Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/06/2026, 01:03

General

  • Target
    slime-tweaks.exe
  • Size 17.9MB
  • Sample260622-ben5nsf18p
  • SHA256 8893a4f712b1160344538ecc4dbd1a704acc26bd0335c1d9e38a22b8133cb0e1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 19 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\slime-tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\slime-tweaks.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3108
    • C:\Users\Admin\AppData\Local\Temp\slime-tweaks.exe
      "C:\Users\Admin\AppData\Local\Temp\slime-tweaks.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "reg query "HKCU\Software\slime tweaks\State" /v "accent_color""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1252
        • C:\Windows\system32\reg.exe
          reg query "HKCU\Software\slime tweaks\State" /v "accent_color"
          4⤵
            PID:1288
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "reg query "HKCU\Software\slime tweaks\State" /v "bg_color""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:6124
          • C:\Windows\system32\reg.exe
            reg query "HKCU\Software\slime tweaks\State" /v "bg_color"
            4⤵
              PID:1560
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "reg query "HKCU\Software\slime tweaks\State" /v "admin_authed""
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3004
            • C:\Windows\system32\reg.exe
              reg query "HKCU\Software\slime tweaks\State" /v "admin_authed"
              4⤵
                PID:1092
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "reg query "HKCU\Software\slime tweaks\State" /v "user_authed""
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3000
              • C:\Windows\system32\reg.exe
                reg query "HKCU\Software\slime tweaks\State" /v "user_authed"
                4⤵
                  PID:5472

          Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                _imaging.cp311-win_amd64.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\PIL\_imaging.cp311-win_amd64.pyd
                • Size 2.5MB
                • SHA256 e04dfdb2bdba09efc4bee07924e7be18b0b324a890eae81a12509d54370d4621
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _imagingft.cp311-win_amd64.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\PIL\_imagingft.cp311-win_amd64.pyd
                • Size 2.1MB
                • SHA256 36de3f5dcf98e5d0a04c391fd6cc7ccee5cb807f6a4881e894c973ba085f8547
                • MD5 SHA1 SHA512 SSDEEP TLSH

                VCRUNTIME140.dll

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\VCRUNTIME140.dll
                • Size 116KB
                • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _bz2.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_bz2.pyd
                • Size 82KB
                • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _ctypes.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_ctypes.pyd
                • Size 121KB
                • SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _decimal.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_decimal.pyd
                • Size 249KB
                • SHA256 980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _elementtree.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_elementtree.pyd
                • Size 125KB
                • SHA256 02e30b6a2bee5be5336e40a9c89575603051bde86f9c9cdc78b7fa7d9b7bd1f0
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _hashlib.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_hashlib.pyd
                • Size 63KB
                • SHA256 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _lzma.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_lzma.pyd
                • Size 155KB
                • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _socket.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_socket.pyd
                • Size 77KB
                • SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _ssl.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_ssl.pyd
                • Size 174KB
                • SHA256 ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678
                • MD5 SHA1 SHA512 SSDEEP TLSH

                auto.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tcl_data\auto.tcl
                • Size 21KB
                • SHA256 517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                cp1252.enc

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tcl_data\encoding\cp1252.enc
                • Size 1KB
                • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
                • MD5 SHA1 SHA512 TLSH

                pkgIndex.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tcl_data\http1.0\pkgIndex.tcl
                • Size 746B
                • SHA256 77265723959c092897c2449c5b7768ca72d0efcd8c505bddbb7a84f6aa401339
                • MD5 SHA1 SHA512 TLSH

                init.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tcl_data\init.tcl
                • Size 25KB
                • SHA256 331bcf0f9f635bd57c3384f2237260d074708b0975c700cfcbdb285f5f59ab1f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                pkgIndex.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tcl_data\opt0.4\pkgIndex.tcl
                • Size 620B
                • SHA256 6a4abd2c519a745325c26fb23be7bbf95252d653a24806eb37fd4aa6a6479afe
                • MD5 SHA1 SHA512 TLSH

                package.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tcl_data\package.tcl
                • Size 23KB
                • SHA256 f46ab61cdebe3aa45fa7e61a48930d64a0d0e7e94d04d6bf244f48c36cafe948
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tclIndex

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tcl_data\tclIndex
                • Size 5KB
                • SHA256 ddf7e42def37888ad0a564aa4f8ca95f4eec942cebebfca851d35515104d5c89
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tm.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tcl_data\tm.tcl
                • Size 11KB
                • SHA256 4b7ed9fd2363d6876092db3f720cbddf97e72b86b519403539ba96e1c815ed8f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                button.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tk_data\button.tcl
                • Size 21KB
                • SHA256 1f5dd8d81b26f16e772e92fd2a22accb785004d0ed3447e54f87005d9c6a07a5
                • MD5 SHA1 SHA512 SSDEEP TLSH

                entry.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tk_data\entry.tcl
                • Size 17KB
                • SHA256 af1de90270693273b52fc735da6b5cd5ca794f5afd4cf03ffd95147161098048
                • MD5 SHA1 SHA512 SSDEEP TLSH

                icons.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tk_data\icons.tcl
                • Size 10KB
                • SHA256 1264940e62b9a37967925418e9d0dc0befd369e8c181b9bab3d1607e3cc14b85
                • MD5 SHA1 SHA512 SSDEEP TLSH

                listbox.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tk_data\listbox.tcl
                • Size 14KB
                • SHA256 47c75f9f8348bf8f2c086c57b97b73741218100ca38d10b8abdf2051c95b9801
                • MD5 SHA1 SHA512 SSDEEP TLSH

                menu.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tk_data\menu.tcl
                • Size 38KB
                • SHA256 d1283f67e435aab0bdbe9fdaa540a162043f8d652c02fe79f3843a451f123d89
                • MD5 SHA1 SHA512 SSDEEP TLSH

                panedwindow.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tk_data\panedwindow.tcl
                • Size 5KB
                • SHA256 aa4f87e41ac8297f51150f2a9f787607690d01793456b93f0939c54d394731f9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                pkgIndex.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tk_data\pkgIndex.tcl
                • Size 376B
                • SHA256 3f2539e85e2a9017913e61fe2600b499315e1a6f249a4ff90e0b530a1eeb8898
                • MD5 SHA1 SHA512 TLSH

                scale.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tk_data\scale.tcl
                • Size 7KB
                • SHA256 0da2dc955ffd71062a21c3b747d9d59d66a5b09a907b9ed220be1b2342205a05
                • MD5 SHA1 SHA512 SSDEEP TLSH

                scrlbar.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tk_data\scrlbar.tcl
                • Size 12KB
                • SHA256 eec90404f702d3cfbfaec0f13bf5ed1ebeb736bee12d7e69770181a25401c61f
                • MD5 SHA1 SHA512 SSDEEP TLSH

                spinbox.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tk_data\spinbox.tcl
                • Size 16KB
                • SHA256 2ff791a44406dc8339c7da6116e6ec92289bee5fc1367d378f48094f4abea277
                • MD5 SHA1 SHA512 SSDEEP TLSH

                text.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tk_data\text.tcl
                • Size 34KB
                • SHA256 4a42ad370e0cd93d4133b49788c0b0e1c7cd78383e88bacb51cb751e8bfda15e
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tk.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tk_data\tk.tcl
                • Size 23KB
                • SHA256 0f617d96cbf213296d7a5f7fcffbb4ae1149840d7d045211ef932e8dd66683e9
                • MD5 SHA1 SHA512 SSDEEP TLSH

                fonts.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tk_data\ttk\fonts.tcl
                • Size 5KB
                • SHA256 b94c319e5a557a5665b1676d602b6495c0887c5bacf7fa5b776200112978bb7b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                ttk.tcl

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tk_data\ttk\ttk.tcl
                • Size 4KB
                • SHA256 2c48343b1a47f472d1a6b9ee8d670ce7fb428db0db7244dc323ff4c7a8b4f64b
                • MD5 SHA1 SHA512 SSDEEP TLSH

                _tkinter.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\_tkinter.pyd
                • Size 62KB
                • SHA256 6f7bdc2f60a1795b58ec7015ec262d6b234aa8d0f022185de0f52bac4adab449
                • MD5 SHA1 SHA512 SSDEEP TLSH

                base_library.zip

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\base_library.zip
                • Size 1.4MB
                • SHA256 3ca011420cf32a6101dc2d9689bfd166591351887398fb56281b979c1342fdf4
                • MD5 SHA1 SHA512 SSDEEP TLSH

                icon.ico

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\icon.ico
                • Size 26KB
                • SHA256 34a3ecc65c63a0e9e12db353a1c54cba504549f4d06a09f680011caa729a20af
                • MD5 SHA1 SHA512 SSDEEP TLSH

                libcrypto-3.dll

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\libcrypto-3.dll
                • Size 5.0MB
                • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
                • MD5 SHA1 SHA512 SSDEEP TLSH

                libffi-8.dll

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\libffi-8.dll
                • Size 38KB
                • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                • MD5 SHA1 SHA512 SSDEEP TLSH

                libssl-3.dll

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\libssl-3.dll
                • Size 768KB
                • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
                • MD5 SHA1 SHA512 SSDEEP TLSH

                pyexpat.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\pyexpat.pyd
                • Size 194KB
                • SHA256 c7c7564f7f874fb660a46384980a2cf28bc3e245ca83628a197ccf861eab5560
                • MD5 SHA1 SHA512 SSDEEP TLSH

                python311.dll

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\python311.dll
                • Size 5.5MB
                • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
                • MD5 SHA1 SHA512 SSDEEP TLSH

                select.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\select.pyd
                • Size 29KB
                • SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
                • MD5 SHA1 SHA512 SSDEEP TLSH

                slime.png

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\slime.png
                • Size 394KB
                • SHA256 34ef1d1a882d690f678dc734e655ac3080780175acb47d27eddd6bda8bff3d94
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tcl86t.dll

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\tcl86t.dll
                • Size 1.8MB
                • SHA256 4e699ff2d6d147d0586c8c77be5a18f20ca0758f432d7b0f489223f2fa4dd221
                • MD5 SHA1 SHA512 SSDEEP TLSH

                msgcat-1.6.1.tm

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\tcl8\8.5\msgcat-1.6.1.tm
                • Size 34KB
                • SHA256 6774519f179872ec5292523f2788b77b2b839e15665037e097a0d4edddd1c6fb
                • MD5 SHA1 SHA512 SSDEEP TLSH

                tk86t.dll

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\tk86t.dll
                • Size 1.5MB
                • SHA256 b6af038120f2b8644c7ce1e11917f410009848287622135d7e386f90d28a831c
                • MD5 SHA1 SHA512 SSDEEP TLSH

                unicodedata.pyd

                • Path C:\Users\Admin\AppData\Local\Temp\_MEI31082\unicodedata.pyd
                • Size 1.1MB
                • SHA256 37c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02
                • MD5 SHA1 SHA512 SSDEEP TLSH