luna_stealer | 20dddf2030677bbff03386edbd4249ab38a16ad15decccb063feeb4993c119fa

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Unname-Bootsfps.exe
Size 18.5MB
Sample260826-sn9leafl2y
SHA256 20dddf2030677bbff03386edbd4249ab38a16ad15decccb063feeb4993c119fa
MD5 339f07722b8e1f6365b7dc57a838b0da
SHA1 f3c692e5247eef1a44bd3cb064cd4ebb75ded37f
SHA512 c538e625befdd13d0cfada3bab9dcb671288e58c7d24e9ffacc65ff2ce6c22dbc81352d876c376996c0e7ee2a3e136279c554dac22bc16a145e12da660e17da4
SSDEEP 393216:SAyq9yDUkQn/lyKVWL9eH4QnDxnXShEaOSfvUr5Weq:SAyqgAkQn9LdHDtnyEaOkvUr5WV
TLSH
T1DE173328BBE600D7D0EA123E5D53E55AD9E07C12576182EB0320A7DA3F2B4E89D3D774
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution luna_stealer persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Family: LunaStealer
LunaStealer is an infostealer written in Python and packaged with Pyinstaller.
stealer luna_stealer

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3800	powershell.exe
5332	powershell.exe
3524	powershell.exe
1436	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3800	powershell.exe
1788	cmd.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Unname-Bootsfps.exe	Unname-Bootsfps.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1788	cmd.exe

Loads dropped DLL 31 IoCs

pid	Process
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
1788	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
6	discord.com
8	discord.com
9	discord.com

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
5	api.ipify.org
7	api.ipify.org

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/0x000d00000001c54b-92.dat	upx
behavioral4/memory/5184-96-0x00007FFD60B10000-0x00007FFD6121F000-memory.dmp	upx
behavioral4/files/0x000d00000001c51d-101.dat	upx
behavioral4/memory/5184-104-0x00007FFD73B40000-0x00007FFD73B69000-memory.dmp	upx
behavioral4/files/0x000d00000001c545-105.dat	upx
behavioral4/memory/5184-106-0x00007FFD77470000-0x00007FFD7747F000-memory.dmp	upx
behavioral4/files/0x000d00000001c51b-107.dat	upx
behavioral4/memory/5184-110-0x00007FFD73B20000-0x00007FFD73B3A000-memory.dmp	upx
behavioral4/files/0x000d00000001c521-111.dat	upx
behavioral4/files/0x000d00000001c52a-112.dat	upx
behavioral4/memory/5184-115-0x00007FFD73A70000-0x00007FFD73AF0000-memory.dmp	upx
behavioral4/memory/5184-114-0x00007FFD73AF0000-0x00007FFD73B1C000-memory.dmp	upx
behavioral4/files/0x000d00000001c523-116.dat	upx
behavioral4/memory/5184-118-0x00007FFD772C0000-0x00007FFD772CD000-memory.dmp	upx
behavioral4/files/0x000d00000001c529-119.dat	upx
behavioral4/files/0x000d00000001c520-124.dat	upx
behavioral4/memory/5184-127-0x00007FFD73A50000-0x00007FFD73A64000-memory.dmp	upx
behavioral4/files/0x000d00000001c544-126.dat	upx
behavioral4/memory/5184-121-0x00007FFD77230000-0x00007FFD7723F000-memory.dmp	upx
behavioral4/memory/5184-129-0x00007FFD60B10000-0x00007FFD6121F000-memory.dmp	upx
behavioral4/memory/5184-130-0x00007FFD604D0000-0x00007FFD60B01000-memory.dmp	upx
behavioral4/files/0x000d00000001c524-132.dat	upx
behavioral4/memory/5184-133-0x00007FFD73A30000-0x00007FFD73A4A000-memory.dmp	upx
behavioral4/memory/5184-138-0x00007FFD739F0000-0x00007FFD73A25000-memory.dmp	upx
behavioral4/files/0x000d00000001c546-139.dat	upx
behavioral4/memory/5184-140-0x00007FFD6BE20000-0x00007FFD6BF73000-memory.dmp	upx
behavioral4/memory/5184-137-0x00007FFD73B40000-0x00007FFD73B69000-memory.dmp	upx
behavioral4/files/0x000d00000001c527-135.dat	upx
behavioral4/files/0x000d00000001c554-144.dat	upx
behavioral4/files/0x000d00000001c525-143.dat	upx
behavioral4/memory/5184-146-0x00007FFD6C320000-0x00007FFD6C346000-memory.dmp	upx
behavioral4/memory/5184-147-0x00007FFD63D00000-0x00007FFD63E8A000-memory.dmp	upx
behavioral4/files/0x000d00000001c548-148.dat	upx
behavioral4/files/0x000d00000001c54e-152.dat	upx
behavioral4/memory/5184-154-0x00007FFD772C0000-0x00007FFD772CD000-memory.dmp	upx
behavioral4/files/0x000d00000001c530-156.dat	upx
behavioral4/memory/5184-158-0x00007FFD77230000-0x00007FFD7723F000-memory.dmp	upx
behavioral4/memory/5184-155-0x00007FFD739D0000-0x00007FFD739DD000-memory.dmp	upx
behavioral4/files/0x000d00000001c531-159.dat	upx
behavioral4/memory/5184-162-0x00007FFD73A50000-0x00007FFD73A64000-memory.dmp	upx
behavioral4/files/0x000d00000001c555-163.dat	upx
behavioral4/memory/5184-168-0x00007FFD679F0000-0x00007FFD67AAE000-memory.dmp	upx
behavioral4/memory/5184-171-0x00007FFD73A30000-0x00007FFD73A4A000-memory.dmp	upx
behavioral4/memory/5184-179-0x00007FFD73430000-0x00007FFD7343C000-memory.dmp	upx
behavioral4/files/0x000d00000001c514-180.dat	upx
behavioral4/memory/5184-183-0x00007FFD5FD20000-0x00007FFD5FFAC000-memory.dmp	upx
behavioral4/memory/5184-182-0x00007FFD6C320000-0x00007FFD6C346000-memory.dmp	upx
behavioral4/memory/5184-178-0x00007FFD6BE20000-0x00007FFD6BF73000-memory.dmp	upx
behavioral4/files/0x000d00000001c4da-177.dat	upx
behavioral4/memory/5184-176-0x00007FFD701A0000-0x00007FFD701B2000-memory.dmp	upx
behavioral4/memory/5184-175-0x00007FFD739F0000-0x00007FFD73A25000-memory.dmp	upx
behavioral4/files/0x000d00000001c4d9-173.dat	upx
behavioral4/files/0x000d00000001c557-187.dat	upx
behavioral4/memory/5184-190-0x00007FFD6BD60000-0x00007FFD6BD8A000-memory.dmp	upx
behavioral4/files/0x000d00000001c54d-191.dat	upx
behavioral4/memory/5184-192-0x00007FFD69A50000-0x00007FFD69A7F000-memory.dmp	upx
behavioral4/memory/5184-189-0x00007FFD63D00000-0x00007FFD63E8A000-memory.dmp	upx
behavioral4/memory/5184-172-0x00007FFD73490000-0x00007FFD7349B000-memory.dmp	upx
behavioral4/files/0x000d00000001c50e-169.dat	upx
behavioral4/memory/5184-166-0x00007FFD6C280000-0x00007FFD6C2BA000-memory.dmp	upx
behavioral4/memory/5184-165-0x00007FFD604D0000-0x00007FFD60B01000-memory.dmp	upx
behavioral4/memory/5184-161-0x00007FFD5FFB0000-0x00007FFD60267000-memory.dmp	upx
behavioral4/memory/5184-151-0x00007FFD70720000-0x00007FFD7073B000-memory.dmp	upx
behavioral4/memory/5184-150-0x00007FFD73A70000-0x00007FFD73AF0000-memory.dmp	upx

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2676	cmd.exe
4480	cmd.exe
5572	cmd.exe
2536	cmd.exe
3352	cmd.exe
4216	cmd.exe
2532	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2532	cmd.exe
4136	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4480	cmd.exe
5824	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
692	WMIC.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4136	PING.EXE

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
4304	WMIC.exe
4304	WMIC.exe
4304	WMIC.exe
4304	WMIC.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
5184	Unname-Bootsfps.exe
3800	powershell.exe
3800	powershell.exe
3800	powershell.exe
3524	powershell.exe
3524	powershell.exe
3524	powershell.exe
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe
5332	powershell.exe
5332	powershell.exe
5332	powershell.exe
2208	WMIC.exe
2208	WMIC.exe
2208	WMIC.exe
2208	WMIC.exe
804	wmic.exe
804	wmic.exe
804	wmic.exe
804	wmic.exe
692	WMIC.exe
692	WMIC.exe
692	WMIC.exe
692	WMIC.exe
4920	WMIC.exe
4920	WMIC.exe
4920	WMIC.exe
4920	WMIC.exe
4376	WMIC.exe
4376	WMIC.exe
4376	WMIC.exe
4376	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5184	Unname-Bootsfps.exe
Token: SeIncreaseQuotaPrivilege	4304	WMIC.exe
Token: SeSecurityPrivilege	4304	WMIC.exe
Token: SeTakeOwnershipPrivilege	4304	WMIC.exe
Token: SeLoadDriverPrivilege	4304	WMIC.exe
Token: SeSystemProfilePrivilege	4304	WMIC.exe
Token: SeSystemtimePrivilege	4304	WMIC.exe
Token: SeProfSingleProcessPrivilege	4304	WMIC.exe
Token: SeIncBasePriorityPrivilege	4304	WMIC.exe
Token: SeCreatePagefilePrivilege	4304	WMIC.exe
Token: SeBackupPrivilege	4304	WMIC.exe
Token: SeRestorePrivilege	4304	WMIC.exe
Token: SeShutdownPrivilege	4304	WMIC.exe
Token: SeDebugPrivilege	4304	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4304	WMIC.exe
Token: SeRemoteShutdownPrivilege	4304	WMIC.exe
Token: SeUndockPrivilege	4304	WMIC.exe
Token: SeManageVolumePrivilege	4304	WMIC.exe
Token: 33	4304	WMIC.exe
Token: 34	4304	WMIC.exe
Token: 35	4304	WMIC.exe
Token: 36	4304	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4304	WMIC.exe
Token: SeSecurityPrivilege	4304	WMIC.exe
Token: SeTakeOwnershipPrivilege	4304	WMIC.exe
Token: SeLoadDriverPrivilege	4304	WMIC.exe
Token: SeSystemProfilePrivilege	4304	WMIC.exe
Token: SeSystemtimePrivilege	4304	WMIC.exe
Token: SeProfSingleProcessPrivilege	4304	WMIC.exe
Token: SeIncBasePriorityPrivilege	4304	WMIC.exe
Token: SeCreatePagefilePrivilege	4304	WMIC.exe
Token: SeBackupPrivilege	4304	WMIC.exe
Token: SeRestorePrivilege	4304	WMIC.exe
Token: SeShutdownPrivilege	4304	WMIC.exe
Token: SeDebugPrivilege	4304	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4304	WMIC.exe
Token: SeRemoteShutdownPrivilege	4304	WMIC.exe
Token: SeUndockPrivilege	4304	WMIC.exe
Token: SeManageVolumePrivilege	4304	WMIC.exe
Token: 33	4304	WMIC.exe
Token: 34	4304	WMIC.exe
Token: 35	4304	WMIC.exe
Token: 36	4304	WMIC.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeIncreaseQuotaPrivilege	3800	powershell.exe
Token: SeSecurityPrivilege	3800	powershell.exe
Token: SeTakeOwnershipPrivilege	3800	powershell.exe
Token: SeLoadDriverPrivilege	3800	powershell.exe
Token: SeSystemProfilePrivilege	3800	powershell.exe
Token: SeSystemtimePrivilege	3800	powershell.exe
Token: SeProfSingleProcessPrivilege	3800	powershell.exe
Token: SeIncBasePriorityPrivilege	3800	powershell.exe
Token: SeCreatePagefilePrivilege	3800	powershell.exe
Token: SeBackupPrivilege	3800	powershell.exe
Token: SeRestorePrivilege	3800	powershell.exe
Token: SeShutdownPrivilege	3800	powershell.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeSystemEnvironmentPrivilege	3800	powershell.exe
Token: SeRemoteShutdownPrivilege	3800	powershell.exe
Token: SeUndockPrivilege	3800	powershell.exe
Token: SeManageVolumePrivilege	3800	powershell.exe
Token: 33	3800	powershell.exe
Token: 34	3800	powershell.exe
Token: 35	3800	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 5184	3284	Unname-Bootsfps.exe	89
PID 5184 wrote to memory of 2676	5184	Unname-Bootsfps.exe	91
PID 2676 wrote to memory of 4304	2676	cmd.exe	93
PID 5184 wrote to memory of 4480	5184	Unname-Bootsfps.exe	94
PID 4480 wrote to memory of 5824	4480	cmd.exe	96
PID 5184 wrote to memory of 1788	5184	Unname-Bootsfps.exe	97
PID 1788 wrote to memory of 3800	1788	cmd.exe	99
PID 1788 wrote to memory of 3524	1788	cmd.exe	101
PID 1788 wrote to memory of 1436	1788	cmd.exe	102
PID 1788 wrote to memory of 5332	1788	cmd.exe	103
PID 5184 wrote to memory of 5572	5184	Unname-Bootsfps.exe	104
PID 5572 wrote to memory of 2208	5572	cmd.exe	106
PID 5184 wrote to memory of 804	5184	Unname-Bootsfps.exe	107
PID 5184 wrote to memory of 2536	5184	Unname-Bootsfps.exe	109
PID 2536 wrote to memory of 692	2536	cmd.exe	111
PID 5184 wrote to memory of 3352	5184	Unname-Bootsfps.exe	112
PID 3352 wrote to memory of 4920	3352	cmd.exe	114
PID 5184 wrote to memory of 4216	5184	Unname-Bootsfps.exe	115
PID 4216 wrote to memory of 4376	4216	cmd.exe	117
PID 5184 wrote to memory of 2532	5184	Unname-Bootsfps.exe	118
PID 2532 wrote to memory of 4136	2532	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\Unname-Bootsfps.exe
"C:\Users\Admin\AppData\Local\Temp\Unname-Bootsfps.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Users\Admin\AppData\Local\Temp\Unname-Bootsfps.exe
  "C:\Users\Admin\AppData\Local\Temp\Unname-Bootsfps.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
    3⤵
    - Disables one or more Microsoft Defender components
    - Disables automatic submission of suspicious files to Microsoft by Windows Defender
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2208
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /F "C:\Users\Admin\AppData\Local\Temp\Unname-Bootsfps.exe""
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Windows\system32\PING.EXE
      ping localhost -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\Cryptodome\Cipher\_raw_aes.pyd
Size 17KB
SHA256 1f6adc3ff4fb894821f970a24bb7b7658e79109bed2d0c3a495e0b594800270a
MD5 fbd6eee3db86e78d4549707c1abdb34f
SHA1 8e1e0caf291a1f783247d9e5210ee271e959487a
SHA512 9bd27c0d9e77e00c26bfbca2e2097379ed45cb4d7abc47af56d85cca6afa643e081526ade1f8ff663f3dae425b854bac5d7713109b33603bd35e02e6a349c833
SSDEEP 384:hYKO4ybrS6X6d0Gtbdc/4xOxmOq4JAQnpvnOIh+s4uZa7gJX8CS:hY/tKvcg4IOqkAMpvxxpMCS
TLSH
T1FB72AFF5A2BEC8BCC9B560320CA299A9F3217B6B6413031F05D135BE5EB3D541F22A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\Cryptodome\Cipher\_raw_aesni.pyd
Size 11KB
SHA256 af9b383b067dd7ee8d0796a1e95f5c7f30efc25be5cd646e8c0e2a86b6ecf3a0
MD5 f1ddec2fb6f8582db90bee6fac6b4640
SHA1 458e56694673d70d1d7f19d01275c1cc91c3e724
SHA512 0ed3808c2b41353107b51df87ead3cb9a66f517d209d791251896a0e7a7edfcfeb247dd25513c33d88b6f4918d0d188cb046bd91d461d2cbd1b1a7279abb2ce3
SSDEEP 192:owYipdrvzmhp8BShP1nmQ2Ia+hyKnhSqwT4RRL4haQDkYj273QJXlEnLU:o9iLl0hP/vLys0q+4gRDZa7gJXW
TLSH
T19F329ED78219E6FCC4B574B718975A94FB323436122A9B2F08CA37BF9CB6A143420774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\Cryptodome\Util\_cpuid_c.pyd
Size 9KB
SHA256 6bf9f292aae102b5d36387b97a18ee05407f857e31d40d77b635e8dffbc40bc4
MD5 18f6c2e330e702f22d6589e79872aa06
SHA1 8c2eac53e39625a4ee5f9589cc67ab8e833bc9ae
SHA512 763e1ca2695462a9fe40ca38435b708e67242e4056bab952b8ec896b83ef8c7904801292f6e475630c256ec430f4c8344d2024c7ee8c384e7e61f271ccbd288b
SSDEEP 192:dkRQHLyJVf5DoE+uJL72iD5UR9rGHc/NhkYj273QJXpHzI:qCoVf9L7DD569q81hZa7gJXZI
TLSH
T1CD124CB7937EF2FCC53A54B60D4B4898FA65F83BD112131F01E432FA4CA67526D21661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\PIL\_imaging.cp314-win_amd64.pyd
Size 794KB
SHA256 e0716f4252d855821aa7ca008cb47fd5cf1d85145755fae0bc60c637630b3fe3
MD5 0dcac3113740b09c7d31bc69a211b3c3
SHA1 51f1b5aa95c9ab8977b755d70e0cfe91078ca34f
SHA512 d9d74b670010077e4a532549bcaa7a769e7000731638791e4e02724d44d0fb4c7424ba2a387a007486b1ba93752134ffebffcf078f29424b27d1fdb8576894e2
SSDEEP 24576:UYxBHt37h0INYkxJAMhBYiB/Ez8o2q+b:U037hMkrhhuW60
TLSH
T146052339AB3E5D16D03675BF1407E6196CB27C943220832C5E94C44AAF19A8FBF35B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\_bz2.pyd
Size 51KB
SHA256 d8b66ce7c2c16c31e5c9d91b01a48380f813f27e852211e0aef784ae365a30d8
MD5 d48fa1b28e4a6a3007f4cc955a61b24c
SHA1 8fff1b04c42721f5bdc627b68504a994e1c6b14e
SHA512 a0657c315d76691609f80f2c05df919266fe58089195083fede8198562df727fd69d3ad3f72b63bc4b2cc743f298d2ea08ff63b158288e9a3be45ab264855d68
SSDEEP 1536:FgrRnv1oCAhFJdAFJm0OnIp3V17yPs5i9EfIY+8i:iV+C/mhIp3V14V
TLSH
T15333D0CB0AB48096D7635DB261B0E943FA35ABD3A410979630DD724E0E6B7D1A313369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\_ctypes.pyd
Size 67KB
SHA256 00867a33b655c4f062df5d342dfda56ef7ac3e1933dfa126f55c0d58684cf15d
MD5 7de3aa2eb97088f5ffcecf8e338fe04c
SHA1 4ce0ac0fec1038960a24b96baf3de059e8e168b5
SHA512 c5b74f7934b742efb8c1d23fc59dbeb999e7b84c2a864d8ee7c8d80a4566aa3d673b0490faaf331bcaa1114542a36241a8a4a4851ea0ce4887907fa4a026b7c3
SSDEEP 1536:VGsidR9UsG6C+QTu1a4Q+3JnzwjGBPLjyIpGPiWyPs5i90fIYHD:V/IPG6/85+Z8jGtLuIpGPi1S
TLSH
T1C263E0CF427D9191F7531630B2F4DC93FE385BD364621B6E30E991AA09AB3C2A707265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\_hashlib.pyd
Size 38KB
SHA256 8b23ff02bf21ab34676a3a54589aa9a783a1b771ce6ad57d10013585a8a19d3e
MD5 eeb9e91a460902557c31299de38775ee
SHA1 a04a804cbc226e1784cd841322132a7a7ecf8330
SHA512 3a31b15898871b4a2584c6598369118c8a1948107c5a4e2210247928126bd26ac4ff73cb73b10ff69f7d39aab54bfca1b499195fc869250d6818b784df8fd292
SSDEEP 768:NFzCaLH2eWtTkvVE9k6p2vZ+5EApaBIpDIAOyPsSvPuBL2Ip4NTxf1ml9dHH7LM:bCHPp2vMuBIpDIAOyPs5i9nfIbHHnM
TLSH
T18F03AFC64638D012FBA3A9B172E0DDC2FE34A7A3545257BB30E9A2D51E633C0D727265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\_lzma.pyd
Size 88KB
SHA256 f16310de99cfc67ae028ac8a5169a3767e4cceb5ecb30146adb30fec88458bc2
MD5 13ce86e02674bec7ef2dbb78de68164c
SHA1 d9fa69a548228687dc9e7acec8de0ea6b25a8683
SHA512 149d6eb873df164901b99227ffe49366a5409f312bae088e9f978210bcfdb2f0517b6e3e9af87e0c11f5d1d9d8ee28c6ca1ebb575f5e65392892be07f3293bc9
SSDEEP 1536:abCORtk/GFJL/D1c0VkwjHnOFm9b/uko4J3b4ohwTpC3dIpI1ihyPs5i9OQfIY29:XORuGFt/HkG/G4J3b4GwTpCtIpI1iLx1
TLSH
T1AC9302DBC7F88063FE636D3071F5CA82793557EB622687A314DE71520E223C5A3A3265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\_queue.pyd
Size 28KB
SHA256 5fc16a972f3914a29a90e9efba52ec52891b59656cf6883e753af527acc7ad4e
MD5 405053f79b7d95343143bcdd435fe1fb
SHA1 3e130056a2a66a2d819240c5f653bcf17204c77b
SHA512 69ef19f3e68683451368e05a8e23623706961e8ebc6db4bcceeda00eb24ca53e4a3a673e8ddaed7c9293db6f65141d8849e143dc9e450279a9e235eeaa3f0df3
SSDEEP 768:M2YI3si/fuHLEHTtpCPIpRUA3yPsSvPuBL2Ip4uTxf1mlRaXN61k:MpH/PIpRUA3yPs5i9ufIYNh
TLSH
T1AAD28ED646788026FA32AE7162F4DD83FA357BD36810876730EDA1AA0E633D1D317265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\_socket.pyd
Size 46KB
SHA256 f9b75845ce3d701106133cb9fe8d28a4f30b08d99919ddbb6843a4df053191da
MD5 d1dbf6651e46234f28ec794afafeae03
SHA1 70fee3763e458806128ff33d5f1f75a6f3e660bc
SHA512 f7439df64a8c58088a0f1957b4e321fb4e32bdd64092700a9322a91b89ea1a0efad3919a6752322e13077843cc402cda9f8e3abe02bd4be020d80d7cd74e328a
SSDEEP 768:5lRvR/zcKTGGtU7gujesZiZJx2u/Y6dlwWIefwptq2IpGw1YtnyPsSvPuBL2Ip4Y:hvRYKTGooe4ifT/hdlw+fqq2IpGw1Anh
TLSH
T14823BFE70268E056EAB39F7262A4D9C3F6B87FA310565727309DA1960E733C19F05329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\_sqlite3.pyd
Size 61KB
SHA256 b8b703eb4be4b0f5993a510daeef52854fd392553c4c0d7ca7f535c40d14e0be
MD5 54660d73079c7b32ad4423ba3e8399c9
SHA1 88875a6eff42bf78a58a0a4630cd933cc8877645
SHA512 ccb61ecae7375b8b3a403df4d3a2c1cd70b33c51eedba0bc62ef17b73a9f21abd7d0af92db70d43407fe8ef26abf9d3dd7b6142acbfec89207bae4ac61a46320
SSDEEP 1536:0Btb9E25fsDSAIL3fY1zQceb4xwcD9Ja/jZIpDQlWyPs5i9NbfIkFy:atb9fsDxCfY1Bo4RD98lIpDQlV8P
TLSH
T14F53E1C6837890A6E6B69D7190E4D95AFD3627F39034877328F674A10EE73839742238
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\_ssl.pyd
Size 69KB
SHA256 f7c091566f79b3c230a128976cec4ce740f86d23da7a73be9d83316edbe69219
MD5 5322884f68e725a77f2c47a4d851d414
SHA1 64db9e4d13f16617a5e429f2384d1b977ccb8c21
SHA512 29713aabd1e72d16b38778f57984fcf2e614fccb267d10b4dc007677034c0396b057220356d0eb6ee3a286c28e23b783172d3a6f0026256d0be16ea85861546e
SSDEEP 1536:D0REJRkC9CxzEXZHwdBxHGrWY/groNukG7vIp37S03yPs5i9wfILFq:Y2J2gCxzEpqBtGrWY/grIVG7Ip37S1c
TLSH
T1FC63E0DB8938A026FE716A3191E4CC43B971E2D3A449872F34D9B3E616133D0E757768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\_uuid.pyd
Size 27KB
SHA256 fbfd7fe8583b346ba20b174b2510c0830237f5092bdf9fc26da9d6b25b018385
MD5 0dd6191e9e0ba13adcd0cbb43acd54ba
SHA1 b15512cb9ae680a0f45d0c630ca03292fe65548a
SHA512 4e3f7d428ff6b760752da5c216249b9bac42ea9e87712e2944176c4e00c04e866f88a99618ba8a3cd856935b16a655a8d4afe19c7396001c68a6c2a3046872a9
SSDEEP 768:1615cUIpIwgyPsSvPuBL2Ip4BwTxf1mlRaXV6K/:1615cUIpIwgyPs5i9GfIYVz
TLSH
T1BDD26D8A9A748043FE5397B0D1B2DE43FA39BBD3191187AB316991850E533C1E31B39D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\_wmi.pyd
Size 30KB
SHA256 379ff569093c9c8f1bc30f7ce2160f12bd343c88629224c66c6ba32ae0bb2dd7
MD5 aeab88cc6accf56faa12fb0b3ae237fe
SHA1 63a9c0d30d127b955e0db3da34ccadcc08c51258
SHA512 a3f32b5abefc487c6fcfd127b1557c9d8b25c946eab37440cba78452f81ae76be17eea0c56181ea5234e62217dd08b29064a35690ebd85c9b08a0ada1db3cc86
SSDEEP 768:m+So74TudMdaHYbpLTdIp3igVyPsSvPuBL2Ip4/Txf1mlRaXE6XJ:fSoUfcYdTdIp3igVyPs5i9FfIYEq
TLSH
T138E29ED7453C812AEA73DE7192E8DCC7FA3877E710154B6A349992E50E273D1E303269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\_zstd.pyd
Size 176KB
SHA256 74f2788df3be0d0912a3b4e9fa7178164bdc4e5f23161a6305bd1038c959eea7
MD5 3bf712cdb774290db855cb4a6f215f71
SHA1 8f2675c5f8dd663a0a081aa1154d48c5a9027563
SHA512 6e506d9de69bdd09d6478491fe37cffd594aceeb773bf276a8ae971c3d68fdff69d3012cdeb8f358701236ef296fa2978144b7e79ac62a4e3b977f6ac211cd53
SSDEEP 3072:/9qd7z3VzZvhqR01Nj0c5+Ta0nzMn4qonZzRhpBcU97IpIMz9TH:FqtPIR0vx+m/n4q6Z7rcUOtH
TLSH
T1E40412941068102DF5C3B9B23598DACF6AB883D7644C5FB770B8B2920A73B91AF52374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\base_library.zip
Size 1.3MB
SHA256 fca06366b7a7263148ebd454b93b1d3de66440dc01c8dda879d54341c8f41192
MD5 acd3df3e746fc74761d19cbf494a55ef
SHA1 600a3b086c1a214e86e318032438266e8cf6b676
SHA512 571e2c4835ecf8a3b2e0dca5aef6f01a57e148bf86238996d690a2af00b7966e726d0f267d0c0c0a158f8cb1034c768549134cd248f438d9e12666981b316e10
SSDEEP 24576:cRQeOdP2m2dflLadWOlbLYEO2DZFRZjuUFO0:o/cdhYEvRZuUFb
TLSH
T1A2552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\certifi\cacert.pem
Size 234KB
SHA256 9cc2a774b5198dcff14d9be1e66091f538975d867ce029a96bce15a55dfd730f
MD5 eae6947de5ef7a283146da71e558021d
SHA1 9110158ba911882667460f8c81fbd7510353dfd7
SHA512 97678d7ef9beb4fae3d9dcda9869a7f40f61058de4ea1623b5f1e0599b34f6de0214d82a288c27faf80e06a0897bdb57eed262767c4995795a74dadce25c7947
SSDEEP 6144:0pl6RrqADwYCuCRT/QRSRqNb7c4u59hrh:0L6RrHnRWav309f
TLSH
T1E5347C954F2A9C092C9FE1C1CA9B1357DD3A027A99FEF0F1390A2408D24622B57FDD9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\charset_normalizer\cd.cp314-win_amd64.pyd
Size 52KB
SHA256 95b42f959ee0220527c92a6a64c8c0e75eb4b2023e049f611494729a7a8924c8
MD5 f41bd9487c0ebb246f44ffc24ad8ca2f
SHA1 4c631a6c64373561f3533e250f3b13847e07582c
SHA512 ac6ace879dbc05c183e187c302dcaf993730dac647be5ef4b66404dec06e7094e587d419240044c2917d0bded105a29fad1682d1b709ac9e6bd5cf3e7a156055
SSDEEP 768:MgsSFFVAizO5oZMRQK+6e7y5hmka1hFcnZg0NZttxqFApAEiBJnjli4e8pG:ySCGpZMz+F7k0hFEZKApAEiBJnZdo
TLSH
T14833F1870979A1B8CD11E0F72AE1508FBE153659612B2B1F10F0177B9FEFA957C212A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\charset_normalizer\md.cp314-win_amd64.pyd
Size 61KB
SHA256 57dfaafba88cff1f5cb5e4b2d7e3bd6b44d7bd8f18bbf4bea6d1f8c6ec094550
MD5 6a6cfc0da654d46bdac70ab335248067
SHA1 614663534f0bc0247abbe206047c1317dc853fee
SHA512 b22344dc0f56c11dfeac8609b057fcd74ada4f56e1a0fd859be2479f4bd814c42ab108fc4ff0d3a37f32462aec4934e8bf86955e70af41ec61bffd58f96e271d
SSDEEP 1536:/V4eB1+jZ9wJhohpK0B3ycj8G+ayEFHEb3TKs:/VNB1sAOpK0BPjeg9q
TLSH
T1E953011C955FB974EC0ADD33A66719859928B871F1A23B2F56A42A8FCC3F1D02B130C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\libcrypto-3.dll
Size 1.6MB
SHA256 264099c9566d00d83b0dd29fe6e013d32fd888dc09164d9bc4044d6bd30eedc4
MD5 f475c66269f2490de9d2c10acbcd4292
SHA1 35cc95245f81b79b49fdf8982d460d2e864163e1
SHA512 f872777639dc42fff6c57b4f10ba7d2ab1cfa3bab5229548a048f9717211f0e997cd6791c484e46fb7151a4e3689713d9f57c9f37c3b863894988ba667adf357
SSDEEP 49152:+7jNm9z0XkbctNyQabDfwr71CPwDvt3uFA0C:ay2tNyQkTc71CPwDvt3uFA0C
TLSH
T18F75122428FFB80BCB87D5788F30CD268F995602B319DFA56E7999441C18E0E4E785ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\libffi-8.dll
Size 29KB
SHA256 a7ac89b42d203ad40bad636ad610cf9f6da02128e5a20b8b4420530a35a4fb29
MD5 bb1feaa818eba7757ada3d06f5c57557
SHA1 f2de5f06dc6884166de165d34ef2b029bb0acf8b
SHA512 95dd1f0c482b0b0190e561bc08fe58db39fd8bb879a2dec0cabd40d78773161eb76441a9b1230399e3add602685d0617c092fff8bf0ab6903b537a9382782a97
SSDEEP 768:Op/6aepjG56w24Up3p45YiSyvkIPxWEqG:MA154spK7SytPxF
TLSH
T18CD2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\libssl-3.dll
Size 369KB
SHA256 fe4fbff456f3a4c1ee5faaa22941e2d9a8f7e9bdee016e42f89319a5462a926b
MD5 14aff73cedf8327fd811760f1b1bac2a
SHA1 34aa0009798140ae4c6162e92858b76129cbc969
SHA512 3a753bdac56c250c34e5abea69817616831fe3bb8e517f9631b0e9d41ef90d6fdd53522ead7ed0218da7c76b351cf0f82c6d3594a4b028e2454a619dae41da97
SSDEEP 6144:S+MnqvRCGB8ecda+2QuL5KlBje7StK0PGdicc3Xf3spNLT9BzKt/c:S7oRCQ+To4ne76UfoPcvGU
TLSH
T146841213311FC267C4A3AF76DB7092C1FB3C7743D741EE2A7A2AC6440AA569CA35E059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\psutil\_psutil_windows.pyd
Size 32KB
SHA256 6bedc0c2aef20f159cf83cb3c00f324274c56a87fccd6d43ab781fcfa443c16a
MD5 12a954fd8bd87c0878945229e7f12d96
SHA1 9b9b79fefb3cea5fb20dfca3aec86ccfdc155b34
SHA512 54eb02623acab7d09167b8f34c29895f50d9ab66e5350c490be633f173f5f7ba91cbc3f498752f56b89cd234cad0a1dcccf6d9549783eecb6497cf99e9808b09
SSDEEP 768:VYU5FhhiJBW2uvTwJ+874UVXaEAZz/ESjhsfojUpH:VYqhhiJVuvsjVpXAdco8
TLSH
T114E2F2C3E227B774CEAB6C331A5712685B89F0372698571B047990377D23AB6BC20C52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\python3.DLL
Size 72KB
SHA256 6c45910e7c82617ca6360820de861699cc99f9efee434df290aa4c6e38f39886
MD5 2de7979a521cf55306e48163bfd527bd
SHA1 e36a5745ec9b1487833a1dead2940a9fdab29a4e
SHA512 6df1dccae7abc906116aa3889e18058db6358c9a7c32ebd493b0dd0a9241eeaba2be71542a1c14a5d3da22d0b9e9c1a0bb9c5a586efc878cb1190b3b4d8148cb
SSDEEP 768:vQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIL:+bTrnXngXMRAIpG0pyPs5i9rfIYc3
TLSH
T11D735E5E6B54F8A2D6B669FC78D199CE242B12FC4F2984DFA47CD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\python314.dll
Size 1.9MB
SHA256 5007e66ed004d5b47695f8555a9f07cb595fd79f04664eb859dab6c06e91975c
MD5 7b505b5baa754ad3478a953b1fac23c1
SHA1 8a45f9f7f575e6f757f52187ceb8502c940c06fb
SHA512 bf860c9015a666c5cf2c7513455304e8fa0f4e71c3d78fae3048aef1e5fa8ca1e6023f2d01bdb72433f23b6b56a804ba1cd34a5d08d4183829ce4fb9497903ae
SSDEEP 49152:rMCmLUyTYfI5G88b/os3YgFFHbW+t83Nk/++PUlDYOK7:sXUI5PgD96+t8y+Lnk
TLSH
T1FB953370742A91FFC3D3B47A0BE1F95792BF2210A1AB65A4A670D1D7064A6099F3F70C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\pywin32_system32\pywintypes314.dll
Size 62KB
SHA256 d3ed715240c6cf5b401ab4e6011d719b9379a20882f5c1f30ee46454bc59c377
MD5 a4e56d37bfa5c412c097cd3fc59e2bc5
SHA1 144f9c8ddc4291c507da21e8f63441dbfddafa96
SHA512 209bcd28bc24bd45175378113eb8aa38d9b9c4f3ec8d28e1cb5e42221ec8bf137569b854d7f1927fee870a700a5a3c37cf0981e1b44cdf2249f41ad17b90e42e
SSDEEP 1536:+8xX6ROKyJO+4n6rvZUdPTzIa5Xow84q:jX6ArRO6DZUdPTsaNor4
TLSH
T1C2536C427D97CDEFCA1BE3332C99141494D39265470AEBE1D9D7C0A3E4FA3926C2A427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\select.pyd
Size 28KB
SHA256 cd193f4acdb3a9c6d75c230da8068ec95e338d6552baaada82365dce6f99f3eb
MD5 c72d0e3aa7b52836570122c726f1c28b
SHA1 0d88a46464ea9178a23dcd9ddc2652f865908c75
SHA512 4ea4c102255501433537647a93b10360b438cf9d3558da97c7404b3228c6acb2f7f7feccc8fb84ed4a9c121ffc6f8aa0dc1a8eecccb66e7762a2c3622d30f7e1
SSDEEP 768:Fgmk8qSPSNp9TDIpRGALyPsSvPuBL2Ip4j5Txf1mlRaX16m:FWN1TDIpRGALyPs5i9jLfIY1N
TLSH
T1B2D29ED74678C05BFE62997162E0DDC3FD347BE36408876B30A9B2960EA73C19716329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\sqlite3.dll
Size 663KB
SHA256 cb67a81270018532b60c0214d1126ab2cc37a0dea3a808c232802e15fd74c2dc
MD5 e358f1b935defcdafa9f9824269d29b4
SHA1 e2d2d83e16480987008b3d78f494bae1e883c9ad
SHA512 634ac3de4c5eefb961eaacb2537f8b85c3ee20fc8c181ad437118844c424157ed7be29829b3f7e4cd0337d26f9e87b26c86eb2379bf66fde859432fb644ca1c6
SSDEEP 12288:Jk+lfQj6CGecriX5Ozz2bI1uekpl5bx1+AHSktSSLF/l3/h2RAXq/A:J1ojbGec2X5Ozn1u335SAHSktv9QGXqY
TLSH
T1C4E423E6593BD005F9F2A871D0D2E5C2E930621FDCF809EBA4C8E6563CEE662F611135
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\unicodedata.pyd
Size 277KB
SHA256 a1752d5e1b5d0d4973d625ff64b879884a4e257540dcc2e53a183065928fdc3c
MD5 3020ac39283e37343154d95b0fe516d5
SHA1 0253dc6d79473888c12b09e651d51a99ce205d17
SHA512 78b80171db248092a3a723c761270881c4a1102268070feda7db00249bc38392b0b87267997869075769303b4e81597285659340ccd7c0a996f7c138bf899096
SSDEEP 6144:vKIUUCI74Q+bcksT3IWec8qtTIcNx9KGv1MsSXgKtvQS:IO74tNsT3reDqtzNx9KiMvXgKxQS
TLSH
T1AD5423EDA68CD2A2FFB3BA7392C1C102AB3575E36854432760D8546A6C77347C35B358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000cd42\win32\win32crypt.pyd
Size 52KB
SHA256 843b6c7ef1086530fdab28c698c89e0aadd72ac92cf5c27fe95b469f6f7fec3c
MD5 12096ef575d0ba7642e792b5e724de6f
SHA1 45cca445aa396b91225a4cb7906f403dc2e84a78
SHA512 60c00d62a7efddd711421aa883b30a1bb345274aaf357744658d474d376c5bec0fbaa31206f4e99bf7494002172f3e72aa635d060a60df469abc28ef15152e9b
SSDEEP 768:kSlYds12tD3GtWTKHs5FxSJ4ZJWh3OmAuDo5cn1i+qEyxAxvRpBVPa/W9rM+EiHH:4k2tD3EyKHS0iZ2/oO6NO9Za/
TLSH
T1ED33BF01360B5DAFDCE7F3738C805419E0D2A95A972A6FA25843D1FA34F91E14C6D2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_yjnnz05i.jww.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yjnnz05i.jww.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3524-217-0x00000290A0A90000-0x00000290A0B42000-memory.dmp

Download

memory/3800-204-0x0000027971910000-0x0000027971932000-memory.dmp

Download

memory/3800-211-0x0000027971C90000-0x0000027971C9A000-memory.dmp

Download

memory/3800-210-0x0000027971BD0000-0x0000027971C82000-memory.dmp

Download

memory/3800-209-0x0000027971BB0000-0x0000027971BCE000-memory.dmp

Download

memory/5184-138-0x00007FFD739F0000-0x00007FFD73A25000-memory.dmp

Download

memory/5184-106-0x00007FFD77470000-0x00007FFD7747F000-memory.dmp

Download

memory/5184-158-0x00007FFD77230000-0x00007FFD7723F000-memory.dmp

Download

memory/5184-155-0x00007FFD739D0000-0x00007FFD739DD000-memory.dmp

Download

memory/5184-147-0x00007FFD63D00000-0x00007FFD63E8A000-memory.dmp

Download

memory/5184-162-0x00007FFD73A50000-0x00007FFD73A64000-memory.dmp

Download

memory/5184-146-0x00007FFD6C320000-0x00007FFD6C346000-memory.dmp

Download

memory/5184-168-0x00007FFD679F0000-0x00007FFD67AAE000-memory.dmp

Download

memory/5184-171-0x00007FFD73A30000-0x00007FFD73A4A000-memory.dmp

Download

memory/5184-179-0x00007FFD73430000-0x00007FFD7343C000-memory.dmp

Download

memory/5184-137-0x00007FFD73B40000-0x00007FFD73B69000-memory.dmp

Download

memory/5184-183-0x00007FFD5FD20000-0x00007FFD5FFAC000-memory.dmp

Download

memory/5184-182-0x00007FFD6C320000-0x00007FFD6C346000-memory.dmp

Download

memory/5184-178-0x00007FFD6BE20000-0x00007FFD6BF73000-memory.dmp

Download

memory/5184-140-0x00007FFD6BE20000-0x00007FFD6BF73000-memory.dmp

Download

memory/5184-176-0x00007FFD701A0000-0x00007FFD701B2000-memory.dmp

Download

memory/5184-175-0x00007FFD739F0000-0x00007FFD73A25000-memory.dmp

Download

memory/5184-133-0x00007FFD73A30000-0x00007FFD73A4A000-memory.dmp

Download

memory/5184-130-0x00007FFD604D0000-0x00007FFD60B01000-memory.dmp

Download

memory/5184-190-0x00007FFD6BD60000-0x00007FFD6BD8A000-memory.dmp

Download

memory/5184-129-0x00007FFD60B10000-0x00007FFD6121F000-memory.dmp

Download

memory/5184-192-0x00007FFD69A50000-0x00007FFD69A7F000-memory.dmp

Download

memory/5184-189-0x00007FFD63D00000-0x00007FFD63E8A000-memory.dmp

Download

memory/5184-121-0x00007FFD77230000-0x00007FFD7723F000-memory.dmp

Download

memory/5184-172-0x00007FFD73490000-0x00007FFD7349B000-memory.dmp

Download

memory/5184-127-0x00007FFD73A50000-0x00007FFD73A64000-memory.dmp

Download

memory/5184-166-0x00007FFD6C280000-0x00007FFD6C2BA000-memory.dmp

Download

memory/5184-165-0x00007FFD604D0000-0x00007FFD60B01000-memory.dmp

Download

memory/5184-161-0x00007FFD5FFB0000-0x00007FFD60267000-memory.dmp

Download

memory/5184-151-0x00007FFD70720000-0x00007FFD7073B000-memory.dmp

Download

memory/5184-150-0x00007FFD73A70000-0x00007FFD73AF0000-memory.dmp

Download

memory/5184-118-0x00007FFD772C0000-0x00007FFD772CD000-memory.dmp

Download

memory/5184-114-0x00007FFD73AF0000-0x00007FFD73B1C000-memory.dmp

Download

memory/5184-206-0x00007FFD5FFB0000-0x00007FFD60267000-memory.dmp

Download

memory/5184-205-0x00007FFD739D0000-0x00007FFD739DD000-memory.dmp

Download

memory/5184-115-0x00007FFD73A70000-0x00007FFD73AF0000-memory.dmp

Download

memory/5184-110-0x00007FFD73B20000-0x00007FFD73B3A000-memory.dmp

Download

memory/5184-154-0x00007FFD772C0000-0x00007FFD772CD000-memory.dmp

Download

memory/5184-104-0x00007FFD73B40000-0x00007FFD73B69000-memory.dmp

Download

memory/5184-96-0x00007FFD60B10000-0x00007FFD6121F000-memory.dmp

Download

memory/5184-246-0x00007FFD739F0000-0x00007FFD73A25000-memory.dmp

Download

memory/5184-259-0x00007FFD6BD60000-0x00007FFD6BD8A000-memory.dmp

Download

memory/5184-261-0x00007FFD5FD20000-0x00007FFD5FFAC000-memory.dmp

Download

memory/5184-244-0x00007FFD604D0000-0x00007FFD60B01000-memory.dmp

Download

memory/5184-247-0x00007FFD6BE20000-0x00007FFD6BF73000-memory.dmp

Download

memory/5184-235-0x00007FFD60B10000-0x00007FFD6121F000-memory.dmp

Download

memory/5184-249-0x00007FFD63D00000-0x00007FFD63E8A000-memory.dmp

Download

memory/5184-289-0x00007FFD6BD60000-0x00007FFD6BD8A000-memory.dmp

Download

memory/5184-295-0x00007FFD73AF0000-0x00007FFD73B1C000-memory.dmp

Download

memory/5184-288-0x00007FFD5FD20000-0x00007FFD5FFAC000-memory.dmp

Download

memory/5184-282-0x00007FFD5FFB0000-0x00007FFD60267000-memory.dmp

Download

memory/5184-279-0x00007FFD63D00000-0x00007FFD63E8A000-memory.dmp

Download

memory/5184-277-0x00007FFD6BE20000-0x00007FFD6BF73000-memory.dmp

Download

memory/5184-294-0x00007FFD73B20000-0x00007FFD73B3A000-memory.dmp

Download

memory/5184-293-0x00007FFD77470000-0x00007FFD7747F000-memory.dmp

Download

memory/5184-292-0x00007FFD73B40000-0x00007FFD73B69000-memory.dmp

Download

memory/5184-291-0x00007FFD73A70000-0x00007FFD73AF0000-memory.dmp

Download

memory/5184-290-0x00007FFD69A50000-0x00007FFD69A7F000-memory.dmp

Download

memory/5184-287-0x00007FFD73430000-0x00007FFD7343C000-memory.dmp

Download

memory/5184-286-0x00007FFD701A0000-0x00007FFD701B2000-memory.dmp

Download

memory/5184-285-0x00007FFD73490000-0x00007FFD7349B000-memory.dmp

Download

memory/5184-284-0x00007FFD679F0000-0x00007FFD67AAE000-memory.dmp

Download

memory/5184-283-0x00007FFD6C280000-0x00007FFD6C2BA000-memory.dmp

Download

memory/5184-281-0x00007FFD739D0000-0x00007FFD739DD000-memory.dmp

Download

memory/5184-278-0x00007FFD6C320000-0x00007FFD6C346000-memory.dmp

Download

memory/5184-275-0x00007FFD73A30000-0x00007FFD73A4A000-memory.dmp

Download

memory/5184-274-0x00007FFD604D0000-0x00007FFD60B01000-memory.dmp

Download

memory/5184-265-0x00007FFD60B10000-0x00007FFD6121F000-memory.dmp

Download

memory/5184-273-0x00007FFD73A50000-0x00007FFD73A64000-memory.dmp

Download

memory/5184-272-0x00007FFD77230000-0x00007FFD7723F000-memory.dmp

Download

memory/5184-280-0x00007FFD70720000-0x00007FFD7073B000-memory.dmp

Download

memory/5184-276-0x00007FFD739F0000-0x00007FFD73A25000-memory.dmp

Download

memory/5184-271-0x00007FFD772C0000-0x00007FFD772CD000-memory.dmp

Download