53a09254d971607b41f76c5888b1402564d2251733f5af21b4bc2e90ad8d164d

Analysis

max time kernel
300s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Luc1dsmenu.exe
Size 22.6MB
Sample260720-ejd22sg19z
SHA256 53a09254d971607b41f76c5888b1402564d2251733f5af21b4bc2e90ad8d164d
MD5 91ccab96c24c1b6a59fb846ee951803b
SHA1 66d0603d055315e83288aec5aec4746f79a9fbc4
SHA512 1a69800c3a224870859fbb3b880eb4bb3c7c7b09e984b5e81faa9bc06961977bdd39ad0c478df7b25247abad9809fa14c57aa9b3f3354305ad303c94f380e8e6
SSDEEP 393216:9tSd+sFl7dCR1C99zCi6C/1vVwGaa5wEMiuHClUXMCHWUjjjx5WsqWxTFz5T3x7p:HSbFlUR1OzCi6qoaGziuilUXMb8esqAq
TLSH
T16C37331823908469EDF2843B25A7D528DAE2BC1757A8C69FC32C33D11D335E66939E73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution spyware stealer

Malware Config

Signatures

Loads dropped DLL 52 IoCs

pid	Process
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2076	powershell.exe
5252	powershell.exe
4164	powershell.exe
3276	powershell.exe
1216	powershell.exe
3544	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
9	api.gofile.io
11	discord.com
1	api.gofile.io

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
1	ip-api.com
2	api.ipify.org

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
2076	powershell.exe
2076	powershell.exe
2076	powershell.exe
5252	powershell.exe
5252	powershell.exe
5252	powershell.exe
4164	powershell.exe
4164	powershell.exe
4164	powershell.exe
3276	powershell.exe
3276	powershell.exe
3276	powershell.exe
1216	powershell.exe
1216	powershell.exe
1216	powershell.exe
3544	powershell.exe
3544	powershell.exe
3544	powershell.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe
4508	Luc1dsmenu.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4508	Luc1dsmenu.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	5252	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	3544	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4508	2368	Luc1dsmenu.exe	89
PID 4508 wrote to memory of 2076	4508	Luc1dsmenu.exe	91
PID 4508 wrote to memory of 5252	4508	Luc1dsmenu.exe	93
PID 4508 wrote to memory of 4164	4508	Luc1dsmenu.exe	95
PID 4508 wrote to memory of 3276	4508	Luc1dsmenu.exe	97
PID 4508 wrote to memory of 1216	4508	Luc1dsmenu.exe	99
PID 4508 wrote to memory of 3544	4508	Luc1dsmenu.exe	101

C:\Users\Admin\AppData\Local\Temp\Luc1dsmenu.exe
"C:\Users\Admin\AppData\Local\Temp\Luc1dsmenu.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\Luc1dsmenu.exe
  "C:\Users\Admin\AppData\Local\Temp\Luc1dsmenu.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Class Win32_BIOS).SerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Class Win32_BaseBoard).SerialNumber"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Class Win32_Processor).ProcessorId"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Class Win32_BIOS).OEMStringArray"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-WmiObject -Class Win32_SystemEnclosure).SMBIOSAssetTag"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\VCRUNTIME140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
TLSH
T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\_asyncio.pyd
Size 69KB
SHA256 3b46fa8f966288ead65465468c8e300b9179f5d7b39aa25d7231ff3702ca7887
MD5 90a38a8271379a371a2a4c580e9cd97d
SHA1 3fde48214fd606114d7df72921cf66ef84bc04c5
SHA512 3bde0b274f959d201f7820e3c01896c24e4909348c0bc748ade68610a13a4d1e980c50dab33466469cdd19eb90915b45593faab6c3609ae3f616951089de1fdc
SSDEEP 1536:5VrJQiOU7v3gWTgI9PBgT5NIMOn27SyBxEU:55JQiOU7/g8L9PBSNIMOn2CU
TLSH
T191638E83E3E0459ADD57A178D4632F56EBB1F2420A00479F52A8C18F2F7379252FE726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\_bz2.pyd
Size 83KB
SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
MD5 30f396f8411274f15ac85b14b7b3cd3d
SHA1 d3921f39e193d89aa93c2677cbfb47bc1ede949c
SHA512 7d997ef18e2cbc5bca20a4730129f69a6d19abdda0261b06ad28ad8a2bddcdecb12e126df9969539216f4f51467c0fe954e4776d842e7b373fe93a8246a5ca3f
SSDEEP 1536:Iyhz79151BVo1vXfzIFnaR4bO1As0n8qsjk+VIMCVl7SyVx7:/hzx15evXkuxAP8qMk+VIMCVlJ
TLSH
T1CE839E92E3956AF5F41F81B956C10367E771B945075083EFF348C2592F03B426EAC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\_ctypes.pyd
Size 122KB
SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
MD5 5377ab365c86bbcdd998580a79be28b4
SHA1 b0a6342df76c4da5b1e28a036025e274be322b35
SHA512 56f28d431093b9f08606d09b84a392de7ba390e66b7def469b84a21bfc648b2de3839b2eee4fb846bbf8bb6ba505f9d720ccb6bb1a723e78e8e8b59ab940ac26
SSDEEP 3072:IXw32spTVYgFoj6N2xE9sb7V/f/E4ZBq5syCtYPU95IMLPhr:IgGEOgFoj68ksRf/ERsX
TLSH
T174C36C1B339400A9EBA34178C4B36E07D7F1B41B076197CF12A4C6992F637A76E6E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\_hashlib.pyd
Size 64KB
SHA256 43acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d
MD5 a25bc2b21b555293554d7f611eaa75ea
SHA1 a0dfd4fcfae5b94d4471357f60569b0c18b30c17
SHA512 b39767c2757c65500fc4f4289cb3825333d43cb659e3b95af4347bd2a277a7f25d18359cedbdde9a020c7ab57b736548c739909867ce9de1dbd3f638f4737dc5
SSDEEP 1536:9PgLpgE4Z27jHZWZnEmoANIMOIi7SyAx2:9EtHZeEmoANIMOIit
TLSH
T18F537E09A69544E8C96781B8C8A35F57FAF2F1511710A7DF0368C28D2F237C3A6BB752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\_lzma.pyd
Size 156KB
SHA256 a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
MD5 9e94fac072a14ca9ed3f20292169e5b2
SHA1 1eeac19715ea32a65641d82a380b9fa624e3cf0d
SHA512 b7b3d0f737dd3b88794f75a8a6614c6fb6b1a64398c6330a52a2680caf7e558038470f6f3fc024ce691f6f51a852c05f7f431ac2687f4525683ff09132a0decb
SSDEEP 3072:ssvkxujgo7e2uONOG+hi+CTznfF9mNoDXnmbuVIMZ10L:snu0o7JUCNYOD2Kg
TLSH
T1DCF32992A394F0D5F6728C78D6624F17E7F67849032092DA02CCD36D2B1FB759A2A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\_overlapped.pyd
Size 54KB
SHA256 2187281a097025c03991cd8eb2c9ca416278b898bd640a8732421b91ada607e8
MD5 737f46e8dac553427a823c5f0556961c
SHA1 30796737caec891a5707b71cf0ad1072469dd9de
SHA512 f0f4b9045d5328335dc5d779f7ef5ce322eaa8126ec14a84be73edd47efb165f59903bff95eb0661eba291b4bb71474dd0b0686edc132f2fba305c47bb3d019f
SSDEEP 1536:5inr44gaZPXPCJ/+yZdDDrRIMXtH7SyNx7:5ZJ/+yZdDDrRIMXtHt
TLSH
T19E437B16679404D9ED37C17EE4A70E1BEBB0B1964650930F62A8C24A1F737837BAE3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\_queue.pyd
Size 31KB
SHA256 0a6acfd24dfbaa777460c6d003f71af473d5415607807973a382512f77d075fa
MD5 e1c6ff3c48d1ca755fb8a2ba700243b2
SHA1 2f2d4c0f429b8a7144d65b179beab2d760396bfb
SHA512 55bfd1a848f2a70a7a55626fb84086689f867a79f09726c825522d8530f4e83708eb7caa7f7869155d3ae48f3b6aa583b556f3971a2f3412626ae76680e83ca1
SSDEEP 768:WlzRmezj6rGqMoW45IMQUHR5YiSyvMcAMxkEm2j:yRm0mGpoW45IMQUHf7SyVxb
TLSH
T1C6E2AE97BA540C5AC973C87594A25E25F972B3864701C3CF2229C24D2F327837BB97B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\_socket.pyd
Size 81KB
SHA256 67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
MD5 69801d1a0809c52db984602ca2653541
SHA1 0f6e77086f049a7c12880829de051dcbe3d66764
SHA512 5fce77dd567c046feb5a13baf55fdd8112798818d852dfecc752dac87680ce0b89edfbfbdab32404cf471b70453a33f33488d3104cd82f4e0b94290e83eae7bb
SSDEEP 1536:mOYhekrkJqlerLSyypHf9/s+S+pzMii/n1IsJqKN5IMLwoR7SygCxkWN:vwkJqHyypHf9/sT+pzMiE1IwdN5IMLw0
TLSH
T1E7835A12A69050F9DB73C0B6C6635F23FBB4B48013D5939F1166C66A1F33782BE79A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\_ssl.pyd
Size 174KB
SHA256 fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4
MD5 90f080c53a2b7e23a5efd5fd3806f352
SHA1 e3b339533bc906688b4d885bdc29626fbb9df2fe
SHA512 4b9b8899052c1e34675985088d39fe7c95bfd1bbce6fd5cbac8b1e61eda2fbb253eef21f8a5362ea624e8b1696f1e46c366835025aabcb7aa66c1e6709aab58a
SSDEEP 3072:9EkiCZfBmvD1ZLnM2YfW6XSvWJLX2GvMf1ba+VRJNI7IM/H9o/PCrXuI3JVIMC7g:riC5QD1dwW6XSOMfjTwJH
TLSH
T18B046B03B5942EBBD813E4B9C1231913DBF1F015331257DE48D6D64A0F17B4AAEAAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\_uuid.pyd
Size 25KB
SHA256 8ae23bfa84ce64c3240c61bedb06172bfd76be2ad30788d4499cb24047fce09f
MD5 d8c6d60ea44694015ba6123ff75bd38d
SHA1 813deb632f3f3747fe39c5b8ef67bada91184f62
SHA512 d3d408c79e291ed56ca3135b5043e555e53b70dff45964c8c8d7ffa92b27c6cdea1e717087b79159181f1258f9613fe6d05e3867d9c944f43a980b5bf27a75ab
SSDEEP 384:maxIcRiAWVIMZwbTHQIYiSy1pCQm9Y+pAM+o/8E9VF0Ny7yYV:ScR3WVIMZwn5YiSyvXMAMxkE8YV
TLSH
T18FC26D56AA605C15DD178A7074E24A26EEB6B7814B50C3C72329C1990F723C37BEB3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\_wmi.pyd
Size 36KB
SHA256 73b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32
MD5 827615eee937880862e2f26548b91e83
SHA1 186346b816a9de1ba69e51042faf36f47d768b6c
SHA512 45114caf2b4a7678e6b1e64d84b118fb3437232b4c0add345ddb6fbda87cebd7b5adad11899bdcd95ddfe83fdc3944a93674ca3d1b5f643a2963fbe709e44fb8
SSDEEP 768:rUmqQhTcYr6NxO0VIMCit5YiSyv4YmAJAMxkEn:Im7GBNxO0VIMCiz7SyQYmQxz
TLSH
T106F27E67E7940895D937CDB9C8864E27E971B5825B11C3CF331482590F323C1AE7A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_http_parser.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\aiohttp\_http_parser.cp312-win_amd64.pyd
Size 243KB
SHA256 4e0696c3fbe077724791f4632ee15632e2e6b74a485e15e9abc2bba6e02ccd42
MD5 63b41a11401583de4218a9bc5299ca5e
SHA1 160f0a00441cd0a24efea1176cb785edf85e2dbb
SHA512 68e0a397c5a8691ded8c9fa0d28398d5c5c6e19fbf84d0ff7b7a784063e9417957c037207d91a5958df74583a4adc4d847cae1b7a05da8237d8aed9e39ea62ca
SSDEEP 6144:+lcfCAIbBCRHvygAX3iqBTnq+VQtsMwTW0X861p:VOARfQBjqJqMwK2
TLSH
T17B341B0292D6186AFD1761B848276517EBF270302B22BBCF1560C55BBF53AA5B37C336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_http_writer.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\aiohttp\_http_writer.cp312-win_amd64.pyd
Size 46KB
SHA256 a5924d28d313405a3f070faa21eb29947d46b648b43be96aa24b7ead18dd6c6e
MD5 4aa5c5490c3946ff871d36a60732cfa3
SHA1 73d6dd4c02480ba503d8b7b109b5b8a886e23201
SHA512 f2fcee8649ac8e6e3214a19c475bd2eb9c20e233dead90e43e67173c2a0fd5772aaa96ddefbacb6ec5eebe905a2d257a9acd234802923d8bb857456ab1e6ce0e
SSDEEP 768:bgOynEh40S3fxqUFBd7DxmsnDLlVc5wOxibAvS0+P:blyEq0S3fcs/s8cOn2S0+P
TLSH
T1EB234D4672A480B6D593D1B8C5336D17F2B1F0216B1227CF0264D69F2F937E6A27E362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mask.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\aiohttp\_websocket\mask.cp312-win_amd64.pyd
Size 36KB
SHA256 f57aa14c01afb440e64ca88ca36c67013046679c695ea755284ffba73f885681
MD5 5eb9e0b4255db66bd621d91814bea48f
SHA1 05c6cab7ac9815b48bb6dfd7b9fc0e5ae15671ad
SHA512 79e2e8850cec21b2bbee7408b7dfd607b392bd96d263fdeb69d1f55b62dd32518beeffc6c4aaf84a10d69250393d81a94377070ffa059f620f3950c2c2a6a46d
SSDEEP 384:QwM3f6RQwj6I9MTuAXE2x4bABeIQ3HVM/hYlAK+jWb1eLG9AbnXcwI3t1WrmakD:zRrmTHi1M/hbWbkKec1rHH09
TLSH
T157F24945676900EEE5E2C2B8C1336D1AE2B2F055231173DF0260C29F2F63BD6667B766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_c.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\aiohttp\_websocket\reader_c.cp312-win_amd64.pyd
Size 144KB
SHA256 b7c16443e2eab7e5a493b05b2824c0d11f724bb4f3963aa82ff0aef7ceea263d
MD5 8ad2f33224461e565122b841ce104290
SHA1 e5d07d2f1da040aacc38a53bdfeb777898e6c24e
SHA512 f36662c1901f6a184474e23b9a4945494bee66050e0c48c1e235fa54b9269bb01a6f31730041f5e344a36dfd4a8f1fe5a78c2f572737600e4cf89d239a222d56
SSDEEP 1536:6uyMlYTZ0h/Ltjb6+i6js8YnM4ysdJn3XD5egAiU8NI2lVE36b58/p/JoWA3nVdb:6uyw6+snM4yw3XYgYgy6kKWmd/0
TLSH
T16AE32B17B2E81067D997A1B888332527F7F2B0012B1167CF0250D79A3F57BE6BABD251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\base_library.zip
Size 1.3MB
SHA256 7981465483851a28c6530504913e20e0a225c4c53944793d75469859cd9b64b8
MD5 f5879d91aed531b2e03539399b5c7f32
SHA1 d339662bf50dfdfb61af0a989a9d9a2c19ed1119
SHA512 9a069067c6eabe6d8959b7b4cff5bc3361e63575f0f4b8dd4799efb9e1b8af06f6f5cd7883e96096853f2616b3c76ac0f4fae246697fb1ffb36b7619d25314b2
SSDEEP 12288:U72/HFHcPndmJHtSYYTq+zYgEkA1qJuj0xB/R2/yquKxLmn94clJGUqo1dQik6:W2/HxcPndmJ0YCrIXfa94clJGUp5k6
TLSH
T15C55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\charset_normalizer\md.cp312-win_amd64.pyd
Size 10KB
SHA256 76a535e0953b48a2348b877236a5799cf1d01cb21422c7f17942f35367cb5c8f
MD5 52726cc0c88dd2c0b528dcf1e936ea88
SHA1 edb91fa3ba8f1a128b581c297621c495e5b90f1e
SHA512 48d432cb6e3f6ed76be4ab2079f00b44b4ad9022f9f6c66ba925b4c5dddc8a4a851c3aed901b694b7bd658d98ee32df8a6bf8bf65b5f13c9a6df8642a7b46c97
SSDEEP 192:M6dxGrmoX+sMl/++Ch9p8mBd1pcVL58A0JH6:7dx4m446BDXcj8Ae
TLSH
T1A022085CFF6458EAD9268134C9375E4AB132BB22170277CF8770906A2FA37F26534785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
Size 124KB
SHA256 0830c3ff6e6f8394a7df170f95fc10de65ab9f22b30f9d2383f0cc299b8df101
MD5 1bb4e612320cc2aca375db74384ed88a
SHA1 c706ab2e599a656b9f9dd2344b890215a41cec49
SHA512 beac2a1628d5fbe7e2f7a17e41afeb7c5e84fe5fde9de6a87a19dbf42a022e8ca6fb5d49e38d9bc0d5e2949cd86f63207ab6fbbcb710701a33b585cfb2385597
SSDEEP 1536:Yn/j8rmzdfRYc0L/JBffqUpMJ4pNuk6G4JdeqBSQxwg1uZ1geLusbq63a:Yn/Irwqci/JBHqUpJuFPeeer9Lusbq
TLSH
T1F6C3192762950077CA634279CDB7A512D7E1F5510B3263CF04A4C6A95F03BEABEBEB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\libssl-3.dll
Size 774KB
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
TLSH
T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multidict.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\multidict\_multidict.cp312-win_amd64.pyd
Size 79KB
SHA256 68857f6684df6ebc29a4eeae96ba93e9a205d283877426a364c1e0b99ae830c0
MD5 a17bc92d1d8f3d2cf44d7e2d6ffac3f3
SHA1 81a5d6867b7dd06c13890bebd07f2b6d5ce426ab
SHA512 7f40b35f1b70a3c79e9fd040883af88b2fec45bb38d443c9bc14ad8c2833614388e629576b1e9276b8e9348a84beee49390e3c3c9267ff7bb00e8babc99c0701
SSDEEP 1536:5mLVbU7K3ZXoSZO/ysdTU0Nv8nkpJPQpSsti1iJJTyuh9ua:gLVb35ZO/NTjNvyGJPQp7ti1iJJTyuhv
TLSH
T16683F642A6E910A6C9A285798C33BE27DBF1B14213122BCF41B0D65D2F53EDB5FBD601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_helpers_c.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\propcache\_helpers_c.cp312-win_amd64.pyd
Size 63KB
SHA256 f40a9706e20058cda899118faa7a68ee584302a4fd6933bab87ed0bc5ce7d2ca
MD5 157df2a3e4931c1dfd420afce303b1ea
SHA1 eb64a9b66a2ed7a4bea00e4ed59ff3ae14f32268
SHA512 8a60533bce01066c000ec8b9c88fc9cf91f8c8209219eb9d11ad9b68920e4ec58b8e3e987d49bd12d40446ec910e1b8ebf163c150904188e93df16d0b91f20ab
SSDEEP 768:WTZ2vAGcveIoyLxvnUPujzZt2EjcylsIetdDeROid4YQgT4GFjqNCzB0r:WVI5DIoQFUWnpjcylsNjLdIzB0r
TLSH
T1BC531A06A2A4509BD99790788433BD27F6B0F4112B2127CF53A4C38E2F52BD766BE753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\python3.DLL
Size 66KB
SHA256 25a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2
MD5 5eace36402143b0205635818363d8e57
SHA1 ae7b03251a0bac083dec3b1802b5ca9c10132b4c
SHA512 7cb3619ea46fbaaf45abfa3d6f29e7a5522777980e0a9d2da021d6c68bcc380abe38e8004e1f31d817371fb3cdd5425d4bb115cb2dc0d40d59d111a2d98b21d4
SSDEEP 768:OV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/d:ODmF61JFn+/Ob5IML0l7SySxUx
TLSH
T112637052BB54F8A3DBFA65FC39D199CD142B12CC872584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\python312.dll
Size 6.6MB
SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
MD5 166cc2f997cba5fc011820e6b46e8ea7
SHA1 d6179213afea084f02566ea190202c752286ca1f
SHA512 49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb
SSDEEP 49152:mRSn173WIgXqQYRn0I+gaYFD0iRpIrCMEGXgeieBwHTuJTA8LbLH7ft4OCLj8j4V:mIn8hYEgw8Ij887GlSvBHDMiEruuln
TLSH
T170667D697268C0A9C96BA0B0CC13C28AE7B27C517F50530B70EBB75E2F737A2535A745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\pywin32_system32\pywintypes312.dll
Size 133KB
SHA256 b29e4098f9f53f05e3281636d079de58b05a26c03669cea4ec1673e51750fa31
MD5 8ed6992c59428882449fca6d74db2421
SHA1 aaf305a9291d2f7b138a6a79e0af35222b261e8b
SHA512 bb6af4b925cc1d1abe0f4448cb1f56517c6bf3d562b1960932be2bd8efcd8c4b150a2f7c4a1e712e2fa903384a942fa0a5eb8e778581e3c41c13dd18c5a3feaf
SSDEEP 3072:McFypZnckPDuEVH1jmqafY/r06YrrO3lUG4eqjgD5UMH:5qnckPPR1MfY/rk3u4Jg9UMH
TLSH
T168D34B47374684DAE976A37D8D771A02D3A2B0100711E3CF06A5C2AB6F637D6AD3B643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\select.pyd
Size 30KB
SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
MD5 7c14c7bc02e47d5c8158383cb7e14124
SHA1 5ee9e5968e7b5ce9e4c53a303dac9fc8faf98df3
SHA512 af70cbdd882b923013cb47545633b1147ce45c547b8202d7555043cfa77c1deee8a51a2bc5f93db4e3b9cbf7818f625ca8e3b367bffc534e26d35f475351a77c
SSDEEP 384:IyRVBC9t6Lhz64CHf2slDT90Y5IMQGCHQIYiSy1pCQFm/AM+o/8E9VF0Ny/r5n+/:LGyKHfx1H5IMQGY5YiSyv4AMxkEFNnq
TLSH
T1AFD29E576BB46845DD23C87268A28F26EE35B756871082CF3368C15D1F227C27B7B3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\unicodedata.pyd
Size 1.1MB
SHA256 bf669344d1b1c607d10304be47d2a2fb572e043109181e2c5c1038485af0c3d7
MD5 a8ed52a66731e78b89d3c6c6889c485d
SHA1 781e5275695ace4a5c3ad4f2874b5e375b521638
SHA512 1c131911f120a4287ebf596c52de047309e3be6d99bc18555bd309a27e057cc895a018376aa134df1dc13569f47c97c1a6e8872acedfa06930bbf2b175af9017
SSDEEP 12288:arEHdcM6hbuCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAIU:arEXDCjfk7bPNfv42BN6yzUAIU
TLSH
T18B354AC5BB828E66E87B31B944D1212F1361C273476B533BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\win32\win32api.pyd
Size 132KB
SHA256 b54d63d771b4db2a1bf1e724ff2597e970173ec5a9860c2b0dfdff83cd7a160e
MD5 017298fe9ee7d5d236d8c0811e598873
SHA1 c7fb0bcfd2d61f07f25297c9aaf256299e3381f2
SHA512 9a330775bd030aa259bb1f28c406eda41ed396d6186c6eaf6a56a01aa1cfc69e566a47b5d93c3c3446b56399557a3652ab848429c9f6bfb0c08ed6b089dfdd22
SSDEEP 3072:22zjgkWPUagUh94L3lRVFhLaNzvW569RrUbmiyrvihA1fK:5MkWPDz8DlRVgvNU8rvuaf
TLSH
T1C2D30883B35410C6D96AA6BCC4775B23D772B8240761A7CF0A60C18A1F237E97D7DB98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_quoting_c.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23682\yarl\_quoting_c.cp312-win_amd64.pyd
Size 85KB
SHA256 1dbf18a57fa7ea865700141b6bf3ca7656d136b7cb5b0134c2da7744b4b4c653
MD5 836fcfae116e5bdd6c6c7724a9bf9c0b
SHA1 7884ca9558e7294e8e94f4ce19ab4a5a65635d65
SHA512 8f2b8127ddb35ddf514f149a89f5cd48e3f78b505ad203f0337c759a93c972cb431676c9de3c69a189de3d9c231b2d17f32e23950e7e46a8302855ca73d22c35
SSDEEP 1536:RYPXuY1Hs8xgWRY+mzuygVXAS8CbdlOga9Z0:RYP/1sNzuyk7oga70
TLSH
T1FA832B1A66E1105BD953E1B8C8336927F7B1B0412B1127DF5290D38A2F63BD66EBE343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wbdu4kw1.o3b.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wbdu4kw1.o3b.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2076-187-0x000001CA7AFB0000-0x000001CA7AFD2000-memory.dmp

Download

memory/2076-186-0x00007FFB773D0000-0x00007FFB77D74000-memory.dmp

Download

memory/2076-188-0x00007FFB773D0000-0x00007FFB77D74000-memory.dmp

Download

memory/2076-189-0x00007FFB773D0000-0x00007FFB77D74000-memory.dmp

Download

memory/2076-190-0x00007FFB773D0000-0x00007FFB77D74000-memory.dmp

Download

memory/2076-192-0x00007FFB773D0000-0x00007FFB77D74000-memory.dmp

Download

memory/2076-193-0x00007FFB773D0000-0x00007FFB77D74000-memory.dmp

Download

memory/2076-183-0x00007FFB7755F000-0x00007FFB77560000-memory.dmp

Download