luna_stealer | 58cacb1c908d19068c35cb20418e482d8f843736b800597a2b87693a61f60aaa

Analysis

max time kernel
148s
max time network
20s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 56.5MB
Sample260910-lr1pcat1ht
SHA256 58cacb1c908d19068c35cb20418e482d8f843736b800597a2b87693a61f60aaa
MD5 ddfb910bd1685a5e73ab65c192de705b
SHA1 ae34a1cc82946b1efeccf4a9b66e29a3984fc983
SHA512 dadf712e4d35a5bd6a2de59bada8a482697b6277e4314f843bcb320ed73f0da5896247536a33e3598035d6509e3c42d565599fcc6daff9cd060df1022aa02cbf
SSDEEP 1572864:B/QQRpCHnqf3Gd6xdnj+YV5sz4+jE7szqrlIefZFTw:B/bwnyo6VVN+TW1zE
TLSH
T1C2D733A2545B03CBF0A67730B6528FB48A41EED30360F9C49BB9771E1E83B82457D9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution luna_stealer persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Family: LunaStealer
LunaStealer is an infostealer written in Python and packaged with Pyinstaller.
stealer luna_stealer

LunaStealer is a stealer written in Python and packaged with Pyinstaller 2 IoCs

resource	yara_rule
behavioral2/memory/5992-822-0x000001E5E0760000-0x000001E5E0C82000-memory.dmp	family_lunastealer
behavioral2/memory/5992-952-0x000001E5E0760000-0x000001E5E0C82000-memory.dmp	family_lunastealer

Loads dropped DLL 64 IoCs

pid	Process
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
3	discord.com
5	discord.com
6	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000900000001c9d1-726.dat	upx
behavioral2/memory/5992-729-0x00007FFA95D30000-0x00007FFA96319000-memory.dmp	upx
behavioral2/files/0x000c00000001c5cf-732.dat	upx
behavioral2/memory/5992-738-0x00007FFAAE880000-0x00007FFAAE8A3000-memory.dmp	upx
behavioral2/files/0x000c00000001c60b-737.dat	upx
behavioral2/files/0x000c00000001c5cd-741.dat	upx
behavioral2/memory/5992-740-0x00007FFAB0A80000-0x00007FFAB0A8F000-memory.dmp	upx
behavioral2/memory/5992-744-0x00007FFAAE860000-0x00007FFAAE879000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d2-743.dat	upx
behavioral2/memory/5992-776-0x00007FFAACCA0000-0x00007FFAACCCE000-memory.dmp	upx
behavioral2/files/0x000900000001c9d4-775.dat	upx
behavioral2/memory/5992-774-0x00007FFAACCD0000-0x00007FFAACCDD000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d5-772.dat	upx
behavioral2/files/0x000900000001c9d3-779.dat	upx
behavioral2/memory/5992-781-0x00007FFAACBD0000-0x00007FFAACC8C000-memory.dmp	upx
behavioral2/files/0x000900000001c9e3-783.dat	upx
behavioral2/memory/5992-785-0x00007FFAACBA0000-0x00007FFAACBCB000-memory.dmp	upx
behavioral2/memory/5992-784-0x00007FFAAE880000-0x00007FFAAE8A3000-memory.dmp	upx
behavioral2/memory/5992-780-0x00007FFA95D30000-0x00007FFA96319000-memory.dmp	upx
behavioral2/memory/5992-771-0x00007FFAAEF90000-0x00007FFAAEF9D000-memory.dmp	upx
behavioral2/files/0x000900000001c9d5-770.dat	upx
behavioral2/memory/5992-769-0x00007FFAAE7D0000-0x00007FFAAE7E9000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d7-768.dat	upx
behavioral2/memory/5992-767-0x00007FFAAE7F0000-0x00007FFAAE826000-memory.dmp	upx
behavioral2/files/0x000900000001c9cf-766.dat	upx
behavioral2/memory/5992-765-0x00007FFAAE830000-0x00007FFAAE85D000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d9-763.dat	upx
behavioral2/files/0x000c00000001c5d8-762.dat	upx
behavioral2/files/0x000c00000001c5d4-759.dat	upx
behavioral2/files/0x000c00000001c5d3-758.dat	upx
behavioral2/files/0x000c00000001c5d1-757.dat	upx
behavioral2/files/0x000c00000001c5d0-756.dat	upx
behavioral2/files/0x000c00000001c5ce-755.dat	upx
behavioral2/files/0x000c00000001c5cc-754.dat	upx
behavioral2/files/0x000900000001c9e0-752.dat	upx
behavioral2/files/0x000900000001c9df-751.dat	upx
behavioral2/files/0x000c00000001c60c-747.dat	upx
behavioral2/files/0x000c00000001c60a-746.dat	upx
behavioral2/memory/5992-787-0x00007FFAACB60000-0x00007FFAACB93000-memory.dmp	upx
behavioral2/memory/5992-791-0x00007FFAA0D90000-0x00007FFAA0E5D000-memory.dmp	upx
behavioral2/memory/5992-792-0x00007FFA95800000-0x00007FFA95D22000-memory.dmp	upx
behavioral2/memory/5992-796-0x00007FFAAA420000-0x00007FFAAA435000-memory.dmp	upx
behavioral2/memory/5992-798-0x00007FFAA91F0000-0x00007FFAA9202000-memory.dmp	upx
behavioral2/memory/5992-795-0x00007FFAAE7D0000-0x00007FFAAE7E9000-memory.dmp	upx
behavioral2/files/0x000900000001c9ec-799.dat	upx
behavioral2/memory/5992-801-0x00007FFAA0D00000-0x00007FFAA0D87000-memory.dmp	upx
behavioral2/memory/5992-803-0x00007FFAACCA0000-0x00007FFAACCCE000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e0-805.dat	upx
behavioral2/files/0x000c00000001c5e1-807.dat	upx
behavioral2/memory/5992-813-0x00007FFAA8D20000-0x00007FFAA8D46000-memory.dmp	upx
behavioral2/memory/5992-812-0x00007FFAA0BE0000-0x00007FFAA0CFC000-memory.dmp	upx
behavioral2/memory/5992-811-0x00007FFAACB50000-0x00007FFAACB5B000-memory.dmp	upx
behavioral2/memory/5992-810-0x00007FFAACBD0000-0x00007FFAACC8C000-memory.dmp	upx
behavioral2/memory/5992-804-0x00007FFAA8F80000-0x00007FFAA8F94000-memory.dmp	upx
behavioral2/files/0x000c00000001c631-816.dat	upx
behavioral2/memory/5992-819-0x00007FFAA8D00000-0x00007FFAA8D18000-memory.dmp	upx
behavioral2/memory/5992-818-0x00007FFAACB60000-0x00007FFAACB93000-memory.dmp	upx
behavioral2/memory/5992-820-0x00007FFAA0D90000-0x00007FFAA0E5D000-memory.dmp	upx
behavioral2/memory/5992-823-0x00007FFAA0BB0000-0x00007FFAA0BD3000-memory.dmp	upx
behavioral2/memory/5992-821-0x00007FFA95800000-0x00007FFA95D22000-memory.dmp	upx
behavioral2/memory/5992-824-0x00007FFA99270000-0x00007FFA993E7000-memory.dmp	upx
behavioral2/memory/5992-825-0x00007FFA9D690000-0x00007FFA9D6C8000-memory.dmp	upx
behavioral2/memory/5992-827-0x00007FFAA9170000-0x00007FFAA917B000-memory.dmp	upx
behavioral2/memory/5992-828-0x00007FFAA8F70000-0x00007FFAA8F7B000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1952	cmd.exe
2116	cmd.exe
5912	cmd.exe
3308	cmd.exe
5856	cmd.exe
700	cmd.exe
2996	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4844	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4708	WMIC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{50097E03-1293-453C-B56B-9B5FF91E77B7}	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
3804	WMIC.exe
3804	WMIC.exe
3804	WMIC.exe
3804	WMIC.exe
4076	wmic.exe
4076	wmic.exe
4076	wmic.exe
4076	wmic.exe
4708	WMIC.exe
4708	WMIC.exe
4708	WMIC.exe
4708	WMIC.exe
2268	WMIC.exe
2268	WMIC.exe
2268	WMIC.exe
2268	WMIC.exe
5088	WMIC.exe
5088	WMIC.exe
5088	WMIC.exe
5088	WMIC.exe
2292	WMIC.exe
2292	WMIC.exe
2292	WMIC.exe
2292	WMIC.exe
5792	WMIC.exe
5792	WMIC.exe
5792	WMIC.exe
5792	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeIncreaseQuotaPrivilege	3804	WMIC.exe
Token: SeSecurityPrivilege	3804	WMIC.exe
Token: SeTakeOwnershipPrivilege	3804	WMIC.exe
Token: SeLoadDriverPrivilege	3804	WMIC.exe
Token: SeSystemProfilePrivilege	3804	WMIC.exe
Token: SeSystemtimePrivilege	3804	WMIC.exe
Token: SeProfSingleProcessPrivilege	3804	WMIC.exe
Token: SeIncBasePriorityPrivilege	3804	WMIC.exe
Token: SeCreatePagefilePrivilege	3804	WMIC.exe
Token: SeBackupPrivilege	3804	WMIC.exe
Token: SeRestorePrivilege	3804	WMIC.exe
Token: SeShutdownPrivilege	3804	WMIC.exe
Token: SeDebugPrivilege	3804	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3804	WMIC.exe
Token: SeRemoteShutdownPrivilege	3804	WMIC.exe
Token: SeUndockPrivilege	3804	WMIC.exe
Token: SeManageVolumePrivilege	3804	WMIC.exe
Token: 33	3804	WMIC.exe
Token: 34	3804	WMIC.exe
Token: 35	3804	WMIC.exe
Token: 36	3804	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3804	WMIC.exe
Token: SeSecurityPrivilege	3804	WMIC.exe
Token: SeTakeOwnershipPrivilege	3804	WMIC.exe
Token: SeLoadDriverPrivilege	3804	WMIC.exe
Token: SeSystemProfilePrivilege	3804	WMIC.exe
Token: SeSystemtimePrivilege	3804	WMIC.exe
Token: SeProfSingleProcessPrivilege	3804	WMIC.exe
Token: SeIncBasePriorityPrivilege	3804	WMIC.exe
Token: SeCreatePagefilePrivilege	3804	WMIC.exe
Token: SeBackupPrivilege	3804	WMIC.exe
Token: SeRestorePrivilege	3804	WMIC.exe
Token: SeShutdownPrivilege	3804	WMIC.exe
Token: SeDebugPrivilege	3804	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3804	WMIC.exe
Token: SeRemoteShutdownPrivilege	3804	WMIC.exe
Token: SeUndockPrivilege	3804	WMIC.exe
Token: SeManageVolumePrivilege	3804	WMIC.exe
Token: 33	3804	WMIC.exe
Token: 34	3804	WMIC.exe
Token: 35	3804	WMIC.exe
Token: 36	3804	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4076	wmic.exe
Token: SeSecurityPrivilege	4076	wmic.exe
Token: SeTakeOwnershipPrivilege	4076	wmic.exe
Token: SeLoadDriverPrivilege	4076	wmic.exe
Token: SeSystemProfilePrivilege	4076	wmic.exe
Token: SeSystemtimePrivilege	4076	wmic.exe
Token: SeProfSingleProcessPrivilege	4076	wmic.exe
Token: SeIncBasePriorityPrivilege	4076	wmic.exe
Token: SeCreatePagefilePrivilege	4076	wmic.exe
Token: SeBackupPrivilege	4076	wmic.exe
Token: SeRestorePrivilege	4076	wmic.exe
Token: SeShutdownPrivilege	4076	wmic.exe
Token: SeDebugPrivilege	4076	wmic.exe
Token: SeSystemEnvironmentPrivilege	4076	wmic.exe
Token: SeRemoteShutdownPrivilege	4076	wmic.exe
Token: SeUndockPrivilege	4076	wmic.exe
Token: SeManageVolumePrivilege	4076	wmic.exe
Token: 33	4076	wmic.exe
Token: 34	4076	wmic.exe
Token: 35	4076	wmic.exe
Token: 36	4076	wmic.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 5992	4212	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 5992 wrote to memory of 5856	5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 5992 wrote to memory of 4844	5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 5992 wrote to memory of 700	5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	94
PID 700 wrote to memory of 3804	700	cmd.exe	96
PID 5992 wrote to memory of 4076	5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	98
PID 5992 wrote to memory of 2996	5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	100
PID 2996 wrote to memory of 4708	2996	cmd.exe	102
PID 5992 wrote to memory of 1952	5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	103
PID 1952 wrote to memory of 2268	1952	cmd.exe	105
PID 5992 wrote to memory of 2116	5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	106
PID 2116 wrote to memory of 5088	2116	cmd.exe	108
PID 5992 wrote to memory of 5912	5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	109
PID 5912 wrote to memory of 2292	5912	cmd.exe	111
PID 5992 wrote to memory of 3308	5992	2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	112
PID 3308 wrote to memory of 5792	3308	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Users\Admin\AppData\Local\Temp\2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-10_ddfb910bd1685a5e73ab65c192de705b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:5856
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:700
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3804
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:4708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5912
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path softwarelicensingservice get OA3xOriginalProductKey
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cc's.txt

Path C:\Users\Admin\AppData\Local\Temp\3ayiKew9Kj\Browser\cc's.txt
Size 91B
SHA256 c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c
MD5 5aa796b6950a92a226cc5c98ed1c47e8
SHA1 6706a4082fc2c141272122f1ca424a446506c44d
SHA512 976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad
TLSH
T1C8B012C4055142A406710123110DB0013C748EE273C4010571AD9018334EC64B389D8E
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\3ayiKew9Kj\Browser\history.txt
Size 83B
SHA256 7fb621511f8419114230df9e4217ca7063e1480b01122a77d707cc8216ae0bff
MD5 3170167be26e6926ccce0b5b1e4049b8
SHA1 f4b02097bcbc28bbbe9a642fd70ba9623bcf9b15
SHA512 3d8aa17a708be3771ab3c74170a4bc36c931fb5b89eeaabaa3b10e8919d5be6d14aed52c3b21ee36525e3a6319cae0aaf730f7cd56fb1c569e27df129e9fb13a
TLSH
T1FAA01288C11144D913BD0060B48701047868F1050754100138C04840B60D66242909B6
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\VCRUNTIME140_1.dll
Size 48KB
SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
MD5 7e668ab8a78bd0118b94978d154c85bc
SHA1 dbac42a02a8d50639805174afd21d45f3c56e3a0
SHA512 72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032
SSDEEP 768:YEgYXUcHJcUJSDW/tfxL1qBSHGm6Ub/I2Hi09z0XQKBcRmuU9zuKl:YvGS8fZ1esJwUpz0X3B+d8zuKl
TLSH
T1F6236CD593785082D49BA9B08197DE17BE3CFA924B50928F0BA1D15C2F637D0A73D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\_asyncio.pyd
Size 36KB
SHA256 383fa587f1912ab2592b442a5c13e3be2b61d83f9ebd077d93ccd7e4302c5d8e
MD5 8ccb701b124fb82bacdf65a070fd257d
SHA1 6c15866ee5150870ebe1658303aa4751066bd748
SHA512 30fb63a600678c57d0ac66a48f186de7388b2187965967b3a9fd33316371b6e0d81f85472b3a7fedbd1af72ea5d7110e6827dc43d23592262ad37b2f45781492
SSDEEP 768:3M6N/jQdkgecnskMKffKF9xQspYLyUIVOn8M5YiSyvWAMxkEu:3R0kiV3+fsBIVOn827SyMx6
TLSH
T109F2B0A7C1B4AC24DC6B9DB230D4C938FA35B9975960C7E7320C81689F713826FA1775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\_bz2.pyd
Size 48KB
SHA256 24f92b2639b102fa388b44d62d41ea20140d498d67284cb8dd4f566ba5a654df
MD5 ffde755017bd13cadf3d1c22672fe4f3
SHA1 6c64a3fdca95b3df07b8130e7ef3fa0224a59b9f
SHA512 ef87cbe79bf5ab7d505a94d9a34f31ebfa52f9ab63734b4459c606aa9f4d8b19a1bc2c7d6b44a917fb2aeb888c31bc30e1b211272b4ebeae5770e16ddf58384e
SSDEEP 1536:a5xdYKhY/Y5bQMskWu3IVCVJv7SyhJDxhy:SxdYKS/Y5RJRIVCVJvXpy
TLSH
T14623D1E79A78EC18C8539CB135D49828FA75794A682083D7631DC1729F31352EFD32B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\_cffi_backend.cp311-win_amd64.pyd
Size 71KB
SHA256 b346624f456f5297696e9708fa44a5473c1dc53443d14e6b5330cf191ca2d766
MD5 55ee36964cfb1cb5c4a13762722e6b8e
SHA1 b7337e1aeac9bec9daffac43bcb881011f9eded9
SHA512 337462452c576fa1001c750df5af943a9efebf0409246849d700b6c2e2766ed2c4bf46ca7027d2e37bf1f949525fca682ee322ac7867e0b5525be9054c10c24a
SSDEEP 1536:imtchbmUHui4ehi47gdUCK41d34AANP8zj6V:LuhKUHuwPMO9y10P83
TLSH
T12563F1F27566EEF6C3760837428484C886906C75B300D3F72EAA747A4ED37A86EF1641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\_ctypes.pyd
Size 58KB
SHA256 8024504f54d5aa238b614d6ab0c6da336a152545584d0705b0a9c841b5803066
MD5 392f40bbdd809c9ca1b16708fdd5f277
SHA1 4f407dd241acadcd14c7f182562eb0a2436eebe9
SHA512 44aeeeb187a437d5006cd45151e36c5ec001c0205797e3e7ba222b3ecdb4b66183afabcd050477e74f0f6a2df703fce3a008927d3db56d4377c588c33a46da60
SSDEEP 1536:akUOlRrHrPcX1nBeXfeIO/h8mLwj46IVLPZp7SyIx9:a5OLL0FnIXm/yk6IVLPZpo
TLSH
T1DC43F16342949C32FE1BCD3238D0A518EE37B5DB5A54CBE3328BD13A5B713C29A41679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\_decimal.pyd
Size 106KB
SHA256 75e248360a3693aaf9176cc03a73a31bb4f92181e87e0d3f1085566ab34f4c76
MD5 94c2baa42c7e7d65d10a75a6ed4f69d2
SHA1 6e41fa6a3aa1f04854fe4820a0096a3ace9527f1
SHA512 19ed75d59e3479aae1045d0a68f8b78af6ff7c5e5db78aa42c08d1e852cec2598db441690ecb2d1c65d7d82bfeae9b71ed6d9ab4ff8848e4304f86bbb0559f79
SSDEEP 1536:lOt51H+NnBZBmb1fZGlHc9ye/U65Qka1RkT1IJ5NrIecwgWN/xiNIVOqHC07SyiY:YzanBZkGlmRc1en8R/iIVOqHC0r
TLSH
T1D5B302D75AF8D43ECA37DA3075E01AACCE3976960D58C3E790D8866C2B623D238157D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\_hashlib.pyd
Size 35KB
SHA256 4c5ae5d4840ed14968d0ce25b3852a4759071937cfceab18a9f5e2769e9a3171
MD5 0e83544c550a24bb0f66216e0cd004ad
SHA1 dfa496ad2c3e47d1853319915912b6628190261c
SHA512 6702f2da4b6f764edbbd5373495de85acbc30875ec2ce44590766b1826a1989465060143ffbf38b7f30b89751ec2aa40f368b34eb019412f0185ed80388fe126
SSDEEP 768:d35lZrQBDJLFSRN0cp71I6Pm9zje2pojcIVOI8a5YiSyvELAMxkE1R1:p5YbLkfzpIwm9zK1jcIVOI847SyMrxZz
TLSH
T19FF2BF934574FC2CC9174DF232C48934FE337A5A9995C3EF228891295FB12826F963B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\_lzma.pyd
Size 85KB
SHA256 993a77ef685ebe766f2a54f2affc90a180881e998b9baf8a6f32f7e6570838e0
MD5 39dce3c42b4293b028dfbcd23e167a81
SHA1 8c20f3953320660b24e418ea6f9e5d4e84a6aa16
SHA512 9fbe44314d37223840e007368d28bb8693b3f43740ef4c41fc449c90ad0adce6c29ec4219bafcde52464e335fcaaa7fb4d6192eefe2adb8248d30c43ef198557
SSDEEP 1536:0dMcTNiSSlZFto5ChAwRYMekiq/xFQhIHFB38EtW9ue20dcwfgpPzLNLJcIVZ1Ch:YTJitRLeZq/fZH3Ns9D2WcGgthLGIVZI
TLSH
T14F83F1B3AA319F6DC436483632D9C518FF757EAF5640C2ED309481A29F237415BE127A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\_multiprocessing.pyd
Size 26KB
SHA256 ee39387de7e92c3a8986375e7b7cd5768d2ef2ad2f6165e2f8a78b7812af0e4e
MD5 53aa0aabf143bc6d7be4fc52c8c8513c
SHA1 a7e74272b4635932eda0761825967e195668edd3
SHA512 2fe6614ebc51e8b81570f237b3f2ce8a3c00822452583be4213a5e9f6d3fe35ac56edc905f6c39fda32b7a97f8939d35118b5407fa5f170f45fd279b00257f76
SSDEEP 768:my6HNbprWpwDXIVWt835YiSyvE+OAMxkEO:+99DXIVWt8p7Sy18xK
TLSH
T187C2AFB386689C24DC229D7170D49839FE357E474641C2EB328CD1668F727822AD63FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\_overlapped.pyd
Size 32KB
SHA256 04eafcd301ead4b1fd6166a1eba5579b3750a6dc0906b1564c0ccedaec910c73
MD5 b96cf33b3d3ea4a865353526f248a7ed
SHA1 9f95b97e676653124aa45247af554333bc0b58cf
SHA512 42519d66ed1ec0fe6d89745a899ed22d66989d9837e86d9c3ab26f78857d3cb408d02fcfa19d3aff5110f56c8731131673782e94c7a74feeb3fea022a2e32a3a
SSDEEP 768:21y7LmeBIEqqupNjRIVXtM75YiSyvw5AMxkEfEk:zvmeBI9jRIVXtMF7Sy4hxjEk
TLSH
T19BE2B0D792A8AC68C9378DB131E55A24FF32B9968510C39B3219522A4F723413FE21F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\_queue.pyd
Size 25KB
SHA256 aefb0a6fa7ec581c42fee2158c26c40080d2d03bf70f1b7ed168bf04d94ec2fd
MD5 256542a0a50915039d6b0465ca278d95
SHA1 885d0030d51a6c58ac5dc1316ee9dd5d3d83e5d8
SHA512 709c5603ab4c8a4366da25dbfa836c3c24111432d1c09bceb1874ec613cfe34664535d3bb1c4e9a49931c636262a6689020f192f000e57dbb0e89ce8917b6efc
SSDEEP 768:PRihFuym2pDjIVQU8v5YiSyvyxAMxkE44:IXmqjIVQU8B7Sy+xE4
TLSH
T120C29DA38278AC68CE279DB234D58834FE31BD979590C3AB324D81764F327413BA5379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\_socket.pyd
Size 43KB
SHA256 5d0d27f5cac7fec9dac774b1a18605a9a3a09ebdbcf2aa069fd31c482cd8d46e
MD5 eaeb0c5b7740ef5e2bbd00f77ba356e0
SHA1 515dccad36309db1fa9e6cfd2cb104ec23f4c9ae
SHA512 db6ba9c3d83273aa1dfcafd836e13f9117b7011ca87b038305893957bbba2d7a3d712a8e5f808378f5d34c595cdae51ed95242795255c7ac2f4e13dca13a2dfa
SSDEEP 768:wkQ8MABQVaAwmySb0TrgeBYdEpZbqIVLwJF65YiSyvTAMxkEY:wkTIzwF/JbqIVLwJFY7SyLxU
TLSH
T12313D0E795581C70E8679D3038E88825FD30FD838865C2D73359D22B8FA23917BA2379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\_sqlite3.pyd
Size 56KB
SHA256 e42681b7e995e4514b9574b9461be50c9a39927b1eb43b0081e4338d7fe7e0d9
MD5 512d9e7870a3948cc2ee94d0b4082d2b
SHA1 d36edee46fe7dc95f0fde6440731b557655525b2
SHA512 7b11dc83b138b0970e84045d1065678222bb2aa0aeea4a5d7c3cd45acfac45e246cde6a28ca8026a11d6b6006d933e485e9d5a218a3e48a5dc31da91cac2bb06
SSDEEP 1536:pw9DUaMjfQ0G17k3Gq+m3SvZ6XhH60CSLMIVOQZu7Sypx/:CzMjYfwPzR60qIVOQZuB
TLSH
T17243E1A3C2946C18E9369CF375D42639E77078838A51C6CB329DA33B8F757433A602B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\_ssl.pyd
Size 65KB
SHA256 119de2672890ced44f0c56b885dad0126ad7b8facd59fc6913ca94f87c36be69
MD5 fdbab97d89757173503faefda3d07c7d
SHA1 310182406d6e9dd5b49e71fc896d24d8c4da62ca
SHA512 946b6494af3b6ddb7f5dd185d32eaa1115133f3f01b560f403706f0bfd378dc7f6d5e79b5ce906c64aec20e2617cc66711f423765551b7a7a94de3a26f0d7dd0
SSDEEP 1536:zbCYwNqce1LbV8uQvTLwNsDgzg+JR15xzf5/5JrwIVC7y3S7Syykx0:zuYwNABQQxzhRTxTx5JcIVC7yCa
TLSH
T1E263F1834725BC7DCC121D7631958126FB31A8A718B6C6AB31DEA3798F623017B031BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\_uuid.pyd
Size 24KB
SHA256 fc09e40e569f472dd4ba2ea93da48220a6b0387ec62bb0f41f13ef8fab215413
MD5 3a09b6db7e4d6ff0f74c292649e4ba96
SHA1 1a515f98946a4dccc50579cbcedf959017f3a23c
SHA512 8d5ea9f7eee3d75f0673cc7821a94c50f753299128f3d623e7a9c262788c91c267827c859c5d46314a42310c27699af5cdfc6f7821dd38bf03c0b35873d9730f
SSDEEP 384:lCfwFpEWjfivQpIVZwobHQIYiSy1pCQFjzuAM+o/8E9VF0NySoJ:4qpEI4QpIVZwg5YiSyvgAMxkE7
TLSH
T104B27D86DA605C11EC178AB1B0D14F2AE931FA864B90C3CB335CC1595F613837AFA3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\base_library.zip
Size 1.4MB
SHA256 ca40732f885379489d75a2dec8eb68a7cce024f7302dd86d63f075e2745a1e7d
MD5 d220b7e359810266fe6885a169448fa0
SHA1 556728b326318b992b0def059eca239eb14ba198
SHA512 8f802c2e717b0cb47c3eeea990ffa0214f17d00c79ce65a0c0824a4f095bde9a3d9d85efb38f8f2535e703476cb6f379195565761a0b1d738d045d7bb2c0b542
SSDEEP 24576:mQR5pATG8/R5lUKdcubgAnyfb8h30iwhBdYf9PfeYHHc:mQR5pE/RbPu
TLSH
T1CD6509817982B5B7F804F3BB4026090DB328C5B4FB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\certifi\cacert.pem
Size 285KB
SHA256 7a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92
MD5 d3e74c9d33719c8ab162baa4ae743b27
SHA1 ee32f2ccd4bc56ca68441a02bf33e32dc6205c2b
SHA512 e0fb35d6901a6debbf48a0655e2aa1040700eb5166e732ae2617e89ef5e6869e8ddd5c7875fa83f31d447d4abc3db14bffd29600c9af725d9b03f03363469b4c
SSDEEP 6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5NF:QWb/TRJLWURrI55MWavdF0D
TLSH
T12E547C964F269C05289FE1C1CA9B1357DD3E027B99FEF0F1394A2448D24622A17FCD9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\charset_normalizer\md.cp311-win_amd64.pyd
Size 9KB
SHA256 6864ce58854fc54853f557c218bddbb73fe457b704bee24da84579d82aee6509
MD5 542c223312c5dbe5d21fc216dfb8cb7e
SHA1 c2922363caf50c40ac079786af12141f69248d5d
SHA512 2eab599c5ca6eeb8b80bccce839b37ca42c949d45d12981a1efe43df980736ede7b4fd1a23d2dbba7895948a8dfa79136549dffb9fdbf7110430f53fea557c31
SSDEEP 96:KG6jp/QthczuG47NfGTJiWpmLeiRrRcfuljG2+wUiVzTkYBbPJBj34lVhXg246aw:O6tq4hfGNpeeiTJxTkYj273QJXpHI8O
TLSH
T1E1125CB7737EE5B8C46658B105528994FB31F832921A132F05F532BF4CB7B882A14630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
Size 39KB
SHA256 4609d4065b796165f71f15a17dc43307219acaac2248e48c15e8e0b3ae5685be
MD5 d28bf4b47504d9fa10214d284bf47bca
SHA1 8ab2d660f00d4b0db47da1d691cb27c044240940
SHA512 e6dc5e31047ae7fbe81e80d86d42c6d34faa36c4812d6c640610fb5a679acd0890e10eae3d142dfed0b2b9474b83daf162b2bceb2cadc06a70a7115dd831e074
SSDEEP 768:AJWJjbkBClgXZHm7SIwqvEz/u11zxms4bpqK:fADmvwvzYWLgK
TLSH
T1E903F16321BF7AFCC40254B62D61C1FDABD2787A72A247BF18F1A47D8C61F502922821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\libcrypto-3.dll
Size 1.6MB
SHA256 07c64ebafd1623bc7e6a7299228d656fbb524eb7523b5082841effafb4778f52
MD5 620c100eb510ef9c00a72b84f09d3243
SHA1 37687aa22aabc54deae898140ad748f158da4710
SHA512 58f2dacf18f3c741d682c8602f9a457a1cfbdbd23bbb1c5bad434feb47617d65365d4bbbae9832271df4027e11c1d4053d88e7843dc181dc2ba2741eda7362b3
SSDEEP 49152:oMyDwbv70aKbP1zkLO5YHLA1CPwDvt3uFlDCZ:cwbv77KbPaqYHLA1CPwDvt3uFlDCZ
TLSH
T10A75121414BF780BF749A4789F34D8AA8D5E2712B708DFE12D6E8E280C19D0E95BD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\libffi-8.dll
Size 29KB
SHA256 7d08df2c496c32281bf9a010b62e8898b9743db8b95a7ebee12d746c2e95d676
MD5 be8ceb4f7cb0782322f0eb52bc217797
SHA1 280a7cc8d297697f7f818e4274a7edd3b53f1e4d
SHA512 07318c71c3137114e0cfec7d8b4815fd6efa51ce70b377121f26dc469cefe041d5098e1c92af8ed0c53b21e9c845fddee4d6646d5bd8395a3f1370ba56a59571
SSDEEP 768:Pp/6aepjG56w24Up3p45YiSyvkIPxWEqG:1A154spK7SytPxF
TLSH
T153D2CFF34521FC39DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\libssl-3.dll
Size 223KB
SHA256 6e35afcee97988bc8e3f861341d12e79b9178aa9eb8382b6b4aee5f2f9855c2d
MD5 2c4bd4de4369f7b93b8cf03d51f984b2
SHA1 4e16f57887dd64dd0fb98adee03e7a99fc09b783
SHA512 c1430148b6813d859e7fda225bc5d1fa014006b079370df9562464536f2ef91bfa50e921bedbad04fbd311b6b1cb6e64be991e1afd5f01a7dfc6dcda90a3f46a
SSDEEP 3072:qFfmvsqWLSCMT+MyN6Qp2oZqpN+/fvrqknqbf6CjaBGkfPkZAK1ck2kBVfLwOmFd:qFevsT9JN+vyH1nqLr3CPrYBBRcd
TLSH
T14D2402A2712F8823CC17EEB6DBF860E5D76D770A6F06C8663723C90CBB6091C665C255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luna.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\luna.aes
Size 66KB
SHA256 86b16a3830fa6fc95565e8c14be2ace4976f39fe08ebbe342f81600bc510e664
MD5 56b5a7bb8d034b6d5ea153452d726ed6
SHA1 932cf9a23b0dccb317c28aec255ffd327a8b99ed
SHA512 64a94f54596961ca6bda0733d24094524aa60bbe748a9741c93a7b8816c49e7d24ce8298a05cdc8842fea9ef751a461cc2e72572d0a850da29fdffd1f2915c88
SSDEEP 1536:tByoUaMRq82/T94zdWEPGaYZ4PYzauuUVxg6:u5aMsTruzdrGaYZ44XxL
TLSH
T1916302CA911BB6697DEF51B50E8A56A7986F9032007181D30B7D28C0931CB9C7CDEF97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\psutil\_psutil_windows.pyd
Size 31KB
SHA256 a1a297c62345f33d3bdb7db4e4b23b3aad75057440d1218d34291b57b1538423
MD5 8a8e3fdcafb2d8f07b54028edafb5b09
SHA1 9eccb4d95d1e700109e3c786713b523958b14c25
SHA512 a32dc4e508e0b844fa7fd1efade9af999b3bd9116bc93657d6718608b8cdee3e3b1b753ea52549d2f36a831f7bf0edd661f57693d1fa5b1b84bc0d894fcff258
SSDEEP 768:/vaDMlccGli4/1LnromOJjNOzhtPTXuwKuzpSp6:/vaQlmUQFnrobNEht6wDY
TLSH
T15AE2CFDA347BC6BCCD9D92734188055DAFA83833965A4B1F10F130FB4CAA9B15D217E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\pyexpat.pyd
Size 87KB
SHA256 3c5a70df69872d4abafb9ba4db5beaf7da360ee56bf6ea534e3cd7cff5adc328
MD5 a8b86b17645af4c102adde3acf2cc293
SHA1 89b07d7619638866d6ab0dce188350097111fee5
SHA512 66f0aad0d019444a3f9ccff0a50aa88cb2e023f262ab151a2b4f946b86eb60ff34af2d650ec28995e6bd8167a0c159e24b57fe7b365ca26f41fd3b7de9e0deae
SSDEEP 1536:XYynT+G0EI+epxbbIdegcKO4q1GLOUIzUre2N75Bq/hIa3BmK/PxsdIVLh3p7SyD:XjQEbepxbbYnf7q1G6Uhre2NNBq/IsAg
TLSH
T17D93F1A6C6B5AC60EE6398362AD45519AA70BF433F848183737CC8738F293403F5A374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\python3.DLL
Size 65KB
SHA256 e45452efa356db874f2e5ff08c9cc0fe22528609e5d341f8fb67ba48885ab77d
MD5 d8ba00c1d9fcc7c0abbffb5c214da647
SHA1 5fa9d5700b42a83bfcc125d1c45e0111b9d62035
SHA512 df1b714494856f618a742791eefbf470b2eee07b51d983256e4386ea7d48da5c7b1e896f222ea55a748c9413203886cde3a65ef9e7ea069014fa626f81d79cd3
SSDEEP 768:lGw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJa:r/5k8cnzeJd9IVL0v7SyJwx/
TLSH
T170637F529B58F8A6DAF665FC38D19DCE543B12CC83ED88DCA57893D30E1A310A62734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\python311.dll
Size 1.6MB
SHA256 2f48c4d1ad846f7617e886cbdc88154d17464be0eabc5fa9db81cead0d157056
MD5 ac6cc302aa9e58ec53b56b9f2786de40
SHA1 1375c081b7c920ee267002bc153ff3b80c07187e
SHA512 9bdfe7ebca2d01fdba940e646418579abc8fdccea7e772f3e98eef5f6d4743ebda0796ad7356a29f3472149b5468758600e5d2e3eaaa53a737771effc3d6fcb2
SSDEEP 24576:eJY99sOZi/8N8C1CSIJyR4ZRE1Rqq/uQivcHe2Bg5Cmek5CP7uP6zohpLGLZFkh2:RjZiEN8p6ivZUHe2BgcpP7uaor6
TLSH
T153853332288DCC9FE8973676A1C7CB17D85A0293441791D5F9B8C1A727C7E21AA3736C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\pywin32_system32\pythoncom311.dll
Size 193KB
SHA256 39f4e62d0366897e20eb849cdc78f4ea988605ba86a95c9c741f2797086a6788
MD5 471d17f08b66f1489516d271ebf831e3
SHA1 0296e3848de8e99c55bab82c7b181112fb30e840
SHA512 857a92588f3363ce9e139fe92222ece6d7d926fdcb2c5c1febfb6328389f3e5f8b82063aface5b61015de031e6bfda556067f49f9cc8103664749d8581da1587
SSDEEP 3072:rCTzJRyBPsxhaPueTqxVvMCeYp3FotYqL+KYw532+i/PygB3O6h7ZKkypdir:rCTzJRyfPuBE26r+Tv+iXyb6hlkpd
TLSH
T1A714E051BE9786EFD4A8F3B2AC841601DBD7E6594317E702506B8252B0FB3C72C1D2A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\pywin32_system32\pywintypes311.dll
Size 62KB
SHA256 e3be247830c23a1751e1bab98d02ba5da3721d2a85469eda3764fc583ca2a6ff
MD5 04ce7664658c9c18527594708550d59e
SHA1 1db7e6722aaea33d92fba441fca294600d904103
SHA512 e9744b2eee5fa848d5ac83622a6b1c1a1009d7ad8a944bda7a118dd75d8d24218fa2e4ef67718caabda0dd67efdd5be1497705afef8edec830f1b2402d0f0a8b
SSDEEP 768:xjPpDPKuASjw7XqXcK+yhDzC8mgnC6cD+g90EKiv53YF2a/npFUQLJ6uxQEZOVPi:RdASj2XeBz3m7Sg9xeUQLJhm8eq
TLSH
T19F535B816E9BD99FCA17E3336C890811D4D7E255530AE7D199EBC1D3E0FA3D22C2A427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\select.pyd
Size 25KB
SHA256 e80f59027bed120b19b8e8812087a669ccfef0e56c4138195c5f825c97e57b7b
MD5 dbab684e67423f530dcf304d09479890
SHA1 908526a71ccb3005b144c786919836a19cdc6c37
SHA512 2231198e324654999b964ad74735bb0ff34359566e8bdb21ba97e4d0cf061a1450bad3a01766d772a57fbfef2877c44011a279db6bfd6a1907c8a93f7fb906ed
SSDEEP 384:IUAW1guHrh0h1d4NZa7gJXZjNIVQG86lHQIYiSy1pCQfwug+AM+o/8E9VF0NyciC:IjW1JVpJjNIVQG8S5YiSyv3g+AMxkEdC
TLSH
T167C29EE34174A868CD3B8DB138D48534FE31BD97896087EB324D82668F627817BE5376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\sqlite3.dll
Size 622KB
SHA256 9f44cb4769ae3006afe6f177b62cbd43b925148b495d218d12d96d2724479629
MD5 1529d1d7e315ca22ff1be71b503e10e7
SHA1 4a6977bc2a4dc3cae7976fc93775816b23d6fe59
SHA512 0cbdbe755681f60ff6435a48fb69b8b216db5f03a97535ebf701ea74ccfc2d6fd9332d0402f366cc70362191ab8df47a2224180860d8d15b60d5c87bdf031f0f
SSDEEP 12288:tevMEHnoed8VDT4Rc+iHsLG56RY+hPQHAnxeIglZsk2F24ZHL2Ubsi2V4G2:t8oy8x4Rl1dRnxeDlZxsl2MsDVr2
TLSH
T132D423F3F02B8C5CF5F28D79E0A3748189196D2EEEB115C3EB6CD3199A29A40CC5A750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\unicodedata.pyd
Size 295KB
SHA256 7dc0f15468ad60ab6ffda8e462877bf37229f7df0e6a1fb055b27eaa5566e3b9
MD5 c98ac55067ca6b298c49d627db9e4c4b
SHA1 fa2e9d0610a21f7fd08275a566979b1bee8ea2bf
SHA512 4b2bade13f17d4ee792430ff9f4c51c2c015db372b5af1ae94f9be66c66506a31d0c58ac915f2e454dde2936c8d05d8bdc7dd358850395fd2afd3d3d817acb5b
SSDEEP 6144:Ok/Qvs7yfQJYx4x9UVqHDMDNCStEQc5YmDp9KiQ/y:OkUfQJbUV2MhCwEQc5Np9zQ6
TLSH
T1005423FBCD5194B1E62B9E30A3C5916AED3DBE03095AC5E3A757E1AC5F2177223403A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\win32\win32api.pyd
Size 48KB
SHA256 2c37610d165a3c3c0350b08a5d803928267aa69878f753d2e2b048de4f3a7413
MD5 d2668458d3a33de3fbe931eb029a3628
SHA1 258351db3b6ce6ae80a428c2b5dc0a3f7cfa112a
SHA512 440b760300043938c1a3130baf667426d1dabdb6dab24581054c9d5ef213997183b0a317b4f846f277eabb07f7bd4d2cc42d90158511c904b7a78672869c641d
SSDEEP 1536:K3ykyksFORBuqvb905yb8/z0lyUSxsur8kR2e:uykUeXZ2UK8k8e
TLSH
T10C23F1DB9349F6F8C65695B312E603C8B27AA82193B6878F80951171097D7E0EFBC618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backend_c.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI42122\zstandard\backend_c.cp311-win_amd64.pyd
Size 174KB
SHA256 bb210e80a9d2957a4bbdbd809d4e98bb78d8b6d99ceb5a965dfc1afe6c5e52f8
MD5 27b39c3d5734c38a73cd128985961d99
SHA1 db1bae0179194f9e1f101da9b85c9963cead31c9
SHA512 249a84f43592e5ab63e340c4e45a4306dcaa8c6d287627ac87b852d9503c81754a6fd8373afbbc50cb4d3eeac47b1e276b38e65274d6fa71f09d4792685d7bea
SSDEEP 3072:rt5PzJJg+/OOPeehiXWm4R9nReAHYwXdFB7QG8kIiTNmhfex3U4AytwRWvGm+op:rt5PzJOA/eehgWmUnR5db7QGw8Nmh2xl
TLSH
T1D50412F13A37F978D8420EB00B1E84BC86217DC3C5852333B79CBA6179D96A1B6152AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5992-853-0x00007FFA99250000-0x00007FFA9926C000-memory.dmp

Download

memory/5992-831-0x00007FFAA7EC0000-0x00007FFAA7ECB000-memory.dmp

Download

memory/5992-767-0x00007FFAAE7F0000-0x00007FFAAE826000-memory.dmp

Download

memory/5992-769-0x00007FFAAE7D0000-0x00007FFAAE7E9000-memory.dmp

Download

memory/5992-771-0x00007FFAAEF90000-0x00007FFAAEF9D000-memory.dmp

Download

memory/5992-780-0x00007FFA95D30000-0x00007FFA96319000-memory.dmp

Download

memory/5992-784-0x00007FFAAE880000-0x00007FFAAE8A3000-memory.dmp

Download

memory/5992-787-0x00007FFAACB60000-0x00007FFAACB93000-memory.dmp

Download

memory/5992-791-0x00007FFAA0D90000-0x00007FFAA0E5D000-memory.dmp

Download

memory/5992-792-0x00007FFA95800000-0x00007FFA95D22000-memory.dmp

Download

memory/5992-793-0x000001E5E0760000-0x000001E5E0C82000-memory.dmp

Download

memory/5992-796-0x00007FFAAA420000-0x00007FFAAA435000-memory.dmp

Download

memory/5992-798-0x00007FFAA91F0000-0x00007FFAA9202000-memory.dmp

Download

memory/5992-795-0x00007FFAAE7D0000-0x00007FFAAE7E9000-memory.dmp

Download

memory/5992-785-0x00007FFAACBA0000-0x00007FFAACBCB000-memory.dmp

Download

memory/5992-801-0x00007FFAA0D00000-0x00007FFAA0D87000-memory.dmp

Download

memory/5992-803-0x00007FFAACCA0000-0x00007FFAACCCE000-memory.dmp

Download

memory/5992-781-0x00007FFAACBD0000-0x00007FFAACC8C000-memory.dmp

Download

memory/5992-774-0x00007FFAACCD0000-0x00007FFAACCDD000-memory.dmp

Download

memory/5992-813-0x00007FFAA8D20000-0x00007FFAA8D46000-memory.dmp

Download

memory/5992-812-0x00007FFAA0BE0000-0x00007FFAA0CFC000-memory.dmp

Download

memory/5992-811-0x00007FFAACB50000-0x00007FFAACB5B000-memory.dmp

Download

memory/5992-810-0x00007FFAACBD0000-0x00007FFAACC8C000-memory.dmp

Download

memory/5992-804-0x00007FFAA8F80000-0x00007FFAA8F94000-memory.dmp

Download

memory/5992-776-0x00007FFAACCA0000-0x00007FFAACCCE000-memory.dmp

Download

memory/5992-744-0x00007FFAAE860000-0x00007FFAAE879000-memory.dmp

Download

memory/5992-819-0x00007FFAA8D00000-0x00007FFAA8D18000-memory.dmp

Download

memory/5992-818-0x00007FFAACB60000-0x00007FFAACB93000-memory.dmp

Download

memory/5992-822-0x000001E5E0760000-0x000001E5E0C82000-memory.dmp

Download

memory/5992-820-0x00007FFAA0D90000-0x00007FFAA0E5D000-memory.dmp

Download

memory/5992-823-0x00007FFAA0BB0000-0x00007FFAA0BD3000-memory.dmp

Download

memory/5992-821-0x00007FFA95800000-0x00007FFA95D22000-memory.dmp

Download

memory/5992-824-0x00007FFA99270000-0x00007FFA993E7000-memory.dmp

Download

memory/5992-825-0x00007FFA9D690000-0x00007FFA9D6C8000-memory.dmp

Download

memory/5992-827-0x00007FFAA9170000-0x00007FFAA917B000-memory.dmp

Download

memory/5992-828-0x00007FFAA8F70000-0x00007FFAA8F7B000-memory.dmp

Download

memory/5992-830-0x00007FFAA8CC0000-0x00007FFAA8CCC000-memory.dmp

Download

memory/5992-833-0x00007FFAA2DA0000-0x00007FFAA2DAC000-memory.dmp

Download

memory/5992-837-0x00007FFAA11E0000-0x00007FFAA11EC000-memory.dmp

Download

memory/5992-839-0x00007FFAA0100000-0x00007FFAA010C000-memory.dmp

Download

memory/5992-845-0x00007FFA9E8C0000-0x00007FFA9E8CB000-memory.dmp

Download

memory/5992-848-0x00007FFA9D290000-0x00007FFA9D29D000-memory.dmp

Download

memory/5992-851-0x00007FFA9C920000-0x00007FFA9C949000-memory.dmp

Download

memory/5992-740-0x00007FFAB0A80000-0x00007FFAB0A8F000-memory.dmp

Download

memory/5992-852-0x00007FFA9CC20000-0x00007FFA9CC2B000-memory.dmp

Download

memory/5992-850-0x00007FFA9D280000-0x00007FFA9D28C000-memory.dmp

Download

memory/5992-854-0x00007FFA95520000-0x00007FFA957FF000-memory.dmp

Download

memory/5992-849-0x00007FFA9CC30000-0x00007FFA9CC42000-memory.dmp

Download

memory/5992-847-0x00007FFA9E8A0000-0x00007FFA9E8AC000-memory.dmp

Download

memory/5992-846-0x00007FFA9E8B0000-0x00007FFA9E8BC000-memory.dmp

Download

memory/5992-844-0x00007FFA9EA70000-0x00007FFA9EA7B000-memory.dmp

Download

memory/5992-843-0x00007FFA9D690000-0x00007FFA9D6C8000-memory.dmp

Download

memory/5992-842-0x00007FFA9EB10000-0x00007FFA9EB1C000-memory.dmp

Download

memory/5992-841-0x00007FFA9F1E0000-0x00007FFA9F1EE000-memory.dmp

Download

memory/5992-855-0x00007FFA93420000-0x00007FFA95513000-memory.dmp

Download

memory/5992-840-0x00007FFA99270000-0x00007FFA993E7000-memory.dmp

Download

memory/5992-838-0x00007FFAA0BB0000-0x00007FFAA0BD3000-memory.dmp

Download

memory/5992-836-0x00007FFAA8D00000-0x00007FFAA8D18000-memory.dmp

Download

memory/5992-835-0x00007FFAA2D90000-0x00007FFAA2D9B000-memory.dmp

Download

memory/5992-834-0x00007FFAA8D20000-0x00007FFAA8D46000-memory.dmp

Download

memory/5992-832-0x00007FFAA0BE0000-0x00007FFAA0CFC000-memory.dmp

Download

memory/5992-765-0x00007FFAAE830000-0x00007FFAAE85D000-memory.dmp

Download

memory/5992-829-0x00007FFAA0D00000-0x00007FFAA0D87000-memory.dmp

Download

memory/5992-826-0x00007FFAAA420000-0x00007FFAAA435000-memory.dmp

Download

memory/5992-863-0x00007FFA973D0000-0x00007FFA973E9000-memory.dmp

Download

memory/5992-865-0x00007FFA97390000-0x00007FFA973A3000-memory.dmp

Download

memory/5992-867-0x00007FFA98E90000-0x00007FFA98EA7000-memory.dmp

Download

memory/5992-866-0x00007FFA93360000-0x00007FFA93414000-memory.dmp

Download

memory/5992-864-0x00007FFA973B0000-0x00007FFA973CD000-memory.dmp

Download

memory/5992-862-0x00007FFA973F0000-0x00007FFA9740A000-memory.dmp

Download

memory/5992-861-0x00007FFA97410000-0x00007FFA97457000-memory.dmp

Download

memory/5992-860-0x00007FFA977D0000-0x00007FFA97803000-memory.dmp

Download

memory/5992-859-0x00007FFA97810000-0x00007FFA97840000-memory.dmp

Download

memory/5992-858-0x00007FFA979A0000-0x00007FFA97A3C000-memory.dmp

Download

memory/5992-857-0x00007FFA98DB0000-0x00007FFA98DD2000-memory.dmp

Download

memory/5992-856-0x00007FFA98DE0000-0x00007FFA98E01000-memory.dmp

Download

memory/5992-738-0x00007FFAAE880000-0x00007FFAAE8A3000-memory.dmp

Download

memory/5992-729-0x00007FFA95D30000-0x00007FFA96319000-memory.dmp

Download

memory/5992-900-0x00007FFA9C920000-0x00007FFA9C949000-memory.dmp

Download

memory/5992-909-0x00007FFAACCD0000-0x00007FFAACCDD000-memory.dmp

Download

memory/5992-923-0x00007FFAA8D00000-0x00007FFAA8D18000-memory.dmp

Download

memory/5992-913-0x00007FFAACB60000-0x00007FFAACB93000-memory.dmp

Download

memory/5992-901-0x00007FFA95D30000-0x00007FFA96319000-memory.dmp

Download

memory/5992-902-0x00007FFAAE880000-0x00007FFAAE8A3000-memory.dmp

Download

memory/5992-931-0x00007FFAB0A80000-0x00007FFAB0A8F000-memory.dmp

Download

memory/5992-929-0x00007FFA95D30000-0x00007FFA96319000-memory.dmp

Download

memory/5992-941-0x00007FFAACB60000-0x00007FFAACB93000-memory.dmp

Download

memory/5992-946-0x00007FFAA0D00000-0x00007FFAA0D87000-memory.dmp

Download

memory/5992-951-0x00007FFAA8D00000-0x00007FFAA8D18000-memory.dmp

Download

memory/5992-950-0x00007FFAA0BE0000-0x00007FFAA0CFC000-memory.dmp

Download

memory/5992-949-0x00007FFAA8D20000-0x00007FFAA8D46000-memory.dmp

Download

memory/5992-948-0x00007FFAACB50000-0x00007FFAACB5B000-memory.dmp

Download

memory/5992-962-0x00007FFA98DB0000-0x00007FFA98DD2000-memory.dmp

Download

memory/5992-968-0x00007FFA973D0000-0x00007FFA973E9000-memory.dmp

Download

memory/5992-967-0x00007FFA973F0000-0x00007FFA9740A000-memory.dmp

Download

memory/5992-966-0x00007FFA97410000-0x00007FFA97457000-memory.dmp

Download

memory/5992-965-0x00007FFA977D0000-0x00007FFA97803000-memory.dmp

Download

memory/5992-964-0x00007FFA97810000-0x00007FFA97840000-memory.dmp

Download

memory/5992-963-0x00007FFA979A0000-0x00007FFA97A3C000-memory.dmp

Download

memory/5992-961-0x00007FFA98DE0000-0x00007FFA98E01000-memory.dmp

Download

memory/5992-960-0x00007FFA98E90000-0x00007FFA98EA7000-memory.dmp

Download

memory/5992-959-0x00007FFA95520000-0x00007FFA957FF000-memory.dmp

Download

memory/5992-958-0x00007FFA99250000-0x00007FFA9926C000-memory.dmp

Download

memory/5992-957-0x00007FFA9CC20000-0x00007FFA9CC2B000-memory.dmp

Download

memory/5992-956-0x00007FFA9C920000-0x00007FFA9C949000-memory.dmp

Download

memory/5992-955-0x00007FFA99270000-0x00007FFA993E7000-memory.dmp

Download

memory/5992-954-0x00007FFA9D690000-0x00007FFA9D6C8000-memory.dmp

Download

memory/5992-953-0x00007FFAA0BB0000-0x00007FFAA0BD3000-memory.dmp

Download

memory/5992-952-0x000001E5E0760000-0x000001E5E0C82000-memory.dmp

Download

memory/5992-947-0x00007FFAA8F80000-0x00007FFAA8F94000-memory.dmp

Download

memory/5992-943-0x00007FFA95800000-0x00007FFA95D22000-memory.dmp

Download

memory/5992-945-0x00007FFAA91F0000-0x00007FFAA9202000-memory.dmp

Download

memory/5992-942-0x00007FFAA0D90000-0x00007FFAA0E5D000-memory.dmp

Download

memory/5992-939-0x00007FFAACBD0000-0x00007FFAACC8C000-memory.dmp

Download

memory/5992-944-0x00007FFAAA420000-0x00007FFAAA435000-memory.dmp

Download

memory/5992-940-0x00007FFAACBA0000-0x00007FFAACBCB000-memory.dmp

Download

memory/5992-938-0x00007FFAACCA0000-0x00007FFAACCCE000-memory.dmp

Download

memory/5992-937-0x00007FFAACCD0000-0x00007FFAACCDD000-memory.dmp

Download

memory/5992-936-0x00007FFAAEF90000-0x00007FFAAEF9D000-memory.dmp

Download

memory/5992-935-0x00007FFAAE7D0000-0x00007FFAAE7E9000-memory.dmp

Download

memory/5992-934-0x00007FFAAE7F0000-0x00007FFAAE826000-memory.dmp

Download

memory/5992-932-0x00007FFAAE860000-0x00007FFAAE879000-memory.dmp

Download

memory/5992-930-0x00007FFAAE880000-0x00007FFAAE8A3000-memory.dmp

Download

memory/5992-933-0x00007FFAAE830000-0x00007FFAAE85D000-memory.dmp

Download