Analysis
- max time kernel
77s - max time network
94s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 17:04
Behavioral task
behavioral1
Sample
Luqqzstrap_Installer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
Luqqzstrap_Installer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target Luqqzstrap_Installer.exe
- Size 112.1MB
- Sample260810-vlqfvstdmc
- SHA256 270f9e8a2d59fddb0bdff0fc560a578e12e40e31f045a8ca9dc6c27ea7a3e2b9
- MD5 1f201e41fff0b126b745d37bc8acd862
- SHA1 077cf11e3118f0eed6275b4fef871c883bc1b90f
- SHA512 1420d12fc9ce172c52ca996a6cba21c883b2469e5e27a97f4e30f4031379661a8cc7b3167c5942b1ea13090351a72a51a03f78cf9c1327d6a29ca2c83e2348b6
- SSDEEP 3145728:yXjlLbVw/IvwqJi+CuOm7W9ullbDjRiuYwlRh:yTp5wI+Gq9ullbtph
- TLSH T16748333B71836A7EE02E353539F19560693BB621602358035BE8D98C8F6B1F42D3F697
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1244 Luqqzstrap_Installer.tmp 4968 Luqqzstrap.exe 2008 QtWebEngineProcess.exe - Loads dropped DLL 64 IoCs
pid Process 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 6 raw.githubusercontent.com 2 raw.githubusercontent.com 5 raw.githubusercontent.com - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\api-ms-win-crt-string-l1-1-0.dll Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-BWJ0NLXTQ8.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-5PNIJ0QMZD.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-HSVVN1BV1O.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\PIL\is-L7BS9ZAQJY.tmp Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\api-ms-win-core-handle-l1-1-0.dll Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\is-RH2D8EVTVW.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\webview\platforms\is-45IIY9XXRP.tmp Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\Luqqzstrap.exe Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\libssl-3.dll Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-MZ9LD6RSTP.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-HNRM90QBGP.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\webview\is-PTA801BDB8.tmp Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\api-ms-win-crt-stdio-l1-1-0.dll Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\api-ms-win-crt-filesystem-l1-1-0.dll Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\is-7JS0DCR7UW.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\src\data\is-741W7X3P93.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-225EH8XK1I.tmp Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\pyside6qml.abi3.dll Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-RFJM2W6WEF.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-GPZ4Q9OBR3.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\is-5TZHSAE589.tmp Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\api-ms-win-core-datetime-l1-1-0.dll Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\libffi-8.dll Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-EQQLO62L13.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\plugins\position\is-5SVIM7B8EH.tmp Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\unins000.dat Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\Qt6QmlMeta.dll Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\plugins\position\is-ZAAWEVJW9G.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\pywebview-6.2.1.dist-info\is-39PFZ1G2A7.tmp Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\Qt6Quick.dll Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-FFIXNV69LK.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\PIL\is-CGK6P7K88T.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\is-611IML549I.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\is-LDVX7P10LZ.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\is-5NDKXXAZB7.tmp Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\dbghelp.dll Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\plugins\tls\qcertonlybackend.dll Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\shiboken6\VCRUNTIME140_1.dll Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-PCTO4LJLGS.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\charset_normalizer\is-3JSGEGNUYT.tmp Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\api-ms-win-crt-conio-l1-1-0.dll Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\QtWebEngineProcess.exe Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\plugins\networkinformation\qnetworklistmanager.dll Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-98O3W7R3Z6.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\is-IKRR3NSCE0.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\src\gui\ui\is-4JWLT5442A.tmp Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\api-ms-win-core-file-l2-1-0.dll Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-BG75ZQPGP3.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-G2FGXU76TD.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-N0UHXMDP3W.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\is-IE6KE48VDT.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\is-88T2TSEQNM.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\is-CCMU1F7QBY.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\webview\dom\is-E1Y6XH82I1.tmp Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\pyside6.abi3.dll Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-FLM6IZPLAG.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\plugins\imageformats\is-NE3DX8980I.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-3G5BMVTIUM.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\is-N70QUAZ20W.tmp Luqqzstrap_Installer.tmp File opened for modification C:\Program Files (x86)\Luqqzstrap\_internal\api-ms-win-crt-runtime-l1-1-0.dll Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\is-HVT3NGVR51.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\is-9TLYGH8W93.tmp Luqqzstrap_Installer.tmp File created C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\is-AQ7ZRNU0VW.tmp Luqqzstrap_Installer.tmp - Detects Pyinstaller 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c5ea-452.dat pyinstaller - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Luqqzstrap_Installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Luqqzstrap_Installer.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/5924-0-0x0000000000370000-0x000000000046A000-memory.dmp innosetup behavioral2/memory/5924-8-0x0000000000370000-0x000000000046A000-memory.dmp innosetup behavioral2/memory/5924-470-0x0000000000370000-0x000000000046A000-memory.dmp innosetup - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4968 Luqqzstrap.exe - Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 1244 Luqqzstrap_Installer.tmp 1244 Luqqzstrap_Installer.tmp 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 2008 QtWebEngineProcess.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe - Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe Token: SeShutdownPrivilege 4968 Luqqzstrap.exe Token: SeCreatePagefilePrivilege 4968 Luqqzstrap.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1244 Luqqzstrap_Installer.tmp 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4968 Luqqzstrap.exe 4968 Luqqzstrap.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4968 Luqqzstrap.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5924 wrote to memory of 1244 5924 Luqqzstrap_Installer.exe 88 PID 1244 wrote to memory of 4968 1244 Luqqzstrap_Installer.tmp 89 PID 4968 wrote to memory of 2008 4968 Luqqzstrap.exe 91 PID 4968 wrote to memory of 2008 4968 Luqqzstrap.exe 91 PID 4968 wrote to memory of 2008 4968 Luqqzstrap.exe 91 PID 4968 wrote to memory of 4884 4968 Luqqzstrap.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\Luqqzstrap_Installer.exe"C:\Users\Admin\AppData\Local\Temp\Luqqzstrap_Installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\is-3XXVTIEZVI.tmp\Luqqzstrap_Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-3XXVTIEZVI.tmp\Luqqzstrap_Installer.tmp" /SL5="$60192,116147978,965632,C:\Users\Admin\AppData\Local\Temp\Luqqzstrap_Installer.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Program Files (x86)\Luqqzstrap\Luqqzstrap.exe"C:\Program Files (x86)\Luqqzstrap\Luqqzstrap.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\QtWebEngineProcess.exe"C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\.\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --webengine-locales-path="C:/Program Files (x86)/Luqqzstrap/_internal/PySide6/translations\qtwebengine_locales" --webengine-resources-path="C:/Program Files (x86)/Luqqzstrap/_internal/PySide6\resources" --disable-speech-api --touch-events=auto --use-fake-ui-for-media-stream --disable-blink-features=EyeDropperAPI,WebOTP,DocumentPictureInPictureAPI --video-capture-use-gpu-memory-buffer --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=3 --time-ticks-at-unix-epoch=-1786380949042770 --launch-time-ticks=661683739 --field-trial-handle=4272,i,2590455622808673719,5215644236346375974,262144 --enable-features=AutoplayIgnoreWebAudio,NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,EyeDropper,InstalledApp,WebOTP,WebPayments,WebUSB --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2008
-
-
C:\Windows\system32\curl.EXEC:\Windows\system32\curl.EXE -fsSL --max-time 15 -A FFM-Offset-Loader/1.0 https://dev.imtheo.lol/Offsets/FFlags.hpp4⤵PID:4884
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2000
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Luqqzstrap\Luqqzstrap.exe
- Size 6.8MB
- SHA256 83a8345c6c9988b84bbac58f4f3b89a5c171a5087cd3f705f5366ddb585f50a9
- MD5 7509d27270acf88a8034ecc494886616
- SHA1 15f13f5366af36f618e94064fbae3d481bd2899a
- SHA512 8f162fd38970aab41284c542216a6bb35ade6cd89e7a22a40943810657e1a85908e6f4421e9c265ce0f2174262e5b4cf2e01bcbb10b181d3e1964c329819edd9
- SSDEEP 196608:JRuqjezHsbAxmDwHCcrK6CTFsc+DbcmddE7g1H:JRX4Hs0ADwHFex47P1
- TLSH T190763364A7A105ABECE2913E69A2C612F2F178101B31D2DF0B6C5B752F375E44A3E371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\MSVCP140_1.dll
- Size 26KB
- SHA256 b2113956aa3fcb9decfe65be1ee7829f8e3ae0899633ae89fe04888ada201594
- MD5 125fd152497716d47a5ede1b3e815e53
- SHA1 2bdb19c06b7ace945f1ab8a6c7cc74c5bdd4b8bd
- SHA512 c91256e08c83fa4e31dd157cef52797bea2c7c4279a210946dea8c518f1aeb35411a292130a3357b8eb84e28b6b02c9f6f8ca539756c7747c576f123747fe445
- SSDEEP 384:3ju2J9VQH+qNy09dmFWcS5gW7rHQIYiu9cQrPwiy8RbmL4nNyq0dzS:a8QH+qNy0PmgN5YiuiQrT5AL34
- TLSH T103C28D43EA108C04EC278934D8C69D6AF676F5904F92C3CB6359821D0FA63C379BE769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\Qt6Core.dll
- Size 10.0MB
- SHA256 65fe6224b6c47a15b058738031d31dce9928c4d7a58e1b8db6434f6f5cddd702
- MD5 d07506bad82cadd91c4224b6b35141a3
- SHA1 49194338604e1b7539eb32dd20a68257bbf03a5b
- SHA512 03f22f28d7c85e41e760789f22efdc0f866ee57e6086950abd27a9d60f78e5bb3ab8f898bcef72088fdaf93cb14026b19415fb312925b7c249f1b09362732c45
- SSDEEP 98304:WeAbhLTfRmoOKFdu9CwJsv6tnYNJMAA1gcV/3cNuWXelP:Whn8KFdu9CwJsv6tnuSA+/3cNuWXe
- TLSH T1FAB6390766FA0102F6FBDA34DAB75116DBB27C466B3096EF025861185D337F09E3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\QtCore.pyd
- Size 3.2MB
- SHA256 be52341a5df1f76ecca2fb1e94eb429dfa46f0b659ed6536f25119b565b21ea8
- MD5 938146ea00d1ca246284e60b8da29c3d
- SHA1 c04644ccbeedbe3ee0b853b1033ff63235fbe5ab
- SHA512 90c113e603ab0f1e805526e5d918db9ef61c99b465353c9a5b46023482f023dde19e70b78a5fc474d3ef4c2cccd3ac8a7250967fe5c4d8848f670a67d91ad48d
- SSDEEP 49152:wPhpi4wSOtPtQkPa8RQV8T5Rp/o4BHhTK9NvE8BRVzBvTfNfQwPsDXQ4XipL1/ip:Tu2S1f+T
- TLSH T1B5F55B9F93990180D73BE1BDC90B4A07D2F234924596F30B556ACC686FD73A2276DBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\PySide6\pyside6.abi3.dll
- Size 242KB
- SHA256 d4072be872b31f3748de5e6c28cb2976dafbf063d3ccfa38e5dabda29babcdaf
- MD5 a4a8f3b778b78e46246b1ad658f577ed
- SHA1 44749d0d28f8ec7122b5ec238f6d505d0918d26f
- SHA512 4fb1cc16bd7feb46833f0f21071683ff47bfe6225a4efc27106b0509e56b4a28c8d184adc84dbbac94ac83327f4335d1ea1aec7dfadb2f8e5139cb3c0066329d
- SSDEEP 6144:IEzkiZZnST8nH/oACtcwW1JucudQM2k8XRrWLxR8NDYXH:4T8QA/Bwcuz22Pb
- TLSH T198345C6B33445E99DEAFC279C902850AD2B3B4120361E34F03B5DBA65F6B3933A1D746
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\_bz2.pyd
- Size 85KB
- SHA256 33641a8ad0403473d678c7435197d49550fc5185ba7979fb16ab80256b1f9072
- MD5 98aa4ec9b691267912bcb3336fc7cafc
- SHA1 8955d7e923c4bf05d84a03666ec8cdb4fab2f616
- SHA512 62084c7077ed896b92055e5a278651d6eeca65622321e389e551e8a331b51c9fe2a5eb1b903eaed41117a7a8efce514b9d62acf2b62985d1535812ab59011387
- SSDEEP 1536:w1sxz74jpCk2wWdyOeR3RYZvksL8DdRbEvtwIA3V4y7NsR9KfIkWO:GsxzsIdtYOeRuZcsYZlitwIA3VU
- TLSH T162838D82E3A462B7F59F91B4D7810753F730FF560710A3AFB25482863F12B91AE58366
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\_ctypes.pyd
- Size 139KB
- SHA256 79967d8614f735cc62b81649641fd8d0414ca66d3d6656fa7788334bbdbbd35b
- MD5 409e2c98beb0554395f65fc8b55951c7
- SHA1 f7e25afa8bd80fa8ed709aed8ced4374c0f1ed93
- SHA512 8babb6fe295975868c1aa57c63dcab6f2cd151ba7074848dc7da27de2ea46a886496754b7c7e09b043ec5dc2813d30cbdbaa136f0f26302a1b7246a5da7962a7
- SSDEEP 3072:5Dpx2Lp7KR+FrkdOJWWcovIXBzTKRFyxpMIAGPwuTkY:tpxCtKUr8WDvIXBnU8xppkY
- TLSH T1DDD38E4B736840A6DA678138C6739E47EBB1F4521A1087CF4264C99B1F633A2AF3F715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\_hashlib.pyd
- Size 67KB
- SHA256 58c5c9ff93f989e2a233b8c5e06420ea73dd6c013e1f08d996fb0f2828eba0aa
- MD5 c435a8d2988b2b248664a45ac26b8b14
- SHA1 224adc85a39374e72de0383810aa747a7bc89705
- SHA512 480a76ad73ce1942751af83fca8913e3a36961876b15341035162a121b71aa0a86e992d3b6ca54a8a7ae7d43efc24fe8a824819f833c539a2abd30c41257d62c
- SSDEEP 1536:2qCcJ6CJ2GEioPMc5Wv52ztK4oIADIJy7NsR9BfIkH:xCcEyG1X5Wv52zBoIADI4
- TLSH T1F3636C46A6984092D62382B5C9E34E43FA74F6512B1197CFA239C1CD2F233C3677B75A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\_lzma.pyd
- Size 157KB
- SHA256 a01f1927adaa60adcfbe3b0314205a528cb9dd5a93b7e61cb284eddee9b0b347
- MD5 d5e9416137026497171e131dff6e569f
- SHA1 16de80a710940e38537d1d2aea22bc33d5948591
- SHA512 e7cb2a3c68e7f5129a4712b38b81fc84fc57881bd1d087c755ba16ee6d892be7ec0708a30465d2a28fe9b587226f233e02a2f512f861ad58012b5b80fe7c1927
- SSDEEP 3072:QJ66gwnM5uNIJfuPdX+ENYQrHznfx9mNopUpdgwIAI1ho:QURwnNIk1XrBrTpYOQgL
- TLSH T11AF35C86B794F0E6F3628C38D6624F57E6F578190320929A01CC976D2B1FB759A2F313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\_queue.pyd
- Size 35KB
- SHA256 2a7bb0a53e86ae4982a6f64e2570137829a0be66537bb1c166913af273edbf0c
- MD5 ca3c81d27c1baf30131d62f290d69057
- SHA1 d8c637b974f7c6d5a8761b02e145f8a1c3b5538c
- SHA512 684111ef143ef891701e209857486e3172e6f1d02fd50236e591e231748ba7acee31cffb840a5cb56ba57e92c57654e461cf479cace7bfc3fabcd42442911b7e
- SSDEEP 768:ZlBxk6rOVBBmMIARUb6hy5RNLaRYT2Ip4DaTxf1ml9dH3jL:ZjSBBmMIARUbmy7NsR9GfIbH3v
- TLSH T128F28DC66A689097E6A3C970C2E2DE53F575F793170086DF2169828E1F273C2A33635D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\_socket.pyd
- Size 85KB
- SHA256 435a86973131c5d5dc90f828e72d7bb0607578a48ab5bc5377f4a280a6beb8f7
- MD5 8a8a372bee9f3b313e44bf441fd5dd61
- SHA1 802cc8454b2c5ca4c8a7754821b756d3ca248058
- SHA512 bbf0362e306e0679937158647f402bd93a23f7f4270f90eff524b44b0f0af114456f8681b933424a50e3fa764b2ea5aabc67e385a02da2427c340163bf6ed739
- SSDEEP 1536:ecVuncT0XH3XAJtZypxQ7XP+66wSz2/jAjI/Lb6NsQ3cs8PgMrMIAGwsy7NsR9dB:nEny2+jypxQ7XPz6wSz2/jAjQOsQssVG
- TLSH T1C5835B01AA6040F6EB72C172C2639E63FB74B5C012D4A75F5466C65A1F333C2BE3AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\_ssl.pyd
- Size 180KB
- SHA256 06f51fbe150c831af619890eea2d9fca9ce8b49758bfe3f382883551c592e6b3
- MD5 372d2752bed978ad699a22fe125fe285
- SHA1 9600c5fc4f904f65b29fb523cf9aadc9f109716e
- SHA512 87c0a1385e624acfdeec9194a20d02475aac5cc965f558b40a932d955b49e70517f4691c142e8718bec283b3ab5d7671b886084792f47a236759000308716414
- SSDEEP 3072:2Lj0a+17gAx5pW3kfh6CM6qMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/Uo:4+17gAA3Qh6CM33bLOUBD
- TLSH T147048C47B1946EF7D913E8B9C2234443EBB4F145332287DE48D6D6860F03746AE6AB63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\_uuid.pyd
- Size 27KB
- SHA256 35f26f7f55ded30da92ed30258fb9624a7398ba3eadee134813133c560fcbbae
- MD5 f422a29fd0cf366bbf400691c3edbf8d
- SHA1 8df1f6f480e916f2ada3d7f90e1f1cbe64f8b781
- SHA512 e5388352d230aa5a278cc833583940d4711b5126fe4efd3c225812bcfa8df57ee7cafda7a2975e7bce6882886e325f6b1f1cce4f1d7a588a9f854752d2d3bd69
- SSDEEP 768:WPn15cwIAIwjhy5RNLaRYT2Ip4DTxf1mlIJnl:WPn15cwIAIwdy7NsR9BfIkn
- TLSH T1A3D27E8A9A784047FE935B70D1F6DE43B939BBD31A11865B317A81C50E133C1B32B26E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\_wmi.pyd
- Size 39KB
- SHA256 eccb72a070d63f0ddde054c7a15d375b11b1dfc3362452c55ccabb487dee87fc
- MD5 495460dff020ae1b0ed769ca066d2635
- SHA1 04dff00adde1f80ed9a367a0d7221af1968afa17
- SHA512 d3171934fad631f51edd02526e6f05e43986c1bf8bc16d02877077d39bd7aa27f83efb2f27ada23e792c2a1bad8ce17bc2f0801e308f425c21d3bbae99ace5c8
- SSDEEP 768:D2/EEqrVmjsyu2OQMVwIA3ilhy5RNLaRYT2Ip4ETxf1ml9dHMjL:OE9BEe2OQMVwIA3iTy7NsR9YfIbHMv
- TLSH T1A0038E89E6680092FB67DA70C5A6CE53F575B7931712838F326582990F333D1E73A329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\_zstd.pyd
- Size 491KB
- SHA256 e5924e2985186797668dd3b2e1efeb9313459258a4564dbf5499935c7ebd44e7
- MD5 a75e9eb46c217f915fb8db1deed6dbb3
- SHA1 b7e1bb9e18856a93b405c8adff3a198695b37d50
- SHA512 c160a4681d9e5ecbeaa9416e294883fae9a212e28a8fdee5b86181f7e1cb35b9f1352e2af7894ae1023fb839e75d4fcaa4c5bc61024bd7cf0e261e21edb02cfb
- SSDEEP 6144:dZ87M+EgY9pB2l1eUVcnmw3Vh4S+zKhThruVxzeeO07WEz9LKE+UIHHHRToSH2l4:vNcumw3vT8eeOyWEz8xHnRTrWl93R9D
- TLSH T17AB48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\base_library.zip
- Size 1.3MB
- SHA256 12fe01ad091d823880949c78ceeef28a84963b63f19e8d4ffaeec3ce9cd74119
- MD5 32d4aa59e2a8a32066646108bce162a6
- SHA1 ed2976090be5f8290530f60c08b2d15a75663660
- SHA512 81432ed8559c8f71d1cbe9b90235881cfd1ad8f397d2ffde2860122d5c72c5f72450da64b97f8628c24081cbaa2832ffc7f2b32deed63e78643a4a8b9ee7fc71
- SSDEEP 24576:AdUuT3llbDQeOdP2m2dfYuUF0L4bRp8HO2:Ad33X/wuUFFR+R
- TLSH T1AA552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\libcrypto-3.dll
- Size 5.0MB
- SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
- MD5 7e8a8461fcd43c82841a99a2054711f1
- SHA1 a931808c56e3a117795491965cb3f679cdc05886
- SHA512 023c34e26b7dc7240d4571f8f808bdd0b749bd6e924948c3db9c5bb4f7acf24557d3a94bfe6ff82697f9747b35c13a73b94482dff3568e1dadb8fe08b598bc61
- SSDEEP 98304:on+c+4Vp8XhjqO58Pw1CPwDvt3uFlDCQ9p:mPTVpghjqO5841CPwDvt3uFlDCQ/
- TLSH T147367B6AA7A80189E4BAC13CC9534617D2B1F81A57B097CF18A156BD0F37FDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\libssl-3.dll
- Size 776KB
- SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
- MD5 299335af4f92df8a446d5f98d6e9cfc4
- SHA1 75ddcd4863ffde24d22914946ce4e085722dcdbe
- SHA512 2da67c01775d71122e6bb951b7e5e7462e8725f79b513551478cd262dae2d97e108427241d13f4fd6ef1d35b739d34fb9c999ca4a6d50271ceda8e0c3dab313c
- SSDEEP 12288:8VJ6zW/kDXMeI0niRBRKZk60STGaFc4rldFe9XbC:JDXMeI0iRBRKZN08GaFFe9XbC
- TLSH T1D3F44CADB37C05DDD8B6C17986934623E3B6F4162330EBEB065186790F277D52B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\python3.dll
- Size 72KB
- SHA256 1dd696f02326e32e67b52c25b249b3acce3238176212d16e8fb1a050a1455ae9
- MD5 33282f049faffb54e4b5604f18bcb4f7
- SHA1 3406bdbd09a8968816f303f5c6e8e220a9336807
- SHA512 6a8754ed4a24748d60002f2a02c0cc193a4d2185edba7c834572a6815b1aa1bea4733708460dbd2780cc3a6c856ce8aba0d2f55cd1a65c164599267784e0d2a6
- SSDEEP 768:PQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKI1:ebTrnXngXMjMIAG0Yy7NsR9/fIbHgv
- TLSH T110734B5E6B54F8A2D6F629FC78D199CE242B12FC4F2984DFA47DD3920D1A310A22734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\python314.dll
- Size 6.5MB
- SHA256 a07f7d09c3121492bb066535c6d0811df5fbc2090cbca7031a97bb47ce1480c9
- MD5 e823b990ba85afa143b799c291058dce
- SHA1 3e53a71a5c72c3011bee19a792a6552a0d702671
- SHA512 fc9b0a6795993e1c4519622726647c33c415a9aa9983daa52d1f9f371c58fb74067599052f5b9c25f5acc08ed15021221dc524543a4de87b5705bba145a1b622
- SSDEEP 98304:6PEfNNEwwP1Fyh4NIyDB7Qfo7wavAHDMiEuGC:tfXEwM1Eh4ayDpji1
- TLSH T180669E26737401A5D9BB8035CA074647DBB1BC00AB30D34B59A47ADA3F733635BAEB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\select.pyd
- Size 32KB
- SHA256 56441c3148743a0890986ccdf93fea8174155b0ee84db2493151f075d8e7c51a
- MD5 220234862600483073f18e48a7860bc5
- SHA1 fd000174506afa55ffe67f72b45f8bb9e572ad6c
- SHA512 c4b7f64f8934c9892763487fcd0eaf4c8087679082d0bb250cc264bdabaf88fb7245ec5b54abbe412a05c397abe56729f297bff98a956f9d4d8f98310ecbfcde
- SSDEEP 768:oB7YoHf8aqFMIARGLhy5RNLaRYT2Ip4zTxf1ml9dH7DjLkB:oB71/8aqFMIARG1y7NsR9RfIbHHv
- TLSH T126E27DCAAB745047E6A3CA7186A2CE43F939B7A35651829F31B991C90E173C1F337319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
- Size 1KB
- SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
- MD5 4ce7501f6608f6ce4011d627979e1ae4
- SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
- SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
- TLSH T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\shiboken6\MSVCP140.dll
- Size 536KB
- SHA256 005f2324c7ff79bbe9a44992b0708abb4c871bd24bcc7a34aca5eab4439c1f4a
- MD5 db5a33e3d927fcda8d0f3013504f0928
- SHA1 c4d101c530a77a0c04e030427f5bf8530ca82665
- SHA512 0f4291e1969e50d7d503d5b81d491ef047234639b1d282279c24a960ca691516b5d6d291fa1c79b55edb93c71afcf608500f8377a3a43628c9a59c1575579af2
- SSDEEP 12288:fdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa6z:fdnGoU/7m/V5WZ8dQEKZm+jWodEER7z
- TLSH T16CC42A27F74A06B0E195E3B8A1838702D7F1BC498322E3C752EB955D2F573D0A67B690
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\shiboken6\Shiboken.pyd
- Size 32KB
- SHA256 0e2c5318c5ac60a016a12230bbb1f6a9d990c45cbf4a7c4af24aefb5ab7dc40a
- MD5 da10bfdadc7dad176221e1cb649dddf5
- SHA1 3d9e524cbe29ab4a95dc8afed32e0eb9b51d3251
- SHA512 ffc75f77f7657ef9c78818fc7cebbda56ecbd39b11098a4dc8fe73f0388fcc1cd88c55a16bb9a5364546fabff3a3efafa3c358215411ea610b58979db6d0c8ec
- SSDEEP 384:CBFBhadkk14n3CwmRk3RkbR3mQtbScd0a9upvHQIYiu9cQJwZTy8RbmL4nNy8n6:OBMdkl3OmhYJmAmceeiP5YiuiF95ALm6
- TLSH T1A9E29E438D24648DED21D67A80868D1AE1F1B1560751D3CF136BD1EA5FA33C23E3E7AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\shiboken6\shiboken6.abi3.dll
- Size 375KB
- SHA256 47f4f9b44c95037565dd14f4be04f350f20c53c05483b750e0be867c39a7441e
- MD5 2de027ce82d964b55f71c01fcad2f6de
- SHA1 01a61145f111ebaa840f93d0081b1f8327ca6df1
- SHA512 3a4b538045380948cda89de3809b350ac51aabf2f7af33a26d2bdacb98f1a2b4aa8452342c749281c16e2f7788bd7919982b219bd8e033460ceca634ccebafaa
- SSDEEP 6144:lNjK8duskXY9Fc/BnFGFmuDPgiNkbOdxFF2PejUosGfJXPYVIfwcY:fduqA/BAXN1sPeQosGfBnc
- TLSH T144847D27AF5410DCE67B927C8562CA06E27670A6035097CF23F9C2D52B63AD53A7EB01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\ucrtbase.dll
- Size 1.1MB
- SHA256 ff995ea3af81fa04506421831e303d3db776bdb7bbe9e6087af8859975fcbfe0
- MD5 e32486cc4a45406fdf2855dd9080d200
- SHA1 28cbd5ac2293e7140ce505618c3d99130977c987
- SHA512 0674517fffd28e3bb5788a1d789857a0b7c7fb6e67da4b90c80f028adc12ba078e739ca2f8209c3a94c049e59dd1327a83f60cad59bd0df454693a580eb60ff6
- SSDEEP 24576:zRmADWOBBIHv0XESwR5H7iFZBmai0gFcszUmxvSZX0ypme:dtI045H+ZB7fgDze
- TLSH T168359E28B76C02AAC57BE17DC923550EF972380447709ACB03A74BB93E277E956B7311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\unicodedata.pyd
- Size 740KB
- SHA256 58013696b4f08717aee2885aefa24031f4b18b3e62faa8125248cc3e0a86af2a
- MD5 89acf0e666a540a8e22cac1a09f15ff7
- SHA1 e11e74df8f7b7448c79f31fafd6a9ef5f1a393d3
- SHA512 26c9958de86384a1bfab493f2f733e087de887f3f0c7532bf30fb3de2dd32b5942ac806b8bee1370e2f9ae67b5df7fba65fc43aa88dab78f8408c09d1c769a28
- SSDEEP 12288:PPYzAPtrZmDtBPcH+dEYJ5EIub+z70lDJPT36mwtNi:PPY05ZmDPqO54lDJPTMNi
- TLSH T1CDF4E5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\webview\__init__.py
- Size 16KB
- SHA256 53a631a579ce342fb45efbe4ef024b28deabb34f061bcf058fd818ce27aa7e80
- MD5 d67859cbb2e0b13dc184315c3262c1f8
- SHA1 636b52c093c2f3bf6f86186a7b7d8d343f3ed039
- SHA512 850a53f4cc0d962c53d66221c11b1d15027798a1de0a3398474907d50d0483a715d70c0b6ad14606334e490bb9273c51c29e954dea5de6d4c55cf2a0a7104424
- SSDEEP 192:zmoshbV88sqf4POMjOg6Fz+IXuNl8RALTPYaixLQKT2Qb7pxzdUziBg1CK7gaR9l:uhbmk03LM+IG8bYzt75weMVM
- TLSH T13D72D80A990B60270B234DAE5E6FB3011B2B544B7E043134798C95393F9E63FE1F92E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Luqqzstrap\_internal\webview\dom\__init__.py
- Size 1KB
- SHA256 515e69981ea8ba2efea32d473a9f9061854501475c18c33d863501aca99e6fb5
- MD5 330769fa25fbdc18e1d36f6cb331f804
- SHA1 b7a0001cb5d1986295336f6aa438cc62b331f9d6
- SHA512 90ad84040aabcabc519f8f7c1311ceed267e93b68ccddd7ba6e08ac1a6084a68d01a4cee8f39058e6a608f5f939550dc61d98428050e66564941ad78e378ab76
- TLSH T1222135ECB473ED9498B7EE9F856F2502623E1C07062836B6B1AE83121F49158D2DAD91
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3XXVTIEZVI.tmp\Luqqzstrap_Installer.tmp
- Size 4.3MB
- SHA256 a2d616d1187f6eec335b609ca96d251c23bdf8bff5d925dae3593f1089208535
- MD5 d0fbebf80bc1e41fe32705fbff170dde
- SHA1 13dbb3821a18082d3c1c5516e2aeddb21676087e
- SHA512 bb902f85c254fb84363cd945b8370b0f333a3ace32302d8e998f67c2c26f188b3e0b58fb07e0e9cd08ba07fccb5f10e93aac5e467d3d5414b722121286c0ac31
- SSDEEP 98304:39SZUvl30aj90ZFcvdQ0hdgvminQLMj+JH333xR9:EItJj90Z6RgKw0R9
- TLSH T1ED268E03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF4095C4F396416D3A747
- MD5 SHA1 SHA512 SSDEEP TLSH