a16dffe4f3ff0e85b8a14cba0388df71a84c19721bd18e4fadc44c216bc4c5a9

Analysis

user interaction
yes
max time kernel
75s
max time network
78s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/07/2026, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
TBXX_Flash_Tool.exe
Size 27.9MB
Sample260720-qse69adz21
SHA256 a16dffe4f3ff0e85b8a14cba0388df71a84c19721bd18e4fadc44c216bc4c5a9
MD5 d8e1b8e88e01ed45141bab8ac9ce13af
SHA1 358b4e3e7f18ee54dface83db2c9fa1637b5fd86
SHA512 8440bfb6acd923df9776820039150c78a6fa5865db4ea60a322dede573cfe9b646d770b8eb989741606849e3beae357c2a249eaa392bf1bd7055f3fa45e2d401
SSDEEP 786432:eEMALRzMQBtLdUAqGNpfu2uSc4uWGlso5EYWCMqOI1V:B9zzBtLd5VpW2uSc4uZd5EE/
TLSH
T1F95733BCE6928436D120453189E0E7F1801D7CE1FB3BD90BD6397FA12A7BB85632526D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 27 IoCs

pid	Process
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe
3716	TBXX_Flash_Tool.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TBXX_Flash_Tool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TBXX_Flash_Tool.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "57"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3716	TBXX_Flash_Tool.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3716	TBXX_Flash_Tool.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: 35	3716	TBXX_Flash_Tool.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3716	TBXX_Flash_Tool.exe
3920	LogonUI.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 3716	2336	TBXX_Flash_Tool.exe	80

C:\Users\Admin\AppData\Local\Temp\TBXX_Flash_Tool.exe
"C:\Users\Admin\AppData\Local\Temp\TBXX_Flash_Tool.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\TBXX_Flash_Tool.exe
  "C:\Users\Admin\AppData\Local\Temp\TBXX_Flash_Tool.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3716

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a12055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\QtCore.pyd
Size 1.8MB
SHA256 d6b854269fda87a30bd677099633740e00a356a20fadbd0c784509982fab649a
MD5 80393eb5ca5f46285a5945eb4c2882d0
SHA1 b6f1c5190b7905a8b207fa141674c341f0ddc6cd
SHA512 e9872ea90722a06431542b034c347054de2a705f31ccb96c2bcffa4e5061ea09b74557b435a36fe4994e98ebc0ead7e1372d28c6c81803162fcdc2f7b6e928f0
SSDEEP 24576:YXIaveh0DtN2GYz5EZa+3L5C2A4ilvYRweqnCU+/qYyocXw8d+m79tkImWwThrb8:c1dYux9dx3mCmQcxOG25R
TLSH
T14385D9C2D74610A2E6DC81B44772D63E8766CCD8EB1D89F76DAA9D049921EFB41383C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtGui.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\QtGui.pyd
Size 1.9MB
SHA256 84c78e285f3af0d6f819b6e1094c4e7b5f6c70758b6fab69243e895a767c0cb2
MD5 db09f347d547c43ca96048feffbf9714
SHA1 8491b18ee31e484a840a5bf85e7a36f45097d83f
SHA512 0bcceaafdcd47631c95af7acc7c6c908e1f981efb37ea8f0469f02f4a4df41bbfdb9a2d7bf73170aada4ec391d04fbd8c2bd67d964253ae8d413076bc0bd8df3
SSDEEP 24576:k6COOhRz5TX4SPHm2b/Qb43clytfT4F97kau4RgIQi:Wpb0XF9QQg
TLSH
T1429506F69355A0ABE9CD03784B1EEE6B8976EC8C7B1C62D3D0665841DA70EFF1174280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtWidgets.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\QtWidgets.pyd
Size 3.6MB
SHA256 23abcf41647319b7feac1e01ace81345b45eb84a5d49247252507e87e47a5b9b
MD5 d44f97e3a6790a0e7f6cb525a809ea65
SHA1 38579415038ba6bfaf808637926a47c3c0d7b51e
SHA512 a4f94dea70375c06fb6fbd44ed8a957e6afe9f0523bc7f33bde20b79516d285802ae44b460f693c3ee8ee8681bad844ef6319be7374c0de32c2ae97d7811c90b
SSDEEP 24576:8JHhIypYM3X04BCPOzVUhmZawgl14SR89ey96pRqgsR6o59V/AM2jdBsUthemS2O:8Ras+qFEu
TLSH
T1F006B4D6A76512A8F5D9C478077243EE8A059D8CAF4EC9C31637B5067AF9DFF8038260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\iconengines\qsvgicon.dll
Size 34KB
SHA256 adab56237540f2e8775f1d903f29a60b0d3fbb7adfc516205ec2e0f6ec17e294
MD5 edb0a6dffbc132e4ff36b2ca4c243c1e
SHA1 7aa22e946b58626be4dbdf5bbbf85b8745e265d3
SHA512 b305f01dc365431c714889d7dda1d463c9b5afa8faaec72f4083aa9317d3ec8b899991b1a4b82075bdeda52a5203ee65969cd4cc090cff6e1090073799af4223
SSDEEP 768:SE7X1LJChKSkvyOJvVnn0R47MFpEk4DtymztHA:1T4K7tVn0R47MfEk4RHZHA
TLSH
T1B4F24AE2762910E3E2569630355DEE27C83DFBB01BC1C1C7E72B596958563F27E3820A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qgif.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\imageformats\qgif.dll
Size 31KB
SHA256 026e8b5cd6b132ac8ccdf5250b7493a784e7278388e42a0128896ef9fbe9a226
MD5 89b36379e2611b1a4d818d101e825430
SHA1 beebc985006ef2ab5919bd7ed21896b50450835a
SHA512 876d9f63394352774a490881b9ea8b2e5b0c5b92911ba452a489641d293b97c86a612b734190b6dffd569ea2b17e4522c75069bff782c0168b3e585d49023f71
SSDEEP 768:fbB/xMPX85dEQQSudZ9gwAhjiBuUoxOyhCNJemzWV:fb3I+dVudZmjiBu3xOyhMtM
TLSH
T1A9E24981A72640E3E64B4B70B659AE238A3CF3604FD09697EF5386191C557F27E3120E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qicns.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\imageformats\qicns.dll
Size 39KB
SHA256 4c4a9eecb7fe351446e5a9114f4e497afd6d0ccaef2b4c4becd6f40d22a46476
MD5 a4bbe8826718a36583eeb8175fa88a8f
SHA1 0774ba07c507d979a082dabf24bf8d89dd128256
SHA512 a4d4053ca22b4e6704a22a5a5318c2d91769f33519a0fdaa073927bfd5ae36d485d17d3d2461c70b9831088e4dba3e6e24fc6cb98a0445eb0deaea6f218de8a6
SSDEEP 768:nqZSHDIwGDb4WzFmm35+HQdEPe7eIzJBymYbNmmzl:JnGPFmGEPe7RzJBymYbBx
TLSH
T103034A11931E90F2E38F82B4164D5F7FDA39FD524BD095C387638AA428567E1EA3630E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qico.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\imageformats\qico.dll
Size 31KB
SHA256 3b6f9597bf4f566037e5383aab5c341377130215ff490b03ded0052d3cdac385
MD5 9b139b72dcd7bfee05c5be5894577ab2
SHA1 48263ba8d38724dd9f0dd7df65f6e1229235b7a2
SHA512 19f10e3c0bf021284c13998b62f18e4dd0dee0f4e635267a1af80bcb260ebb2aace3813631f1667f657edc16cd5c4d8e51ff435e72c1173fda67610e9f77992f
SSDEEP 768:9fCWKJEH+0wYyCqdWHy6lWzoiHoC5Ksu+mzE:Fl7+0w0yWHy6lWciIC5Ksu7o
TLSH
T1A9E25C41EB1A94E3D6578A70189EA737DA39BB604FD283C7ABD386111C523E33E3420D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjpeg.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\imageformats\qjpeg.dll
Size 363KB
SHA256 f1c7220fcc5dcf03abd5e85f32972cbb257f998467f633b8f7f3e784883e1d3c
MD5 1caf112183dd8471d070741c45d311ac
SHA1 a8f7ad36895ed5a24f48dda276f6b75a20d06651
SHA512 859437bafbee1770054318e89ccfdf95b5fa3aea1bd996e6ead4054d18c98864a790109d38aeefbf6d7a32013fd61ee5379460b8f6f27c81710a4804b6342fec
SSDEEP 6144:3gMI+xk4g+EAgi3RktRjDqrZsLOi5mAlGHqsA92VaDTRsI47cYV:4+zogktRd5jGKxs
TLSH
T18084D542F2969D83CBC50A36CD56D6BA57247E6D8BF381F3B1803BE9B8317927835244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\imageformats\qsvg.dll
Size 26KB
SHA256 687d06a59c5f309bb23c1686b1006334b93b80f8ffe79fa104ce1ce4c65d6cfe
MD5 d67e6e1c57cf3343617ab0746f377cd0
SHA1 824a69da868341477a49bab53a1a93fb918be536
SHA512 a06f905116dc8f47c81197d9a51ba186e2d2216356f5e1fc57a478756c5630e64688e8f5d2d8b54bc9cc3e87eaffccf04153fbf0aca30530477fa86e17fbcaf4
SSDEEP 768:Q59K0WZmBaxfzmYJxhK1phCJ0hTLmYmzX8:LBZmB4CYJ/K1phc0hTLmRz8
TLSH
T1DAC26C43FB1A54B2D26B97B42689976BDC3DF1504FE2DB8B9F0386441CA93E12D3910E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qtga.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\imageformats\qtga.dll
Size 25KB
SHA256 393b59c7cb391c731c33eb1b5a955f2c19fd88d90b6c4012ad9ebc590aa83a68
MD5 e385362d7beb98a438e26477799c1846
SHA1 e02fec01ced9a5d7e43d8e1ed7ba0f894e6bf494
SHA512 8b9fa8fcd01c8275aba70d2fe73ec1dac5359965f119a3b5a81d3fa120db59ed3b5bafc0afbf0cc4229fa8f18df4f88ebe44870f41b26190210a7361c976d6ed
SSDEEP 384:sXzYtpMekttC0JS4C1wQEP69nuZc25L5yyrqLlpIbnfePPLTTjxO:gMtieINC1tEP6cH15yyrcUbmzlO
TLSH
T1A3C25B41FB3690B2D65A86B02995EBA39D3AF3604FE1DFC36F964B451CA87D13C34209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qtiff.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\imageformats\qtiff.dll
Size 337KB
SHA256 27d51897581ed80a4f946940a9b38202fbc9d4849866b2de204cc34925dbd53f
MD5 37d86ff55f994394bb9b09a1c3094a74
SHA1 c30ad4c4a335a2164ca153a675b59eb16acd4fe7
SHA512 070d6808cd0a58283bb6529fb1dd49e0f38c6fe5e67e43abe213b8b7c18df4cb5fa942dd119c6495d44ae586a8a0cb33a76857a0f6ed09825f3c477f7f35c485
SSDEEP 6144:U8k5gJ4+mkXVTgmxadjwgMYxIzjtOSBsDEilzGCHm7SPjj3:AC5msxa9wgMYxIzjESSDdJ
TLSH
T15C749000DEC199A7D9B4417566FBC762B633A58A3F02CB87E74875303A027D129A71FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwbmp.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\imageformats\qwbmp.dll
Size 24KB
SHA256 abe95f636d16c881bcb73bc45c1b64fcee1df6572e895f14df8e49b28f1fb8c1
MD5 97f86c476df4253aa88e344eff599987
SHA1 9446dd5085ebd0ae4c83f3b755aa861731d23105
SHA512 fafc7be061f5f597c04ea1ddf368957c01ac73a87ed0d73e3f3aadcbe20ec24998ed702df49c55e4fec009057c2862595126643102cc23075667c890469b43c1
SSDEEP 384:oTM63PGwsPCCxx94YUJAhm1PAME2DfPAkVr1rUZci5PWQyJ0nfePPLTTjgl1Ok:oY63PGqCOYUShmrE2D7UXpWJJ0mzk6k
TLSH
T18DB25C52FB2A40B2D39786B029A997B3DD39F7505FE1CAC7AB5686042C643E13D3420E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwebp.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\imageformats\qwebp.dll
Size 424KB
SHA256 2cf6f48e38601bef86bb0763ecc62a0e74603d90c46f443a9875f74d566081c1
MD5 2f92aeab2694d9f1e9a3b44f5f091e1b
SHA1 c0c7ad1d30707db08cc9c8557cff977a16683261
SHA512 4687481f31a210dd06e7281830674c0a19f82e7c01fd61fdd847611aa3002f4c6fd8ad9d7b1f03629c3df7863631a0ea4e11c091abe21270c1496bf80a414b9c
SSDEEP 6144:j5lVOS+iwDdJ7+nhx4O96dzOVrlS6PsDrQ0VW13TkRPvoq/aMMxurkVSREwTVU/:FlVOS+17+nhadR6Pp0akR3PayhU/
TLSH
T14A947B409A8775D2E88F20F454EEB77F25341E188309D4F397D47E26B8326E05AB778A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qminimal.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\platforms\qminimal.dll
Size 680KB
SHA256 211b40dd4eae41403398690ac9bd46639b2e2ec84f94aec61b80f8f9106646cc
MD5 a9543406b1d70e863e10806af3e03093
SHA1 e267b459dac15560bd373407a2d45cc29ceb5693
SHA512 f9524f30958ff77c4badd2224925d7edd111ace61d1b375c80a87ae8fd03b7768a47655bcd778ef72a953f1904d99497c76291c78c1cbb3829fae9d26a9f5d2c
SSDEEP 12288:BG5VpMuVMdIX4RtZfzyCusxt9exdlHluz5vm6jcHPfEWmAd:BGTbfXo7fzWOy5HlyhU0ZAd
TLSH
T16AE49D82E79301F1E6C70275426FEB3B4A35661A0335DED3D3906D21A9312E27A3B75E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoffscreen.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\platforms\qoffscreen.dll
Size 605KB
SHA256 b13fc173466d40a32aac48e795bd4a35ee57e4ffc362691ab477ed7f50dfb821
MD5 ae845331c29ffc36864e508f1a9fbe8e
SHA1 8fa6c621e982adfb5f36d6e25ad59709a8543288
SHA512 01254d672631a84185840a4affb78900df41fe7722e78ce0fc174f815bb47678a9ace6e24c478fe575b8631a875714d20457b7964fd33de94e45c8011e4a5df3
SSDEEP 12288:6CtU5p6s78uiGd0W+/yEs2ePmhR5MFzEPO47OgMwFUfEWmJr9:6f+sIhGdGRKAR5MJEmKMwDZJx
TLSH
T175D4AE82A79201F1E6CB0275527BD73B4E3993050325DAC3E3942E65ED216E2B73B35E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwebgl.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\platforms\qwebgl.dll
Size 546KB
SHA256 117831dfc90396807edf0e0fbf27f69eb06b16a02eb5567abc521a4ca8fc9552
MD5 35798b4932d017f610303933fbeeef77
SHA1 145a313035842c0eb649abc24a2a013dd6773112
SHA512 74af4bd7e620c457fdc507164ba997ace37ebdcf6368bbb0aae534ecc8bf796d0f0296fc740545f8e9701b124922d798f214a883fa335670562dfb6955ed8cdb
SSDEEP 6144:pbe87tIu0I7mLzYzRaHiMGA42YgJSUSejRhWr0Q+lZMrSqVVRCl/IMobYcf8dep+:0t/qA1OM22p9rBU/gaK99Gj+nQP+
TLSH
T14AC407954A43A64FE88D5BBC08CC5F69822D69683B50AFE3E79D8C1B616C4F4113B31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\platforms\qwindows.dll
Size 1.2MB
SHA256 498d0cff2610e1ef768bfdd7acbe1e7864a10efcc92a243a471214c762c3f5cc
MD5 7da843d8e261bfa0f2f113696221b104
SHA1 2256328575743ff0b557ed79865f5e39215d0436
SHA512 f4af2a407998be6b72945311322e8c30dc1ee78cf97570844a100ac0b9dd7ea4e1bee0e9a9d35b147beb2189b4311492dc8e1824cd8948dfc4d3d01c70d7f4d3
SSDEEP 12288:HbTJHgJCWntPlPWJoWBx105Xyq8oTCng7UGn15/cjgHehHsqTz4jvF3vXL6g9Afh:7uJCs/WL0MYTAtGnHkT5sq/4jdfHZl0
TLSH
T1C4458E46A25204F1E48A5ABC115FAB3FCA397214031385D3E2947E95F9322E379BF25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qxdgdesktopportal.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\platformthemes\qxdgdesktopportal.dll
Size 48KB
SHA256 f7d2da3c2c16fafaa9a2a84a8ceaa1094c0e23d0b51e9293d686269ee871fd0d
MD5 6b45eb3b364f3cb953f32c1d79b5a036
SHA1 6a027641e84e81839dfd002c87f233083c9b6055
SHA512 b30de8404941fe6512ac4195bf62617c3d5d2ac25d79f84dc62a0b3b2c5a8534c42b48c6a0968d7cbbc8c33ae84209f2a717befbdbe22d407bad08cb08ee6ac3
SSDEEP 768:DOd2YfRcUVdWGl9TLPqCATmivVTZMI6htFOztuCpm0aMwxs8ZvRmzL:Czf/rTLPqDmiNAhtFOs4m0aMwxs8ZMf
TLSH
T1A6235B51A66706E2D1D5C7B558EA972BC33DF5604BC296C7E31B4A320C763E37E3820A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\Qt\plugins\styles\qwindowsvistastyle.dll
Size 125KB
SHA256 44ec4a0f209f5e70b3e35b49a40309341b431f85d2e41bad5be7f2324fa50209
MD5 f0d2ea738bea593f3e8012ff5f2ee11e
SHA1 5cb782c86b5e1d7657851a91671a7062cd6aec36
SHA512 acfc9d82a944caec5dfb61d01c5ae248108d9d2607cc9656f64d079f4219adc909af65f77c33c3b865e6864b568bc57eac6fa6c001302d65815c2ace75be15ff
SSDEEP 3072:7d7EZwu0H8ThK12N8EjGWG9ctleZY6hABwZ0cHtQ4NH4MVM6em2QQNNv6KIjSlDf:S48T0VEi9tVBnNYMe6em2QQNNv6KIjUr
TLSH
T1A2C35B41F29781E0C1C6A1FC041EA757D63BF638833495E7EBE58EA2A4513A31E3A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sip.cp37-win32.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\PyQt5\sip.cp37-win32.pyd
Size 97KB
SHA256 7f666c892c5210a23c0fb414ecf0ece4b6778bd3c68047b2f46a74993ec8049c
MD5 51c15eefb4f7bf5916c0c357bd3d560c
SHA1 bacaccbf745082774f7fc761baa48ca8b9455bb9
SHA512 a93f5949f939e2ffd0a7d9e41092a381f5fabae50e6cbad62ad471baafd1e2512c6a46fbc674ddb85d4225c3cb274b4dd67608e921247c314e04083e3d9402a0
SSDEEP 1536:zTdULQyT98xPQjLIu4/tAhWOu4Y7JxPIhh6243bXWsknsSu/TTlZ:ndF+Ll4Jv7DIh143j2sl//lZ
TLSH
T124A35B42774C61B1D4C951BE63B25AF35A3F20994F6229C3DEE0298C9765AE34B3D30E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\Qt5Core.dll
Size 5.0MB
SHA256 cf8e93aaa512d06c33eeda299f9a9e2f03ce2579cc3019cc700c14dc712c044e
MD5 a8aadbf8569b2666ed428cac867ab3a8
SHA1 1bb02bd74b5389d81c55db271d3193ab53231a03
SHA512 75cf1b1257beebcaaf6e012ee79c1349bc7610fb309d07979f7d22744a14368f472db5230c18f64a2341fc8810b99417a547ae341ec39fdbcec62a7f2ec2cac0
SSDEEP 98304:8Mh6WxtebHCfjJsv6tWKFdu9C+IvZRnZy0Z/r7:8Mh1fJsv6tWKFdu9C+Ir5
TLSH
T150368D91BB978276E596C270C87F775F0429E8014B1245CB93EC360A9A756E23F3B34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\Qt5Gui.dll
Size 5.7MB
SHA256 c4f002232626cb9acecd55eb83f4ffbe48a9143327ee6c80e98d3609454e2ac2
MD5 806e5fdf1b7f8bf1ff3b5b2932a9cc51
SHA1 97f72fb4962d8f4c34eee2f31c1d463dd8809a3b
SHA512 3c7d81c87b3d2dc8765839fa3e537e87b4519ce1f303f5baed2f48e09273fb11d9b1ccc9c61613b560462de1702bcaf70157e3279bf1b9a07daca128138c8902
SSDEEP 49152:U6SX6DQsWn9/Wp2DUivYrMbNo2iw5MUzLzYc4Lm4TCMHr/wOn3aiChtNNmgnmzLJ:U6DQypsnvuMba24rRt/wOqme5A
TLSH
T1DD563B91B1827173CDA2D2BE270F66BF91B7A952C30493C386999F9455303FA0F7B906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Svg.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\Qt5Svg.dll
Size 265KB
SHA256 d099dbdefff005ff9b3338914b7c0dbba4aa1ddd6cd46749100b8b4da5e3ac5f
MD5 a90572a270f154280b7a6f6bfeb8793f
SHA1 4d292ced5552deef2a4454313c5379c948f4e70e
SHA512 27e8b06f335ffe0fb63fd3826dce0b9a349a4c18bcae9795728e2178719e03a1515e576090fd0023686b3d5ae775cb3860e2690a87b3d2447ad9adccf4360d63
SSDEEP 6144:bKjOkkWRDXWs5zF6StLYglQ8y8DvWgvNqW4UebzLgVA2T2LGyruaDkT:bsH5Z6MYgsgYFDkT
TLSH
T1B5443C52B2520DA2D58AD378785F2A27DB3AA08303798FEBC3599C6174643F05DFB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\Qt5Widgets.dll
Size 4.4MB
SHA256 a8a34fa960cd1dfb3500b5d2b486d9ad60125e2b78fa7dbb08141f3861092330
MD5 e0be43fee11c1a9ba5c1f28b2b3dc875
SHA1 2fbfd08c39fbefa4c855f1fd6f8c75748796a9cf
SHA512 3a150ab899569afb4c7cd29c269ff03f966217f459a03bbc4e626ca2ae772398eacf053f21dbafc74a5c48426f9bc6f4782ae039c894484f98cf786cfd3498ee
SSDEEP 98304:C2RXG0VkCA6SBJt++5MIQOQhQe2UmJMKxRIG9ZBsWhnkz+uy8S9LCdS4GnUZCgaJ:SC9xI
TLSH
T1BD267B53B28642F1C886D17849EF6B63C935B1054FAD52D7D38CEE4669E03E02E7E2C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\VCRUNTIME140.dll
Size 84KB
SHA256 1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1
MD5 ae96651cfbd18991d186a029cbecb30c
SHA1 18df8af1022b5cb188e3ee98ac5b4da24ac9c526
SHA512 42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7
SSDEEP 1536:RPwKQRaeU5QsPWFP/wPENm2eK7oJnoUSgpAY8ODcDcm7cIs+4ecbV6iVBoA2r:RwKQRbU5P4XwPENm2eK7mnoUSgpAY8Oa
TLSH
T17A837D11B1C040B1E15608B612E99B23FA7DA3734FD94DCF5FAA5C8C1AB93D2A73425B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\_ctypes.pyd
Size 105KB
SHA256 6a6df7d77b7a5552d8443bd1b98f681ad2e6b5a8acf7ade542dd369beab7e439
MD5 9db2d9962cbd754e91b40f91cbc49542
SHA1 945ae09f678a4ca5f917339c304e5922e61dd588
SHA512 a9d522f5768d265e2dca80faea239cc0ba7bec715d23058571651f8b61402650c01f3bca7f4d10e6806c8a553e79569dc852381d44169f535d63e85148d24e29
SSDEEP 3072:EFvvoeWfh/jlH0GIQTL9XaT90NO/zZi+ujoBITVPaaCpT:ioHR5x1W0NO/zZ/uEpR
TLSH
T17BB37C817A8AB111EFDB40BD63D75EB1356FB09C4F7A08E366A900D845B49C36E3D34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\_hashlib.pyd
Size 31KB
SHA256 2fcb297733e6080480ac24cf073ff5e239fb02a1ce9694313c5047f9c58d781b
MD5 e84e1ba269371e439c2d52024aca6535
SHA1 2abac4b3eb0ab5cbb86efd964089833cd3bd164f
SHA512 22eaa0f42895eba9ab24fe1e33ef6767b2efa18529794d070858f15e116228d087fe7d3db655a564e52eb2ea01bf4a651f0f82417e0fccca8f770057b165d78c
SSDEEP 768:wzONtWOKWHRsYVXwZDcejkaAGSni+L/9ZCOumdITsI0dWDG4yYb:wzObPTxZ9M4EJAHig/9ZCtmdITsI0Iyk
TLSH
T139E26C09FE5044F2EBF6017831D1E7536D2AFD300B9590D3A3DB81CD4EAA593653A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\base_library.zip
Size 769KB
SHA256 ba7d743d7361dfdeb7e412413bcc26885fa6237b787d5eccc9f7bb04f334a354
MD5 15e507241b01459e832a6061277277ba
SHA1 024821ba52a1a66dc93cc309ad1641c5904368bc
SHA512 fdce0eca675a75d53a0bf5952de0966295c7a02c03775fb0dadf71ac172fb7a417e7ba56e4702330c70fcc17b2e20946cb7f5f48aec22ee3f2b1630f72108d8b
SSDEEP 12288:BCRMr5bf+Z81JJDnRbkqCfQETQlGVwyZV0X:AMr5XYfQETQlGVwyZGX
TLSH
T198F41AC05E866EB7FC6AF3BD411F86280A6C53375B88D1073A5D83AA1F4B7D01E35A49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\libcrypto-1_1.dll
Size 2.1MB
SHA256 9fefba93fa3300732b7e68fb3b4dbb57bf2726889772a1d0d6694a71820d71f3
MD5 c0e55a25dd5c5447f15eed0ca6552ab7
SHA1 467bc011e0224df3e6b73ac3b88a97b911cc73b8
SHA512 090b03626df2f26e485fea34f9e60a35c9d60957fbcc2db9c8396a75a2b246669451cc361eb48f070bbc051b12e40cacf2749488ebb8012ba9072d9f0b603fa6
SSDEEP 49152:u6pNhGiC4Svid8zl9vN1CPwDv3uFZixc:ZNo4Vd8B1CPwDv3uFZi
TLSH
T1EBA59D02FBA71652E9CF867D12E7573F8E3266149328DAD38EA138A5C8315D0363F794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\python3.dll
Size 57KB
SHA256 5c65274adfa565ebbc0e8f4a59c1628bcde1250278a72dd926a15d842ec4f5be
MD5 65bf7cfe0395e5743b944f05e79f7719
SHA1 8b57b7b941e4ad15dc35eaf127dcf75ea3a1acc7
SHA512 07a8c2708861c5140bf3931a5a6273162b608a25635949dd74098ad94af8482f315ab1c91a5929b73e28caadccad8ea92b4abf8886cb8c2aa7a19bf9ef856f54
SSDEEP 768:vSvcU+4AjLLDRp9VpBLm6g5YuLIE4k8kF/DFz1OuIwfBSCciqy0oeDOm+FEuBITf:6vf+/La5gOBBITV0Vy3
TLSH
T1D143B44259A4F8A7D6E625FF7CD1DDDA282912C4812E99DCB47983D30E5A233AD3330D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python37.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI23362\python37.dll
Size 3.4MB
SHA256 625ca7bb2d34a3986f77c0c5ce572a08febfcacf5050a986507e822ff694dcaa
MD5 d49eac0faa510f2b2a8934a0f4e4a46f
SHA1 bbe4ab5dae01817157e2d187eb2999149a436a12
SHA512 b17f3370ecd3fe90b928f4a76cbad934b80b96775297acc1181b18ede8f2c8a8301d3298bafa4402bce4138df69d4b57e00e224a4ddbb0d78bb11b217a41a312
SSDEEP 49152:P8+exlMsuBmyrrn59LFjrF5if9tOpTLIK8VHsHMZnxPxbTRwEs+ML1plj:EP+3tF5ifvcTEKcHyMZPGX+6plj
TLSH
T1FFF57D31F401B135E8F524B3E3FE4AB648E9DC58672690C3A5D47CC98672AD326F924E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3716-91-0x0000000074C70000-0x000000007500C000-memory.dmp

Download

memory/3716-107-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

Download

memory/3716-134-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads