537d821eb4d34d09499b4b8584cca58eeaec3aa77ac6bdb6d99e4f56c1299d3c

Analysis

max time kernel
18s
max time network
11s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TgWsProxy_windows_7_64bit (1).exe
Size 16.5MB
Sample260714-wapwmacv9z
SHA256 537d821eb4d34d09499b4b8584cca58eeaec3aa77ac6bdb6d99e4f56c1299d3c
MD5 3650473ff30f52477f65552df762f099
SHA1 75b6c35a450871d5f890fd64bf8a0de12445916c
SHA512 38a8d09d564b144ff718e7e562b249b3837df761dbc78fd791619e7c78b38d64b86eaf627b0ffe2a41f47090ba58aced30624dc58056e801b8fd0fb77b4ceb61
SSDEEP 393216:XlLSssFVL7pUTLfhJiCEDjJ83a10RtN3ZWqaxksx0KYTXjJZ:1LSssFVBUTLJUCEDFEa6tN3PaxkU0LZ
TLSH
T1990733CACB521811FC33933E79E9883AC96374FD8365672B193D1493299B2799D78F02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 26 IoCs

pid	Process
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe
5012	TgWsProxy_windows_7_64bit (1).exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
20	raw.githubusercontent.com

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5012	TgWsProxy_windows_7_64bit (1).exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 5012	1660	TgWsProxy_windows_7_64bit (1).exe	87
PID 5012 wrote to memory of 4436	5012	TgWsProxy_windows_7_64bit (1).exe	88

C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit (1).exe
"C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit (1).exe
  "C:\Users\Admin\AppData\Local\Temp\TgWsProxy_windows_7_64bit (1).exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_imaging.cp38-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\PIL\_imaging.cp38-win_amd64.pyd
Size 2.2MB
SHA256 bf56f78e0cf9bc5181933c80858cd4ee471e1fb45e3d4e59f5830a8b28e0268d
MD5 9f56033af2b4a6114ace83bbe4610900
SHA1 4a932b57fe20ce259b9932c22b43ff29f909b2ea
SHA512 d724ac80185cf8488b7acf3330558024f1a4a03a9e1092163eac35a69139b542315e6c716ba4989651c0585cbac875bcd94b890e617a91bf429940d23cba8d89
SSDEEP 49152:4Szu7v2t94WXKTTYpBzcEPsoU0/H0vmBR:u8vpaEPsoU0CIR
TLSH
T19FB54A02E6A15596C6B68034CDABD616E3B1780D17F186F7B2C4A7F83E23BD0353A395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\VCRUNTIME140.dll
Size 93KB
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722
SSDEEP 1536:dkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOqH+F3fecbTUEuvw:dWD4eUp+HQpcNg0MFnH+F3fecbTUED
TLSH
T123937C4A7BA442BBD06AC178C1E34A16F771B844873053CF13B54AAA5F63BE05E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_asyncio.pyd
Size 63KB
SHA256 6e25aa5931f175b971dfd05aab7a24cef29edd8f4b524341c414d0577c07a200
MD5 0400b1958d0f7aa0d2ad409ea12ffec7
SHA1 ce1a5c61192ffe489a53f029ac0a95d4abb3d2b9
SHA512 8790f3f9c69823d55350ea63a1b8ebb3dad64942b6e6752109d2932b3bb848a5101e2a9a4645e93a476a8c4e5c8b27e15eb39b33fcc772a876b0e8ab9fd5eefa
SSDEEP 768:YVtJbo/5NQQQ2cA27ZKky1qSwr2ysMqBOf/nLeuK1P/dIIYn8sKDG4yMhb:YFborVdW7s1qx737K1P/dIIYndOyQ
TLSH
T187536C46D3808291ED6791B8D8B31F56F7B2F1406B00878E526CC29D2F5336263FEE69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_bz2.pyd
Size 85KB
SHA256 ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
MD5 a49c5f406456b79254eb65d015b81088
SHA1 cfc2a2a89c63df52947af3610e4d9b8999399c91
SHA512 bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae
SSDEEP 1536:eKpLuz7t0fjOUSKdvOKJbdV/qj1M9D8WAPpP3JuFIIMVRy7:VizTTmbJJV/qj1M6WAPpP3JuFIIMVI
TLSH
T1A6839E92F3A056F6F09BF27596614347E731B8094390D3BFA2A8424F2F02B917D6971E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp38-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_cffi_backend.cp38-win_amd64.pyd
Size 173KB
SHA256 efaeb325ed9c318919d73c7d11db3165a7398568047f702c6707b3b154a10a7e
MD5 e5ce26e98eb39d9acd1d564a598c3400
SHA1 46f69c6b169131fd3ca910a65ae40b448cc07567
SHA512 63b899560075d7500ff7514fa2cdb1fc9ee43dc81a16b0c5aba19f3bccc44663d24204620b8399842a488812b2fe58f237d77f65e8f674761cc2bca661ce7ea8
SSDEEP 3072:wgwLlWRQsB4zegjaSzE76dhnlah/ZDS7LbSTLLKAR8L:wplMQsB4GSzhGxObSTLeAOL
TLSH
T1C904495B329C12B2D5934078891B4B92E3B3B470135197CF01A4C6B52F6BBE67E7EB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_ctypes.pyd
Size 124KB
SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
MD5 291a0a9b63bae00a4222a6df71a22023
SHA1 7a6a2aad634ec30e8edb2d2d8d0895c708d84551
SHA512 d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09
SSDEEP 3072:psrzScwzPzuoUxXVxQXKIAqoFQufLTA/1mj9AItH5IIBPmQl:a//wWX8XKIABfLTcmXlyk
TLSH
T130C35B1B735800EAE6674178C5B35E0BDBB2B411072087CF0264C6AA2F637E67E7E745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_hashlib.pyd
Size 46KB
SHA256 a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
MD5 5e5af52f42eaf007e3ac73fd2211f048
SHA1 1a981e66ab5b03f4a74a6bac6227cd45df78010b
SHA512 bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd
SSDEEP 768:E0mbG0HUxzB7992zIyYsw3jYXjV4h6HgevWASdIIYIASDG4ybhMD:Tma00xVMn08x4EBvAdIIYIA2ymD
TLSH
T16B235B05A34104E2D87781B8E4A24F57DA71B5505311A3EF93A8C19E5FA37D333BAF29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_lzma.pyd
Size 159KB
SHA256 9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
MD5 cf9fd17b1706f3044a8f74f6d398d5f1
SHA1 c5cd0debbde042445b9722a676ff36a0ac3959ad
SHA512 5fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a
SSDEEP 3072:LIVa3V86CLON9lUm+/3i4p9qZqznfY9mNovvFOhYIlLvyFIID15x:LIVa3V81LwlC//q+gYOvPIBvy7
TLSH
T1A5F33996B390F4E6E7328C39D6624F17E7F578190320929A01CD836D2B1F7659A2E327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_overlapped.pyd
Size 45KB
SHA256 5f92c163b9fe6abb0f8b106a972f6a86f84271b2e32c67f95737387c85719837
MD5 7d5bb2a3e4fbceaddfeef929a21e610c
SHA1 942b69e716ee522ef01bde792434c638e3d5497a
SHA512 8c44f1683fdea0d8121ff2fe36f2582313980ef20ee1985af7ff36acb022acbb7617e85d2dd3b8e75715444dc0cfc4487c81b43d0222bd832aac867875afbe30
SSDEEP 768:4ALlM4CwMgcpx3F3O6FNnZoYWEpNQ0vnIzRIIttyFDG4ycD7hQ:4CM4a3F3hrJQ0vnIzRIIttyPyr
TLSH
T1ED236B52A35001D6D82B82BAA2A31F13F6B0B6814725D7AF4258C24F1F3379177BE79D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_queue.pyd
Size 28KB
SHA256 67e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
MD5 dd146e2fa08302496b15118bf47703cf
SHA1 d06813e2fcb30cbb00bb3893f30c2661686cf4b7
SHA512 5b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c
SSDEEP 768:UbErqQu06rhuOUrRm4MH5IImUVDG4yaC97hP:wuqXhuOC84a5IImUfydL
TLSH
T19CD27C81A7A858D2E833C179A4E25E27ED71B9115321C3FF1228825D1F36783727BB6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_socket.pyd
Size 78KB
SHA256 87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba
MD5 4827652de133c83fa1cae839b361856c
SHA1 182f9a04bdc42766cfd5fb352f2cb22e5c26665e
SHA512 8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a
SSDEEP 1536:OnzkyYf2r+ciQG5fF3/1NmaA189/s+7+pMXFxRjD3mh5IIBwlyin:Zy62r+P7VnfA189/se+pYxRPK5IIBw7
TLSH
T188735A02A7A051FAD677C07AC2638F23F770F4D41394A39F4564C95A1F23782AE7AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_ssl.pyd
Size 152KB
SHA256 0a721fc230eca278a69a2006e13dfa00e698274281378d4df35227e1f68ea3e0
MD5 d4dfd8c2894670e9f8d6302c09997300
SHA1 c3a6cc8d8079a06a4cac8950e0baba2b43fb1f8e
SHA512 1422bf45d233e2e3f77dce30ba0123625f2a511f73dfdf42ee093b1755963d9abc371935111c28f0d2c02308c5e82867de2546d871c35e657da32a7182026048
SSDEEP 3072:PBgil+Nig7FXVxb/8lwiaibUixhk980VUuOazbAOXLkdWXxZIIkjVD6XFIIM7y:PBgi8iWXVxbI/Xhk9gazbRqo3
TLSH
T107E36C03F2441AF7D813E4BDC6634902E7A9F1052311979E85D6DA4A0F07B06BE6BF6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\_tkinter.pyd
Size 64KB
SHA256 d55ef406b4612695499186355a6130885ad522e48556327c0fb409e0345d552d
MD5 cc74d36aeedc687d5ee733041042e2e5
SHA1 c304c579d15204eb25198e09a558ec747dea4832
SHA512 4e7e5330610e9588ad920f120e13260fa1ff94c73f5f286a42dd8475ce8387a8112ed38a5b0de5dcc855a0bcad6324a9b9344d8c576954f4c50a627ec6c34c86
SSDEEP 1536:ps4dNTSaGCtaXtTAZgXA6hcTql+UvNdIIYSeyuU:ps4dNOy4agXAFTqlvNdIIYSgU
TLSH
T1B2535AAB9354009ADAA7C03DD5726B23E675B9120A10D28F81D4C25A0F637E377FEB5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\base_library.zip
Size 1008KB
SHA256 d98f24433f56c21f108b91bc67f004151de666a164a5b7ecc19414fc1c7ec1d7
MD5 d07f6513e369e3665bd3163180c5834d
SHA1 bb3658eab8003c2e86c67944ef729c9bafa62832
SHA512 b28f25eb57311b5fab293cbf8271b4da8f8589a1e0ff7114d081bd3743762897d654c5dbad0aa1edbbcc7c3892878e894cc8b07114afb67e13c886f29805c664
SSDEEP 24576:dhidKrtosQNRs54PK4IMvVw59bfCEzX5nESWGR32K1:dhidKrtosQNRs54PK4IV9BnjWM71
TLSH
T1E42518407AB16ED7FD0AF3B9402A861C4A2A9339DB49D103794FC35C3F4A3E41E75A99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\cryptography\hazmat\bindings\_rust.pyd
Size 6.4MB
SHA256 c3964fc08e4ca8bc193f131def6cc4b4724b18073aa0e12fed8b87c2e627dc83
MD5 486085aac7bb246a173ceea0879230af
SHA1 ef1095843b2a9c6d8285c7d9e8e334a9ce812fae
SHA512 8a56774a08da0ab9dd561d21febeebc23a5dea6f63d5638ea1b608cd923b857df1f096262865e6ebd56b13efd3bba8d714ffdce8316293229974532c49136460
SSDEEP 98304:EzN+T+xtLlk0PPMAiGoTzeDy3x8lGBlWi9Nk:E5Y6Jk0PPMtfTzp3x8c
TLSH
T1AE667C69A6AC0169D82AC4B8C3879237DB31748A077066EF49D496F92F73FE4173E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blue.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\customtkinter\assets\themes\blue.json
Size 4KB
SHA256 c9417470c16ced7a43d6c4a8e027afa6edc62c24d5aee7c4c2dcd11385964d3b
MD5 05eb3947ce9a8c3bef66c14d0f938671
SHA1 06ffc811ee51609809d88894022e222b339aefee
SHA512 4db7c14fba78185edf6459016608cb8fa0a250dfb48432c552bb4e0466cf49622b34d847e17c254bb1c8d15bf365e91bce3ede552ba8733fde9d21779f7f1c13
SSDEEP 96:KupscLUBH2cEyzmGvtu/XaNgdacgWu/Bwg+Y51hlk2cEdVJFvLpwZdIunacEkGgC:KupNUtMiPQ/XXIRp/v+Y51hT/vlggf+4
TLSH
T167912814C5280EA723FB9B2A1607EA043C9C95D36FA8FE54385881DD0F4F43EC6B5BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\libcrypto-1_1.dll
Size 3.2MB
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668
SSDEEP 98304:ZX+SicVMcqx5q6ypQ821CPwDv3uFfJwwzS:1FicVMcqx5q6yX21CPwDv3uFfJwwz
TLSH
T1AEF58C5AA3AC1194E5BAC07CC9574727E3B1B85A87B05BCF08A681780F27BD6373DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\libssl-1_1.dll
Size 674KB
SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
MD5 50bcfb04328fec1a22c31c0e39286470
SHA1 3a1b78faf34125c7b8d684419fa715c367db3daa
SHA512 370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685
SSDEEP 12288:XXnznrSRNaJkxbpdM2QJCCMHxtfz8Irj0R6wQHPRv8Fl4tekY2U2lvz:vSTxbpd/Rrj0R6nd+SJnU2lvz
TLSH
T192E43995ABB514A9E9E6C17C86534A37E376F4142330AFCF0661853D0F1BBC92B3A358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\psutil\_psutil_windows.pyd
Size 65KB
SHA256 e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996
MD5 3cba71b6bc59c26518dc865241add80a
SHA1 7e9c609790b1de110328bbbcbb4cd09b7150e5bd
SHA512 3ef7e20e382d51d93c707be930e12781636433650d0a2c27e109ebebeba1f30ea3e7b09af985f87f67f6b9d2ac6a7a717435f94b9d1585a9eb093a83771b43f2
SSDEEP 1536:BWseNxkc7Xva0Y420G1UD+dS4QBeLmRy:BWkcbi0Y42bUD+dS44eiRy
TLSH
T145635C56B35800F4D95BA17C89B36A33E9B2B0521729A7CF05A0C69A0F63BD7633DF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\pyexpat.pyd
Size 187KB
SHA256 5caf51f12406bdb980db1361fab79c51be8cac0a2a0071a083adf4d84f423e95
MD5 2ae23047648257afa90d0ca96811979f
SHA1 0833cf7ccae477faa4656c74d593d0f59844cadd
SHA512 13052eb183bb7eb8bb2740ff39f63805b69e920f2e21b482657a9995aa002579a88296b81ec415942511d2ed146689d1868b446f7e698e72da22f5c182706030
SSDEEP 3072:s/aC72KSgM/ehOrwkSW8chDNcKNOxywSXaFUAKLnVzPOvNRyfIvfTZvZ3OFVnVvU:QaQX/UehaTSW8chOFTiLndkyfiTJ0VvU
TLSH
T172145B577155C0EAE9538038D696CE07DAB2B861070197CF12A4E7BDAF27B923E2C319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\python3.DLL
Size 58KB
SHA256 074b06ae1d0a0b5c26f0ce097c91e2f24a5d38b279849115495fc40c6c10117e
MD5 c9f0b55fce50c904dff9276014cef6d8
SHA1 9f9ae27df619b695827a5af29414b592fc584e43
SHA512 8dd188003d8419a25de7fbb37b29a4bc57a6fd93f2d79b5327ad2897d4ae626d7427f4e6ac84463c158bcb18b6c1e02e83ed49f347389252477bbeeb864ac799
SSDEEP 768:bS99q+0o22ByfbEap+VCBQ53gUiT5pLFdBk4/yFi1nuVwWBjChtFyrUdmd9RSxD0:M9xiEAnUvdy5IIB0/ya7
TLSH
T15D433D525BD4FCA3D6E625FF38D19D89F42912C08D15949CA8799293FE1A233AE3730C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python38.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\python38.dll
Size 4.0MB
SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
MD5 26ba25d468a778d37f1a24f4514d9814
SHA1 b64fe169690557656ede3ae50d3c5a197fea6013
SHA512 80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080
SSDEEP 49152:7szv0pyfz43jjWo2tAfHkhPAXCZT8nyhhA2i2hLX5CSwkINazHO+MJnjPabxTdOF:7P/kuARjoNYH5MJubFiH
TLSH
T1EE167B32A79401A4DAB79476C5138706CBF2FC513B20E34A91A4BAD52F73BA316EF705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\select.pyd
Size 27KB
SHA256 fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
MD5 e21cff76db11c1066fd96af86332b640
SHA1 e78ef7075c479b1d218132d89bf4bec13d54c06a
SHA512 e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f
SSDEEP 384:T2XLk/FcA2CTeHkXvwhMMHqS5C6l1tPe0cEJXa5IImGPDG4y8iD0hS:T2qXIkXvwhRHqSRtmKq5IImGPDG4y+hS
TLSH
T131C27D87D75468D6EC73C171B8E18F17E932B6104325C3EF226882694F677C231BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\tcl86t.dll
Size 1.6MB
SHA256 f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
MD5 c0b23815701dbae2a359cb8adb9ae730
SHA1 5be6736b645ed12e97b9462b77e5a43482673d90
SHA512 ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725
SSDEEP 24576:umJTd0nVi/Md3bupZkKBhWPRIlq5YZ6a2CXH7oZgKGc+erWJUVWyubuapwQDlaTR:umJTd4iMwXH7oZgKb++BVL4B+GITgr0h
TLSH
T10D859F17EB68119CD4BBC1B8C52BB907EBF1B4151360A7DB51A04B922F23FE2277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msgcat-1.6.1.tm

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\tcl8\8.5\msgcat-1.6.1.tm
Size 33KB
SHA256 4fdf70fdcedef97aa8bd82a02669b066b5dfe7630c92494a130fc7c627b52b55
MD5 db52847c625ea3290f81238595a915cd
SHA1 45a4ed9b74965e399430290bcdcd64aca5d29159
SHA512 5a8fb4ada7b2efbf1cadd10dbe4dc7ea7acd101cb8fd0b80dad42be3ed8804fc8695c53e6aeec088c2d4c3ee01af97d148b836289da6e4f9ee14432b923c7e40
SSDEEP 768:joWBAxonz0L7KILBk0U8Vl9NFljRFpGA1TrPiBDxDFP8sCNl:MWBAxgzY7KIL7j1NFl1Fp11/PiBVBksU
TLSH
T134E2E659578702A735D251AA2CC592E41E3CD26F206E9D4FB8AE810CFB09F6D43F70E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\tcl\auto.tcl
Size 20KB
SHA256 f385515658832feb75ee4dce5bd53f7f67f2629077b7d049b86a730a49bd0840
MD5 5e9b3e874f8fbeaadef3a004a1b291b5
SHA1 b356286005efb4a3a46a1fdd53e4fcdc406569d0
SHA512 482c555a0da2e635fa6838a40377eef547746b2907f53d77e9ffce8063c1a24322d8faa3421fc8d12fdcaff831b517a65dafb1cea6f5ea010bdc18a441b38790
SSDEEP 384:vyPcB5RJtAZ7SP9nYP9I5HU3mOuWzXBEWKYHEN+7yBtYSbI0QD+lM:AcB5RJtAFSPBYPN3mOuiVHEN+78YSbqT
TLSH
T18792A7639FE442B62092C13B186DB9A4AE7FC2BB4625841538FC921C7BD1814C6FF7E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\tcl\encoding\cp1252.enc
Size 1KB
SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
MD5 5900f51fd8b5ff75e65594eb7dd50533
SHA1 2e21300e0bc8a847d0423671b08d3c65761ee172
SHA512 ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc
TLSH
T13711492446A18DE8FA4F30A520ECFB70857374F3D1DA229027388304D38DE8D0C997EA
MD5 SHA1 SHA512 TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\tcl\http1.0\pkgIndex.tcl
Size 735B
SHA256 420c4b3088c9dacd21bc348011cac61d7cb283b9bee78ae72eed764ab094651c
MD5 10ec7cd64ca949099c818646b6fae31c
SHA1 6001a58a0701dff225e2510a4aaee6489a537657
SHA512 34a0acb689e430ed2903d8a903d531a3d734cb37733ef13c5d243cb9f59c020a3856aad98726e10ad7f4d67619a3af1018f6c3e53a6e073e39bd31d088efd4af
TLSH
T1E50110C7BFF423B01C118792364BD681DF18E218B37256F970A0A41C80A34269B47D35
MD5 SHA1 SHA512 TLSH

Submit Download

init.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\tcl\init.tcl
Size 23KB
SHA256 bc492b19308bc011cfcd321f1e6e65e6239d4eeb620cc02f7e9bf89002511d4a
MD5 b900811a252be90c693e5e7ae365869d
SHA1 345752c46f7e8e67dadef7f6fd514bed4b708fc5
SHA512 36b8cdba61b9222f65b055c0c513801f3278a3851912215658bcf0ce10f80197c1f12a5ca3054d8604da005ce08da8dcd303b8544706b642140a49c4377dd6ce
SSDEEP 384:U8Oh2gWD8Ud4zaJqacMQsRNLKx32LgWMOFaBBf6/9IrO1zWq8oXbjdEfdQxAp12Q:2OD8Ud4WJqJfcMOFt/9IrOBWq8oXwQxM
TLSH
T115B2E90193D4A1727193413A4DCEE698797EC1FB59AC8A7D7CCC824C774261A8BFA3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\tcl\opt0.4\pkgIndex.tcl
Size 607B
SHA256 eb9925a8f0fcc7c2a1113968ab0537180e10c9187b139c8371adf821c7b56718
MD5 92ff1e42cfc5fecce95068fc38d995b3
SHA1 b2e71842f14d5422a9093115d52f19bcca1bf881
SHA512 608d436395d055c5449a53208f3869b8793df267b8476ad31bcdd9659a222797814832720c495d938e34bf7d253ffc3f01a73cc0399c0dfb9c85d2789c7f11c0
TLSH
T1FCF00CA6BBF043A085014DD33988A7812F6DF178711000F57818E09CE2A10A28F9B8B2
MD5 SHA1 SHA512 TLSH

Submit Download

package.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\tcl\package.tcl
Size 22KB
SHA256 47b6af117199b1511f6103ec966a58e2fd41f0aba775c44692b2069f6ed10bad
MD5 55e2db5dcf8d49f8cd5b7d64fea640c7
SHA1 8fdc28822b0cc08fa3569a14a8c96edca03bfbbd
SHA512 824c210106de7eae57a480e3f6e3a5c8fb8ac4bbf0a0a386d576d3eb2a3ac849bdfe638428184056da9e81767e2b63eff8e18068a1cf5149c9f8a018f817d3e5
SSDEEP 384:I72oQXm9jcLyBLWueSzvAXMiow90l3NhETrh4NLTluYhoNL3ZAqYi:I72oQXmgyBCqvAcFw2dhOrh4NZVhoN3F
TLSH
T1FEA2FA12E7CC52A6348241765E497D9D0F3DC0FFA1A951BD749882EC7780D2A0AEE7F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tclIndex

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\tcl\tclIndex
Size 5KB
SHA256 abf7d9d1e86de931096c21820bfa4fd70db1f55005d2db4aa674d86200867806
MD5 e127196e9174b429cc09c040158f6aab
SHA1 ff850f5d1bd8efc1a8cb765fe8221330f0c6c699
SHA512 c4b98ebc65e25df41e6b9a93e16e608cf309fa0ae712578ee4974d84f7f33bcf2a6ed7626e88a343350e13da0c5c1a88e24a87fcbd44f7da5983bb3ef036a162
SSDEEP 96:esataNULULUVUhU5U1UIUZUJeUpgURUFD15Q0AkU6PkrBkGUjZKspDzmK5SMFTub:eNtEACkiwM3g4ePOiD15Q0AkU6PkrBko
TLSH
T148B1221EB756822893D481070995FE687ADED1E4D23DC92E99A4E1CD10B30077FEC9F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tm.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\tcl\tm.tcl
Size 11KB
SHA256 6437bd7040206d3f2db734fa482b6e79c68bcc950fba80c544c7f390ba158f9b
MD5 f9ed2096eea0f998c6701db8309f95a6
SHA1 bcdb4f7e3db3e2d78d25ed4e9231297465b45db8
SHA512 e4fb8f28dc72ea913f79cedf5776788a0310608236d6607adc441e7f3036d589fd2b31c446c187ef5827fd37dcaa26d9e94d802513e3bf3300e94dd939695b30
SSDEEP 192:CnjVD6gOGFpvXKPrzYkWo55z3ovPvKvaWZPZ9W6TV9ujpZw7K3mQ4auPltqQvu9:CGQvX+XYkn59YvPSvDJTV9174zuPltBC
TLSH
T18132A453A3C8137BA29303691E8BE2E45B7CD1FF53D5A1A9B81D81A4370192807BB3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\tk86t.dll
Size 1.4MB
SHA256 1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5
MD5 fdc8a5d96f9576bd70aa1cadc2f21748
SHA1 bae145525a18ce7e5bc69c5f43c6044de7b6e004
SHA512 816ada61c1fd941d10e6bb4350baa77f520e2476058249b269802be826bab294a9c18edc5d590f5ed6f8dafed502ab7ffb29db2f44292cb5bedf2f5fa609f49c
SSDEEP 24576:J7+Vm6O8hbcrckTNrkhaJVQhWnmb7u/DSe9qT03ZjLmFMoERDY5TUT/tXzddGyIK:JCQ69cYY9JVQWx/DSe9qTqJLUMPsJUT/
TLSH
T165654A06A2A1C198C467D178C5179EBEE7F17C00931457DB29A8BE693F33BE2277A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\tk\pkgIndex.tcl
Size 363B
SHA256 cd44ee7f76c37c0c522bd0cfca41c38cdeddc74392b2191a3af1a63d9d18888e
MD5 a6448af2c8fafc9a4f42eaca6bf6ab2e
SHA1 0b295b46b6df906e89f40a907022068bc6219302
SHA512 5b1a8ca5b09b7281de55460d21d5195c4ee086bebdc35fa561001181490669ffc67d261f99eaa900467fe97e980eb733c5ffbf9d8c541ede18992bf4a435c749
TLSH
T1D7E0C0A603716E23039210136998F9CC7BFDC2FB950CC3AE201033ACCF1104060E54F9
MD5 SHA1 SHA512 TLSH

Submit Download

tk.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\tk\tk.tcl
Size 22KB
SHA256 e1067a0668debb2d8e8ec3b7bc1aec3723627649832b20333f9369f28e4dfdbf
MD5 3250ec5b2efe5bbe4d3ec271f94e5359
SHA1 6a0fe910041c8df4f3cdc19871813792e8cc4e4c
SHA512 f8e403f3d59d44333bce2aa7917e6d8115bec0fe5ae9a1306f215018b05056467643b7aa228154ddced176072bc903dfb556cb2638f5c55c1285c376079e8fe3
SSDEEP 384:dmAlIQ7ylH462gngqeObubqLwvoGah0QSA4jLGn3WB0MCdPAWD+g190K5TzMSW4d:dmOIQulHokh0QzMemB0MCD+g1bk+
TLSH
T162A2C6199DE066B3646BC02F13EF2E00E4B4A4FF1A69AC4A79DC5D942F4883A01FD1F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI16602\ui\i18n\en.json
Size 8KB
SHA256 892f32d0d8ae0a59fe305e029f61ae63ad9908f2414a78d5cd35d3903103cca7
MD5 1e3f18d2a118bbbff4f7d50b05dfbd8a
SHA1 3d1b74722bb83f2d24af6c1a6afe01db18c4b9f5
SHA512 d8b602350dde8f2facf97635e82ac6d112e6f00101f27f1e6fe1bc140fcb8ed9ecc9c91c6add2633551568b2b0a4c1efa0f2a3bff37d2a8be05450d0a9e52740
SSDEEP 96:yUriE1hA+SV5vmpFEeh3SvgR5iNMpE90Di3AwHDfCSOZ67Z9wfJ6FzONYS0N6pUb:yU2gXm0E6CL90EHrCScj4F/S05b
TLSH
T15C02B363A610116709F20352786B5B837310DC5B4781392847BB896D24DE9BBA4FFABF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads