luna_stealer | ed5e1abc95aabfc7ac5647c134288c7e653208add0d394c1f65024dcb574ab80

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 15.2MB
Sample261024-vc6fqacy4m
SHA256 ed5e1abc95aabfc7ac5647c134288c7e653208add0d394c1f65024dcb574ab80
MD5 35f6152b0b6ee30a82df445f75dfa7d6
SHA1 fac1416a256eeb37e7bc71d67c0438668099211b
SHA512 f30ba2ea74a9ed5f7369e014eeeaef343c00b0603a8be83d7935ab0272d77a56709d43e8687ec363738983c72de81d6a35afb65e6ea3b94f939828cd3193c7dc
SSDEEP 393216:2/tnnx8fMBockTgIp1durEUWj77xQYvYQonIKA:qtnxsc3Ip7dbXxknIR
TLSH
T128F633C657AC44E0E5E6123EA5AB8050AAF3FCAAA394D7DF07F426442F036D18C35F65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution luna_stealer spyware stealer upx

Malware Config

Signatures

Family: LunaStealer
LunaStealer is an infostealer written in Python and packaged with Pyinstaller.
stealer luna_stealer

Loads dropped DLL 30 IoCs

pid	Process
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
3	api.ipify.org

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c601-87.dat	upx
behavioral2/memory/5252-91-0x00007FFB3E090000-0x00007FFB3E755000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d8-96.dat	upx
behavioral2/memory/5252-101-0x00007FFB56900000-0x00007FFB5690F000-memory.dmp	upx
behavioral2/files/0x000c00000001c5fb-100.dat	upx
behavioral2/memory/5252-104-0x00007FFB550B0000-0x00007FFB550CA000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d6-103.dat	upx
behavioral2/memory/5252-107-0x00007FFB55080000-0x00007FFB550AD000-memory.dmp	upx
behavioral2/files/0x000c00000001c5de-108.dat	upx
behavioral2/files/0x000c00000001c5da-116.dat	upx
behavioral2/memory/5252-119-0x00007FFB54FC0000-0x00007FFB54FD4000-memory.dmp	upx
behavioral2/files/0x000c00000001c5fa-118.dat	upx
behavioral2/memory/5252-113-0x00007FFB55060000-0x00007FFB5506D000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e3-112.dat	upx
behavioral2/memory/5252-110-0x00007FFB55070000-0x00007FFB5507D000-memory.dmp	upx
behavioral2/memory/5252-121-0x00007FFB3DB60000-0x00007FFB3E089000-memory.dmp	upx
behavioral2/files/0x000c00000001c5df-122.dat	upx
behavioral2/files/0x000c00000001c605-124.dat	upx
behavioral2/files/0x000c00000001c5e1-127.dat	upx
behavioral2/memory/5252-135-0x00007FFB550D0000-0x00007FFB550F5000-memory.dmp	upx
behavioral2/memory/5252-133-0x00007FFB49490000-0x00007FFB4955D000-memory.dmp	upx
behavioral2/memory/5252-131-0x00007FFB3E090000-0x00007FFB3E755000-memory.dmp	upx
behavioral2/memory/5252-134-0x00007FFB50D70000-0x00007FFB50DA3000-memory.dmp	upx
behavioral2/memory/5252-132-0x00007FFB51FA0000-0x00007FFB51FAD000-memory.dmp	upx
behavioral2/files/0x000c00000001c5fc-130.dat	upx
behavioral2/memory/5252-140-0x00007FFB50D40000-0x00007FFB50D64000-memory.dmp	upx
behavioral2/memory/5252-143-0x00007FFB420E0000-0x00007FFB4225E000-memory.dmp	upx
behavioral2/files/0x000c00000001c5fe-144.dat	upx
behavioral2/files/0x000c00000001c60d-147.dat	upx
behavioral2/memory/5252-149-0x00007FFB41150000-0x00007FFB4126B000-memory.dmp	upx
behavioral2/memory/5252-146-0x00007FFB4FDA0000-0x00007FFB4FDB8000-memory.dmp	upx
behavioral2/memory/5252-142-0x00007FFB550B0000-0x00007FFB550CA000-memory.dmp	upx
behavioral2/files/0x000c00000001c60c-141.dat	upx
behavioral2/memory/5252-153-0x00007FFB49A50000-0x00007FFB49A86000-memory.dmp	upx
behavioral2/files/0x000c00000001c59f-157.dat	upx
behavioral2/files/0x000c00000001c5ce-162.dat	upx
behavioral2/memory/5252-166-0x00007FFB3D670000-0x00007FFB3D8F3000-memory.dmp	upx
behavioral2/memory/5252-176-0x00007FFB493D0000-0x00007FFB493FF000-memory.dmp	upx
behavioral2/memory/5252-175-0x00007FFB50D70000-0x00007FFB50DA3000-memory.dmp	upx
behavioral2/files/0x000c00000001c604-174.dat	upx
behavioral2/memory/5252-173-0x00007FFB49400000-0x00007FFB4942A000-memory.dmp	upx
behavioral2/memory/5252-172-0x00007FFB49490000-0x00007FFB4955D000-memory.dmp	upx
behavioral2/files/0x000c00000001c60f-170.dat	upx
behavioral2/memory/5252-163-0x00007FFB3DB60000-0x00007FFB3E089000-memory.dmp	upx
behavioral2/memory/5252-164-0x00007FFB50A20000-0x00007FFB50A2C000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a0-161.dat	upx
behavioral2/memory/5252-158-0x00007FFB54FC0000-0x00007FFB54FD4000-memory.dmp	upx
behavioral2/memory/5252-159-0x00007FFB4FD80000-0x00007FFB4FD91000-memory.dmp	upx
behavioral2/memory/5252-152-0x00007FFB55060000-0x00007FFB5506D000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d7-151.dat	upx
behavioral2/files/0x000c00000001c5e0-138.dat	upx
behavioral2/memory/5252-125-0x00007FFB54FA0000-0x00007FFB54FB9000-memory.dmp	upx
behavioral2/files/0x000c00000001c5db-106.dat	upx
behavioral2/memory/5252-99-0x00007FFB550D0000-0x00007FFB550F5000-memory.dmp	upx
behavioral2/memory/5252-188-0x00007FFB50D40000-0x00007FFB50D64000-memory.dmp	upx
behavioral2/memory/5252-190-0x00007FFB420E0000-0x00007FFB4225E000-memory.dmp	upx
behavioral2/memory/5252-191-0x00007FFB4FDA0000-0x00007FFB4FDB8000-memory.dmp	upx
behavioral2/memory/5252-192-0x00007FFB41150000-0x00007FFB4126B000-memory.dmp	upx
behavioral2/memory/5252-196-0x00007FFB4FC40000-0x00007FFB4FC4F000-memory.dmp	upx
behavioral2/memory/5252-195-0x00007FFB49A50000-0x00007FFB49A86000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d0-194.dat	upx
behavioral2/memory/5252-199-0x00007FFB4FD80000-0x00007FFB4FD91000-memory.dmp	upx
behavioral2/memory/5252-202-0x00007FFB56900000-0x00007FFB5690F000-memory.dmp	upx
behavioral2/memory/5252-200-0x00007FFB3E090000-0x00007FFB3E755000-memory.dmp	upx

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
4668	WMIC.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1164	cmd.exe
3248	cmd.exe
1888	cmd.exe
3188	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2156	WMIC.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3692	WMIC.exe
3692	WMIC.exe
3692	WMIC.exe
3692	WMIC.exe
2880	wmic.exe
2880	wmic.exe
2880	wmic.exe
2880	wmic.exe
2156	WMIC.exe
2156	WMIC.exe
2156	WMIC.exe
2156	WMIC.exe
4372	WMIC.exe
4372	WMIC.exe
4372	WMIC.exe
4372	WMIC.exe
4668	WMIC.exe
4668	WMIC.exe
4668	WMIC.exe
4668	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeIncreaseQuotaPrivilege	3692	WMIC.exe
Token: SeSecurityPrivilege	3692	WMIC.exe
Token: SeTakeOwnershipPrivilege	3692	WMIC.exe
Token: SeLoadDriverPrivilege	3692	WMIC.exe
Token: SeSystemProfilePrivilege	3692	WMIC.exe
Token: SeSystemtimePrivilege	3692	WMIC.exe
Token: SeProfSingleProcessPrivilege	3692	WMIC.exe
Token: SeIncBasePriorityPrivilege	3692	WMIC.exe
Token: SeCreatePagefilePrivilege	3692	WMIC.exe
Token: SeBackupPrivilege	3692	WMIC.exe
Token: SeRestorePrivilege	3692	WMIC.exe
Token: SeShutdownPrivilege	3692	WMIC.exe
Token: SeDebugPrivilege	3692	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3692	WMIC.exe
Token: SeRemoteShutdownPrivilege	3692	WMIC.exe
Token: SeUndockPrivilege	3692	WMIC.exe
Token: SeManageVolumePrivilege	3692	WMIC.exe
Token: 33	3692	WMIC.exe
Token: 34	3692	WMIC.exe
Token: 35	3692	WMIC.exe
Token: 36	3692	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3692	WMIC.exe
Token: SeSecurityPrivilege	3692	WMIC.exe
Token: SeTakeOwnershipPrivilege	3692	WMIC.exe
Token: SeLoadDriverPrivilege	3692	WMIC.exe
Token: SeSystemProfilePrivilege	3692	WMIC.exe
Token: SeSystemtimePrivilege	3692	WMIC.exe
Token: SeProfSingleProcessPrivilege	3692	WMIC.exe
Token: SeIncBasePriorityPrivilege	3692	WMIC.exe
Token: SeCreatePagefilePrivilege	3692	WMIC.exe
Token: SeBackupPrivilege	3692	WMIC.exe
Token: SeRestorePrivilege	3692	WMIC.exe
Token: SeShutdownPrivilege	3692	WMIC.exe
Token: SeDebugPrivilege	3692	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3692	WMIC.exe
Token: SeRemoteShutdownPrivilege	3692	WMIC.exe
Token: SeUndockPrivilege	3692	WMIC.exe
Token: SeManageVolumePrivilege	3692	WMIC.exe
Token: 33	3692	WMIC.exe
Token: 34	3692	WMIC.exe
Token: 35	3692	WMIC.exe
Token: 36	3692	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2880	wmic.exe
Token: SeSecurityPrivilege	2880	wmic.exe
Token: SeTakeOwnershipPrivilege	2880	wmic.exe
Token: SeLoadDriverPrivilege	2880	wmic.exe
Token: SeSystemProfilePrivilege	2880	wmic.exe
Token: SeSystemtimePrivilege	2880	wmic.exe
Token: SeProfSingleProcessPrivilege	2880	wmic.exe
Token: SeIncBasePriorityPrivilege	2880	wmic.exe
Token: SeCreatePagefilePrivilege	2880	wmic.exe
Token: SeBackupPrivilege	2880	wmic.exe
Token: SeRestorePrivilege	2880	wmic.exe
Token: SeShutdownPrivilege	2880	wmic.exe
Token: SeDebugPrivilege	2880	wmic.exe
Token: SeSystemEnvironmentPrivilege	2880	wmic.exe
Token: SeRemoteShutdownPrivilege	2880	wmic.exe
Token: SeUndockPrivilege	2880	wmic.exe
Token: SeManageVolumePrivilege	2880	wmic.exe
Token: 33	2880	wmic.exe
Token: 34	2880	wmic.exe
Token: 35	2880	wmic.exe
Token: 36	2880	wmic.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 5252	4512	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 5252 wrote to memory of 1164	5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 1164 wrote to memory of 3692	1164	cmd.exe	93
PID 5252 wrote to memory of 2880	5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 5252 wrote to memory of 3248	5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	96
PID 3248 wrote to memory of 2156	3248	cmd.exe	98
PID 5252 wrote to memory of 1888	5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	99
PID 1888 wrote to memory of 4372	1888	cmd.exe	101
PID 5252 wrote to memory of 3188	5252	2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	102
PID 3188 wrote to memory of 4668	3188	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_35f6152b0b6ee30a82df445f75dfa7d6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3692
- - C:\Windows\System32\Wbem\wmic.exe
    wmic cpu get Name
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:2156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Windows\System32\wbem\WMIC.exe
      C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\Cryptodome\Cipher\_raw_aes.pyd
Size 18KB
SHA256 e8b0081df2c1a1a2643c6e2766a095e2cee1673c0d2fdb1b5d01dabea341b9bc
MD5 535fae9550427c65055d3219d8b59900
SHA1 7eb8477df0167e3517237943b8838a153f2d3b09
SHA512 8fb21ca9fc5cafde64daa8a242370c4d6c77eaf089bfa0b031a3c157b990f1623e7cfcdc6adf0ef1dc88686be08daff3a58ab4ecff6a2b902aa2a78c21f9c417
SSDEEP 384:KlY0iKYmWedZQnCb5g0Fp9MzVECN7r4FZa7gJX2:KlYAtcCb5FMz2CNapG
TLSH
T10082C0E6F2B9D2F9C2E6CC7212A2CA547711BB077552233F05E1207EADB6B603D31990
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\Cryptodome\Cipher\_raw_aesni.pyd
Size 11KB
SHA256 fd951f06444092851e81a1f0e9df48988addcc0542176af00c1605749c71fed2
MD5 aa3f4c94111ac48e0ece83bbf88ef15e
SHA1 d4fb9e075ceb7a4ffabec4cac552ff23449064bb
SHA512 c0c051379b8851d508d65b017bb4919fdf548ea2ae8504dfe816aab59ff3b4ee376e75775b1e6bfacf22fefed7ad3ba2fc082e5b47cc4fa7726587709976c5c5
SSDEEP 192:e5ud0CrWWuE8EXdrArlnNNVvUSyZM4feDHckkYj273QJXlEnP:erEuEnX+RXVvD4ockZa7gJX6
TLSH
T1CF328EEB822FA6FCC551847306578C94E7717427252A6B1F08D826FE0CF73A06A34B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\Cryptodome\Util\_cpuid_c.pyd
Size 10KB
SHA256 8b3df53a5e7b9ca0c20db71cac696a0473c297bbead93ef7ea3bddf6f74d6aef
MD5 1d7a2919baf588597ea324c76f2d39b8
SHA1 09242ce6a8be6c3e764d651ad30bf96d0ae61472
SHA512 9b37e0260acfebc816a772379a82d7e159abba2ce8b39d5653985ed5f52563b891b2431853851b2f5a5959c57146184cea9bd365299be1d9479f5cc5583d886c
SSDEEP 192:MnZluowiOQNS/1F6i8mXIIFLgSWigeAR:2ubiOTD/XIIF8SWqA
TLSH
T10E22070CFE6249EAD96581B8C4674E4AB17ABB101723B38F0330662F1EE67C76126B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\PIL\_imaging.cp312-win_amd64.pyd
Size 772KB
SHA256 5607153f3bee4d7d4d592bf404ec025240b39d7dc71e337d7f73fdf0bd4ab26f
MD5 6fb2f0ee5f19602c0bcb6e51a6ba5ae9
SHA1 bd8a093cfb421840f5890bad137a88788ad60fbf
SHA512 0def2ba4bbd9b732d5b1db65e3551932fa5d46697bbaeb81ec8b9ce5622428bb9466672ac99bba2e19a5c435d61155a126db8ed880d9602d7dc1d803f6642bc7
SSDEEP 12288:+ZNUbysK4fgwDu0D77+eojwJNxYDdterqK9Zgcg66tLGaQ/aIG4Or0PDfd:SKbySjDuov+HMSthK9icglfQ/aIGzmT
TLSH
T166F433F2A22569B2C0FBF7F108D6FE44C870EDD1C7A69DB305F1685D8D5A94046873A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imagingmath.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\PIL\_imagingmath.cp312-win_amd64.pyd
Size 12KB
SHA256 db5d09ad62c3937d9922069ec2b930c388f3f48f16ab490dab1fcf79a4ba7198
MD5 0eb173a04abd50a4c73c696fa01b3ab5
SHA1 edd6d13f50541e8225da9719626a3513fa44681c
SHA512 55ee40b8cbba142210947cede31db26c35355248488cfb4b257385a7545676f8b061ebcdf74ea8e993d09cc5b7e7487f09dc5ab81a0f62bad837ef9b59a4c048
SSDEEP 192:WPrW+LhFt3rmFE7AP4Gbty4mNfPEgFJ/QSsbIkjkYj273QJX3Hc6GPPs:WPdNu8wVty4mNf8gtsxjZa7gJXlGP
TLSH
T162427DF3567AE0FCC135497540934ED4F3247C77220A433F85A53ABF9CAA724A9B1AA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\VCRUNTIME140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
TLSH
T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_bz2.pyd
Size 48KB
SHA256 ac8a3e0fdd19a2bdc0e6476cb0534be35d7abca191e53fb0a8e2f3874808f3e2
MD5 2b55e990209afa5e0dd33e195789b6d8
SHA1 506e5716be38511bd4aae2798b579b03d985db29
SHA512 9d294fa8b6835ad05a1684cc86c2e385811b6f79cdff60777b62598b5dee1cedecc242beb9035e723af0d6384c82afbc644c6038ecc9e2e63f703e85536ed57c
SSDEEP 768:BXjTDOU1Mkw8KBJ7QlIRZcz63VPzH8y5GNexMpO/IjCVD0P5YiSyvEAMxkE4s:pnO7kwXBJ78OZENkB/IjCVDc7SyqxJ
TLSH
T13F23CFA396B86D54CC375E7238C0CD29EE3179979454C397310CC26A9FB2383AA935B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_cffi_backend.cp312-win_amd64.pyd
Size 71KB
SHA256 b330ca45e204f03c0b6dc5ff18c168271c56bac4387a00e304fbb5827ab14e33
MD5 96ef1bb7f6933cc901e68b5a4cca837f
SHA1 fcccc4e76775784d8614ad2077492937f4a0074a
SHA512 9599bddedf042425c8d9e31df33f9f9f52bc09c7178ac7de0993b1babfdb91d41cb497eb9df601de32a30547e268513ba6fd00f271e2520fcfd4cc3f84f1c6ef
SSDEEP 1536:OnjntDM+CRwQ3WZivX41Ct2VPEjbQ+/NA+Gpop2R6ywvqL:irtgRTGl1g9jbQ+UXN1
TLSH
T1CC6302C32B68BE7DD3740FB6149B4148EA726E6D2461B70B036A34FF092F9F245559B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_ctypes.pyd
Size 59KB
SHA256 1467a310d06354697be7fece65b7f19ec1f05f8ee2f238a8105711f2370045be
MD5 a9b7e4d7341eb33a6c5f3fb22389906e
SHA1 6572e53ddf43e8aef2fef1657eb0fe79812ae34f
SHA512 7cc3dc9ec9e55984ee62e9af873cb71f16cbb475c163672f2a6b5df8f109a2ca722c7f87e2adaccd116063ff518b0f91ea42ca8f51795a349e0272dd09a48a77
SSDEEP 1536:WQm2JyhT7X84MYNbLlJRiQFM+pIWHIjLPj+7SyANx4:WQ9JyhT7nHnjFXeiIjLPj+6U
TLSH
T11B53E1A384B9BC15CD279D7232E54B21FE31795B4711C3EB211CE2358FB1702AAA6379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_hashlib.pyd
Size 35KB
SHA256 735fb40bfbfb1669d2200491918c14d03698d2deaf7701bf039d349c4f01c53d
MD5 f7d4a7ad7dab94f0e5135b7cf9ee630d
SHA1 038553d8f48015aa0cfcec57a9922f6c7ea2d0d2
SHA512 eeb93c493ac1b654920de727e42415b192c0edbdc38b3a8da2e6016ad083343abcfdc501cf18febccaa07ac8b18fcc0c8e9a668bb318ce7f28dee66031bd8985
SSDEEP 768:t665W8yKNUYvmiOhWzYda7jeWMl9pcgvIjOIOL5YiSyveAMxkEQ:UXg6iLYosugvIjOIO17Sy0xs
TLSH
T1D2F2CFE34AB8885CCD76CDB238C94858FF7139578540C3D7218E92BA8FB1741AF66276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_lzma.pyd
Size 86KB
SHA256 e46149d520e4bfa1d0f4ef6c29889d41e8ffdd6e297c0a9bde529cccc833fced
MD5 08eba043ec6a63678739f4cf360aa74d
SHA1 81c832097bb2f1a2455c95ca7bb6739d3e2bbab5
SHA512 0ca2471e2932c4b5b0ef935ecb0a42310002a59fb13d3f4c7dfb8ddc8595eff2409cf600cf5d22ab057e224c31aca44c83f04b9a170536accec30579b6ccb48b
SSDEEP 1536:A33ep7MJoKbCKmzzYu0RgKYtpreDVERxzTykTwTGcIjZ14S7SyWxq:UeRgFWKNZRZCeDVEz81IjZ14Sv
TLSH
T11F83F15B53B06D14C416DEB338C97818FE317F938B718FA7621DE19AABE17413A92234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_queue.pyd
Size 26KB
SHA256 38d2f0a922a86337ae79dd0faa234a891d2881700d4d74346c3ccdf415ccfe46
MD5 99df7fead561d2f2937d7de84a936ae7
SHA1 d577348136868b75a3b02f7e1b1889f5dca2299e
SHA512 ee10ff5b4844d81e221f586af988e8b58587c5dee29296b0d5d6205b3b77bb6040ec5a92f40597716376ba45f4732445dfb26812e702d89d1b5e214fd3515fb4
SSDEEP 384:W6I92F0lWEJlgaSrBdgZc8PI8rZa7gJXi+IjQUONSHQIYiSy1pCQy1SAM+o/8E9o:ZAvSrBFgpS+IjQUOG5YiSyvwSAMxkEBo
TLSH
T190C2AEB386B49C68CD238DB134D44D29FE3179934A50C3D7325892AA8F71381ABE53B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_socket.pyd
Size 44KB
SHA256 ec088b838dfdb2be18d01f6b5e87974a95d595a5368133600ba2b9e05ee74d81
MD5 f16ab7239e26914a965e3e5436dd5443
SHA1 e50d9d42cd58031b8cf9ed737b3464df480e8097
SHA512 e44fc953ecc08bb61417395509682b0fa2d6ef12765b101acaa923a1baebaf62c16923f7ecba82c37632f1d7355c3b2a268edaaa80454fbb858136de3890c275
SSDEEP 768:G3lDDHqvff0W1WMxvs0xeAlFWJpQT0IjLwDBR5YiSyvyAMxkEo:G3lDKfns0P9T0IjLwDBf7Sy4xU
TLSH
T16713D0B24678AC24C962AD3130D4A614FE35B6979490C7E331CCD1998FB47427EA73B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_sqlite3.pyd
Size 57KB
SHA256 d3857446c1b64f5669c2ef1a13093cba4e90e79743710af9ab00f194a15d70b2
MD5 c703bfce0caa83cc6e06044e0ae5e799
SHA1 7675eb7c065aa31426a9f1116a998db6f399c681
SHA512 37c548a0117cfa1d5a8fada6d53b98a0f6ecc65acca5e5a2ed90dcd5ae91d009f616527a65fa3dab9bef38efc1f19e53f3f51dd525cabd3ba967fe5186d9f6c6
SSDEEP 1536:JXwJUS8MhCTn+6CEO3k/BSJIjOQzZ7SycxdN:J0UKDv3kqIjOQzZU
TLSH
T1CE43E19346B46C25ED67CDB232599A6AA631B6830661CBCA304D817F8F733423ED53F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_ssl.pyd
Size 65KB
SHA256 aefe7cc94f802cf6c4dea936322cb8785731d92ebb7c1f72d4a2a118a4bdc281
MD5 1768639bd4f7a43ecf3673b397646ef3
SHA1 e3513d983fd387de371a64829324e032ff7fcf5b
SHA512 9e186c90dfceb9866eca0acbd4de235d1ea799617a8751585eaf47795d9017408dc22e31cf4144b698cba27910dcfff2efb5377ceba28967146f3eac264e130c
SSDEEP 1536:gzWUwgWT4zVJqpgI36lYp3rf4prHoStjjdIjC7I9x7SytqxcV+9:89JUgC6lgrQvjxIjC7IzVVK
TLSH
T1EA63E1CBC7A57C15CD239CB024888E69B921B7579C5043DA21BD50BE0FB1BD22E677B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_uuid.pyd
Size 24KB
SHA256 d132f754471bd8a6f6d7816453c2e542f250a4d8089b657392fe61a500ae7899
MD5 353e11301ea38261e6b1cb261a81e0fe
SHA1 607c5ebe67e29eabc61978fb52e4ec23b9a3348e
SHA512 fa990b3e9619d59ae3ad0aeffca7a3513ab143bfd0ac9277e711519010f7c453258a4b041be86a275f3c365e980fc857c23563f3b393d1e3a223973a673e88c5
SSDEEP 384:7ZLWqLE/t8XkiQ19IjZwa3HQIYiSy1pCQrlUJkAM+o/8E9VF0NyMx:7fLa9X19IjZwi5YiSyvJUCAMxkEW
TLSH
T178B27D56DE605C11ED2B89B0A4E54E1AE935FB824B9083CB331CC1155F613C3BBFA3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\_wmi.pyd
Size 28KB
SHA256 f5d97c3d4819a114f44b280a0ea58e09fb3c91c950067ece092a24a48e3fe3cc
MD5 bfac86035aad2c3cf19189da71552a7a
SHA1 bc833397ba1f4dbae1e75a19c7cb139a85a813d0
SHA512 d64f0981ceecdf643db4266c2c546bf2c6d93982f81c28070e5560965efc2526d4f841a3abf9d9cdbdf25b49df94ce8f449cd6d57558234f59bb58f4045e14a4
SSDEEP 768:fI2ceLJ0ffpAEXIjCi+LT5YiSyv9AMxkEga+:fIHK0faEXIjCi+Ld7SyNxEa+
TLSH
T1B0D2BFD38624AC35CD178DB239D09839FE32BD47849186DB329CD1AA0F627436E92375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\base_library.zip
Size 1.3MB
SHA256 c404153c7a6612ba9073d194b7d87b079658fefbda5cd5177ad3acc9a224739e
MD5 d09329cbe3975d69a755cf2a19e7f596
SHA1 95682bb12f2cce812d8df0cf3d4e6731349141ea
SHA512 7ad97af0eb25c5fc3916713032af6c6ba64092450c14df6119bfdd411da38dba736c609e1014145c701df51ed6c8c1030220486eda9ae6538bbb81c360a41128
SSDEEP 12288:WgLtsFB1duj2OmE1paYcaOttcY+bZIqL3xHtk0YTq+zYgEkA1qJujdHKP7dmfp1j:/hsuKHSpaYcFttcY+T1i0DKP7dmR1j
TLSH
T1C055D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\certifi\cacert.pem
Size 233KB
SHA256 50f79f98dac192b20dbf73f35c56f0b0c557ab267ff5199d1117cc1180b70785
MD5 6b2f1080a479996e4ff66d25b3c69be2
SHA1 7c4b3adfa5875adb9bb1bf134a9cf3ae1ef873ab
SHA512 185367e8695658dcc7858234a20082322eb57d5eb1c2a05bd591162318749a8a201630f99c14a8c7ccd4b90ba6f572c3ffa4e655cff12cd08e8d503114863ddc
SSDEEP 6144:0pl6RrqADwYCuCFT/QRSRqNb7c4u59hrh:0L6RrHzRWav309f
TLSH
T11A347C954F2A9C092C9FE1C1CA9B2357DD3A027A99FEF0F139062408D24662B57FCD9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\libcrypto-3.dll
Size 1.6MB
SHA256 3fcf6956df6f5dc92b2519062b40475b94786184388540a0353f8a0868413648
MD5 e68a459f00b05b0bd7eafe3da4744aa9
SHA1 41565d2cc2daedd148eeae0c57acd385a6a74254
SHA512 6c4f3747af7be340a3db91e906b949684a39cafc07f42b9fcc27116f4f4bf405583fc0db3684312b277d000d8e6a566db2c43601fa2af499700319c660ef1108
SSDEEP 49152:A6H83HeiR86t/czBf6Y1z8kq5HaMpW/9nn3nL/obN1CPwDvt3uFlDCP:A6c3CFFz8BBpWtbU1CPwDvt3uFlDCP
TLSH
T1B075135121BFB90FF68995384F3588568A2A6736A35CEFF32DBD9D090C04E0E0A785DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\libffi-8.dll
Size 29KB
SHA256 a7ac89b42d203ad40bad636ad610cf9f6da02128e5a20b8b4420530a35a4fb29
MD5 bb1feaa818eba7757ada3d06f5c57557
SHA1 f2de5f06dc6884166de165d34ef2b029bb0acf8b
SHA512 95dd1f0c482b0b0190e561bc08fe58db39fd8bb879a2dec0cabd40d78773161eb76441a9b1230399e3add602685d0617c092fff8bf0ab6903b537a9382782a97
SSDEEP 768:Op/6aepjG56w24Up3p45YiSyvkIPxWEqG:MA154spK7SytPxF
TLSH
T18CD2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\libssl-3.dll
Size 222KB
SHA256 85dd8c17928e78c20cf915c1985659fe99088239793f2bd46acb31a3c344c559
MD5 9b8d3341e1866178f8cecf3d5a416ac8
SHA1 8f2725b78795237568905f1a9cd763a001826e86
SHA512 815abc0517f94982fc402480bba6e0749f44150765e7f8975e4fcbfce62c4a5ff741e39e462d66b64ba3b804bd5b7190b67fff037d11bb314c7d581cfa6097a8
SSDEEP 6144:pmlccqt6UmyaQeUV1BXKtS68fp2FagXlk2:s+t6Ce6XKtSHYomk2
TLSH
T1E82401D2751F682AC8239FBCDE7060EADB7CB7451780CA933B03D9557B98A0CA27D215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\psutil\_psutil_windows.pyd
Size 31KB
SHA256 571115cca942bc76010b379df5d28afcb0f0d0de65a3bac89a95c6a86838b983
MD5 d2ab09582b4c649abf814cdce5d34701
SHA1 b7a3ebd6ff94710cf527baf0bb920b42d4055649
SHA512 022ccaeb99dc08997d917f85c6bc3aefdad5074c995008942a2f35f46ba07d73bb5bc7bc971ec71cb0e60dcb096b2c990866fe29c57670d069e7bdc3b14f6172
SSDEEP 768:8vaDMlccGli4/1LnromOJjNOzhtPTXuwKuzpSp6:8vaQlmUQFnrobNEht6wDY
TLSH
T154E2CFDA347BC6BCCD9D92734188055DAFA43833965A4B1F10F130FB4CAA9B15D217E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\python3.dll
Size 66KB
SHA256 d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123
MD5 79b02450d6ca4852165036c8d4eaed1f
SHA1 ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4
SHA512 47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416
SSDEEP 768:dHmHXV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0y3:dHmHXDmF61JFn+/O4hIjL017Sy/bxe
TLSH
T1C3637052BB54F8A3DBFA69FC39D199CD542B12CC872584ECA57893D30E1A310A2E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\python312.dll
Size 1.7MB
SHA256 a1a83cb947e78e58338cf9757fd472f7daaea584cf3419393f50fa6baca0304f
MD5 cd6b7d36eeb1f8c09ee12f1d0bc02c3f
SHA1 9a0b340ed22bedbf041dcdac86dcf3d496269d96
SHA512 04dfc098920638ebe6147761d4eb8fd808f24fb0b7f6dc1f336696af8d5443d6a08be7b934f3d8fdda087e3717ecae2c97ee9db75f152230d7f863b1bf77f6b2
SSDEEP 49152:Ym7u77uID/cZXnJ4Ph3tLm82R8PeDCemJ:l7uJcZX6pumfJ
TLSH
T1FB8533F26C5D99E1EDF45AFA65C289036A5E1414803CC0EA2977F6C309D2F709D27BAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\pywin32_system32\pywintypes312.dll
Size 62KB
SHA256 77c6d74e3bc091f4f876736df5f7cb9d655993163ada8ee9cb95d433423d664e
MD5 fdfbe26ea79ceae4f3bc08d7828b6c98
SHA1 a44ffa796045464ebb48f703b8bc22e263ac3060
SHA512 8fb76d2edffa130fd86582545329c574a5dc6ff6c544cd8b91c71f3654520d4711f24d01feb93f0f68d5123ac1e72a6eb3ab10ddf7df2ea539b656a4a3ebef1e
SSDEEP 768:+hyOld6DdTJnwA9YNcXC9ubX+ICGBrFV4rx7HT0pqr542YhyEZOVP4alv1Rj01Yw:+h6fnT2cguT+V6rT4rJHTFr54Thy84q
TLSH
T13C538C526E17DC9FCA1BE3372C89442190C7A255474DFBE296D7C2E3E0EA3D22C2A517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\select.pyd
Size 25KB
SHA256 26795e47ba956aba6cf2ed85f0bed8cf702c6031fabaf1e9d398f18841370029
MD5 4bde24dc64f7aebce05b345cf9330768
SHA1 4c5be7cd3dd76613c20fb0301188a42072bc2022
SHA512 a0893e6506302128e5f15574ea5188450a8eafb08f729ce07f36dacf0f8c0fc389f55dc1c05d467afce23b6c295cd17d568b6ba0f615492b6893492fd339b565
SSDEEP 768:jW9SNyB153wXwCp5DlIjQGO/5YiSyv38aAMxkE7:Ra3aDlIjQGOx7Sy/8Yxn
TLSH
T1EAC29EF341645864CD378DB234C58968FE36B9579A10C3D7329CD2AA4F713826BA23B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\sqlite3.dll
Size 644KB
SHA256 61ebfdfdcc5a98641f609ec246a01547e24473fcfd3c788d8cb66e530daa96e5
MD5 3d32bfbf300ee22d3cc0d91cdf919034
SHA1 03f915c949aaf924fb4b3080a3ebce61e890a31e
SHA512 fe6e4907628152fd9375fba57e4e4846a3de351f51dd47e2a917d0b4987f710842634d214f8c042f07c5762d1348b3327ca8bc3ce373d24c14062d663a8a8466
SSDEEP 12288:lTdlyELYyNiFVhF+v4GTHxoyMnYllAuz1eRDRA8z7B/oe7zMdxsp2gB:lTdlyK5oFVDQ4GGYsaejd1/oeTp2gB
TLSH
T106E423E749BB48DCE1D20437EEEBA5F1A6E06D60FDE586564E5872003F122D28B7008F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\unicodedata.pyd
Size 295KB
SHA256 6e17dd270551560a65cfdba40d7822239331d09ff6c5e941b36a156bf7b5ee66
MD5 1285bd3ad81d714761779379b6d28d82
SHA1 7e49e60ace7db24230f9c00c45ea2923f07a92f8
SHA512 9d885928818af6b593280d4a594af5fd6fe98617dfb995d457b234d343960230b31e63ded29a76e0b9b8fbcd327c9c4eb689ff79e5b383cbc30f6cd24ed81147
SSDEEP 6144:zI6xDUAPCa+tr3XyOu6sNq64AnCK+V3evv7J7usiUZonaJnZ54QZ:/DLB+tryJ6sI647m7Fu4oM4QZ
TLSH
T18D5423D53BD4E863E196CBF23D55462A8F3530876282228771ADC1588F6FBC25F630E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000011a02\win32\win32crypt.pyd
Size 52KB
SHA256 209484c0771dbdc0776e787605219ac42ca290c4a000572dfbafead0e621f479
MD5 51c9979d122018639396dc8d9d498975
SHA1 5906d4df89bffa48a27b6badd35aaa9cda691792
SHA512 c9ae568293a8dec180c5b593833473fd0c743c9a764023e2052374d65a91fe1662049b61d319838b1034ccb8a203d478ddafd219c6828920f6f9268313c21e8c
SSDEEP 1536:aI+ifHwgkXHDcyerxtKeis0Z5ELHfdgam:ZpfH6XHRuKeis0feWa
TLSH
T11233CF153D5B5EBED8D3F3B35C00184AE5927A0ED71A2F910482D35268EA6F10C6A57B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5252-173-0x00007FFB49400000-0x00007FFB4942A000-memory.dmp

Download

memory/5252-99-0x00007FFB550D0000-0x00007FFB550F5000-memory.dmp

Download

memory/5252-149-0x00007FFB41150000-0x00007FFB4126B000-memory.dmp

Download

memory/5252-146-0x00007FFB4FDA0000-0x00007FFB4FDB8000-memory.dmp

Download

memory/5252-142-0x00007FFB550B0000-0x00007FFB550CA000-memory.dmp

Download

memory/5252-140-0x00007FFB50D40000-0x00007FFB50D64000-memory.dmp

Download

memory/5252-153-0x00007FFB49A50000-0x00007FFB49A86000-memory.dmp

Download

memory/5252-132-0x00007FFB51FA0000-0x00007FFB51FAD000-memory.dmp

Download

memory/5252-134-0x00007FFB50D70000-0x00007FFB50DA3000-memory.dmp

Download

memory/5252-166-0x00007FFB3D670000-0x00007FFB3D8F3000-memory.dmp

Download

memory/5252-131-0x00007FFB3E090000-0x00007FFB3E755000-memory.dmp

Download

memory/5252-176-0x00007FFB493D0000-0x00007FFB493FF000-memory.dmp

Download

memory/5252-175-0x00007FFB50D70000-0x00007FFB50DA3000-memory.dmp

Download

memory/5252-133-0x00007FFB49490000-0x00007FFB4955D000-memory.dmp

Download

memory/5252-135-0x00007FFB550D0000-0x00007FFB550F5000-memory.dmp

Download

memory/5252-172-0x00007FFB49490000-0x00007FFB4955D000-memory.dmp

Download

memory/5252-121-0x00007FFB3DB60000-0x00007FFB3E089000-memory.dmp

Download

memory/5252-110-0x00007FFB55070000-0x00007FFB5507D000-memory.dmp

Download

memory/5252-163-0x00007FFB3DB60000-0x00007FFB3E089000-memory.dmp

Download

memory/5252-164-0x00007FFB50A20000-0x00007FFB50A2C000-memory.dmp

Download

memory/5252-113-0x00007FFB55060000-0x00007FFB5506D000-memory.dmp

Download

memory/5252-158-0x00007FFB54FC0000-0x00007FFB54FD4000-memory.dmp

Download

memory/5252-159-0x00007FFB4FD80000-0x00007FFB4FD91000-memory.dmp

Download

memory/5252-119-0x00007FFB54FC0000-0x00007FFB54FD4000-memory.dmp

Download

memory/5252-152-0x00007FFB55060000-0x00007FFB5506D000-memory.dmp

Download

memory/5252-107-0x00007FFB55080000-0x00007FFB550AD000-memory.dmp

Download

memory/5252-104-0x00007FFB550B0000-0x00007FFB550CA000-memory.dmp

Download

memory/5252-125-0x00007FFB54FA0000-0x00007FFB54FB9000-memory.dmp

Download

memory/5252-101-0x00007FFB56900000-0x00007FFB5690F000-memory.dmp

Download

memory/5252-143-0x00007FFB420E0000-0x00007FFB4225E000-memory.dmp

Download

memory/5252-188-0x00007FFB50D40000-0x00007FFB50D64000-memory.dmp

Download

memory/5252-190-0x00007FFB420E0000-0x00007FFB4225E000-memory.dmp

Download

memory/5252-191-0x00007FFB4FDA0000-0x00007FFB4FDB8000-memory.dmp

Download

memory/5252-192-0x00007FFB41150000-0x00007FFB4126B000-memory.dmp

Download

memory/5252-196-0x00007FFB4FC40000-0x00007FFB4FC4F000-memory.dmp

Download

memory/5252-195-0x00007FFB49A50000-0x00007FFB49A86000-memory.dmp

Download

memory/5252-91-0x00007FFB3E090000-0x00007FFB3E755000-memory.dmp

Download

memory/5252-199-0x00007FFB4FD80000-0x00007FFB4FD91000-memory.dmp

Download

memory/5252-202-0x00007FFB56900000-0x00007FFB5690F000-memory.dmp

Download

memory/5252-200-0x00007FFB3E090000-0x00007FFB3E755000-memory.dmp

Download

memory/5252-215-0x00007FFB4FDA0000-0x00007FFB4FDB8000-memory.dmp

Download

memory/5252-213-0x00007FFB50D40000-0x00007FFB50D64000-memory.dmp

Download

memory/5252-220-0x00007FFB493D0000-0x00007FFB493FF000-memory.dmp

Download

memory/5252-218-0x00007FFB3D670000-0x00007FFB3D8F3000-memory.dmp

Download

memory/5252-216-0x00007FFB41150000-0x00007FFB4126B000-memory.dmp

Download

memory/5252-219-0x00007FFB49400000-0x00007FFB4942A000-memory.dmp

Download

memory/5252-217-0x00007FFB49A50000-0x00007FFB49A86000-memory.dmp

Download

memory/5252-221-0x00007FFB4FC40000-0x00007FFB4FC4F000-memory.dmp

Download

memory/5252-214-0x00007FFB420E0000-0x00007FFB4225E000-memory.dmp

Download

memory/5252-212-0x00007FFB49490000-0x00007FFB4955D000-memory.dmp

Download

memory/5252-211-0x00007FFB50D70000-0x00007FFB50DA3000-memory.dmp

Download

memory/5252-210-0x00007FFB51FA0000-0x00007FFB51FAD000-memory.dmp

Download

memory/5252-208-0x00007FFB3DB60000-0x00007FFB3E089000-memory.dmp

Download

memory/5252-209-0x00007FFB54FA0000-0x00007FFB54FB9000-memory.dmp

Download

memory/5252-207-0x00007FFB54FC0000-0x00007FFB54FD4000-memory.dmp

Download

memory/5252-206-0x00007FFB55060000-0x00007FFB5506D000-memory.dmp

Download

memory/5252-205-0x00007FFB55070000-0x00007FFB5507D000-memory.dmp

Download

memory/5252-203-0x00007FFB550B0000-0x00007FFB550CA000-memory.dmp

Download

memory/5252-201-0x00007FFB550D0000-0x00007FFB550F5000-memory.dmp

Download

memory/5252-204-0x00007FFB55080000-0x00007FFB550AD000-memory.dmp

Download