifies file attributes
            PID:4692
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"
          3⤵
          • Disables one or more Microsoft Defender components
          • Disables automatic submission of suspicious files to Microsoft by Windows Defender
          • Suspicious use of WriteProcessMemory
          PID:5900
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Disables one or more Microsoft Defender components
            • Suspicious behavior: EnumeratesProcesses
            PID:3836
        • C:\Windows\SYSTEM32\netsh.exe
          netsh wlan show profiles
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:2732
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'""
          3⤵
          • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
          • Suspicious use of WriteProcessMemory
          PID:3264
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:5520
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:5320
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:1384
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic os get Caption"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4116
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic os get Caption
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1316
        • C:\Windows\System32\Wbem\wmic.exe
          wmic cpu get Name
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:5724
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2756
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic path win32_VideoController get name
            4⤵
            • Detects videocard installed
            • Suspicious behavior: EnumeratesProcesses
            PID:1548
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5372
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic computersystem get totalphysicalmemory
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1328
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4180
          • C:\Windows\System32\wbem\WMIC.exe
            C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4764
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1364
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic path softwarelicensingservice get OA3xOriginalProductKey
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:256
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1320
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1892
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:912
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2768
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4140
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4888

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Active Setup

          1
          T1547.014

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Hide Artifacts

          3
          T1564

          File/Path Exclusions

          1
          T1564.012

          Hidden Files and Directories

          2
          T1564.001

          Impair Defenses

          3
          T1562

          Disable or Modify Tools

          3
          T1562.001

          Modify Registry

          2
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          3
          T1552

          Credentials In Files

          3
          T1552.001

          Discovery

          Browser Information Discovery

          1
          T1217

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          3
          T1012

          System Information Discovery

          3
          T1082

          System Network Configuration Discovery

          1
          T1016

          Wi-Fi Discovery

          1
          T1016.002

          Lateral Movement

          Collection

          Data from Local System

          2
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 599B
          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\VCRUNTIME140.dll
          • Size 106KB
          • SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\_asyncio.pyd
          • Size 34KB
          • SHA256 3939fa93efb35bbdead8ed294605a764a08828cdf1d88b7bc835edf8409e835b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\_bz2.pyd
          • Size 46KB
          • SHA256 f68775b81e881f2bddeda06442e44d2c6820db2dbab37fa1852dc411d8e28a85
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\_cffi_backend.cp310-win_amd64.pyd
          • Size 71KB
          • SHA256 8fa7db27750c4351d403271dc525a411840844cc913415eca2b1866c5e9dbd7f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\_ctypes.pyd
          • Size 56KB
          • SHA256 4ad24645396dee635c6900b48704df0ba3f9d728331d207b73d1efa67c8564c6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\_decimal.pyd
          • Size 103KB
          • SHA256 04769e2f8182c32c780f0bc9324f30a1a2a904b5395e2fcffabbc0cc4fcbff5c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\_hashlib.pyd
          • Size 33KB
          • SHA256 228f1f78216051c90e5a9cd5aadce01f5c100fe4e60cccd8bcb92fdcbcdda145
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\_lzma.pyd
          • Size 84KB
          • SHA256 c31b390ad7834ec10dec2ea2af9d110ffd0483df920046c74236ef736b10fbd7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiprocessing.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\_multiprocessing.pyd
          • Size 25KB
          • SHA256 3098b2380f875700f2e3c2b8a61b9f49f91d8d1b0e76a520eaaf4c53d6d9166e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\_overlapped.pyd
          • Size 30KB
          • SHA256 f0690bf7cfbe91a29b4f820ed943211bafd40426c7cd325841259973c1badf10
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\_queue.pyd
          • Size 24KB
          • SHA256 8120ef496869391ea2625009d8151e9989267912ea398f5fe2fba10b0476b8bf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\_socket.pyd
          • Size 41KB
          • SHA256 bd3edf2966e386649aa773a86d4aaf6c9d858bcc794d23953ad1abca2c3c9b3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _sqlite3.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\_sqlite3.pyd
          • Size 48KB
          • SHA256 3212adb3f154cfa01cc366183e631726f3dc22aa4cfb7cdf2ee1a313e53656ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\_ssl.pyd
          • Size 60KB
          • SHA256 773ab4c98a927ae385ee220a3d59240e2cb86eabc9f3e923e27539b340ca3cf3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\_uuid.pyd
          • Size 21KB
          • SHA256 ee2f712585d63ee001de052bc9229d3d0e7cb759b1894e166d9672caee8b13b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\base_library.zip
          • Size 859KB
          • SHA256 3894257c825f74b77e048bdfe56ecdec86a5a7cb735723c32bb4cc3d8d548314
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cacert.pem
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\certifi\cacert.pem
          • Size 287KB
          • SHA256 1605d0d39c5e25d67e7838da6a17dcf2e8c6cfa79030e8fb0318e35f5495493c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          md.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\charset_normalizer\md.cp310-win_amd64.pyd
          • Size 9KB
          • SHA256 595f85c233750daf228b7dc19c28327b06ac9964835a48811d126ea47ab063c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          md__mypyc.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
          • Size 39KB
          • SHA256 b8b328bb6cd58475d7235578f27aef4dfeeefe1abd7198af564cb541cccf5e30
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\libcrypto-1_1.dll
          • Size 1.1MB
          • SHA256 6242d2e13aef871c4b8cfd75fc0f8530e8dccfeaba8f1b66280e9345f52b833b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\libffi-7.dll
          • Size 23KB
          • SHA256 ddfd0755e011ea0df26d77cf3628e2cc59653aee02bf241b54b6b08561520453
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\libssl-1_1.dll
          • Size 203KB
          • SHA256 84e4c37fb28b6cf79e2386163fe6bb094a50c1e8825a4bcdb4cb216f4236d831
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          luna.aes
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\luna.aes
          • Size 6.7MB
          • SHA256 12647042065962b673249c053347a33c6a5dc9668de309c9c9b2b2b7fe032009
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _psutil_windows.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\psutil\_psutil_windows.pyd
          • Size 31KB
          • SHA256 92202b877579b74a87be769d58f9d1e8aced8a97336ad70e97d09685a10afeb3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\pyexpat.pyd
          • Size 86KB
          • SHA256 29759d0d3e02b0d8f4882f91f1bc7e8f2c43f5d8ac3c3a5c3b24f5f7c341ca8a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\python3.dll
          • Size 63KB
          • SHA256 d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python310.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\python310.dll
          • Size 1.4MB
          • SHA256 9db7ebafff20370df1ae6fc5ee98962e03fcfc02ec47abed28802191f6750dd2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pythoncom310.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\pywin32_system32\pythoncom310.dll
          • Size 193KB
          • SHA256 30b5dbd6d41f6128b063cc7f9854944dd0497b0d9cb6ba8e18c8d55f33b7733e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes310.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\pywin32_system32\pywintypes310.dll
          • Size 62KB
          • SHA256 6c4b09b003645f5a581a2406a003916847a60e689492b5d8c8be3cbbd4254244
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\select.pyd
          • Size 24KB
          • SHA256 f02fa3749ba56e11b8e55d7b426cdab61186b7d8e7b3590add9b37fa2ec2c061
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sqlite3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\sqlite3.dll
          • Size 608KB
          • SHA256 afd37cf21f0e8ac613bd6ebfbcf97215f416466fdf34b98207bded5d67f667d7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\unicodedata.pyd
          • Size 287KB
          • SHA256 0c723804b1f1800d273157684771ff22035db92f83146a1a8d0d4b4d0774bb2f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\win32\win32api.pyd
          • Size 48KB
          • SHA256 1fca2edfada089e695d4ec071e4b59bfaca3bd30327f72a92a51ec2cb5de46eb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          backend_c.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI35162\zstandard\backend_c.cp310-win_amd64.pyd
          • Size 174KB
          • SHA256 e07dda20d5403f5beca70c0db5229a7b4f81cc735ec3f9220da0475fce90146e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_f1x0rdip.f1d.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f1x0rdip.f1d.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          cc's.txt
          • Path C:\Users\Admin\AppData\Local\Temp\nG8HAsVUTP\Browser\cc's.txt
          • Size 91B
          • SHA256 c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          cookies.txt
          • Path C:\Users\Admin\AppData\Local\Temp\nG8HAsVUTP\Browser\cookies.txt
          • Size 99B
          • SHA256 2d3bd57cbdba94ace9ae0a2d85e59ba1590e9ee3154661a4716965eff1124202
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          history.txt
          • Path C:\Users\Admin\AppData\Local\Temp\nG8HAsVUTP\Browser\history.txt
          • Size 83B
          • SHA256 7fb621511f8419114230df9e4217ca7063e1480b01122a77d707cc8216ae0bff
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          AssertRestart.docx
          • Path C:\Users\Admin\AppData\Local\Temp\nG8HAsVUTP\Common Files\AssertRestart.docx
          • Size 12KB
          • SHA256 d64e8de1fefe863da39b2a3e053bbe8c1597c9dbd22585f7605b5bb824cc5e41
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ConvertUnprotect.csv
          • Path C:\Users\Admin\AppData\Local\Temp\nG8HAsVUTP\Common Files\ConvertUnprotect.csv
          • Size 710KB
          • SHA256 c668329a0741828ef95535c36d6e56fd511134f055e76ced89f24da914227c84
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GetSearch.xls
          • Path C:\Users\Admin\AppData\Local\Temp\nG8HAsVUTP\Common Files\GetSearch.xls
          • Size 959KB
          • SHA256 8fce8bbe2821246bcf9907dc5206d47498a0d39262e4997f85b0e4488bf6ce26
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          JoinRevoke.docx
          • Path C:\Users\Admin\AppData\Local\Temp\nG8HAsVUTP\Common Files\JoinRevoke.docx
          • Size 19KB
          • SHA256 4c62ba9101fe12686bdcbeaf1595f0d07d8fe7c95158a8b3cab239f9373fddba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MoveRedo.txt
          • Path C:\Users\Admin\AppData\Local\Temp\nG8HAsVUTP\Common Files\MoveRedo.txt
          • Size 778KB
          • SHA256 f655328460d05c04b04673d5cb23f2ebf27ca8b3218978501336f77cfae3161f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtectSelect.xls
          • Path C:\Users\Admin\AppData\Local\Temp\nG8HAsVUTP\Common Files\ProtectSelect.xls
          • Size 470KB
          • SHA256 1dc9ae4d81cf94c5df88a721d860f6739b3ea0d69bc4a9df2d67d1c8b0087652
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2656-748-0x00007FFCD2380000-0x00007FFCD238F000-memory.dmp
          Download

          memory/2656-899-0x00007FFCC2F30000-0x00007FFCC2F59000-memory.dmp
          Download

          memory/2656-806-0x00007FFCB9F10000-0x00007FFCBA285000-memory.dmp
          Download

          memory/2656-805-0x00007FFCCCCA0000-0x00007FFCCCD5C000-memory.dmp
          Download

          memory/2656-798-0x00007FFCCD440000-0x00007FFCCD46E000-memory.dmp
          Download

          memory/2656-812-0x00007FFCD0EA0000-0x00007FFCD0EB4000-memory.dmp
          Download

          memory/2656-796-0x00007FFCD0F20000-0x00007FFCD0F39000-memory.dmp
          Download

          memory/2656-752-0x00007FFCD2360000-0x00007FFCD2379000-memory.dmp
          Download

          memory/2656-819-0x00007FFCC5270000-0x00007FFCC5296000-memory.dmp
          Download

          memory/2656-754-0x00007FFCD0F80000-0x00007FFCD0FAD000-memory.dmp
          Download

          memory/2656-816-0x00007FFCD09D0000-0x00007FFCD09DB000-memory.dmp
          Download

          memory/2656-811-0x00007FFCCCB80000-0x00007FFCCCC98000-memory.dmp
          Download

          memory/2656-809-0x00007FFCCBDF0000-0x00007FFCCBE77000-memory.dmp
          Download

          memory/2656-804-0x000001F33C030000-0x000001F33C3A5000-memory.dmp
          Download

          memory/2656-803-0x00007FFCC52A0000-0x00007FFCC5358000-memory.dmp
          Download

          memory/2656-821-0x00007FFCCDBF0000-0x00007FFCCDBFA000-memory.dmp
          Download

          memory/2656-779-0x00007FFCD0F10000-0x00007FFCD0F1D000-memory.dmp
          Download

          memory/2656-824-0x00007FFCCD240000-0x00007FFCCD258000-memory.dmp
          Download

          memory/2656-826-0x00007FFCCD1F0000-0x00007FFCCD20F000-memory.dmp
          Download

          memory/2656-828-0x00007FFCCD440000-0x00007FFCCD46E000-memory.dmp
          Download

          memory/2656-830-0x00007FFCBAC40000-0x00007FFCBADB1000-memory.dmp
          Download

          memory/2656-829-0x00007FFCC52A0000-0x00007FFCC5358000-memory.dmp
          Download

          memory/2656-832-0x00007FFCC51D0000-0x00007FFCC5208000-memory.dmp
          Download

          memory/2656-831-0x000001F33C030000-0x000001F33C3A5000-memory.dmp
          Download

          memory/2656-834-0x00007FFCCDBE0000-0x00007FFCCDBEB000-memory.dmp
          Download

          memory/2656-836-0x00007FFCCD1B0000-0x00007FFCCD1BC000-memory.dmp
          Download

          memory/2656-837-0x00007FFCCCB70000-0x00007FFCCCB7B000-memory.dmp
          Download

          memory/2656-838-0x00007FFCCC6D0000-0x00007FFCCC6DC000-memory.dmp
          Download

          memory/2656-841-0x00007FFCCD240000-0x00007FFCCD258000-memory.dmp
          Download

          memory/2656-843-0x00007FFCCB6F0000-0x00007FFCCB6FC000-memory.dmp
          Download

          memory/2656-847-0x00007FFCC73D0000-0x00007FFCC73DC000-memory.dmp
          Download

          memory/2656-849-0x00007FFCC51C0000-0x00007FFCC51CB000-memory.dmp
          Download

          memory/2656-851-0x00007FFCC51A0000-0x00007FFCC51AC000-memory.dmp
          Download

          memory/2656-854-0x00007FFCC5160000-0x00007FFCC516C000-memory.dmp
          Download

          memory/2656-856-0x00007FFCC5150000-0x00007FFCC515B000-memory.dmp
          Download

          memory/2656-857-0x00007FFCC2F10000-0x00007FFCC2F2C000-memory.dmp
          Download

          memory/2656-858-0x00007FFCB9C30000-0x00007FFCB9F0F000-memory.dmp
          Download

          memory/2656-855-0x00007FFCC2F30000-0x00007FFCC2F59000-memory.dmp
          Download

          memory/2656-853-0x00007FFCC5170000-0x00007FFCC5182000-memory.dmp
          Download

          memory/2656-852-0x00007FFCC5190000-0x00007FFCC519D000-memory.dmp
          Download

          memory/2656-850-0x00007FFCC51B0000-0x00007FFCC51BC000-memory.dmp
          Download

          memory/2656-848-0x00007FFCC73C0000-0x00007FFCC73CB000-memory.dmp
          Download

          memory/2656-846-0x00007FFCC51D0000-0x00007FFCC5208000-memory.dmp
          Download

          memory/2656-845-0x00007FFCCB6E0000-0x00007FFCCB6EE000-memory.dmp
          Download

          memory/2656-844-0x00007FFCBAC40000-0x00007FFCBADB1000-memory.dmp
          Download

          memory/2656-842-0x00007FFCCD1F0000-0x00007FFCCD20F000-memory.dmp
          Download

          memory/2656-840-0x00007FFCCBDD0000-0x00007FFCCBDDC000-memory.dmp
          Download

          memory/2656-839-0x00007FFCCBDE0000-0x00007FFCCBDEB000-memory.dmp
          Download

          memory/2656-835-0x00007FFCCD1C0000-0x00007FFCCD1CB000-memory.dmp
          Download

          memory/2656-833-0x00007FFCB9F10000-0x00007FFCBA285000-memory.dmp
          Download

          memory/2656-861-0x00007FFCC2AE0000-0x00007FFCC2B01000-memory.dmp
          Download

          memory/2656-864-0x00007FFCBAB70000-0x00007FFCBABA0000-memory.dmp
          Download

          memory/2656-863-0x00007FFCBABA0000-0x00007FFCBAC3C000-memory.dmp
          Download

          memory/2656-862-0x00007FFCBB330000-0x00007FFCBB352000-memory.dmp
          Download

          memory/2656-859-0x000001F348AC0000-0x000001F34ABB3000-memory.dmp
          Download

          memory/2656-860-0x00007FFCC2EF0000-0x00007FFCC2F07000-memory.dmp
          Download

          memory/2656-865-0x000001F348AC0000-0x000001F34ABB3000-memory.dmp
          Download

          memory/2656-871-0x00007FFCB7320000-0x00007FFCB73D4000-memory.dmp
          Download

          memory/2656-870-0x00007FFCB73E0000-0x00007FFCB73F3000-memory.dmp
          Download

          memory/2656-869-0x00007FFCB7400000-0x00007FFCB741D000-memory.dmp
          Download

          memory/2656-868-0x00007FFCB95F0000-0x00007FFCB9609000-memory.dmp
          Download

          memory/2656-867-0x00007FFCB9B30000-0x00007FFCB9B4A000-memory.dmp
          Download

          memory/2656-866-0x00007FFCBAAE0000-0x00007FFCBAB28000-memory.dmp
          Download

          memory/2656-872-0x00007FFCBAB30000-0x00007FFCBAB63000-memory.dmp
          Download

          memory/2656-879-0x00007FFCD0F20000-0x00007FFCD0F39000-memory.dmp
          Download

          memory/2656-873-0x00007FFCBA290000-0x00007FFCBA6FE000-memory.dmp
          Download

          memory/2656-874-0x00007FFCD49D0000-0x00007FFCD49F4000-memory.dmp
          Download

          memory/2656-800-0x00007FFCD0ED0000-0x00007FFCD0EFE000-memory.dmp
          Download

          memory/2656-737-0x00007FFCBA290000-0x00007FFCBA6FE000-memory.dmp
          Download

          memory/2656-1022-0x00007FFCBA290000-0x00007FFCBA6FE000-memory.dmp
          Download

          memory/2656-1024-0x00007FFCD2380000-0x00007FFCD238F000-memory.dmp
          Download

          memory/2656-1025-0x00007FFCD2360000-0x00007FFCD2379000-memory.dmp
          Download

          memory/2656-782-0x00007FFCD0F00000-0x00007FFCD0F0D000-memory.dmp
          Download

          memory/2656-1026-0x00007FFCD0F80000-0x00007FFCD0FAD000-memory.dmp
          Download

          memory/2656-947-0x00007FFCB9C30000-0x00007FFCB9F0F000-memory.dmp
          Download

          memory/2656-1028-0x00007FFCD0F20000-0x00007FFCD0F39000-memory.dmp
          Download

          memory/2656-953-0x00007FFCBAB70000-0x00007FFCBABA0000-memory.dmp
          Download

          memory/2656-952-0x00007FFCBABA0000-0x00007FFCBAC3C000-memory.dmp
          Download

          memory/2656-784-0x00007FFCD0ED0000-0x00007FFCD0EFE000-memory.dmp
          Download

          memory/2656-788-0x00007FFCBA290000-0x00007FFCBA6FE000-memory.dmp
          Download

          memory/2656-789-0x00007FFCCCCA0000-0x00007FFCCCD5C000-memory.dmp
          Download

          memory/2656-795-0x00007FFCCCB80000-0x00007FFCCCC98000-memory.dmp
          Download

          memory/2656-792-0x00007FFCD49D0000-0x00007FFCD49F4000-memory.dmp
          Download

          memory/2656-793-0x00007FFCCDC00000-0x00007FFCCDC2B000-memory.dmp
          Download

          memory/2656-777-0x00007FFCD0F20000-0x00007FFCD0F39000-memory.dmp
          Download

          memory/2656-775-0x00007FFCD0F40000-0x00007FFCD0F74000-memory.dmp
          Download

          memory/2656-746-0x00007FFCD49D0000-0x00007FFCD49F4000-memory.dmp
          Download

          memory/2656-994-0x00007FFCD49D0000-0x00007FFCD49F4000-memory.dmp
          Download

          memory/2656-1014-0x00007FFCCD240000-0x00007FFCCD258000-memory.dmp
          Download

          memory/2656-993-0x00007FFCBA290000-0x00007FFCBA6FE000-memory.dmp
          Download

          memory/2656-1006-0x00007FFCCD440000-0x00007FFCCD46E000-memory.dmp
          Download

          memory/2656-1001-0x00007FFCD0F00000-0x00007FFCD0F0D000-memory.dmp
          Download

          memory/2656-1029-0x00007FFCD0F10000-0x00007FFCD0F1D000-memory.dmp
          Download

          memory/2656-1023-0x00007FFCD49D0000-0x00007FFCD49F4000-memory.dmp
          Download

          memory/2656-1032-0x00007FFCCCCA0000-0x00007FFCCCD5C000-memory.dmp
          Download

          memory/2656-1031-0x00007FFCD0ED0000-0x00007FFCD0EFE000-memory.dmp
          Download

          memory/2656-1030-0x00007FFCD0F00000-0x00007FFCD0F0D000-memory.dmp
          Download

          memory/2656-1033-0x00007FFCCDC00000-0x00007FFCCDC2B000-memory.dmp
          Download

          memory/2656-1035-0x00007FFCCD440000-0x00007FFCCD46E000-memory.dmp
          Download

          memory/2656-1043-0x00007FFCCD240000-0x00007FFCCD258000-memory.dmp
          Download

          memory/2656-1045-0x00007FFCB9C20000-0x00007FFCB9C2F000-memory.dmp
          Download

          memory/2656-1042-0x00007FFCCDBF0000-0x00007FFCCDBFA000-memory.dmp
          Download

          memory/2656-1044-0x000001F348AC0000-0x000001F34ABB3000-memory.dmp
          Download

          memory/2656-1053-0x00007FFCB9C30000-0x00007FFCB9F0F000-memory.dmp
          Download

          memory/2656-1056-0x00007FFCC2AE0000-0x00007FFCC2B01000-memory.dmp
          Download

          memory/2656-1055-0x00007FFCC2EF0000-0x00007FFCC2F07000-memory.dmp
          Download

          memory/2656-1054-0x00007FFCBAB30000-0x00007FFCBAB63000-memory.dmp
          Download

          memory/2656-1052-0x00007FFCC2F10000-0x00007FFCC2F2C000-memory.dmp
          Download

          memory/2656-1051-0x00007FFCC5150000-0x00007FFCC515B000-memory.dmp
          Download

          memory/2656-1050-0x00007FFCC2F30000-0x00007FFCC2F59000-memory.dmp
          Download

          memory/2656-1049-0x00007FFCC51D0000-0x00007FFCC5208000-memory.dmp
          Download

          memory/2656-1048-0x00007FFCBAC40000-0x00007FFCBADB1000-memory.dmp
          Download

          memory/2656-1047-0x00007FFCCD1F0000-0x00007FFCCD20F000-memory.dmp
          Download

          memory/2656-1046-0x00007FFCCCB80000-0x00007FFCCCC98000-memory.dmp
          Download

          memory/2656-1041-0x00007FFCC5270000-0x00007FFCC5296000-memory.dmp
          Download

          memory/2656-1037-0x00007FFCB9F10000-0x00007FFCBA285000-memory.dmp
          Download

          memory/2656-1040-0x00007FFCD09D0000-0x00007FFCD09DB000-memory.dmp
          Download

          memory/2656-1039-0x00007FFCD0EA0000-0x00007FFCD0EB4000-memory.dmp
          Download

          memory/2656-1038-0x00007FFCCBDF0000-0x00007FFCCBE77000-memory.dmp
          Download

          memory/2656-1036-0x00007FFCC52A0000-0x00007FFCC5358000-memory.dmp
          Download

          memory/2656-1027-0x00007FFCD0F40000-0x00007FFCD0F74000-memory.dmp
          Download

          memory/3836-907-0x000002AAF63E0000-0x000002AAF63EA000-memory.dmp
          Download

          memory/3836-906-0x000002AAF6720000-0x000002AAF67D2000-memory.dmp
          Download

          memory/3836-905-0x000002AAF63C0000-0x000002AAF63DE000-memory.dmp
          Download

          memory/3836-902-0x000002AADDFA0000-0x000002AADDFC2000-memory.dmp
          Download

          memory/4140-1087-0x000001BE801E0000-0x000001BE802E0000-memory.dmp
          Download

          memory/4140-1132-0x000001BE95720000-0x000001BE95740000-memory.dmp
          Download

          memory/4140-1118-0x000001BE83C90000-0x000001BE83CB0000-memory.dmp
          Download

          memory/4140-1094-0x000001BE83E60000-0x000001BE83F60000-memory.dmp
          Download

          memory/4140-1092-0x000001BE83A30000-0x000001BE83A50000-memory.dmp
          Download

          memory/4888-1263-0x000002111F080000-0x000002111F4B4000-memory.dmp
          Download

          memory/5320-950-0x0000022F23AD0000-0x0000022F23B82000-memory.dmp
          Download

          memory/5520-929-0x000001B438370000-0x000001B438422000-memory.dmp
          Download