luna_stealer | eb505549a8ff64ba5035566cce9f22ae3d8a5083142cde60b4a5d5402b76a2b4

Analysis

user interaction
yes
max time kernel
53s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
essentialmenu-by-Anonik.exe
Size 46.1MB
Sample260706-b2cedscx7m
SHA256 eb505549a8ff64ba5035566cce9f22ae3d8a5083142cde60b4a5d5402b76a2b4
MD5 109ad9ca603f372c99b5db9d769b97ed
SHA1 c49e036d00c58c190baaa7eef6270756d07853b9
SHA512 114ae0262b56e6a541814ee20838ed533c1841673a03b1ef8d7a6d93e7e09699e84e0f4ee650aec45a75daf2113b0da446bc52727d952afc29d81bd326e88b6a
SSDEEP 393216:ov90+5gDkTh2Jp5MwurEUWjsrz7E5PKk9buK+x:W9PvThidb8z7bkEK+
TLSH
T1F9B73399376054A4F986103B966BC8019777FCB25798C39F0AF831A62F437E0CD3AE65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution luna_stealer persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Family: LunaStealer
LunaStealer is an infostealer written in Python and packaged with Pyinstaller.
stealer luna_stealer

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2404	powershell.exe
4012	powershell.exe
3544	powershell.exe
2480	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4272	cmd.exe
4012	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4480	cmd.exe
1156	powershell.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4272	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\essentialmenu-by-Anonik.exe	essentialmenu-by-Anonik.exe

Loads dropped DLL 48 IoCs

pid	Process
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4272	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
12	raw.githubusercontent.com
35	discord.com
36	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	api.ipify.org
10	api.ipify.org

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024413-91.dat	upx
behavioral1/memory/3500-95-0x00007FF908F10000-0x00007FF9095D5000-memory.dmp	upx
behavioral1/memory/3500-106-0x00007FF9166D0000-0x00007FF9166F5000-memory.dmp	upx
behavioral1/memory/3500-109-0x00007FF916820000-0x00007FF91683A000-memory.dmp	upx
behavioral1/files/0x00070000000243f6-129.dat	upx
behavioral1/memory/3500-130-0x00007FF9166A0000-0x00007FF9166CD000-memory.dmp	upx
behavioral1/memory/3500-136-0x00007FF915C50000-0x00007FF915C69000-memory.dmp	upx
behavioral1/files/0x0007000000024416-135.dat	upx
behavioral1/files/0x00070000000243f2-134.dat	upx
behavioral1/memory/3500-133-0x00007FF9167F0000-0x00007FF9167FD000-memory.dmp	upx
behavioral1/files/0x00070000000243f4-127.dat	upx
behavioral1/files/0x00070000000243f3-126.dat	upx
behavioral1/files/0x00070000000243f1-124.dat	upx
behavioral1/files/0x00070000000243f0-123.dat	upx
behavioral1/files/0x00070000000243ef-122.dat	upx
behavioral1/files/0x00070000000243ed-121.dat	upx
behavioral1/files/0x00070000000243ec-120.dat	upx
behavioral1/files/0x00070000000243ea-119.dat	upx
behavioral1/files/0x00070000000243e8-118.dat	upx
behavioral1/files/0x0007000000024418-116.dat	upx
behavioral1/files/0x0007000000024417-115.dat	upx
behavioral1/files/0x0007000000024411-113.dat	upx
behavioral1/files/0x000700000002440e-112.dat	upx
behavioral1/files/0x000700000002440c-111.dat	upx
behavioral1/files/0x00070000000243ee-110.dat	upx
behavioral1/memory/3500-107-0x00007FF917120000-0x00007FF91712F000-memory.dmp	upx
behavioral1/files/0x000700000002440d-103.dat	upx
behavioral1/files/0x00070000000243e9-105.dat	upx
behavioral1/files/0x00070000000243eb-101.dat	upx
behavioral1/memory/3500-143-0x00007FF908F10000-0x00007FF9095D5000-memory.dmp	upx
behavioral1/memory/3500-148-0x00007FF908350000-0x00007FF90841D000-memory.dmp	upx
behavioral1/memory/3500-147-0x00007FF915BA0000-0x00007FF915BD3000-memory.dmp	upx
behavioral1/memory/3500-144-0x00007FF908420000-0x00007FF908949000-memory.dmp	upx
behavioral1/memory/3500-141-0x00007FF915C30000-0x00007FF915C44000-memory.dmp	upx
behavioral1/memory/3500-140-0x00007FF916070000-0x00007FF91607D000-memory.dmp	upx
behavioral1/memory/3500-137-0x00007FF9163A0000-0x00007FF9163AD000-memory.dmp	upx
behavioral1/memory/3500-150-0x00007FF916910000-0x00007FF916926000-memory.dmp	upx
behavioral1/memory/3500-155-0x00007FF9164D0000-0x00007FF916505000-memory.dmp	upx
behavioral1/memory/3500-154-0x00007FF916730000-0x00007FF916742000-memory.dmp	upx
behavioral1/memory/3500-153-0x00007FF9167F0000-0x00007FF9167FD000-memory.dmp	upx
behavioral1/memory/3500-157-0x00007FF916700000-0x00007FF916724000-memory.dmp	upx
behavioral1/memory/3500-159-0x00007FF909B50000-0x00007FF909CCE000-memory.dmp	upx
behavioral1/files/0x0007000000024410-160.dat	upx
behavioral1/memory/3500-162-0x00007FF915C30000-0x00007FF915C44000-memory.dmp	upx
behavioral1/memory/3500-163-0x00007FF9164B0000-0x00007FF9164C8000-memory.dmp	upx
behavioral1/files/0x000700000002441e-164.dat	upx
behavioral1/memory/3500-168-0x00007FF907E60000-0x00007FF907EE7000-memory.dmp	upx
behavioral1/memory/3500-167-0x00007FF915BA0000-0x00007FF915BD3000-memory.dmp	upx
behavioral1/memory/3500-166-0x00007FF908420000-0x00007FF908949000-memory.dmp	upx
behavioral1/files/0x00070000000243fc-169.dat	upx
behavioral1/memory/3500-172-0x00007FF9164A0000-0x00007FF9164AB000-memory.dmp	upx
behavioral1/files/0x00070000000243fd-173.dat	upx
behavioral1/memory/3500-176-0x00007FF907B80000-0x00007FF907C9B000-memory.dmp	upx
behavioral1/memory/3500-175-0x00007FF916470000-0x00007FF916497000-memory.dmp	upx
behavioral1/files/0x00070000000243c0-177.dat	upx
behavioral1/memory/3500-179-0x00007FF916460000-0x00007FF91646B000-memory.dmp	upx
behavioral1/files/0x00070000000243bb-180.dat	upx
behavioral1/memory/3500-182-0x00007FF916450000-0x00007FF91645B000-memory.dmp	upx
behavioral1/files/0x00070000000243bc-183.dat	upx
behavioral1/memory/3500-186-0x00007FF915B50000-0x00007FF915B5C000-memory.dmp	upx
behavioral1/memory/3500-185-0x00007FF9164D0000-0x00007FF916505000-memory.dmp	upx
behavioral1/memory/3500-188-0x00007FF911E80000-0x00007FF911E8B000-memory.dmp	upx
behavioral1/memory/3500-187-0x00007FF916700000-0x00007FF916724000-memory.dmp	upx
behavioral1/memory/3500-194-0x00007FF90F8D0000-0x00007FF90F8DB000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2676	netsh.exe
3960	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1620	WMIC.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
3500	essentialmenu-by-Anonik.exe
1156	powershell.exe
1156	powershell.exe
4012	powershell.exe
4012	powershell.exe
3544	powershell.exe
3544	powershell.exe
2480	powershell.exe
2480	powershell.exe
2404	powershell.exe
2404	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	essentialmenu-by-Anonik.exe
Token: SeIncreaseQuotaPrivilege	1780	WMIC.exe
Token: SeSecurityPrivilege	1780	WMIC.exe
Token: SeTakeOwnershipPrivilege	1780	WMIC.exe
Token: SeLoadDriverPrivilege	1780	WMIC.exe
Token: SeSystemProfilePrivilege	1780	WMIC.exe
Token: SeSystemtimePrivilege	1780	WMIC.exe
Token: SeProfSingleProcessPrivilege	1780	WMIC.exe
Token: SeIncBasePriorityPrivilege	1780	WMIC.exe
Token: SeCreatePagefilePrivilege	1780	WMIC.exe
Token: SeBackupPrivilege	1780	WMIC.exe
Token: SeRestorePrivilege	1780	WMIC.exe
Token: SeShutdownPrivilege	1780	WMIC.exe
Token: SeDebugPrivilege	1780	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1780	WMIC.exe
Token: SeRemoteShutdownPrivilege	1780	WMIC.exe
Token: SeUndockPrivilege	1780	WMIC.exe
Token: SeManageVolumePrivilege	1780	WMIC.exe
Token: 33	1780	WMIC.exe
Token: 34	1780	WMIC.exe
Token: 35	1780	WMIC.exe
Token: 36	1780	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1780	WMIC.exe
Token: SeSecurityPrivilege	1780	WMIC.exe
Token: SeTakeOwnershipPrivilege	1780	WMIC.exe
Token: SeLoadDriverPrivilege	1780	WMIC.exe
Token: SeSystemProfilePrivilege	1780	WMIC.exe
Token: SeSystemtimePrivilege	1780	WMIC.exe
Token: SeProfSingleProcessPrivilege	1780	WMIC.exe
Token: SeIncBasePriorityPrivilege	1780	WMIC.exe
Token: SeCreatePagefilePrivilege	1780	WMIC.exe
Token: SeBackupPrivilege	1780	WMIC.exe
Token: SeRestorePrivilege	1780	WMIC.exe
Token: SeShutdownPrivilege	1780	WMIC.exe
Token: SeDebugPrivilege	1780	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1780	WMIC.exe
Token: SeRemoteShutdownPrivilege	1780	WMIC.exe
Token: SeUndockPrivilege	1780	WMIC.exe
Token: SeManageVolumePrivilege	1780	WMIC.exe
Token: 33	1780	WMIC.exe
Token: 34	1780	WMIC.exe
Token: 35	1780	WMIC.exe
Token: 36	1780	WMIC.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	3544	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeIncreaseQuotaPrivilege	1300	WMIC.exe
Token: SeSecurityPrivilege	1300	WMIC.exe
Token: SeTakeOwnershipPrivilege	1300	WMIC.exe
Token: SeLoadDriverPrivilege	1300	WMIC.exe
Token: SeSystemProfilePrivilege	1300	WMIC.exe
Token: SeSystemtimePrivilege	1300	WMIC.exe
Token: SeProfSingleProcessPrivilege	1300	WMIC.exe
Token: SeIncBasePriorityPrivilege	1300	WMIC.exe
Token: SeCreatePagefilePrivilege	1300	WMIC.exe
Token: SeBackupPrivilege	1300	WMIC.exe
Token: SeRestorePrivilege	1300	WMIC.exe
Token: SeShutdownPrivilege	1300	WMIC.exe
Token: SeDebugPrivilege	1300	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1300	WMIC.exe
Token: SeRemoteShutdownPrivilege	1300	WMIC.exe
Token: SeUndockPrivilege	1300	WMIC.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 3500	740	essentialmenu-by-Anonik.exe	86
PID 3500 wrote to memory of 536	3500	essentialmenu-by-Anonik.exe	88
PID 536 wrote to memory of 1780	536	cmd.exe	90
PID 3500 wrote to memory of 3960	3500	essentialmenu-by-Anonik.exe	92
PID 3500 wrote to memory of 4480	3500	essentialmenu-by-Anonik.exe	95
PID 3960 wrote to memory of 2676	3960	cmd.exe	94
PID 4480 wrote to memory of 1156	4480	cmd.exe	97
PID 3500 wrote to memory of 4272	3500	essentialmenu-by-Anonik.exe	98
PID 4272 wrote to memory of 4012	4272	cmd.exe	100
PID 4272 wrote to memory of 3544	4272	cmd.exe	101
PID 4272 wrote to memory of 2480	4272	cmd.exe	102
PID 4272 wrote to memory of 2404	4272	cmd.exe	103
PID 3500 wrote to memory of 4912	3500	essentialmenu-by-Anonik.exe	115
PID 4912 wrote to memory of 1300	4912	cmd.exe	117
PID 3500 wrote to memory of 2568	3500	essentialmenu-by-Anonik.exe	118
PID 3500 wrote to memory of 3676	3500	essentialmenu-by-Anonik.exe	120
PID 3676 wrote to memory of 1620	3676	cmd.exe	122
PID 3500 wrote to memory of 2116	3500	essentialmenu-by-Anonik.exe	123
PID 2116 wrote to memory of 1076	2116	cmd.exe	125
PID 3500 wrote to memory of 208	3500	essentialmenu-by-Anonik.exe	126
PID 208 wrote to memory of 3904	208	cmd.exe	128

C:\Users\Admin\AppData\Local\Temp\essentialmenu-by-Anonik.exe
"C:\Users\Admin\AppData\Local\Temp\essentialmenu-by-Anonik.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\essentialmenu-by-Anonik.exe
  "C:\Users\Admin\AppData\Local\Temp\essentialmenu-by-Anonik.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
    3⤵
    - Disables one or more Microsoft Defender components
    - Disables automatic submission of suspicious files to Microsoft by Windows Defender
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1300
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    PID:2568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:1076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      PID:3904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cc's.txt

Path C:\Users\Admin\AppData\Local\Temp\McEOxGOZpG\Browser\cc's.txt
Size 91B
SHA256 c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c
MD5 5aa796b6950a92a226cc5c98ed1c47e8
SHA1 6706a4082fc2c141272122f1ca424a446506c44d
SHA512 976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad
TLSH
T1C8B012C4055142A406710123110DB0013C748EE273C4010571AD9018334EC64B389D8E
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\McEOxGOZpG\Browser\history.txt
Size 23B
SHA256 4db7f6559c454d34d9c2d557524603c3f52649c2d69b26b6e8384a3d179aeae6
MD5 5638715e9aaa8d3f45999ec395e18e77
SHA1 4e3dc4a1123edddf06d92575a033b42a662fe4ad
SHA512 78c96efab1d941e34d3137eae32cef041e2db5b0ebbf883e6a2effa79a323f66e00cfb7c45eb3398b3cbd0469a2be513c3ff63e5622261857eefc1685f77f76b
MD5 SHA1 SHA512

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\Cryptodome\Cipher\_raw_cbc.pyd
Size 10KB
SHA256 a3f98cbaefc4ebf7ad9f6e8eb067b44220a8fa72efa4a6a4b015cdb5aa64c58c
MD5 ecb6bcbafea70b91e63bc4d6eac80690
SHA1 83522cbccc21acd51718fe913b7fe1d9777de134
SHA512 dbe980884cb88f77d0570dd1306e5a2e625aefbf61cea84b73650ae936cfa720805f02fe6232d3345ef950fc4cd675091b81fce6849f1583e44966ca064dcbb8
SSDEEP 192:C6LLPGQXSPRw1RVAIATV7KukYj273QJX93ua:C6L7G4SZURV3AMuZa7gJXs
TLSH
T184224CABD236D5F8C93A98B71D328994FA32B86355136B1F1450257E8CFBF802D30721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cfb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\Cryptodome\Cipher\_raw_cfb.pyd
Size 10KB
SHA256 b9941f43c52eed26ffabc190c7b5fff804f1a8dbbdfadd35fc3ab673e7bf2e05
MD5 18e0a95c5cfed7c054e36f3508c3ca78
SHA1 ae480e982f272f1370f60fa08d7f4772dc003920
SHA512 f817a656529f58732c78cb3bce3db25c8859c176cdbe28056b3f6a13d733f4672bd35166e25ab678d7b8e3239b498e23cfd90ec4be5e906d7b0a093bf83ea1e5
SSDEEP 192:CYmTnQI5hJ/fzLf2kyPCeN4Czw4v5RTZG9hiAZkYj273QJXhngQ:anQYZfzByPJ2M/5RVY0AZZa7gJXe
TLSH
T1BE227CBBC65EDABCC82598B12D1FDC68F97538174116371E08F021BA8CB7B905E14772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\Cryptodome\Cipher\_raw_ecb.pyd
Size 9KB
SHA256 a4cf8ec5227cd73909defaca13988cc0e8ecea234986fc28d0cdc4b4c239ac84
MD5 988bc44217fde3aaef9b400519a87acd
SHA1 40d8e43753bd4712e1dd53419fe19ef59044555f
SHA512 45ab5fdda31056e64011655a8e1d6bc37bbc1454614f2c748c84c65400d28820313605636118dca59701418f03f87833780ea4419a57ccf1bae983c5cb03d983
SSDEEP 192:r51aJhdZfybbKUtzyPwkYj273QJXpHbH:r5kKbOUtzSwZa7gJXxH
TLSH
T15D125B97E2BAF9FCC079A2B3010B84D0FA11BC266157570F1896307E9EAAB502933690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\VCRUNTIME140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
TLSH
T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_asyncio.pyd
Size 37KB
SHA256 617eb50897916095a22494d07e5dbe6c427331c9f983b0d4c1a7279513cd6743
MD5 c4e239aa9041cd3a67d03b0476cd9b95
SHA1 4d7d2ee3320e140d94f41cd3224b2740edb156df
SHA512 6168531b24813504adfa56be4a83b7220bc2a3ef4cf9fc67eb72d10f921331927bd4fe4e27b5527cd8b6148071f0f93930000d735338a5e9351fe3b4a7bc35ad
SSDEEP 768:5oQpRY01+6FaPZ1cctEps1IjOnD25YiSyv7qqAMxkEgo:5HpRY01+4Koc51IjOnDM7SyZx7
TLSH
T1C903CFF385A09C75CD439C3038C49628FE767A970AA087E7325CD2538F963915F8A6B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_bz2.pyd
Size 48KB
SHA256 1ac8ca1558305fcdd975b7846c48e006500629bb5639634958e70b51c62762c5
MD5 ba261cfff9d982be6c64982215f937bc
SHA1 435ebd684adc41d632e35513b0b8511a7d19ee33
SHA512 b7597a1ea8118e8604b32f7c4f38ffed05748c18180866570f8820e84840ed4256df1bf5802896aed947ca4b7b99483a48401fe485da48d578ff01457bcfcb0c
SSDEEP 768:/XjTDOU1Mkw8KBJ7QlIRZcz63VPzH8y5GNexMpO/IjCVD0P5YiSyvEAMxkE4s:7nO7kwXBJ78OZENkB/IjCVDc7SyqxJ
TLSH
T18B23CFA396B86D54CD375E7238C0CD29EE3179979454C397310CC26A9FB2383AA935B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_cffi_backend.cp312-win_amd64.pyd
Size 71KB
SHA256 b2ee6d811dc1d94a761ffe691006e23ad00adeb9b710c4f8e7d59f177401aaba
MD5 5ecaaa900fdabc7207cf938e23f5d956
SHA1 40d4d67e8ba1737caa5e0ab69cb08d7f7f4215ae
SHA512 ff03c361adaf5e14101083e9374e8b85f0b74bda2b6c05a0739237b397fa02dbfa8b6b8cadc4ded1d9b64e8ae63d040e1b6ed2cc3947451b6c3f58ed7bfc1cd0
SSDEEP 1536:Rg9T2pP/bFMqQ9QkdM2yDVNA6V0ruP039E9fMKLh3JbC:xJMekdo7VH039ElJ
TLSH
T1B363022A2547DE32C6A3E5F07EF100EE1D39B4214161879BC6B913BEFDF7AE10264562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_ctypes.pyd
Size 59KB
SHA256 3c52af0a44d768a2cdaaa2163d438f09a5913fec85a01b7d591116e9fbd743b1
MD5 be90d040a4bb2b0ac6a57298c56405e9
SHA1 08fa52b63ec9d9a1a4daa3caba22bae81f794ad3
SHA512 5f300657bee15555d54dcc99355c6fbd42a4c05dc76cd3c942daa16895043c50cbd15a77b77d594819a9ed10fe73cdf98fbb49b6a87081b317f66e3ba06ed873
SSDEEP 1536:MQm2JyhT7X84MYNbLlJRiQFM+pIWHIjLPj+7SyANx4:MQ9JyhT7nHnjFXeiIjLPj+6U
TLSH
T1F853E1A384B9BC15CD279D7232E54B21FE31795B4711C3EB211CE2358FB1702AAA6379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_decimal.pyd
Size 105KB
SHA256 c5ff76699e65aba4c629cc060532447d3643fe1c7b34266f8f2bfdd6396d6613
MD5 e359f1c12b1f0708770c4e35f225f424
SHA1 62e55f31fda96b465761f2f28f079741d9df2bf7
SHA512 b884f6d54c123652621654b2bd0679cf0750ed955eee62aacb94e46e55778465c46d76e5b9ea8361a673165c4989044a6c19ac2e9af31f2e877ebbd3e2698e5f
SSDEEP 3072:arlajXG60D6JCd/WQG+nA1kR6rLlG/iIjOql7ph:asC60D6Y/WKAEggD7n
TLSH
T1E9B302B3CAB8F85AF4762D703257C4A4CF35A5438D154BE7220AC216A761316DAF37B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_hashlib.pyd
Size 35KB
SHA256 794ff644b85bbc5bbbeef42eea7997dc51c6cbb4eeb3605beef3a5c8243e1146
MD5 b67c993f7fb4fdc89874d3d2be56ac8e
SHA1 242409935bd0b75d20d39164983573f490f02c03
SHA512 a1c3ec87d23cb6f111c3e6a16da227f3ee223162cddf866975e060c1b49fb580f5a4c210b4bf483d56f2b666afa39b52951ddd34a8ee21ca0156a299a444073a
SSDEEP 768:D665W8yKNUYvmiOhWzYda7jeWMl9pcgvIjOIOL5YiSyveAMxkEQ:WXg6iLYosugvIjOIO17Sy0xs
TLSH
T1C9F2CFE34AB8885CCD76CDB238C94858FF7139578540C3D7218E92BA8FB1741AF66276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_lzma.pyd
Size 86KB
SHA256 b5dffb38a8a869abef827789f12d75ceb6125335be12a7a990c78d8e8417b674
MD5 a03ab3a9a7d7486e4a4333453e0baef9
SHA1 a2fc8b3bb3b3c869b0c43d584f2c667cbbb5a25f
SHA512 e2b341474b60b0f144c03e40ba473c93fc4378a7dcb0385875bec52839d9f5b9e87944801014df177fca740eeb15718da5ae810c66051b785c37c6bac9c51276
SSDEEP 1536:A93ep7MJoKbCKmzzYu0RgKYtpreDVERxzTykTwTGcIjZ14S7SyWxq:6eRgFWKNZRZCeDVEz81IjZ14Sv
TLSH
T17983F15B53B06D14C416DEB338C97818FE317F938B718FA7621DE19AABE17413A92234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_multiprocessing.pyd
Size 27KB
SHA256 96403254e1592b2930d2c3510ca37e49ed22f0de2d2fa8a7924b25e5585667f4
MD5 36785e939d8a7f067f457ad18f69b498
SHA1 7da5c6c0d81cb16bd142e79afa345c803e5ecc84
SHA512 afd1e021f9b42a3ff720e965863a14bd8bf48ec97c1116e4acb8a193a7e4fe12cbe2ea555cac09423bcc5126b193211d6469a830f01fa1b0c80d07b40169f0b4
SSDEEP 384:MYb+Bw0Y+rw8yXSAkAFOZZa7gJXZT0IjWBL+PQBHQIYiSy1pCQnTzOTtAM+o/8EW:nKYdFXQpJT0IjWt+e5YiSyv3ORAMxkEW
TLSH
T1EDC2AFA386746C38CE274DB134D88826EE31BD575901C7DB314C91BA4F31782BEA63B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_overlapped.pyd
Size 33KB
SHA256 fd338e1c6596e96d16bd1faffd233a30c759c006bbe4c4032c0b99a07180d477
MD5 a8b083be8a5b90ad5962df143b6a5c75
SHA1 f69fb708e97125c907f966e0ca3bb858673b0421
SHA512 8a56b857e91da2a7d67fc38254abe2d20fdb56fe39e4983cbcb916bec76b695c98e65b19d9f24f7f2bb5d75d6c1a3e10e27f8a0827387e4613c5027b87552888
SSDEEP 768:Y0T8qG7JbE4YC2DgLSp6rVIjXt+H5YiSyv3AMxkEDJ:Y48DJbTQgL3rVIjXt+Z7SyfxR
TLSH
T1C4F2CFB342709C28D937CEB23AE48919EE31B9D74651C3D7329C91AB4F707416EE2275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_queue.pyd
Size 26KB
SHA256 46f3f3e83a917bfc8733064ec2389343d0adf325e4feff3e45a9ba3038510cbe
MD5 d21ed27b16a8ccfe002eea93ce4b9129
SHA1 6dfbdac6480e56c84292c489bd217b080c001299
SHA512 2c38f36c51094d113385e6816c2e4ac1a96094b983398639b2c25be806120383e3421abaf6446c30bd6e797c0a74f965f5a7a293f1f0d836a3b82e0265b70099
SSDEEP 384:s6I92F0lWEJlgaSrBdgZc8PI8rZa7gJXi+IjQUONSHQIYiSy1pCQy1SAM+o/8E9o:TAvSrBFgpS+IjQUOG5YiSyvwSAMxkEBo
TLSH
T12FC2AEB386B49C68CD238DB134D44D29FE3179934A50C3D7325892AA8F71381ABE53B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_socket.pyd
Size 44KB
SHA256 2dd34b7b49caf4a1f269f48beaf48deee7130932daf8e7fe2b48f5cc901de1da
MD5 0f65c39912ad241bb256e83cef9b6040
SHA1 f9d183b1fdbe99521aecd98781479765596d76d6
SHA512 4669add920acfa8387fee674ed9e52a0fc780cc45f3a1fe1cc0717b754bf7f759b23c1ecc181bb3c7e779be118f04848c1c023e7a51639bba19d0046c84f7cbc
SSDEEP 768:03lDDHqvff0W1WMxvs0xeAlFWJpQT0IjLwDBR5YiSyvyAMxkEo:03lDKfns0P9T0IjLwDBf7Sy4xU
TLSH
T17913D0B24678AC24C962AD3130D4A614FE35B6979490C7E331CCD1998FB47427EA73B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_sqlite3.pyd
Size 57KB
SHA256 ba72af58df3609949a449ba6a432f8bec0afeac93b512a305c98afc12471a0ae
MD5 9a5b2c0290df382355e1205966f5e824
SHA1 44cb64affc35515c97c73aaccb0457aa132f0a04
SHA512 79c7ef5bc5110b78498ff5b11ef18422563409eb7eb6010c5ff435e98f6ed56d794246a6f80296bb0d00ad3e9814eca01f8ed72eeb3dd844cc40e6c7ddf2826b
SSDEEP 1536:PXwJUS8MhCTn+6CEO3k/BSJIjOQzZ7SycxdN:P0UKDv3kqIjOQzZU
TLSH
T1C243E19346B46C25ED67CDB232599A6AA631B6830661CBCA304D817F8F733423ED53F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_ssl.pyd
Size 65KB
SHA256 8fcbe509bc6214d12207698d4df074d1a05d4f1c91afb7340f296e51d2045509
MD5 339143cd70861741a54eb9e7e3a04916
SHA1 e5b9ed5687ae698671c6cbd67555c791978807cd
SHA512 6313b5be550e132881f81b65d5e6ef6b265e95e2068115c026876ac0bdec3029b87093fca254ad816b7030ea4853378b6d5798b908c003bb5544a13f69ea426b
SSDEEP 1536:mzWUwgWT4zVJqpgI36lYp3rf4prHoStjjdIjC7I9x7SytqxcV+9:O9JUgC6lgrQvjxIjC7IzVVK
TLSH
T15963E1CBC7A57C15CD239CB024888E69B921B7579C5043DA21BD60BE0FB1BD22E673B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_uuid.pyd
Size 24KB
SHA256 d132f754471bd8a6f6d7816453c2e542f250a4d8089b657392fe61a500ae7899
MD5 353e11301ea38261e6b1cb261a81e0fe
SHA1 607c5ebe67e29eabc61978fb52e4ec23b9a3348e
SHA512 fa990b3e9619d59ae3ad0aeffca7a3513ab143bfd0ac9277e711519010f7c453258a4b041be86a275f3c365e980fc857c23563f3b393d1e3a223973a673e88c5
SSDEEP 384:7ZLWqLE/t8XkiQ19IjZwa3HQIYiSy1pCQrlUJkAM+o/8E9VF0NyMx:7fLa9X19IjZwi5YiSyvJUCAMxkEW
TLSH
T178B27D56DE605C11ED2B89B0A4E54E1AE935FB824B9083CB331CC1155F613C3BBFA3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\_wmi.pyd
Size 28KB
SHA256 f9cdf7c964f0ee756df4a63daabe652743a06b7a5b8009c7c0a8d1445e5793af
MD5 f27f263f60aede353e417b00f56cd21e
SHA1 f9748f73d137878f2a852649c1723dd43e4e44db
SHA512 ba7b5878791d91e2574a855dd3564c51bc34221932be87791a3b0045fbe01c494e92fe6f014d64c309486f0d3476df178e0d53a98326484c7d761014ae1cc604
SSDEEP 768:FI2ceLJ0ffpAEXIjCi+LT5YiSyv9AMxkEga+:FIHK0faEXIjCi+Ld7SyNxEa+
TLSH
T1D3D2BFD38624AC35CD178DB239D09839FE32BD4785D186DB329CD1AA0F627436E92375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\base_library.zip
Size 1.3MB
SHA256 8de4f013bfecb9431aabaa97bb084fb7de127b365b9478d6f7610959bf0d2783
MD5 8dad91add129dca41dd17a332a64d593
SHA1 70a4ec5a17ed63caf2407bd76dc116aca7765c0d
SHA512 2163414bc01fc30d47d1de763a8332afe96ea7b296665b1a0840d5197b7e56f4963938e69de35cd2bf89158e5e2240a1650d00d86634ac2a5e2ad825455a2d50
SSDEEP 12288:uttcY+bS4OmE1jc+fYNXPh26UZWAzDX7jOIqL3CjHgopRdmoPFHz1dcfsFvaYcIe:uttcY+NHSPD/e2cqRdmoPxzQIaYcIe
TLSH
T1A655D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\charset_normalizer\md.cp312-win_amd64.pyd
Size 9KB
SHA256 696a3a317aa717dcfd565a9853adfb7df125aec7a366204c0ecbf07c1ed0624d
MD5 b2352e4f9d5c69c86ec16f013865c5b1
SHA1 707931e554172f23d56f65815f55da049568bddf
SHA512 b899e6be4c00c35610c1cfef2fc48201f6296bdf0e52347d83f5fae2a2b4f22cfc2871668a7ec1ad18de8ccd129b0348f27a6034fda75997fb9eb13982367c89
SSDEEP 192:0LAt4p/hIW9cUFecAeukYj273QJXpHI8J:00tWhICJHJuZa7gJXO8
TLSH
T123123BEBD5BEF1BCC4369536091784C0B762B926A216074F15F432BF9CA9B913E34292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
Size 39KB
SHA256 69f6357b5cf96cb302113e858276e2da924cc71e374da6f406cc5323e4b83c1e
MD5 4440fd868cf337f42c500985f199bed5
SHA1 769370b36f3af4e99a930364d1b5b81219dbee98
SHA512 0e9a902b282edffb4be0a127028edc35973382016df20f14029fd37c6a411bcc8591be2ffc40d3d8ebe6a157bdccc66b1d2e6d1764f8bbd4daa4c0f5aa897847
SSDEEP 768:wxlwpAUolsME1CoxDxijLX7evyJIX4EG3pK:wxTw8igjLUf4Er
TLSH
T14603E1633279FDFEC1BFAA713442AE51F610323DC725D90B006615FAECEA9A05D642B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\libcrypto-3.dll
Size 1.6MB
SHA256 d9c01ab4545d4681ab057b572eb8590defd33bc44527bb4ef26a5f23cadbfd03
MD5 ee4ebac30781c90c6fb6fdffa6bdd19a
SHA1 154eada82a520af85c1248b792edb716a72a19e0
SHA512 fc9457046f262595024971047f06df5b5865e53536e8fc5d35a6e5c9da494e99cd2dbeb9d6d17e37b51169b88ed6cb6e5931474dbbab7350e1b4da8e7ee0576c
SSDEEP 49152:26H83HeiR86t/czBf6Y1z8kq5HaMpW/9nn3nL/obN1CPwDvt3uFlDCP:26c3CFFz8BBpWtbU1CPwDvt3uFlDCP
TLSH
T1A375135121BFB90FF68995384F3588568A2A6736A35CEFF32DBD9D090C04E0E0A785DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\libffi-8.dll
Size 29KB
SHA256 ed18fc7eee1bf09d994d8eba144e4e7d1e6a030ba87888001eea550d7afffada
MD5 ae513b7cdc4ee04687002577ffbf1ff4
SHA1 7d9a5eb0ac504bc255e80055d72e42ccb7ab7b4d
SHA512 9fcb24debfaf035a3604a2a9abece0655424f981ebb0afef14b9674e57030dea8c5c230ca8cc13c10de8422777b4c549002350f62b9259c486cca841d9c81634
SSDEEP 768:sp/6aepjG56w24Up3p45YiSyvkIPxWEqG:OA154spK7SytPxF
TLSH
T118D2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\libssl-3.dll
Size 222KB
SHA256 2674c58e05448f8b60d7b2182bbcd2efe386d4b7b1104dd1f753112638cb8e00
MD5 a160ff459e97bf9514ef28281dbc6c81
SHA1 730510497c9a4d28444e5243bc5f44a91643d725
SHA512 04651ca40a806f0596434e0bbe30c7458daf316174ecdbf142cbddc21dbac5f0db58dc284bce5b7c6949545720021b2bd1f768ebf8c2e379a17dc6dc2fb2b46d
SSDEEP 6144:Xmlccqt6UmyaQeUV1BXKtS68fp2FagXlk2:W+t6Ce6XKtSHYomk2
TLSH
T1082401D2751F682AC8239FBCDE7060EADB7CB7451780CA933B03D9557B98A0CA27D215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\psutil\_psutil_windows.pyd
Size 31KB
SHA256 9ba42d887ff1655a9a7fd20b33c6bf80b6429a60dcd9f0409281a25e3d73f329
MD5 4732b2f1e51342fe289bc316897d8d62
SHA1 acb5ac5fc83121e8caec091191bd66d519f29787
SHA512 7435c0da033dbc07bbd2e6bebfc48041701dbc7bcb58276fbf51ba6db7507a16ad8a7a12dbdbdbdd4074772094c3bd969e27a2c4946c050bcff049a9c4666d18
SSDEEP 768:yvaDMlccGli4/1LnromOJjNOzhtPTXuwKuzpSp6:yvaQlmUQFnrobNEht6wDY
TLSH
T1B2E2CFDA347BC6BCCD9D92734188055DAFA43833965A4B1F10F130FB4CAA9B15D217E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\pyexpat.pyd
Size 88KB
SHA256 60a47ac9c1674198998338cf3caef2325bb722e62934310653f9dd01a1cb4109
MD5 cd422a6f821d5cfc56dc0f26b2b600cc
SHA1 5529327b32d2b11195946da66be134dad8e6a120
SHA512 bfb5565ef94a06fe4149292ff21284f6ded1e11e6d3e23a110fdcc8118c60d3a14aba3726802945f90b2981d605098a99df5821c2bedfa4c2b5cc38ac8d681e5
SSDEEP 1536:D9kKVCKOxchMctI3V33uxa9Ki1gsmByFtD8y2S0zRKHxQOGrb+8JYaIjLhlF7Sy9:D9XVC3xjctsV3eaIQgJmx2jzRiQvr7RG
TLSH
T1349302A34E79FC1DCE571DB5398468BCFEB12947C550C38B198D8224AFB6341A2497BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\python3.DLL
Size 66KB
SHA256 d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123
MD5 79b02450d6ca4852165036c8d4eaed1f
SHA1 ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4
SHA512 47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416
SSDEEP 768:dHmHXV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0y3:dHmHXDmF61JFn+/O4hIjL017Sy/bxe
TLSH
T1C3637052BB54F8A3DBFA69FC39D199CD542B12CC872584ECA57893D30E1A310A2E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\python312.dll
Size 1.7MB
SHA256 cc947a9fcd6d569d60960758a6226e27dfe9ed8ca2cec3105ae99a711b1be3a9
MD5 8f9e3a154ef42634941f6b8b0e7596d5
SHA1 bf6a86ed4fe5ef5cd6fa3481a57415abd7d89fa1
SHA512 42c2a57324c32fdf00ed671c8efe419e4dcb3842f630a2fddc9714285c27a6ca5d9e065ea31e0a7a5834cc8c78855984627891dc376a637815ac27f0cdcee519
SSDEEP 49152:am7u77uID/cZXnJ4Ph3tLm82R8PeDCemJ:v7uJcZX6pumfJ
TLSH
T1398533F26C4D99E1EDF45AFA65C289036A5E1414803CC0EA2977F6C309D2F709D27BAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\select.pyd
Size 25KB
SHA256 f05fe1c21959ee25d30aaade30afaaf34fbd99524bdfb3ebee3cf8643ae5d1b6
MD5 f55e6cc581308799114c0b3376bff92c
SHA1 85e9ef00240cf38b8afa434a285396b1355555b6
SHA512 f0d48d228cc292c05712d3eb2b06125c78aefdf481ef245b6ef547c1794e8ca10c19a12dccdb77d1026a5352d0b79be223bdbeb5b08627f8bc9b88757bb587b9
SSDEEP 768:hW9SNyB153wXwCp5DlIjQGO/5YiSyv38aAMxkE7:ba3aDlIjQGOx7Sy/8Yxn
TLSH
T124C29EF341645864CD378DB234C58968FE36BD579A10C3D7329CD2AA4F713826BA23B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\sqlite3.dll
Size 644KB
SHA256 bfe78fe2b54df778c0d62144b1308f1f149bed79ea6bd628ffd76cbc5406cd1a
MD5 c349095f35ef7831444a5612f86e856c
SHA1 d158144d557777cc2464cbd39ddf8c15be48be2f
SHA512 9bd17fc8ce0057e58d18c6ed327225636cab6599b2d743ee159f3987a9d79a761a240ec6133f503991e09746540b0c595708043e1d31d3934b185b117583b737
SSDEEP 12288:jTdlyELYyNiFVhF+v4GTHxoyMnYllAuz1eRDRA8z7B/oe7zMdxsp2gB:jTdlyK5oFVDQ4GGYsaejd1/oeTp2gB
TLSH
T133E423E749BB48DCE1D20437EEEBA5F1A6E06D61FDE586564E5872003F122D28B7408F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\unicodedata.pyd
Size 295KB
SHA256 6c2c45ef24c6797ee92997417dd142e4447d410fae63c7969db615caed9327ba
MD5 1e73c365bb5c3b10def5b168c17cf33d
SHA1 dbcee0e7c69c1e33804d45d677e32b7d00fcf4d5
SHA512 cc0a051a0ccba78829205af134d4195143a767cd80dccb74a9580ac32a8a1e3223febf2ee4d278e89003dd28fe3ea6bbe9ab292c9050c1e24a52a7142436463f
SSDEEP 6144:lI6xDUAPCa+tr3XyOu6sNq64AnCK+V3evv7J7usiUZonaJnZ54QZ:NDLB+tryJ6sI647m7Fu4oM4QZ
TLSH
T1D65423D53BD4E863E196CBF23D55462A8F3530876282228771ADC0588F6FBC25F630E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backend_c.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI7402\zstandard\backend_c.cp312-win_amd64.pyd
Size 174KB
SHA256 195f61ce28b3582a00f5d30c92a957e732b2ec13ba7be20f457f3a10215fad25
MD5 7175acb973e8831e604bccfa53c1ed3a
SHA1 28a4b9064edc115889e13337fd962c63d83a9da6
SHA512 4e8eb9e9beba43fa58798a58e7a3923f3e1cffd4ecd98adca9b136219b27886ca05bbf2a3e456c85c2dee182050a750a9138abc88fda111bd404c9679fd85cc3
SSDEEP 3072:QrtRPeoIjrsmsmFwkKiTsW0zp9zFEVw7qH0/Sc25fqVnY3QJEq7e:8/RIjwmkOsppQs/l4COQJ9e
TLSH
T19404123717AED6DEDE0709FB408A1E4581A5D86B56C7A6AC00C4BDBAF956C8DFD30304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0qn4q11a.sly.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0qn4q11a.sly.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1156-223-0x0000014B72490000-0x0000014B724B2000-memory.dmp

Download

memory/3500-163-0x00007FF9164B0000-0x00007FF9164C8000-memory.dmp

Download

memory/3500-193-0x00007FF909B40000-0x00007FF909B4E000-memory.dmp

Download

memory/3500-137-0x00007FF9163A0000-0x00007FF9163AD000-memory.dmp

Download

memory/3500-150-0x00007FF916910000-0x00007FF916926000-memory.dmp

Download

memory/3500-155-0x00007FF9164D0000-0x00007FF916505000-memory.dmp

Download

memory/3500-154-0x00007FF916730000-0x00007FF916742000-memory.dmp

Download

memory/3500-153-0x00007FF9167F0000-0x00007FF9167FD000-memory.dmp

Download

memory/3500-157-0x00007FF916700000-0x00007FF916724000-memory.dmp

Download

memory/3500-159-0x00007FF909B50000-0x00007FF909CCE000-memory.dmp

Download

memory/3500-141-0x00007FF915C30000-0x00007FF915C44000-memory.dmp

Download

memory/3500-162-0x00007FF915C30000-0x00007FF915C44000-memory.dmp

Download

memory/3500-144-0x00007FF908420000-0x00007FF908949000-memory.dmp

Download

memory/3500-147-0x00007FF915BA0000-0x00007FF915BD3000-memory.dmp

Download

memory/3500-168-0x00007FF907E60000-0x00007FF907EE7000-memory.dmp

Download

memory/3500-167-0x00007FF915BA0000-0x00007FF915BD3000-memory.dmp

Download

memory/3500-166-0x00007FF908420000-0x00007FF908949000-memory.dmp

Download

memory/3500-148-0x00007FF908350000-0x00007FF90841D000-memory.dmp

Download

memory/3500-172-0x00007FF9164A0000-0x00007FF9164AB000-memory.dmp

Download

memory/3500-143-0x00007FF908F10000-0x00007FF9095D5000-memory.dmp

Download

memory/3500-176-0x00007FF907B80000-0x00007FF907C9B000-memory.dmp

Download

memory/3500-175-0x00007FF916470000-0x00007FF916497000-memory.dmp

Download

memory/3500-107-0x00007FF917120000-0x00007FF91712F000-memory.dmp

Download

memory/3500-179-0x00007FF916460000-0x00007FF91646B000-memory.dmp

Download

memory/3500-133-0x00007FF9167F0000-0x00007FF9167FD000-memory.dmp

Download

memory/3500-182-0x00007FF916450000-0x00007FF91645B000-memory.dmp

Download

memory/3500-136-0x00007FF915C50000-0x00007FF915C69000-memory.dmp

Download

memory/3500-186-0x00007FF915B50000-0x00007FF915B5C000-memory.dmp

Download

memory/3500-185-0x00007FF9164D0000-0x00007FF916505000-memory.dmp

Download

memory/3500-188-0x00007FF911E80000-0x00007FF911E8B000-memory.dmp

Download

memory/3500-187-0x00007FF916700000-0x00007FF916724000-memory.dmp

Download

memory/3500-194-0x00007FF90F8D0000-0x00007FF90F8DB000-memory.dmp

Download

memory/3500-140-0x00007FF916070000-0x00007FF91607D000-memory.dmp

Download

memory/3500-192-0x00007FF90A1F0000-0x00007FF90A1FC000-memory.dmp

Download

memory/3500-201-0x00007FF907B80000-0x00007FF907C9B000-memory.dmp

Download

memory/3500-203-0x00007FF909AE0000-0x00007FF909AED000-memory.dmp

Download

memory/3500-202-0x00007FF907B60000-0x00007FF907B72000-memory.dmp

Download

memory/3500-200-0x00007FF909AF0000-0x00007FF909AFC000-memory.dmp

Download

memory/3500-199-0x00007FF909B00000-0x00007FF909B0C000-memory.dmp

Download

memory/3500-198-0x00007FF916470000-0x00007FF916497000-memory.dmp

Download

memory/3500-197-0x00007FF909B20000-0x00007FF909B2B000-memory.dmp

Download

memory/3500-196-0x00007FF909B10000-0x00007FF909B1B000-memory.dmp

Download

memory/3500-195-0x00007FF909B30000-0x00007FF909B3C000-memory.dmp

Download

memory/3500-191-0x00007FF90A200000-0x00007FF90A20C000-memory.dmp

Download

memory/3500-190-0x00007FF90F8E0000-0x00007FF90F8EC000-memory.dmp

Download

memory/3500-189-0x00007FF909B50000-0x00007FF909CCE000-memory.dmp

Download

memory/3500-204-0x00007FF907B50000-0x00007FF907B5C000-memory.dmp

Download

memory/3500-205-0x00007FF907900000-0x00007FF907B45000-memory.dmp

Download

memory/3500-208-0x00007FF907890000-0x00007FF9078BE000-memory.dmp

Download

memory/3500-206-0x00007FF9078C0000-0x00007FF9078E9000-memory.dmp

Download

memory/3500-130-0x00007FF9166A0000-0x00007FF9166CD000-memory.dmp

Download

memory/3500-109-0x00007FF916820000-0x00007FF91683A000-memory.dmp

Download

memory/3500-285-0x00007FF9164B0000-0x00007FF9164C8000-memory.dmp

Download

memory/3500-284-0x00007FF909B50000-0x00007FF909CCE000-memory.dmp

Download

memory/3500-279-0x00007FF908350000-0x00007FF90841D000-memory.dmp

Download

memory/3500-277-0x00007FF908420000-0x00007FF908949000-memory.dmp

Download

memory/3500-267-0x00007FF908F10000-0x00007FF9095D5000-memory.dmp

Download

memory/3500-278-0x00007FF915BA0000-0x00007FF915BD3000-memory.dmp

Download

memory/3500-268-0x00007FF9166D0000-0x00007FF9166F5000-memory.dmp

Download

memory/3500-295-0x00007FF907900000-0x00007FF907B45000-memory.dmp

Download

memory/3500-296-0x00007FF9078C0000-0x00007FF9078E9000-memory.dmp

Download

memory/3500-106-0x00007FF9166D0000-0x00007FF9166F5000-memory.dmp

Download

memory/3500-95-0x00007FF908F10000-0x00007FF9095D5000-memory.dmp

Download

memory/3500-392-0x00007FF908F10000-0x00007FF9095D5000-memory.dmp

Download