ac2ca5bcc0b9c7e01b3eb34df0696cc574b4b0e3b313277508ac11cfa45467dd

Analysis

user interaction
yes
max time kernel
44s
max time network
85s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lumi_spammer.exe
Size 271.0MB
Sample260817-hakd9avdqa
SHA256 ac2ca5bcc0b9c7e01b3eb34df0696cc574b4b0e3b313277508ac11cfa45467dd
MD5 83ba56d574adf98f99857a3558e2b159
SHA1 6e00084cd4a0c68383eae6c21930685f5ea10369
SHA512 b696d09218b505af4fe57840075478a474db1793c59fcde3a5ab8151993a90dd6069163812c8e0922ae668f0b5dd977e872a6b3476c01360ef274e8db2ee866a
SSDEEP 6291456:jAGlQGfqdrc1kHAuYh4FWRQ8799i/5nxxeT/9Q1JC/S:jAmQGCdrcmHA9eFS73ixm/96S
TLSH
T176D833499B833000D598AA7DF5CDCA2966F1550E525F00ABF3E01B746A670E7BE37BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Loads dropped DLL 26 IoCs

pid	Process
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe
5652	lumi_spammer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\LumiSpammer = "\"C:\\Users\\Admin\\AppData\\Roaming\\LumiSpammer\\lumi_spammer.exe\" --autostart"	lumi_spammer.exe

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
3688	net.exe
708	net1.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Web\\Wallpaper\\Windows\\lumi_wallpaper.jpg"	lumi_spammer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Web\Wallpaper\Windows\lumi_wallpaper.jpg	lumi_spammer.exe

Executes a command shell one-liner 1 TTPs 18 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5900	cmd.exe
2976	cmd.exe
5660	cmd.exe
2988	cmd.exe
5712	cmd.exe
4684	cmd.exe
2716	cmd.exe
204	cmd.exe
3604	cmd.exe
3260	cmd.exe
1952	cmd.exe
5096	cmd.exe
3388	cmd.exe
1872	cmd.exe
1048	cmd.exe
1836	cmd.exe
5248	cmd.exe
4832	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1736	vssadmin.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3288	taskkill.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Desktop	lumi_spammer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Desktop\WallpaperStyle = "10"	lumi_spammer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Desktop\TileWallpaper = "0"	lumi_spammer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{69E8607D-7F5D-4907-817C-6C5638CFDC10}	explorer.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5496	whoami.exe
Token: SeDebugPrivilege	3288	taskkill.exe
Token: SeShutdownPrivilege	3496	explorer.exe
Token: SeCreatePagefilePrivilege	3496	explorer.exe
Token: SeShutdownPrivilege	3496	explorer.exe
Token: SeCreatePagefilePrivilege	3496	explorer.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 5652	1552	lumi_spammer.exe	89
PID 5652 wrote to memory of 4684	5652	lumi_spammer.exe	92
PID 4684 wrote to memory of 3688	4684	cmd.exe	94
PID 3688 wrote to memory of 708	3688	net.exe	95
PID 5652 wrote to memory of 5096	5652	lumi_spammer.exe	96
PID 5652 wrote to memory of 2976	5652	lumi_spammer.exe	97
PID 5096 wrote to memory of 5500	5096	cmd.exe	100
PID 2976 wrote to memory of 5496	2976	cmd.exe	101
PID 5500 wrote to memory of 3736	5500	net.exe	102
PID 5652 wrote to memory of 5248	5652	lumi_spammer.exe	103
PID 5652 wrote to memory of 2716	5652	lumi_spammer.exe	106
PID 5248 wrote to memory of 256	5248	cmd.exe	108
PID 2716 wrote to memory of 3960	2716	cmd.exe	109
PID 256 wrote to memory of 5632	256	net.exe	110
PID 5652 wrote to memory of 3388	5652	lumi_spammer.exe	111
PID 5652 wrote to memory of 1872	5652	lumi_spammer.exe	113
PID 3388 wrote to memory of 3288	3388	cmd.exe	115
PID 1872 wrote to memory of 3220	1872	cmd.exe	116
PID 3220 wrote to memory of 5636	3220	net.exe	117
PID 5652 wrote to memory of 5660	5652	lumi_spammer.exe	118
PID 5660 wrote to memory of 5056	5660	cmd.exe	120
PID 5056 wrote to memory of 4184	5056	net.exe	121
PID 5652 wrote to memory of 4832	5652	lumi_spammer.exe	122
PID 4832 wrote to memory of 6080	4832	cmd.exe	124
PID 6080 wrote to memory of 3920	6080	net.exe	125
PID 5652 wrote to memory of 3496	5652	lumi_spammer.exe	126

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	lumi_spammer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Wallpaper = "C:\\Windows\\Web\\Wallpaper\\Windows\\lumi_wallpaper.jpg"	lumi_spammer.exe

C:\Users\Admin\AppData\Local\Temp\lumi_spammer.exe
"C:\Users\Admin\AppData\Local\Temp\lumi_spammer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\lumi_spammer.exe
  "C:\Users\Admin\AppData\Local\Temp\lumi_spammer.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user Lumi Loserforlumi123!spammer /add /y"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\system32\net.exe
      net user Lumi Loserforlumi123!spammer /add /y
      4⤵
      Creates a new local user account
      Suspicious use of WriteProcessMemory
      PID:3688
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Lumi Loserforlumi123!spammer /add /y
        5⤵
        Creates a new local user account
        
        PID:708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators Lumi /add"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\system32\net.exe
      net localgroup Administrators Lumi /add
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5500
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators Lumi /add
        5⤵
        
        PID:3736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "whoami /user /fo csv /nh"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Windows\system32\whoami.exe
      whoami /user /fo csv /nh
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5248
  - - C:\Windows\system32\net.exe
      net localgroup Administrators
      4⤵
      Suspicious use of WriteProcessMemory
      PID:256
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators
        5⤵
        
        PID:5632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "RUNDLL32.EXE USER32.DLL,UpdatePerUserSystemParameters 1, True"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\system32\rundll32.exe
      RUNDLL32.EXE USER32.DLL,UpdatePerUserSystemParameters 1, True
      4⤵
      PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM explorer.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM explorer.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators "Admin" /delete"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Windows\system32\net.exe
      net localgroup Administrators "Admin" /delete
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3220
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators "Admin" /delete
        5⤵
        
        PID:5636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Users "Admin" /add"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Windows\system32\net.exe
      net localgroup Users "Admin" /add
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Users "Admin" /add
        5⤵
        
        PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user "Admin" /active:yes"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Windows\system32\net.exe
      net user "Admin" /active:yes
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6080
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user "Admin" /active:yes
        5⤵
        
        PID:3920
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:3496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators "Administrator" /delete"
    3⤵
    - Executes a command shell one-liner
    PID:1048
  - - C:\Windows\system32\net.exe
      net localgroup Administrators "Administrator" /delete
      4⤵
      PID:1520
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators "Administrator" /delete
        5⤵
        
        PID:2968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Users "Admin" /add"
    3⤵
    - Executes a command shell one-liner
    PID:2988
  - - C:\Windows\system32\net.exe
      net localgroup Users "Admin" /add
      4⤵
      PID:4316
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Users "Admin" /add
        5⤵
        
        PID:2008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user "Admin" /active:yes"
    3⤵
    - Executes a command shell one-liner
    PID:5712
  - - C:\Windows\system32\net.exe
      net user "Admin" /active:yes
      4⤵
      PID:2512
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user "Admin" /active:yes
        5⤵
        
        PID:1672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Administrators "The command completed successfully." /delete"
    3⤵
    - Executes a command shell one-liner
    PID:204
  - - C:\Windows\system32\net.exe
      net localgroup Administrators "The command completed successfully." /delete
      4⤵
      PID:5956
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators "The command completed successfully." /delete
        5⤵
        
        PID:3276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user "Admin" /active:yes"
    3⤵
    - Executes a command shell one-liner
    PID:3604
  - - C:\Windows\system32\net.exe
      net user "Admin" /active:yes
      4⤵
      PID:5196
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user "Admin" /active:yes
        5⤵
        
        PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net localgroup Users "Admin" /add"
    3⤵
    - Executes a command shell one-liner
    PID:3260
  - - C:\Windows\system32\net.exe
      net localgroup Users "Admin" /add
      4⤵
      PID:1292
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Users "Admin" /add
        5⤵
        
        PID:5184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "net user "Admin" /expires:never"
    3⤵
    - Executes a command shell one-liner
    PID:1836
  - - C:\Windows\system32\net.exe
      net user "Admin" /expires:never
      4⤵
      PID:4244
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user "Admin" /expires:never
        5⤵
        
        PID:4488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"
    3⤵
    - Executes a command shell one-liner
    PID:1952
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1736

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:716

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:1848

C:\Users\Admin\AppData\Roaming\LumiSpammer\lumi_spammer.exe
"C:\Users\Admin\AppData\Roaming\LumiSpammer\lumi_spammer.exe" --autostart
1⤵
PID:4432
- C:\Users\Admin\AppData\Roaming\LumiSpammer\lumi_spammer.exe
  "C:\Users\Admin\AppData\Roaming\LumiSpammer\lumi_spammer.exe" --autostart
  2⤵
  PID:3376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:5900

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create Account

T1136

Local Account

T1136.001

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

_imaging.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\PIL\_imaging.cp312-win_amd64.pyd
Size 2.5MB
SHA256 743c7c051b47d60a6bba4b3537e564f1f2e745e342e7351cab5fbe2d0bb96594
MD5 cbb71dddfb2046e063e3d6d3fe78d33d
SHA1 18c0345023024457eaa42e84f93e11f143b6cc56
SHA512 fb3796c6c483b6a9542cdaab0a331524409c0905eb974e7bc9ada7ad8117458410e40d7eb209ccb8f0244725ca8d6b72bdbbf14397751143fa2d20de825018e0
SSDEEP 49152:zmiB/txItVgW/vLazS4aVtEdTt1iBbidCb+Ku7jcl/5G:IJMd6idC6nAB4
TLSH
T1C1C56C06E9D19599C6B28034CDA6C216E3B1B80D17F187F77684A7F93E23BD0353A396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\VCRUNTIME140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
TLSH
T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_bz2.pyd
Size 83KB
SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
MD5 30f396f8411274f15ac85b14b7b3cd3d
SHA1 d3921f39e193d89aa93c2677cbfb47bc1ede949c
SHA512 7d997ef18e2cbc5bca20a4730129f69a6d19abdda0261b06ad28ad8a2bddcdecb12e126df9969539216f4f51467c0fe954e4776d842e7b373fe93a8246a5ca3f
SSDEEP 1536:Iyhz79151BVo1vXfzIFnaR4bO1As0n8qsjk+VIMCVl7SyVx7:/hzx15evXkuxAP8qMk+VIMCVlJ
TLSH
T1CE839E92E3956AF5F41F81B956C10367E771B945075083EFF348C2592F03B426EAC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_ctypes.pyd
Size 122KB
SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
MD5 5377ab365c86bbcdd998580a79be28b4
SHA1 b0a6342df76c4da5b1e28a036025e274be322b35
SHA512 56f28d431093b9f08606d09b84a392de7ba390e66b7def469b84a21bfc648b2de3839b2eee4fb846bbf8bb6ba505f9d720ccb6bb1a723e78e8e8b59ab940ac26
SSDEEP 3072:IXw32spTVYgFoj6N2xE9sb7V/f/E4ZBq5syCtYPU95IMLPhr:IgGEOgFoj68ksRf/ERsX
TLSH
T174C36C1B339400A9EBA34178C4B36E07D7F1B41B076197CF12A4C6992F637A76E6E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_lzma.pyd
Size 156KB
SHA256 a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
MD5 9e94fac072a14ca9ed3f20292169e5b2
SHA1 1eeac19715ea32a65641d82a380b9fa624e3cf0d
SHA512 b7b3d0f737dd3b88794f75a8a6614c6fb6b1a64398c6330a52a2680caf7e558038470f6f3fc024ce691f6f51a852c05f7f431ac2687f4525683ff09132a0decb
SSDEEP 3072:ssvkxujgo7e2uONOG+hi+CTznfF9mNoDXnmbuVIMZ10L:snu0o7JUCNYOD2Kg
TLSH
T1DCF32992A394F0D5F6728C78D6624F17E7F67849032092DA02CCD36D2B1FB759A2A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_socket.pyd
Size 81KB
SHA256 67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
MD5 69801d1a0809c52db984602ca2653541
SHA1 0f6e77086f049a7c12880829de051dcbe3d66764
SHA512 5fce77dd567c046feb5a13baf55fdd8112798818d852dfecc752dac87680ce0b89edfbfbdab32404cf471b70453a33f33488d3104cd82f4e0b94290e83eae7bb
SSDEEP 1536:mOYhekrkJqlerLSyypHf9/s+S+pzMii/n1IsJqKN5IMLwoR7SygCxkWN:vwkJqHyypHf9/sT+pzMiE1IwdN5IMLw0
TLSH
T1E7835A12A69050F9DB73C0B6C6635F23FBB4B48013D5939F1166C66A1F33782BE79A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_tcl_data\auto.tcl
Size 21KB
SHA256 517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c
MD5 08edf746b4a088cb4185c165177bd604
SHA1 395cda114f23e513eef4618da39bb86d034124bf
SHA512 c1727e265a6b0b54773c886a1bce73512e799ba81a4fceeeb84cdc33f5505a5e0984e96326a78c46bf142bc4652a80e213886f60eb54adf92e4dffe953c87f6b
SSDEEP 384:UqT9XC9VZv9QXCTxsCTHI7672ORgS0mzBvxFRTX7Xvt3wBTnFXhCUvuyqz:LT9XC9VZviXCVsCLI7JlmzBvTxvt3gTW
TLSH
T199A2C7635F9542A630B1C22B553DB9A4EF2F81B70675801D38FC912C37F1815C6BEAEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

init.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_tcl_data\init.tcl
Size 25KB
SHA256 7a103a85413988456c2ad615c879bbcb4d91435bcfbbe23393e0eb52b56af6e2
MD5 fe92c81bb4acdda00761c695344d5f1e
SHA1 a87e1516fbd1f9751ec590273925cbc5284b16bd
SHA512 c983076e420614d12ab2a7342f6f74dd5dcdad21c7c547f660e73b74b3be487a560abd73213df3f58be3d9dbd061a12d2956ca85a58d7b9d9e40d9fa6e6c25eb
SSDEEP 768:cXugPHudKlExBG+Xg3Qonlm6ofRRECLSQDjr5vkhzx/i:hgGdKli4eonlm6offLzehNi
TLSH
T1A3B2A7112384917932B343368AB9B598ED7EC1F715AD41BCB8CC825C777150A4AFDBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tclIndex

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_tcl_data\tclIndex
Size 5KB
SHA256 ddf7e42def37888ad0a564aa4f8ca95f4eec942cebebfca851d35515104d5c89
MD5 c62fb22f4c9a3eff286c18421397aaf4
SHA1 4a49b8768cff68f2effaf21264343b7c632a51b2
SHA512 558d401cb6af8ce3641af55caebc9c5005ab843ee84f60c6d55afbbc7f7129da9c58c2f55c887c3159107546fa6bc13ffc4cca63ea8841d7160b8aa99161a185
SSDEEP 96:eOaVhNUMUuUQU2UsUIUbUEUEeUkgU6UWSO0DT5RTdcvsilrvs+jscMK57ehXowrz:ejVHRRLP3LWDXewTbSO0DT5RTdcvsilg
TLSH
T14FC1301AA756C72803F481074999FE283ADED1E4D33DC93E99A491CD10B30076FEE9E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tm.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_tcl_data\tm.tcl
Size 11KB
SHA256 4b7ed9fd2363d6876092db3f720cbddf97e72b86b519403539ba96e1c815ed8f
MD5 215262a286e7f0a14f22db1aa7875f05
SHA1 66b942ba6d3120ef8d5840fcdeb06242a47491ff
SHA512 6ecd745d7da9d826240c0ab59023c703c94b158ae48c1410faa961a8edb512976a4f15ae8def099b58719adf0d2a9c37e6f29f54d39c1ab7ee81fa333a60f39b
SSDEEP 192:55CjnlRfMKqaOH5bE2KjNkkpgpCmqkkuowUh9PTYMsvSO+xy8h/vuKisM68E:5q3MKYH5bE1jNkkpgomq/uCPTYMC+k83
TLSH
T1EC42B512B38A536A62B313254EBAF294DB2DD1FE57E5506C744D81A837208284B7F7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_tk_data\tk.tcl
Size 23KB
SHA256 1d5e7518afc1382e36bf13fc5196c8a7cd93a4e9d24acf445522564245a489b0
MD5 184d05201893b2042d3fa6140fcf277c
SHA1 aad67797864456749adf0c4a1c0be52f563c8fb8
SHA512 291bdf793cabc5ec27e8265a8a313fe0f4acab4db6ce507a46488a83eef72cd43cf5815762b22d1c8d64a9eedea927e109f937e6573058e5493b1354dd449cb3
SSDEEP 384:NJyxt+WaB9USY15gSgC3DbTbXLXKr3cIXyDAbK2LMGgtewT+3oFQRyH5bAy59HmD:NJItNe9USZblXysm7GgteoFQRYMESL
TLSH
T186B2D6195DC062B3513BC13F53BB2A00D87558FB2B76A44978DC48B92F6883B06FE9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_tkinter.pyd
Size 64KB
SHA256 f91d38d865378a120f76596c90e79f6ba57fcf3c39dedb99098e597d9b577256
MD5 911d7552870c5d1ffa646326ab760d38
SHA1 c6d90ef0540f16e0c0112801ff57325d676d2946
SHA512 44fbba9cfe5ae64b440751145c7497588c19cc038838c9e046a328682f100d7f45bd9c914fb8e1d462cf105628767ed308bbc19cdbcc5b0afe74621bccc81d4d
SSDEEP 1536:qGpS27sIvGJdk7Y4Y7S81CpnHcKWNIMOSg7Sy8HHxT:vpVp7jKSppnHcFNIMOSgiH5
TLSH
T18D536D6BA760008ACEA7C179C4B36F23D675B5520B10924F0294D35A2F337E3A7FA755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_wmi.pyd
Size 36KB
SHA256 73b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32
MD5 827615eee937880862e2f26548b91e83
SHA1 186346b816a9de1ba69e51042faf36f47d768b6c
SHA512 45114caf2b4a7678e6b1e64d84b118fb3437232b4c0add345ddb6fbda87cebd7b5adad11899bdcd95ddfe83fdc3944a93674ca3d1b5f643a2963fbe709e44fb8
SSDEEP 768:rUmqQhTcYr6NxO0VIMCit5YiSyv4YmAJAMxkEn:Im7GBNxO0VIMCiz7SyQYmQxz
TLSH
T106F27E67E7940895D937CDB9C8864E27E971B5825B11C3CF331482590F323C1AE7A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\base_library.zip
Size 1.3MB
SHA256 83094f38f47cf7a1a42995e34d5133416e15a7f4e03004f5356937ef69639ade
MD5 dac33853a4a3ac6cbd876732677055c5
SHA1 4bcd8674a3b758602c2988b93b6b1e42ed3bf9fe
SHA512 4b5b7eaf2c41b8e63295664259994c4ff2dc540f223a03cf70db9bdcce300fbad8031761f96bca8c300332ffdea6b0d037862ea7a9d6341b0151692a7b3d4eab
SSDEEP 12288:XW1duHtSYYTq+zYgEkA1qJujl/yquMclJGUqXHcPndmg/RRxJoLmn9G2/HBthW:ou0YnXBclJGU+cPndmg7ca9G2/HDhW
TLSH
T1EE55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blue.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\customtkinter\assets\themes\blue.json
Size 4KB
SHA256 c9417470c16ced7a43d6c4a8e027afa6edc62c24d5aee7c4c2dcd11385964d3b
MD5 05eb3947ce9a8c3bef66c14d0f938671
SHA1 06ffc811ee51609809d88894022e222b339aefee
SHA512 4db7c14fba78185edf6459016608cb8fa0a250dfb48432c552bb4e0466cf49622b34d847e17c254bb1c8d15bf365e91bce3ede552ba8733fde9d21779f7f1c13
SSDEEP 96:KupscLUBH2cEyzmGvtu/XaNgdacgWu/Bwg+Y51hlk2cEdVJFvLpwZdIunacEkGgC:KupNUtMiPQ/XXIRp/v+Y51hT/vlggf+4
TLSH
T167912814C5280EA723FB9B2A1607EA043C9C95D36FA8FE54385881DD0F4F43EC6B5BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dark-blue.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\customtkinter\assets\themes\dark-blue.json
Size 4KB
SHA256 6a57fa6f8fb8961a30ce6429522b180d76e3af9b8e0daac259059841386a6bd3
MD5 37b54f5cd74cd965b783b62f13743f4f
SHA1 f9ebe07e79e146f79dc88a7ff8942c0e43049f0d
SHA512 07c93b7312cb1185bac0555b380b82857bf1f41c93974e5dbaf4dd875822d589aaf80b979272e56e1c2ae3ec7ea34fe81781cc48f2305ce1828ce32984eb43a3
SSDEEP 96:Kg6L6Xv7Lo2cE0mUtFRCdVWFiaVdXcEdVfvLpwiunacELTaUb4:K5uXoM0VTon2iaVd9Xvlp604
TLSH
T15F912A14E5280E9723FB9B2A5707DB043C9C95D36FA8BE54349881CD0F4F43DC6B5AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\cv2\__init__.py
Size 6KB
SHA256 957a91bfd98ffb07a10cd789b7c5c46806568476b61e34c7ad56a00092b981a5
MD5 6f043aff1edd20d3c9d6398f936fbf58
SHA1 7149d2d20e1eb8c10c5d2bdb8eda23551fc82650
SHA512 7358dba479899dbc3afb955903820d2a7a54b9c398bf5d4565c8dc044241821edd621d7416862af396db4216373b1e8aac00eb78046fcc3cc2396aa02cd6947b
SSDEEP 96:cHqnQbu/3aOjcEYIL9GE6AUmZris46/B5aVOQOo2/nH/h5M966GMBWtReWE3uSI3:2qQYaOjIKtc6/Bb/H/h2BWtc93k
TLSH
T1F7E142425DB2641A0036D69DFF9180A4CF5F5FE35628240BBADC21C86FB8460D3F99B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config-3.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\cv2\config-3.py
Size 748B
SHA256 de28c7b5213cca148f09469916584611b3d66c1c8c432880259d6a3a92380213
MD5 e8ed8f25854821c8910bcb8308507dce
SHA1 8a3ac32d3df44794e8a834a6b6a8a1ed3f3aa5f7
SHA512 f3f36edf288a870f5e1f14f3b1113031721e12f30bf235b0e5385711e2bf7f08d0123e6ab14600ab069d2e692d81b7abc3692fb69eed34374fefab3b24f03d86
TLSH
T1B801D07E080F246492B2C759D88440DDC3D762E3F2238554FC6C6300E738CCC4283979
MD5 SHA1 SHA512 TLSH

Submit Download

config.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\cv2\config.py
Size 123B
SHA256 6c6367abce55995ae4a8d3c199420ec53afab287cb17dfc2f430378af75dd301
MD5 73e8bcbeba4dbe040c5f9a096ceda9de
SHA1 52c2e1bb717e8e8bc8409313c7e7e9d654033229
SHA512 f61394e48d8ade108ffd1f38a62267b36c2a1f525aa193884d1128ad47a0ca43ff852c8ce22a789a520964ff8e526e77264d5c61e1e4d8c0753703528ca36ba1
TLSH
T111B092FB84F2608C8212CBB9071E86C4411EEFDEAF422980384039928618CC00306038
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\cv2\data\__init__.py
Size 73B
SHA256 f4ce16721ed7f623a4dcc443ba600d1856db610cb2c3d53c13a8ca028cc68f6d
MD5 734f2f32c81b5cede1098394dab581b5
SHA1 e07450d3f1924078dd09e0b1dea8dd671dfe8801
SHA512 c0c9add6a1cd47f34c91b12ad369e887cfd28859824d258e1eed0c3495378dd950e214f8a540d66cd555ed8efc810418df3f13e09765d24d6fa26b09b44857c0
TLSH
T1C6A002ABC87B2858554FE700D61218E54D5CCEA15E965DC8B5C00E91C368DC653C68DF
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\cv2\gapi\__init__.py
Size 10KB
SHA256 74f5fd2a142a31b0a4707b70c0be3637f0fbf8a940eec4372e7ba87e5a5cedb8
MD5 3a4d80801f49e3a13903811c9e59018a
SHA1 0227b9f1fb7e900777bd8951404075df2d6d3447
SHA512 f79d2c216008fe8ec1f9c28575776c81b5fac63b18996803b76b73eaf088800fe4e46b4c18f7ce9730177549fd5402421719fa2b8ffed73ee60ebacae4d5ccb1
SSDEEP 192:mIntUjnLP6P7B4D7BP7Bb7BewmDraPt0C2Vqed/:m2eBNYraPt0C2V9Z
TLSH
T119228D91DEABE2A1E1B5606F9522C84EF3BB17139D9A260F307DE9302F76445C1D839C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_config_py3.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\cv2\load_config_py3.py
Size 253B
SHA256 074dfaf20ac94f2ca3815393de3a394944470334c51a85b9521f452e0e17bb85
MD5 39b5b0b9ffe1c35c95bbee8a325fbd1e
SHA1 217417fd40e92b47faff557c03542e5137424872
SHA512 1b1e8bff9e749633c00627a6006fadafd53d78bad1b5796f9c5fdb38155da5aeef2e0ddc9589431c43a8f61c16808cd781cea92f42073defd05bda3dc18ceb20
TLSH
T13DD0A7105D4D1D3400E5C27C0B2DF8B2D3EBA1423F01E14BFE5C87D22F94A14C381A94
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\cv2\mat_wrapper\__init__.py
Size 1KB
SHA256 c44707ea1c76f35518ae572b6c1989d76c2ada7e850432e41805dfe112d4e306
MD5 8a38c1b85454bb467d3be71bc0ee3486
SHA1 0d4a8b9b136e3a123d3bc38b484086c8af07a15a
SHA512 94f6e6e8f5ca41677f69487b8c8ef8c2c004250524ecbd46d1407da47abec05d54a765d79e1633eaecf5a3f9815b7a4604e674d6020442a72bc038fecd93ddfa
TLSH
T14321DDC68D173B69497338560895E10BC7349B53FA9005477A7DCA15CFB1862C1A8B2E
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\cv2\misc\__init__.py
Size 38B
SHA256 495bd79594cce174673e372c85c4dd8f4ffdf2b3a73fd4623955b0d55de0d462
MD5 c6b0244719659c5edec0592af112032a
SHA1 6bd926fe0c853a9938bdb5d9537bd88fd1ef5401
SHA512 28d80015309ac1ae19f048e9461d4d04b85ce16b9e68c58d7608351a39b8d3ec0235fccfd928b0349082c702d890b6c6abd36b8030a176bf05888ae8c493b545
MD5 SHA1 SHA512

Submit Download

version.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\cv2\misc\version.py
Size 95B
SHA256 c93a418793fcb15b9b4316c0741b8336740e490e94f3b7d1ebe8cd5f6f23815c
MD5 2d3125f1843a670b9f3229a7bc362816
SHA1 e884bc3d05e5e732d1308de67aa5f96bbf4fc69f
SHA512 bfdcf6bfc1d82e3acaf625b5940ca169784427712f14895fd6ca92cc9c864f1a894fecf97bf2afa6fc5cf4aba9738a302d30024bc192f85025989c0d93a8b540
TLSH
T156B012936C06A033112852BC1444C8006334061185111411BD22D6B87F171945010C8E
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\cv2\typing\__init__.py
Size 5KB
SHA256 ea34b321bd7ec0c970170056923cfa24c7100f94c7fb80bcf07e923c43db2036
MD5 94f3b189aaa53e9272211ecca1dcba6f
SHA1 15840087f2168f35a86187119332f0c0ce4940d2
SHA512 f2bcdb9ec0c8d8afc8ead331cb2ee51b768fd3354912cb73306e4ac96be643df6184b4ac8b34d71fba389c9e6434024c651cc77f0e5fd8b04ce1972b73a5a3da
SSDEEP 96:cuAtJd2TXc/GidAKv5/7VDpHGgME0vi57G:cQzPi+K/R/ME02y
TLSH
T1A4B1014BCACA392A4CF580853E7C5856F33223D7138A1B5B3536143C5D99983C7B8EAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\cv2\utils\__init__.py
Size 344B
SHA256 2b16990b35b569af1ca7239dc10f7b24ec62f27a46626b1e2f1271d2e1aa3554
MD5 952d77a31c0171ae90c0086aa8e3fcc7
SHA1 000d22fd5a2545cefbbf294d63415e82e232820a
SHA512 36e5bea12cdf8ae29d737f7062923ae4a1dbdb2c98904f9a35559222119fafa836c4a7553f5cd9f5639043183155f5e93dfe731ebcf385349a8e4ca72d2e92b6
TLSH
T194E0C2995F039045C33AE93CDAB2A8E8869AA81F801A2D123CBC43607F34D20DA541AF
MD5 SHA1 SHA512 TLSH

Submit Download

version.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\cv2\version.py
Size 97B
SHA256 a0f4881984ab057437cf5692d2d5ec35049698f4acc2b43c755f2d276df45a7a
MD5 5ab715a677261c0b8a328c1b2462095f
SHA1 f79652694e1972f468a1cb9b7241e7dc43208fbe
SHA512 d28ad674866532a52f53dd197686a12aa0354522aaedc1c1181d336009340f887f5200e5a43cc412d1092e4f783d0ed78e729562ab3bdf244efbfe8ba32adc62
TLSH
T131B0123F8B40647038B00B06C881F51342A11890E14E6570F10F2882F3873044BA102C
MD5 SHA1 SHA512 TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libscipy_openblas64_-74a408729250596b0973e69fdd954eea.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\numpy.libs\libscipy_openblas64_-74a408729250596b0973e69fdd954eea.dll
Size 19.5MB
SHA256 74a408729250596b0973e69fdd954eea07a70ff527a1dbaccf9ae21247b80377
MD5 b29ba52df327ea579038828f8df84614
SHA1 ac052f1491ed8e855515d6e0ace515900505ea38
SHA512 3e68e2c8ca42eb37aebe7b6d324fcfa55683faea94de10759ca8fe7a9acc800bef80b24f8f58dc5f390daf1c20c674acd4840bfbceb139d74a5736da264450f9
SSDEEP 196608:cuA0mXTz6XOzPWki2qtbh8j5pGrGV/pi:bOzPWCerGVB
TLSH
T1EB27E68BF4A250D8C47BD4B4936AF533BE60780DC53839665F81CB202FB5F50AA6BB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiarray_umath.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\numpy\_core\_multiarray_umath.cp312-win_amd64.pyd
Size 3.5MB
SHA256 be486c4cc6af57b19e990d6de41508736675908fc68042c61f8cedb618c0d6ca
MD5 57c8de9db301e83f9a9c8e0e5c2e3c0f
SHA1 d1f816663ca783c89266156598826a2407b469ac
SHA512 95dc601f382f503b37bfeab5529f1c02f4485823b71861e71d49a8530ecfbca3f43af9e1a4a016f504e5baf801c753a390fd7cf877c2e8b779a3152d6dc35d7a
SSDEEP 49152:0S8y5vNIaynGAWO1zrGx02CVfzr5uXtEgTFtlYclmOuDsDgpsmnL+fwx:8L2GgCOuDf2
TLSH
T1E2067B9BA2E511D8D16BC0788A7BE10BEF5234270B506AFB2194CA652F23FD9177F701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_umath_linalg.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\numpy\linalg\_umath_linalg.cp312-win_amd64.pyd
Size 109KB
SHA256 1508bb16bcae43315caf62ccad94fc70f43fd2d179b405d37542bfee67129b7f
MD5 e55f01302bd0d22049489a17e05ea312
SHA1 8beca6d085eafe905fee597c28bc935a526b6149
SHA512 756bc627f4abb8badc9f161b3ccd6d07555db5625b26e4903ce5f22187ab44bee33f31b63205f9c13c7a088e5218c3302e75405ec56cdc4efee45906183f4c6f
SSDEEP 1536:nBp0oQVowaFg2ZhuGWe3QphKXq59pfQkthDDqRIuNIIEYhT8G041yw8l3fYvhMb7:PhdwbLaktoIIE3GwvQJ6t/r
TLSH
T18CB3397370D552ECC57AC1F895462A6BFF52748A432027EB13E0CA902E6BF616E3E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\python3.DLL
Size 66KB
SHA256 25a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2
MD5 5eace36402143b0205635818363d8e57
SHA1 ae7b03251a0bac083dec3b1802b5ca9c10132b4c
SHA512 7cb3619ea46fbaaf45abfa3d6f29e7a5522777980e0a9d2da021d6c68bcc380abe38e8004e1f31d817371fb3cdd5425d4bb115cb2dc0d40d59d111a2d98b21d4
SSDEEP 768:OV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/d:ODmF61JFn+/Ob5IML0l7SySxUx
TLSH
T112637052BB54F8A3DBFA65FC39D199CD142B12CC872584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\python312.dll
Size 6.6MB
SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
MD5 166cc2f997cba5fc011820e6b46e8ea7
SHA1 d6179213afea084f02566ea190202c752286ca1f
SHA512 49d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb
SSDEEP 49152:mRSn173WIgXqQYRn0I+gaYFD0iRpIrCMEGXgeieBwHTuJTA8LbLH7ft4OCLj8j4V:mIn8hYEgw8Ij887GlSvBHDMiEruuln
TLSH
T170667D697268C0A9C96BA0B0CC13C28AE7B27C517F50530B70EBB75E2F737A2535A745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\select.pyd
Size 30KB
SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
MD5 7c14c7bc02e47d5c8158383cb7e14124
SHA1 5ee9e5968e7b5ce9e4c53a303dac9fc8faf98df3
SHA512 af70cbdd882b923013cb47545633b1147ce45c547b8202d7555043cfa77c1deee8a51a2bc5f93db4e3b9cbf7818f625ca8e3b367bffc534e26d35f475351a77c
SSDEEP 384:IyRVBC9t6Lhz64CHf2slDT90Y5IMQGCHQIYiSy1pCQFm/AM+o/8E9VF0Ny/r5n+/:LGyKHfx1H5IMQGY5YiSyv4AMxkEFNnq
TLSH
T1AFD29E576BB46845DD23C87268A28F26EE35B756871082CF3368C15D1F227C27B7B3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\tcl86t.dll
Size 1.7MB
SHA256 1026c8c8eaaf3744f3ad8e80b4baa366e88aa0a048c0823838e39acef86ce964
MD5 1ddd4633814e91eb748c84647c526d19
SHA1 c3c2561fd5f971e6487eafff151b2cb00f2eb1e3
SHA512 2c9e64ca4edcd2ec0292b558f40feaa2da875deafd85945aac77e49d0b71e2280e020396f719fecca52afa66454d7a55aa9712113e8fcbbe30202c956bf7f552
SSDEEP 24576:9AZ2kQrvqkPY6i6ktWc2uMOxmWu1/0lglMkgshwlfjwtorWy2eMdPhOC9JlQ5ZDC:9A0W9jEoSy2nd9JlQjaq5vWHZ7XM2eDM
TLSH
T1C4858E1BE76410A8D8ABD1B8C527BB0BEBF178151350A7DB51B08B912F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\tk86t.dll
Size 1.5MB
SHA256 59e2a8784bdbd35b4bf8e688690e2672b6b5d652cc063ba19661eff2715b8e13
MD5 4a740c514fb3b3dfb3d9d20fb57872c5
SHA1 11bea1a884fa01146190c6cae45fdc5f27fc8adc
SHA512 fe2d1dcae5fca2901ca1bffecb0b6fa189a55d8fcc007ec1db379d40a5f47a87d08ee2e3e5f7fbf18d7d609d738c6d31a5a291cd08577d750ab2cc8c54f6491d
SSDEEP 24576:gT3uXVFKflt2zwvzPYHURwgVdF9EWyCzfdmHQnveD4CGan9nViFoHb15K3cmwdb8:IeFSpvzg0RwgVdF9EWyCzfdmHQnveD41
TLSH
T1EE754C06A261C198C66EA134C91796FADBF17C14931057DB76A0BE6D3F33BE2273A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\zlib1.dll
Size 143KB
SHA256 acfa5dbb606aada439fa2bca317d023725cbbd5b5f111fbd61a488d449966845
MD5 c04a1ec01ca28803bb5cd7230bd40e86
SHA1 35f18aca58e6749029a65e598780cd41efcd5b3b
SHA512 756545e218ca384da40f973d38510486a3889e8b7c4e0c304c91158e89ebc7aeca66f9e0ef54027700cd311d27b1f23b2f5eb07089f8da649950e43a555e1cf3
SSDEEP 3072:9qLKjJj3yg1shVjm4OvfqnKAh2mrohmR5JHDbuNpM:9qGEgSefI3roCDbV
TLSH
T100E38D9AB6A224BDC6B7857056E78B76F932B81107309DEF6188C7B41F11E402B593FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1848-1510-0x000001E203C40000-0x000001E203C60000-memory.dmp

Download

memory/1848-1511-0x000001E2039C0000-0x000001E2039E0000-memory.dmp

Download

memory/1848-1490-0x000001E2039E0000-0x000001E203A00000-memory.dmp

Download

memory/1848-1492-0x000001E213E20000-0x000001E213F20000-memory.dmp

Download

memory/1848-1525-0x000001E214200000-0x000001E214220000-memory.dmp

Download

memory/1848-1480-0x000001E2001E0000-0x000001E2002E0000-memory.dmp

Download

memory/1848-1479-0x000001E2001E0000-0x000001E2002E0000-memory.dmp

Download

memory/1848-1478-0x000001E2001E0000-0x000001E2002E0000-memory.dmp

Download

memory/5652-1453-0x00007FFDFF860000-0x00007FFDFF88A000-memory.dmp

Download

memory/5652-1454-0x00007FFDE3340000-0x00007FFDE46BF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads