2b2e14079628d003b49f8072774522cb4b77d15a899e00a6280e42c0ae2e5c79

Analysis

user interaction
yes
max time kernel
57s
max time network
62s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
slava_vir.exe
Size 41.5MB
Sample260625-va84tsdv4y
SHA256 2b2e14079628d003b49f8072774522cb4b77d15a899e00a6280e42c0ae2e5c79
MD5 f873d5ad07688a7975e271c030b4be9e
SHA1 2f92a0fdcfbade49734fe0c00b8ca3340fa57094
SHA512 290f3cbd2e5d75d1c2cc494ab5c61fb50ed00f99f97757f95a7106dbcf841e7a332bdfc7b94d5f459056ec4dab6b4caf34beb1e208162fae0f27dc05c354bbb2
SSDEEP 786432:R+gX4BMdhwzTQXR5FbPp6FcSS5U/LT2KzVyPVLBdBxW814XMb8UJj/i64L:TXGMK4XR3bLSCU/+6yPl3BxWFc1+L
TLSH
T1ED973344F7C808D9E8A52579B5E0534BDA99F0FE47B1C3E391F0058384A7AC0EF5AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware

Malware Config

Signatures

Loads dropped DLL 32 IoCs

pid	Process
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe
1276	slava_vir.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ukraine_flagge.png"	slava_vir.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2664	shutdown.exe
Token: SeRemoteShutdownPrivilege	2664	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3672	conhost.exe
5980	LogonUI.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5484 wrote to memory of 1276	5484	slava_vir.exe	89
PID 1276 wrote to memory of 816	1276	slava_vir.exe	91
PID 816 wrote to memory of 932	816	cmd.exe	93
PID 1276 wrote to memory of 4872	1276	slava_vir.exe	94
PID 4872 wrote to memory of 3672	4872	cmd.exe	95
PID 3672 wrote to memory of 2536	3672	conhost.exe	96
PID 2536 wrote to memory of 5140	2536	cmd.exe	97
PID 1276 wrote to memory of 5804	1276	slava_vir.exe	99
PID 5804 wrote to memory of 2664	5804	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\slava_vir.exe
"C:\Users\Admin\AppData\Local\Temp\slava_vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Users\Admin\AppData\Local\Temp\slava_vir.exe
  "C:\Users\Admin\AppData\Local\Temp\slava_vir.exe"
  2⤵
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -o "ukraine_flagge.png" "https://imgs.search.brave.com/AOACULcl9ogv7Jmj0MUjX3XJ51X4gDx8ZnRQpoaaTmE/rs:fit:500:0:1:0/g:ce/aHR0cHM6Ly9jZG4u/cGl4YWJheS5jb20v/cGhvdG8vMjAyMi8w/My8wMy8wNS81OC91/a3JhaW5lLTcwNDQ2/NDdfNjQwLmpwZw""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Windows\system32\curl.exe
      curl -o "ukraine_flagge.png" "https://imgs.search.brave.com/AOACULcl9ogv7Jmj0MUjX3XJ51X4gDx8ZnRQpoaaTmE/rs:fit:500:0:1:0/g:ce/aHR0cHM6Ly9jZG4u/cGl4YWJheS5jb20v/cGhvdG8vMjAyMi8w/My8wMy8wNS81OC91/a3JhaW5lLTcwNDQ2/NDdfNjQwLmpwZw"
      4⤵
      PID:932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start "" conhost.exe cmd /k "mode 40,20 && color 2 && dir /s""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\system32\conhost.exe
      conhost.exe cmd /k "mode 40,20 && color 2 && dir /s"
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3672
    - - C:\Windows\system32\cmd.exe
        
        cmd /k "mode 40,20 && color 2 && dir /s"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2536
      - C:\Windows\system32\mode.com
        
        mode 40,20
        6⤵
        
        PID:5140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c shutdown /s /t 0
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5804
  - - C:\Windows\system32\shutdown.exe
      shutdown /s /t 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2664

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a12055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\PyQt5\Qt5\bin\MSVCP140.dll
Size 576KB
SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
MD5 01b946a2edc5cc166de018dbb754b69c
SHA1 dbe09b7b9ab2d1a61ef63395111d2eb9b04f0a46
SHA512 65dc3f32faf30e62dfdecb72775df870af4c3a32a0bf576ed1aaae4b16ac6897b62b19e01dc2bf46f46fbe3f475c061f79cbe987eda583fee1817070779860e5
SSDEEP 12288:xI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRkdQEKZm+jWodEEVh51:xD89rxZfQEKZm+jWodEEP5
TLSH
T1DBC40923A74901A0E196E3B891C78306D7F17C468312E3C792FAD66D2F5B7D5AB3B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\PyQt5\Qt5\bin\MSVCP140_1.dll
Size 30KB
SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
MD5 0fe6d52eb94c848fe258dc0ec9ff4c11
SHA1 95cc74c64ab80785f3893d61a73b8a958d24da29
SHA512 c39a134210e314627b0f2072f4ffc9b2ce060d44d3365d11d8c1fe908b3b9403ebdd6f33e67d556bd052338d0ed3d5f16b54d628e8290fd3a155f55d36019a86
SSDEEP 384:rOY/H1SbuIqnX8ndnWc95gW3C8c+pBj0HRN7bULkcyHRN7rxTO6iuQl9xiv:yYIBqnMdxxWd4urv
TLSH
T1F9E24C8AEB688883E963587085B9DD47FC3DF7D15B60529F1259E7680CD33C2AB3461C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\PyQt5\Qt5\bin\Qt5Core.dll
Size 5.7MB
SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
MD5 817520432a42efa345b2d97f5c24510e
SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
SSDEEP 98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
TLSH
T1BA569C47B6A70160D0B6C27CC9A7821BE6B3781287228ADF425CA70A5F777F1293F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\PyQt5\Qt5\bin\VCRUNTIME140_1.dll
Size 43KB
SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
MD5 6bc084255a5e9eb8df2bcd75b4cd0777
SHA1 cf071ad4e512cd934028f005cabe06384a3954b6
SHA512 b822538494d13bda947655af791fed4daa811f20c4b63a45246c8f3befa3ec37ff1aa79246c89174fe35d76ffb636fa228afa4bda0bd6d2c41d01228b151fd89
SSDEEP 384:Aim/NRETi8kykt25HwviU5fJUiP2551xWmbTqOA7SXf+Ny85xM8ATJWr3KWoC8cS:0Ie8kySL2iPQxdvjAevcMESW5lxJG
TLSH
T156136C4597BC8086E46789B0C0A6DF17FE38F6926760928F0B65D25D2F537C0AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\PyQt5\QtCore.pyd
Size 2.4MB
SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
MD5 678fa1496ffdea3a530fa146dedcdbcc
SHA1 c80d8f1de8ae06ecf5750c83d879d2dcc2d6a4f8
SHA512 8d9e3fa49fb42f844d8df241786ea9c0f55e546d373ff07e8c89aac4f3027c62ec1bd0c9c639afeabc034cc39e424b21da55a1609c9f95397a66d5f0d834e88e
SSDEEP 49152:ZYS8YHrNj4/7RsRLvYpiW3pCBU+Z7bJWvCSBYgbxGJ5M2GM/fXR1fUdihfSbCo6e:9bpj4/7RsRLvYpiW3pCBU+Z7bJWvCSBv
TLSH
T1C8B51957631965D4C4FAD638C90F860AF6F370111346A3CF24248BA92F637EA6BBDB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sip.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\PyQt5\sip.cp313-win_amd64.pyd
Size 117KB
SHA256 7a54c971af695af612a1cda68924a2170d4a2afe48dd32770b60fde5b2dd7dab
MD5 2d6576a84b75174a95410762971fca3c
SHA1 11b7a1b56fd4ca01bae27692b57fefcaa9f11ab3
SHA512 b8aeb89f03a7f5079381693695d622386b2ed1ff93b6f7eb80c509624a8568ba56ea573b3f9882f4af205b4a4ff8abf5a624d6e4c68c342e1c2e62608ed0cb0b
SSDEEP 3072:lePO8Y+E74YgjAlluOQxD1Y6QqE9Icnbdrc:lePOV+YgclkVl1WbIcnbVc
TLSH
T1B0C32A5B73D8008AEAA6917C8833A503D7F3B461271157CF12A0C65A2F67EE67DBE740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_brotli.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\_brotli.cp313-win_amd64.pyd
Size 804KB
SHA256 67dfa82dcaed04ed3f358d84b18d1375d59126161de92e00164d36087b179d4d
MD5 5ed46a7126dbdb70f3c60530e35ba035
SHA1 b5c0dcbe3ee42e258cadd54ac46f70f1f903ae1b
SHA512 7f5d2b52c310a239182eedd60833951d46cdd18ca2edd828fcabed4299b2ab5df506a2b271e33f129d0256d6db90f9c902ee4d18a7e41ca61f65365504451de0
SSDEEP 12288:XO85hNmCUoltfSNAHhlyp8aXTw05nmZfR:XTT6AzRAmZfR
TLSH
T16C059D0BD9A25739CC27C4398D6B1236EB357168931089A7B25CE5353B83A2417FF3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\_bz2.pyd
Size 82KB
SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
MD5 cb8c06c8fa9e61e4ac5f22eebf7f1d00
SHA1 d8e0dfc8127749947b09f17c8848166bac659f0d
SHA512 e6da642b7200bfb78f939f7d8148581259baa9a5edda282c621d14ba88083a9b9bd3d17b701e9cde77ad1133c39bd93fc9d955bb620546bb4fcf45c68f1ec7d6
SSDEEP 1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
TLSH
T16F838E42E3A56AF5F86B80B956C10367E771B954075093EFF348C2693F02F426DAC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\_ctypes.pyd
Size 128KB
SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
MD5 a55e57d7594303c89b5f7a1d1d6f2b67
SHA1 904a9304a07716497cf3e4eaafd82715874c94f1
SHA512 ffa61ad2a408a831b5d86b201814256c172e764c9c1dbe0bd81a2e204e9e8117c66f5dfa56bb7d74275d23154c0ed8e10d4ae8a0d0564434e9761d754f1997fc
SSDEEP 3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
TLSH
T1A2D36C0B735800AADA779178C5736F47DBF1B456171087CF02A8C5AA2F63BA26E7E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\_hashlib.pyd
Size 62KB
SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
MD5 32d76c9abd65a5d2671aeede189bc290
SHA1 0d4440c9652b92b40bb92c20f3474f14e34f8d62
SHA512 49dc391f4e63f4ff7d65d6fd837332745cc114a334fd61a7b6aa6f710b235339964b855422233fac4510ccb9a6959896efe880ab24a56261f78b2a0fd5860cd9
SSDEEP 768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
TLSH
T1F5536C01A68080A4C96782B8D9934F5BE6F2F5415791ABDF0318C1CD1F23BC3DAFA796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\_lzma.pyd
Size 154KB
SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
MD5 1ba022d42024a655cf289544ae461fb8
SHA1 9772a31083223ecf66751ff3851d2e3303a0764c
SHA512 2b888a2d7467e29968c6bb65af40d4b5e80722ffdda760ad74c912f3a2f315d402f3c099fde82f00f41de6c9faaedb23a643337eb8821e594c567506e3464c62
SSDEEP 3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
TLSH
T1B9F34982A794F4E5F7728C78D6624F17E7F5781A032092DA01CC876D2B1FB659E2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\_queue.pyd
Size 32KB
SHA256 b9cf502dadcb124f693bf69ecd7077971e37174104dbda563022d74961a67e1e
MD5 1c03caa59b5e4a7fb9b998d8c1da165a
SHA1 8a318f80a705c64076e22913c2206d9247d30cd7
SHA512 783ecda7a155dfc96a718d5a130fb901bbecbed05537434e779135cba88233dd990d86eca2f55a852c9bfb975074f7c44d8a3e4558d7c2060f411ce30b6a915f
SSDEEP 384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
TLSH
T1C8E28D87AB940856D477C875D4E65E35F9B2B6414B0083CF2218C25D1F723836FBABAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\_socket.pyd
Size 81KB
SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
MD5 fe896371430bd9551717ef12a3e7e818
SHA1 e2a7716e9ce840e53e8fc79d50a77f40b353c954
SHA512 67ecd9a07df0a07edd010f7e3732f3d829f482d67869d6bce0c9a61c24c0fdc5ff4f4e4780b9211062a6371945121d8883ba2e9e2cf8eb07b628547312dfe4c9
SSDEEP 1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
TLSH
T141836C11A69050FADFB3C0B5C5675E23FBB4F4801395979F0166C66A1F33382BE7AA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\_ssl.pyd
Size 177KB
SHA256 63ae2fefbfbbbc6ea39cde0a622579d46ff55134bc8c1380289a2976b61f603e
MD5 1c0e3e447f719fbe2601d0683ea566fc
SHA1 5321ab73b36675b238ab3f798c278195223cd7b1
SHA512 e1a430da2a2f6e0a1aed7a76cc4cd2760b3164abc20be304c1db3541119942508e53ea3023a52b8bada17a6052a7a51a4453efad1a888acb3b196881226c2e5c
SSDEEP 3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
TLSH
T179047B07B5946DB7D813E4FAC1230113EBB1F055331297DE44D6DA460F13B4AAEAABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\_tkinter.pyd
Size 64KB
SHA256 a6851d7c25a1216d2c8fa5c1d2e9eca3d0392d60e3b7441ad9f66c23ffdd2f08
MD5 edffcea2091a5661f451ccd83ad4527d
SHA1 f81847c0adc0f58134b195a13486d851911fc516
SHA512 abc9fbf7bfbd705016a9d0430243358a1e8f7c4e398b6ba0fc5b1a147f0a1f635e27b859d742e4184ae9d396a68572b169476703312babc3e7530d698ff9ab48
SSDEEP 1536:Lx2s2VF41qe6gwfdHd5MlU9oBilPrdIJvSi7Sy7z:Lv2VNe6Lfd9alPIlPrdIJvSiJ
TLSH
T1C0537D9BAB64008ACE67C079C4B35F13EA75B5414A10938F02A8C35A1F73793ABFE755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\_wmi.pyd
Size 37KB
SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
MD5 1c30cc7df3bd168d883e93c593890b43
SHA1 31465425f349dae4edac9d0feabc23ce83400807
SHA512 267a1807298797b190888f769d998357b183526dfcb25a6f1413e64c5dccf87f51424b7e5d6f2349d7a19381909ab23b138748d8d9f5858f7dc0552f5c5846ac
SSDEEP 768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
TLSH
T136037E56E7940855D937C6BDC8E64E27F5B1B5825711C3CF3318826D0F32382AA7A3BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\base_library.zip
Size 1.3MB
SHA256 df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19
MD5 a9cbd0455b46c7d14194d1f18ca8719e
SHA1 e1b0c30bccd9583949c247854f617ac8a14cbac7
SHA512 b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528
SSDEEP 12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
TLSH
T100551A92B9527953FF14F37B80B7484CF32E86A2EF00C207355A42661FFEAB49D59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\certifi\cacert.pem
Size 292KB
SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
MD5 50ea156b773e8803f6c1fe712f746cba
SHA1 2c68212e96605210eddf740291862bdf59398aef
SHA512 01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0
SSDEEP 6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
TLSH
T1E8547C964F269C052C9FE1C1CA9B1357DD3A027B99FEF0F1394A2448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\charset_normalizer\md.cp313-win_amd64.pyd
Size 10KB
SHA256 002697227449b6d69026d149cfb220ac85d83b13056c8aa6b9dac3fd3b76caa4
MD5 56fe4f6c7e88212161f49e823ccc989a
SHA1 16d5cbc5f289ad90aeaa4ff7cb828627ac6d4acf
SHA512 7c9d09cf9503f73e6f03d30e54dbb50606a86d09b37302dd72238880c000ae2b64c99027106ba340753691d67ec77b3c6e5004504269508f566bdb5e13615f1e
SSDEEP 96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
TLSH
T13E222A0CFA6458D9DA164178C52B5E0BB0B5B710176273CF0370D57B3EB63D6AA3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
Size 122KB
SHA256 c393098e7803abf08ee8f7381ad7b0f8faffbf66319c05d72823308e898f8cfc
MD5 10116447f9276f10664ba85a5614ba3a
SHA1 efd761a3e6d14e897d37afb0c7317c797f7ae1d6
SHA512 c04461e52b7fe92d108cbdeb879b7a8553dd552d79c88dfa3f5d0036eed8d4b8c839c0bf2563bc0c796f8280ed2828ca84747cb781d2f26b44214fca2091eae4
SSDEEP 3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
TLSH
T15DC3291762990073CA63417ACCB76513DBE2B5510B3253CF04B4C6AA6F17BDAADBEB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\libssl-3.dll
Size 774KB
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
TLSH
T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\python3.DLL
Size 68KB
SHA256 a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
MD5 16855ebef31c5b1ebe767f1c617645b3
SHA1 315521f3a748abfa35cd4d48e8dd09d0556d989b
SHA512 c3957b3bd36b10c7ad6ea1ff3bc7bd65cdceb3e6b4195a25d0649aa0da179276ce170da903d77b50a38fc3d5147a45be32dbcfdbfbf76cc46301199c529adea4
SSDEEP 768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
TLSH
T14B635CD26B57F8A2D6F669FC38DD99CD142B12CC83258DDFA57893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\python313.dll
Size 5.8MB
SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
MD5 b9de917b925dd246b709bb4233777efd
SHA1 775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
SHA512 f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33
SSDEEP 49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
TLSH
T1E9568D16729D40ADC97B8078CA038A4BF7B27C417F60534B61A6BB5E2F733624B6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\select.pyd
Size 30KB
SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
MD5 20831703486869b470006941b4d996f2
SHA1 28851dfd43706542cd3ef1b88b5e2749562dfee0
SHA512 4aaf5d66d2b73f939b9a91e7eddfeb2ce2476c625586ef227b312230414c064aa850b02a4028363aa4664408c9510594754530a6d026a0a84be0168d677c1bc4
SSDEEP 384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
TLSH
T1A7D28E47AF605846D923C972A8E28F26ED35B752875082CF3268C15D0F627C27B7B3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\tcl86t.dll
Size 1.7MB
SHA256 c861f39ad0f4fc7f3875850925f61442bff2bc1839bbbb3584a63bc4d6e5cea6
MD5 8587238932b4f7f394ce587ad169846b
SHA1 6cdc9c1751e812be3a11bb411a145e7ab6885def
SHA512 c88506e5b78ab1459c25de4c7ef65b3c9e24e0f79ab2132e8fdc7a02195af2e137874512a0f423c80d558969e42e2a4bc7d2cddee696624dbd230b32c44f88f2
SSDEEP 49152:ehk299wKFi8C2Qt6IHCmGViSIV8JryqL3eD0:qN9wdeIAvt
TLSH
T11D858E1BE76410A8D8ABD1BCC227A60BEFF174191350A7DB51B08B912F23FE1277A355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\tk86t.dll
Size 1.5MB
SHA256 6425bf57abcc1dfbbe8662b1956883ae0c5ab8c2d9314e19692b3d86babc242c
MD5 6f06390d3ac095827df2f1a8ed5dae0c
SHA1 879f24522821f597c0341ca091e474163764b343
SHA512 27b975e15f6e1b9bc8e3e41152baee25f4b400de3aa6e334c61b2165fecd27560fa5c4296a9b3ff0eb1103173cfb61c348ba11e01a44cbadbecf308b5d7c5095
SSDEEP 24576:tvVYTm+MKYeCmXNrhMMjMt41GZsbTYsgG04ChR3mxOl8v07B62sUCcmxNFClwdbR:tNY7YReNrhMMi41GZsbTYsgG04ChR3mB
TLSH
T1D9754A06A261C198C66EA134C56796BAEBF17C04931057DB72A0FE6D3F73BD2273A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\unicodedata.pyd
Size 693KB
SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
MD5 0902d299a2a487a7b0c2d75862b13640
SHA1 04bcbd5a11861a03a0d323a8050a677c3a88be13
SHA512 8cbef5a9f2d24da1014f8f1ccbddd997a084a0b04dd56bcb6ac38ddb636d05ef7e4ea7f67a085363aad3f43d45413914e55bdef14a662e80be955e6dfc2feca3
SSDEEP 12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
TLSH
T1F9E4F6D5BBCF8D26E69B363A48E3710F5171C2735F0A863BB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI54842\zlib1.dll
Size 142KB
SHA256 8c2ed3e1a90c9b0e3ef844be20e1af791ae8a1b665d4731162404f0eee1697dc
MD5 3a46a119c9860c477f13fe98c878452c
SHA1 e0bcbe5b30ef2a2f58e1206c650672ee3f85abc9
SHA512 0d3d4e8a2c8886fd6e480aecc5051644f39c1e06b1113def7273369f771c4429c757aed13bd8082f4768f617ca3499cd81b79a0893b5a2955fb4b68c8b571c71
SSDEEP 3072:dvEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCf/:dsVD+RrFgvi7Ju
TLSH
T152E37D9BB6A224BDC67781B051E78776F932B8214B309EEF5148C7741B12E406B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1276-1093-0x00007FFD88180000-0x00007FFD883E3000-memory.dmp

Download

memory/1276-1135-0x00007FFD94130000-0x00007FFD94159000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads