Overview

overview

10

Static

static

10

x52be3ccd8...7e.exe

windows10-2004-x64

8

x52be3ccd8...7e.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 03:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    x52be3ccd8fa77713d6d907df9dd208e398931fa2d605745927a29bfcff46027e.exe
  • Size 28.6MB
  • Sample260602-d47dnac12w
  • SHA256 52be3ccd8fa77713d6d907df9dd208e398931fa2d605745927a29bfcff46027e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistenceupx

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Sets file to hidden 1 TTPs 1 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\x52be3ccd8fa77713d6d907df9dd208e398931fa2d605745927a29bfcff46027e.exe
    "C:\Users\Admin\AppData\Local\Temp\x52be3ccd8fa77713d6d907df9dd208e398931fa2d605745927a29bfcff46027e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Users\Admin\AppData\Local\Temp\x52be3ccd8fa77713d6d907df9dd208e398931fa2d605745927a29bfcff46027e.exe
      "C:\Users\Admin\AppData\Local\Temp\x52be3ccd8fa77713d6d907df9dd208e398931fa2d605745927a29bfcff46027e.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2104
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\svchosts\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1832
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\svchosts\activate.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4944
        • C:\Windows\system32\attrib.exe
          attrib +s +h .
          4⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:3500
        • C:\Users\Admin\svchosts\svchosts.exe
          "svchosts.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4696
          • C:\Users\Admin\svchosts\svchosts.exe
            "svchosts.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3816
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\svchosts\""
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4952
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im "x52be3ccd8fa77713d6d907df9dd208e398931fa2d605745927a29bfcff46027e.exe"
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4964
  • C:\Users\Admin\svchosts\svchosts.exe
    C:\Users\Admin\svchosts\svchosts.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Users\Admin\svchosts\svchosts.exe
      C:\Users\Admin\svchosts\svchosts.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3428
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\svchosts\""
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1976

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\_bz2.pyd
        • Size 49KB
        • SHA256 4ac45fbe735244d9679edf0de8a9062696ac85288d0b437f1f6263a0d951c609
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\_ctypes.pyd
        • Size 64KB
        • SHA256 60eeb3f71c10e65afa4b7ce37120268d7540d21fedceeb79b519435361349dcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\_lzma.pyd
        • Size 87KB
        • SHA256 a3ab65e12d4c4d8654c2e2f701e7dafd0d4f7437a10f4591867cfa3cc6f95c3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-console-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-console-l1-1-0.dll
        • Size 13KB
        • SHA256 e78c250bff3039b388ba9c45984348a446d6793e6aa475cfc6a7a9e87939acb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-datetime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-datetime-l1-1-0.dll
        • Size 13KB
        • SHA256 240197e7e0289be13d89d4cf2530cebce2e90f52624cf5f93943625e58549a4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-debug-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-debug-l1-1-0.dll
        • Size 13KB
        • SHA256 cd7eb8e4ae3a8c5d1b5275708562c95dddec7263165a25f07090042c96cb382c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-errorhandling-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 13KB
        • SHA256 56f4746a871dd2c769f58ad054e1151154277518b0b17114cb971acee74d50c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-file-l1-1-0.dll
        • Size 16KB
        • SHA256 64f1d6c77f27dbcc28552abeb62e6298c245c373175b5e71d548bdef8cfee1b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-file-l1-2-0.dll
        • Size 13KB
        • SHA256 02499e4bd6a06b6e209c129cefba7a97fb88a927ddd7f040a4c565a637117eec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l2-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-file-l2-1-0.dll
        • Size 13KB
        • SHA256 36b2f34e94c5b3e95119b9634e858850f7014a38900a0b21a07453a5c03ea438
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-handle-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-handle-l1-1-0.dll
        • Size 13KB
        • SHA256 33904e7ae40c46dc6169b8f9854a92918a0b2c8f10c6da6a363f8653b5ed3f0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-heap-l1-1-0.dll
        • Size 13KB
        • SHA256 7375121b6f907f4bc1f3aeeef36febd5a661fd6e838d296a478b0852c8bb0317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-interlocked-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 13KB
        • SHA256 461d567f6004afa6a731489a43d1c9ee805b5bb10e2abb7d5b4121b534f8530d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-libraryloader-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 14KB
        • SHA256 ec3197d9204796f2f5bd5a62b77634fd7a24d4264d13e71252f5610e29f71538
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-localization-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-localization-l1-2-0.dll
        • Size 15KB
        • SHA256 d779e62383d5042c499c7f4035ef0de6d8f50b6c0f05527f4c52e1ebe4eb7f8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-memory-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-memory-l1-1-0.dll
        • Size 13KB
        • SHA256 3b855fc804b1ceb37058b3a3e1060411fe23171dddddd5a4e1cb3a8690ffa873
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-namedpipe-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 13KB
        • SHA256 c052ce0e53457821cfdccc37e3e1db3b45c63e4bc3201ece0e5647d5852a9ba6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processenvironment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 14KB
        • SHA256 d04e5ad362d83972c493de84521518318d20423b90c71d24ec35131fdc30dc36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 15KB
        • SHA256 3cad78b16c07c4af5788575225e474b4ccda98bebef2cccfe3be47e62442221f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 13KB
        • SHA256 35b9a9ac8895c7848290fb57cb80dafacc95f509ed8e6b94a1fccacca54c45a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-profile-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-profile-l1-1-0.dll
        • Size 12KB
        • SHA256 97597d6aab443c91c4adbef88a0dd5ef5739dd6b0c9612f3f15942bf8581b890
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-rtlsupport-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 13KB
        • SHA256 148b935f19156b8aa91c5446d7d14a72ea43aaaf24f52c5b360a6171d640b2e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-string-l1-1-0.dll
        • Size 13KB
        • SHA256 42e1a5a86e8fe32283f8734fc5ad1e50d06a963ab9f94faa2f265f086b0b96fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-synch-l1-1-0.dll
        • Size 15KB
        • SHA256 e24dc1b2c20a17bae7251ae6e47d8a8467f4d4e50f0bd8406c34a231e301bd28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-synch-l1-2-0.dll
        • Size 13KB
        • SHA256 130e1dc0aec0dddc4cbceb552cd18fba1f9d4f24c8c5e46dc4dd5d95a616427a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-sysinfo-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 14KB
        • SHA256 39fcda8d91b38500473e7fa49322f75ba6c5a365f1ec43e12b719ad64e8041dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-timezone-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-timezone-l1-1-0.dll
        • Size 13KB
        • SHA256 e5c795f107901204d89bda66a4e5d0e1e52d4a61f7b98518728e08f26b536a9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-util-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-core-util-l1-1-0.dll
        • Size 13KB
        • SHA256 381f8bac21f436a480c3573cf23284b4a7283769ca5bfd369f7d6f83bf70428c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-conio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-crt-conio-l1-1-0.dll
        • Size 14KB
        • SHA256 4d41117dd8b2a3e06b78e38adc8f94ed1ce3c3758c3430a8e1b99d0f559e2228
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-convert-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-crt-convert-l1-1-0.dll
        • Size 17KB
        • SHA256 fc33e275363b71d1268cc93429f9455a8b74493b86f4e03a6b79aab0d5cd6c45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-environment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-crt-environment-l1-1-0.dll
        • Size 13KB
        • SHA256 3391fd0044e43361e2d150cbcde41449378a9542568d5a44fa241b835391e7af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-filesystem-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 15KB
        • SHA256 c17f4b5863988b9accff4551a94a9a3e43eb57c3a1dde0a0d602703a7d875946
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-crt-heap-l1-1-0.dll
        • Size 14KB
        • SHA256 e8765ad84f4de78430be562ae9b632623f5ff36606594ec564bd0b5ad205d610
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-locale-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-crt-locale-l1-1-0.dll
        • Size 13KB
        • SHA256 9dba66cb87f13d5000b699621109417d28d6a1b73e79443b6cbb0b0dd96a07b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-math-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-crt-math-l1-1-0.dll
        • Size 22KB
        • SHA256 d63a914d772276fd4f67db8c7145e72b7ad0d8dd213e67ed972a7b7f98bed919
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-process-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-crt-process-l1-1-0.dll
        • Size 14KB
        • SHA256 bcb1f15ae02e82b3c77139300f703e1bd7147253be278c4254fe0f8153d368f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-runtime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 17KB
        • SHA256 5bf4669d843b11e6a15b92b8096c996629ad70b55e769a50462827ae88ee41cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-stdio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 19KB
        • SHA256 a1581247130673bcf16b76a81ed9cf48b54446a19d606618d88e1e33d45ab205
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-crt-string-l1-1-0.dll
        • Size 19KB
        • SHA256 0f0d18ef69e049f3d43e8b4f9007d41956a0204037cd102a740b5bc512f39ee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-time-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-crt-time-l1-1-0.dll
        • Size 15KB
        • SHA256 a941a2464713f4ba2a769bdc2ec2a92b6190ee128473a7f0c510d8d8a8804aed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-utility-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\api-ms-win-crt-utility-l1-1-0.dll
        • Size 13KB
        • SHA256 bd869a9f9708b9df4b16acfa2a316f1342da19c2f0fb373d3657196777c0f1c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\base_library.zip
        • Size 1.3MB
        • SHA256 c8d70d7827e8462e9b193e1c155690487de82db20e39a9aedca57436ae09b6fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\libcrypto-3.dll
        • Size 1.6MB
        • SHA256 4f3b2d67412445a57f716c96fa88ecb5fbbc2f0d2de4a5f8a70afe5f632f939b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\libffi-8.dll
        • Size 29KB
        • SHA256 e9d8eb01bb9b02ce3859ba4527938a71b4668f98897d46f29e94b27014036523
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libopus-0.x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\libopus-0.x64.dll
        • Size 217KB
        • SHA256 fa8715dd0df84fdedbe4aa17763b2ab0db8941fa33421b6d42e25e59c4ae8732
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\libssl-3.dll
        • Size 223KB
        • SHA256 12878ba5c42fd5d584c70ab571ab92da8c715db0144e11f7fc0f2cc77db1bc22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\pyexpat.pyd
        • Size 91KB
        • SHA256 85d0e6b335f3e13b3d2deccd7266d8f9e7ca3e77e8138a4862f7ffae750512bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\python3.DLL
        • Size 69KB
        • SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\python313.dll
        • Size 1.9MB
        • SHA256 5c8f10fc0fd973008791d72aefbd6da2fec490b3e62ae7dfba2ce33e71b7fbb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\select.pyd
        • Size 26KB
        • SHA256 06534f90d2d65ef0aa6949d23abbfec3962998c32b3bd00e9de6e874c2d00c1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\sqlite3.dll
        • Size 661KB
        • SHA256 7a92980c6c15f22dcc0d9f3387ea9197c92808499177324d18ab2fe48d79b720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\tcl86t.dll
        • Size 660KB
        • SHA256 badc105c120eedba40a115f24c644ab24f936dd58cdac1d1ba52b87562e40230
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13082\ucrtbase.dll
        • Size 987KB
        • SHA256 9fad12a042a5ed8fc32e7a02e6e3ee1bc4cc33662794a5db9df94462d3965a34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        euc-cn.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34002\_tcl_data\encoding\euc-cn.enc
        • Size 84KB
        • SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INSTALLER
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46962\cryptography-45.0.2.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512
        Submit Download

        __PSScriptPolicyTest_5iotjq0t.yn5.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5iotjq0t.yn5.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1832-1301-0x0000018BC32F0000-0x0000018BC32F8000-memory.dmp
        Download

        memory/1832-1280-0x0000018BC3180000-0x0000018BC31A2000-memory.dmp
        Download

        memory/1832-1296-0x0000018BC3210000-0x0000018BC32C3000-memory.dmp
        Download

        memory/1832-1302-0x0000018BC3320000-0x0000018BC3326000-memory.dmp
        Download

        memory/1832-1303-0x0000018BC3330000-0x0000018BC333A000-memory.dmp
        Download

        memory/1832-1305-0x0000018BC2FD0000-0x0000018BC2FE0000-memory.dmp
        Download

        memory/1832-1278-0x0000018BC2FD0000-0x0000018BC2FE0000-memory.dmp
        Download

        memory/1832-1300-0x0000018BC37A0000-0x0000018BC37BA000-memory.dmp
        Download

        memory/1832-1277-0x0000018BC2FD0000-0x0000018BC2FE0000-memory.dmp
        Download

        memory/1832-1297-0x0000018BC32D0000-0x0000018BC32DA000-memory.dmp
        Download

        memory/1832-1299-0x0000018BC32E0000-0x0000018BC32EA000-memory.dmp
        Download

        memory/1832-1287-0x0000018BC2FD0000-0x0000018BC2FE0000-memory.dmp
        Download

        memory/1832-1288-0x00007FF41A710000-0x00007FF41A720000-memory.dmp
        Download

        memory/1832-1295-0x0000018BC31F0000-0x0000018BC320C000-memory.dmp
        Download

        memory/1832-1298-0x0000018BC3300000-0x0000018BC331C000-memory.dmp
        Download

        memory/2104-1251-0x00007FF963730000-0x00007FF96375F000-memory.dmp
        Download

        memory/2104-1162-0x00007FF974B10000-0x00007FF974B37000-memory.dmp
        Download

        memory/2104-1237-0x00007FF973FE0000-0x00007FF974013000-memory.dmp
        Download

        memory/2104-1240-0x00007FF969340000-0x00007FF96935B000-memory.dmp
        Download

        memory/2104-1239-0x00007FF963D60000-0x00007FF963E2E000-memory.dmp
        Download

        memory/2104-1238-0x00007FF9693F0000-0x00007FF969411000-memory.dmp
        Download

        memory/2104-1236-0x00007FF96B3D0000-0x00007FF96B3E9000-memory.dmp
        Download

        memory/2104-1234-0x00007FF973F70000-0x00007FF973F7C000-memory.dmp
        Download

        memory/2104-1233-0x00007FF96B550000-0x00007FF96B562000-memory.dmp
        Download

        memory/2104-1231-0x00007FF973F80000-0x00007FF973F92000-memory.dmp
        Download

        memory/2104-1230-0x00007FF963E30000-0x00007FF964363000-memory.dmp
        Download

        memory/2104-1228-0x00007FF9782A0000-0x00007FF9782B4000-memory.dmp
        Download

        memory/2104-1227-0x00007FF975150000-0x00007FF97515F000-memory.dmp
        Download

        memory/2104-1232-0x00007FF96B570000-0x00007FF96B586000-memory.dmp
        Download

        memory/2104-1241-0x00007FF975160000-0x00007FF975178000-memory.dmp
        Download

        memory/2104-1243-0x00007FF9652A0000-0x00007FF9652B1000-memory.dmp
        Download

        memory/2104-1242-0x00007FF963890000-0x00007FF9638DD000-memory.dmp
        Download

        memory/2104-1244-0x00007FF975150000-0x00007FF97515F000-memory.dmp
        Download

        memory/2104-1245-0x00007FF963850000-0x00007FF963882000-memory.dmp
        Download

        memory/2104-1246-0x00007FF965280000-0x00007FF96529C000-memory.dmp
        Download

        memory/2104-1247-0x00007FF963830000-0x00007FF963844000-memory.dmp
        Download

        memory/2104-1249-0x00007FF963790000-0x00007FF9637C8000-memory.dmp
        Download

        memory/2104-1248-0x00007FF9637D0000-0x00007FF96382D000-memory.dmp
        Download

        memory/2104-1250-0x00007FF963760000-0x00007FF96378A000-memory.dmp
        Download

        memory/2104-1252-0x00007FF963700000-0x00007FF963725000-memory.dmp
        Download

        memory/2104-1253-0x00007FF963570000-0x00007FF9636F9000-memory.dmp
        Download

        memory/2104-1229-0x00007FF973FA0000-0x00007FF973FAB000-memory.dmp
        Download

        memory/2104-1255-0x00007FF963550000-0x00007FF963568000-memory.dmp
        Download

        memory/2104-1254-0x00007FF963890000-0x00007FF9638DD000-memory.dmp
        Download

        memory/2104-1259-0x00007FF968DA0000-0x00007FF968DAC000-memory.dmp
        Download

        memory/2104-1260-0x00007FF9634A0000-0x00007FF9634D7000-memory.dmp
        Download

        memory/2104-1258-0x00007FF9634E0000-0x00007FF9634F2000-memory.dmp
        Download

        memory/2104-1257-0x00007FF9693E0000-0x00007FF9693EB000-memory.dmp
        Download

        memory/2104-1256-0x00007FF9652A0000-0x00007FF9652B1000-memory.dmp
        Download

        memory/2104-1261-0x00007FF963230000-0x00007FF96349D000-memory.dmp
        Download

        memory/2104-1262-0x00007FF962990000-0x00007FF963230000-memory.dmp
        Download

        memory/2104-1263-0x00007FF9637D0000-0x00007FF96382D000-memory.dmp
        Download

        memory/2104-1264-0x00007FF962930000-0x00007FF962989000-memory.dmp
        Download

        memory/2104-1266-0x00007FF962890000-0x00007FF9628D0000-memory.dmp
        Download

        memory/2104-1265-0x00007FF9628D0000-0x00007FF9628E6000-memory.dmp
        Download

        memory/2104-1269-0x00007FF963700000-0x00007FF963725000-memory.dmp
        Download

        memory/2104-1271-0x00007FF9624E0000-0x00007FF962681000-memory.dmp
        Download

        memory/2104-1273-0x00007FF9624B0000-0x00007FF9624DD000-memory.dmp
        Download

        memory/2104-1272-0x00007FF963570000-0x00007FF9636F9000-memory.dmp
        Download

        memory/2104-1270-0x00007FF962690000-0x00007FF962860000-memory.dmp
        Download

        memory/2104-1268-0x00007FF962860000-0x00007FF962876000-memory.dmp
        Download

        memory/2104-1267-0x00007FF963760000-0x00007FF96378A000-memory.dmp
        Download

        memory/2104-1274-0x00007FF962490000-0x00007FF9624AA000-memory.dmp
        Download

        memory/2104-1276-0x00007FF962460000-0x00007FF96248B000-memory.dmp
        Download

        memory/2104-1275-0x00007FF962990000-0x00007FF963230000-memory.dmp
        Download

        memory/2104-1279-0x00007FF963230000-0x00007FF96349D000-memory.dmp
        Download

        memory/2104-1224-0x00007FF978FD0000-0x00007FF978FDB000-memory.dmp
        Download

        memory/2104-1226-0x00007FF973D70000-0x00007FF973E23000-memory.dmp
        Download

        memory/2104-1225-0x00007FF973FB0000-0x00007FF973FD8000-memory.dmp
        Download

        memory/2104-1223-0x00007FF979270000-0x00007FF97927D000-memory.dmp
        Download

        memory/2104-1220-0x000002232A4C0000-0x000002232AB27000-memory.dmp
        Download

        memory/2104-1221-0x00007FF973FE0000-0x00007FF974013000-memory.dmp
        Download

        memory/2104-1222-0x00007FF963D60000-0x00007FF963E2E000-memory.dmp
        Download

        memory/2104-1218-0x000002232A4C0000-0x000002232AB27000-memory.dmp
        Download

        memory/2104-1219-0x00007FF97A6A0000-0x00007FF97A6AD000-memory.dmp
        Download

        memory/2104-1217-0x00007FF974020000-0x00007FF974039000-memory.dmp
        Download

        memory/2104-1235-0x00007FF974020000-0x00007FF974039000-memory.dmp
        Download

        memory/2104-1164-0x00007FF97EBD0000-0x00007FF97EBDF000-memory.dmp
        Download

        memory/2104-1213-0x00007FF978300000-0x00007FF97831A000-memory.dmp
        Download

        memory/2104-1214-0x00007FF974AE0000-0x00007FF974B0B000-memory.dmp
        Download

        memory/2104-1216-0x00007FF963E30000-0x00007FF964363000-memory.dmp
        Download

        memory/2104-1215-0x00007FF9782A0000-0x00007FF9782B4000-memory.dmp
        Download

        memory/2104-1304-0x00007FF962860000-0x00007FF962876000-memory.dmp
        Download

        memory/2104-1308-0x00007FF962690000-0x00007FF962860000-memory.dmp
        Download

        memory/2104-1310-0x00007FF9694D0000-0x00007FF969545000-memory.dmp
        Download

        memory/2104-1309-0x00007FF9624E0000-0x00007FF962681000-memory.dmp
        Download

        memory/2104-1471-0x00007FF9637D0000-0x00007FF96382D000-memory.dmp
        Download

        memory/2104-1477-0x00007FF963D60000-0x00007FF963E2E000-memory.dmp
        Download

        memory/2104-1476-0x00007FF9782A0000-0x00007FF9782B4000-memory.dmp
        Download

        memory/2104-1475-0x00007FF97EBD0000-0x00007FF97EBDF000-memory.dmp
        Download

        memory/2104-1474-0x00007FF974B10000-0x00007FF974B37000-memory.dmp
        Download

        memory/2104-1473-0x00007FF978300000-0x00007FF97831A000-memory.dmp
        Download

        memory/2104-1472-0x00007FF974AE0000-0x00007FF974B0B000-memory.dmp
        Download

        memory/2104-1470-0x00007FF963830000-0x00007FF963844000-memory.dmp
        Download

        memory/2104-1469-0x00007FF965280000-0x00007FF96529C000-memory.dmp
        Download

        memory/2104-1468-0x00007FF963850000-0x00007FF963882000-memory.dmp
        Download

        memory/2104-1467-0x00007FF9652A0000-0x00007FF9652B1000-memory.dmp
        Download

        memory/2104-1466-0x00007FF963890000-0x00007FF9638DD000-memory.dmp
        Download

        memory/2104-1465-0x00007FF975160000-0x00007FF975178000-memory.dmp
        Download

        memory/2104-1464-0x00007FF969340000-0x00007FF96935B000-memory.dmp
        Download

        memory/2104-1463-0x00007FF9693F0000-0x00007FF969411000-memory.dmp
        Download

        memory/2104-1462-0x00007FF96B3D0000-0x00007FF96B3E9000-memory.dmp
        Download

        memory/2104-1461-0x00007FF96B550000-0x00007FF96B562000-memory.dmp
        Download

        memory/2104-1460-0x00007FF96B570000-0x00007FF96B586000-memory.dmp
        Download

        memory/2104-1459-0x00007FF973F70000-0x00007FF973F7C000-memory.dmp
        Download

        memory/2104-1458-0x00007FF973F80000-0x00007FF973F92000-memory.dmp
        Download

        memory/2104-1457-0x00007FF973FA0000-0x00007FF973FAB000-memory.dmp
        Download

        memory/2104-1456-0x00007FF975150000-0x00007FF97515F000-memory.dmp
        Download

        memory/2104-1455-0x00007FF973D70000-0x00007FF973E23000-memory.dmp
        Download

        memory/2104-1454-0x00007FF973FB0000-0x00007FF973FD8000-memory.dmp
        Download

        memory/2104-1569-0x00007FF963760000-0x00007FF96378A000-memory.dmp
        Download

        memory/2104-1568-0x00007FF963790000-0x00007FF9637C8000-memory.dmp
        Download

        memory/2104-1453-0x00007FF978FD0000-0x00007FF978FDB000-memory.dmp
        Download

        memory/2104-1452-0x00007FF979270000-0x00007FF97927D000-memory.dmp
        Download

        memory/2104-1447-0x00007FF963E30000-0x00007FF964363000-memory.dmp
        Download

        memory/2104-1449-0x00007FF97A6A0000-0x00007FF97A6AD000-memory.dmp
        Download

        memory/2104-1441-0x000002232A4C0000-0x000002232AB27000-memory.dmp
        Download

        memory/2104-1450-0x00007FF973FE0000-0x00007FF974013000-memory.dmp
        Download

        memory/2104-1448-0x00007FF974020000-0x00007FF974039000-memory.dmp
        Download

        memory/2104-1153-0x000002232A4C0000-0x000002232AB27000-memory.dmp
        Download

        memory/2104-1152-0x000002232A4C0000-0x000002232AB27000-memory.dmp
        Download

        memory/3428-3847-0x00007FF963E20000-0x00007FF963E47000-memory.dmp
        Download

        memory/3428-3846-0x00007FF963270000-0x00007FF9638D7000-memory.dmp
        Download

        memory/3428-3852-0x00007FF962AC0000-0x00007FF962FF3000-memory.dmp
        Download

        memory/3428-3855-0x00007FF9621E0000-0x00007FF962213000-memory.dmp
        Download

        memory/3428-3857-0x00007FF963D60000-0x00007FF963D6D000-memory.dmp
        Download

        memory/3428-3865-0x00007FF961A60000-0x00007FF961A76000-memory.dmp
        Download

        memory/3428-3867-0x00007FF961A20000-0x00007FF961A39000-memory.dmp
        Download

        memory/3428-3870-0x00007FF95DCB0000-0x00007FF95DCC8000-memory.dmp
        Download

        memory/3428-3871-0x00007FF9578E0000-0x00007FF95792D000-memory.dmp
        Download

        memory/3816-3833-0x00007FF973F90000-0x00007FF973FA6000-memory.dmp
        Download

        memory/3816-3835-0x00007FF96B570000-0x00007FF96B589000-memory.dmp
        Download

        memory/3816-3815-0x00007FF978290000-0x00007FF9782B7000-memory.dmp
        Download

        memory/3816-3814-0x00007FF964680000-0x00007FF964CE7000-memory.dmp
        Download

        memory/3816-3823-0x00007FF974000000-0x00007FF974033000-memory.dmp
        Download

        memory/3816-3820-0x00000265F9380000-0x00000265F98B3000-memory.dmp
        Download

        memory/3816-3838-0x00007FF96B3D0000-0x00007FF96B3E8000-memory.dmp
        Download

        memory/3816-3839-0x00007FF965090000-0x00007FF9650DD000-memory.dmp
        Download

        memory/3816-3825-0x00007FF97D890000-0x00007FF97D89D000-memory.dmp
        Download