042a9accf93c7d5eeb64ef3aed3075dc2336cfe9807ade894fe6f7db516cb7aa

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AioBypass.exe
Size 44.8MB
Sample260802-22cy2aha97
SHA256 042a9accf93c7d5eeb64ef3aed3075dc2336cfe9807ade894fe6f7db516cb7aa
MD5 66592d9d2f189ec3a4f8eadd00b32296
SHA1 a91bb797d1b755a46289f1c35cad2990eadd74e9
SHA512 128d0336bc51531154d072f791b4559b5259a4a61efdf019134c9e25ea4916c6675ff498f370569ed0b6559db195abef165e349d073daf060f1fabae2fb7d488
SSDEEP 786432:TfpmexFNdu1b64UblJ1gESxaSZUR93gO8UggFesyFLoiEX1MB1p7C:TfweXu1BgJ1IZA3gO8UgQT+U31s2
TLSH
T10CA73365316040DDECE7BA3B17B79841D3B7B4227349CD9B23A087C96D837B41A3C99A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Loads dropped DLL 33 IoCs

pid	Process
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1572	sc.exe
2028	sc.exe
3456	sc.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4528	cmd.exe
2068	cmd.exe
5028	cmd.exe
3844	cmd.exe
1248	cmd.exe
2044	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2068	cmd.exe
3844	cmd.exe
2044	cmd.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
3188	taskkill.exe
2332	taskkill.exe
2484	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2924	AioBypass.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2924	AioBypass.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	AioBypass.exe
Token: SeDebugPrivilege	3188	taskkill.exe
Token: SeDebugPrivilege	2332	taskkill.exe
Token: SeDebugPrivilege	2484	taskkill.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe
2924	AioBypass.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 2924	3224	AioBypass.exe	85
PID 2924 wrote to memory of 2068	2924	AioBypass.exe	95
PID 2068 wrote to memory of 3188	2068	cmd.exe	97
PID 2924 wrote to memory of 5028	2924	AioBypass.exe	99
PID 5028 wrote to memory of 1572	5028	cmd.exe	101
PID 2924 wrote to memory of 3844	2924	AioBypass.exe	102
PID 3844 wrote to memory of 2332	3844	cmd.exe	104
PID 2924 wrote to memory of 1248	2924	AioBypass.exe	105
PID 1248 wrote to memory of 2028	1248	cmd.exe	107
PID 2924 wrote to memory of 2044	2924	AioBypass.exe	108
PID 2044 wrote to memory of 2484	2044	cmd.exe	110
PID 2924 wrote to memory of 4528	2924	AioBypass.exe	111
PID 4528 wrote to memory of 3456	4528	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\AioBypass.exe
"C:\Users\Admin\AppData\Local\Temp\AioBypass.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Users\Admin\AppData\Local\Temp\AioBypass.exe
  "C:\Users\Admin\AppData\Local\Temp\AioBypass.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im VALORANT-Win64-Shipping.exe
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im VALORANT-Win64-Shipping.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:1572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im VALORANT-Win64-Shipping.exe
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im VALORANT-Win64-Shipping.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im VALORANT-Win64-Shipping.exe
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im VALORANT-Win64-Shipping.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop vgc
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\system32\sc.exe
      sc stop vgc
      4⤵
      Launches sc.exe
      PID:3456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\PySide6\MSVCP140_1.dll
Size 26KB
SHA256 8ce6980144fadfea52b6f14f7799e05e3232c28414fb5e617968a814be33fc1a
MD5 c14abae6b40d2b59636dd5f4382ea78b
SHA1 fc6ba39c0b18adc7b04d8f0c3fdfbae78bcf5de5
SHA512 cfbbfeb82e29784c220cb642cebaf435d90c96fcdc9d1bbf63cfc00ee5825eb685d11d3796799ed97af1e520b8acf3fb6f3b4dbe7aeb02879b1d88bde9d27fc0
SSDEEP 384:3j02J9VQH+qNy09dmFWcS5gW7rHQIYiu9cQrPwcy8RbmL4nNydFs2:Y8QH+qNy0PmgN5YiuiQrd5AL/e2
TLSH
T1B1C28D43EA508C04EC278930E8C69D66F676F5904F92D3CB6399821D0FB63C27DB9769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\PySide6\Qt6Core.dll
Size 9.8MB
SHA256 d8c54af3d84b16c17a086451ee8ef6e821e478603ffb9b91c000a7e50d6a7f6c
MD5 22af3a84817188185ce8ddab8bf2a13c
SHA1 7b8390d0fcc502ccab8b7dffd69847b2d2bfb5df
SHA512 fd6062bac3ed219b1d9a87f242b2edbebafd30746b6004970d5ca9f19b3daee9ca1508ed490d37aefd2d0b31a21a997cdd400909267bab81f70200aa05e415fc
SSDEEP 98304:4VLKyLebAofeVMKFdu9CwJsv6t6mJMSKgVcC/3cP:WWPBSMKFdu9CwJsv6t6mSStZ/3e
TLSH
T180A6390766FA0011FAFBDA34DAB75112DBB27C466B3496DF025861185E337F09E3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Gui.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\PySide6\Qt6Gui.dll
Size 9.1MB
SHA256 34bc69bb2e21c11a6f318c60430852eddac856848842cf0c5a19d22f7733992b
MD5 493989ae73e24fcc27aa81cb4baf4530
SHA1 1be39c291e79a4833692ef89d88264f2c781fdec
SHA512 3e4b3bb4436bb2fd3b282d2319ead319149463f8068d979a03cc86a156dc0feda408744bc0e1bbd8302c1cbc15892876665d14a6a651e1499f2cdf2b9cc952ea
SSDEEP 98304:A17B8zKQ16be6OAZl5XWv7StQiYBNXcqQYOPTme3:U6ie6ZZTdtQiYBNMVPTmg
TLSH
T18DA68D57A2A911D8D57BD13CCB9B9517EBB2701503629BDB02A0CA152F33BF12ABF311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Widgets.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\PySide6\Qt6Widgets.dll
Size 6.3MB
SHA256 77dff21c7f28072da5d05288822f1e750d37e3827b2e051acad01af18d8d4130
MD5 380e17b274c5a2f3975ddda5bac59c46
SHA1 35ac56346082d138a2db53606b413ec04c59c695
SHA512 3ad223c1c3b111823afb5eccc861054949c92148ae2c833fd841c971d75587d65ad1b3fcdcc49e3d6a3407354708fedc38ee81302a6dd597b774b9e482b851ce
SSDEEP 98304:TLNqD/uTGvqxgiJaj4mxHJpd9tozE2XJHTYE:PNqDaGvqxgiJajFxHJpd9tozE2XJzP
TLSH
T1FC667B5763EA0185C5AFD13DCB0B8A17E6B2700443229BCB1169CE592F73BE16E7E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\PySide6\QtCore.pyd
Size 3.1MB
SHA256 97612934c29d24c2f4c6a16a75171c061384261877038fe80f43048c800c92f8
MD5 2eb54e938073edd86f9265a102523cdd
SHA1 3abd0a29286cd97898936dcaeb0a429bbb5a59e8
SHA512 fdcf4340561ee3de56d6d3ae990be7892f06fd3761f93b008317e337f407dadb4dc45c9867075b127c89191ddafc17eb132fde6971051ebfdbb86f69e9fe33d0
SSDEEP 49152:kVMD3VKfihMrxLgtArfsGPizv7jSc4+yfhGkG5PzS/fmqDgaKn9aFGZ0DijLwbCD:6ohpk4
TLSH
T1F0E55C9F935911C0D73BE17DC90B8907D6F274924986A30B546ACD681FE73A3236EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtWidgets.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\PySide6\QtWidgets.pyd
Size 4.6MB
SHA256 cef76cbe093a955d9bc8a18be29e5f7adcd3fdf97b145a39b4f7e41f9738f40c
MD5 29b883f9a2ed8a2ea07742860d9da735
SHA1 98ee840937b4f81df8edc9ee43a412fbfccbcb2a
SHA512 6461b4a66d2bac5c3577cb2d9f725e5420a19526d24edd0cf5075f470e776bb9f09b8cf0daa41e287d5f9a8abe31c66f72a6f4ec93069faa03ea6b34aa3b6c00
SSDEEP 49152:mpzHt+jBeg4+a3PciampRVdHiqvtry+lTqmb9hSc+70F+yZHVx6gCB1PdptPdhCF:HclywIOalKilLgz4KR
TLSH
T109265ADE576E10C4C27BD27ECD0BA917D1F2B0868889A30B0C66C9ACDFB379259557C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyside6.abi3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\PySide6\pyside6.abi3.dll
Size 253KB
SHA256 6f3fb0793f16e40576b71b6f88e14288efc3ac55eb7be9cb158d8ee764bf9c1d
MD5 363374d5ecafacc869ab0be2378908a1
SHA1 41690efbb6853d537c5a7e5364fe9098331aa3e1
SHA512 285f5d41c85488a5ededd53853ba07f448fc9d8bc03c96c6b0fcb14c21a2eede929da5f37dca864a41c1104955d3237500163246760cd746d50892b5b7e9117e
SSDEEP 6144:AzuHtxp+kFchbby2RvQcC0edjDGcWeA004v0Mj0tjG9syrrO2v:Tchb54jFDGcWeAU9Ka
TLSH
T1B4446D2B33405EA9FE6BC279C9428A06D6B3B0020361E74F47A5CBE61F6B753362D745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\_bz2.pyd
Size 85KB
SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
MD5 94fd94a3194ef83be4437755a14cb810
SHA1 7cef55c1ff01f359963cceebcbf6baa6cc8c7a5d
SHA512 2cac920cb3b101dade078fb96b8438db7bf0ab17f009c9df64b443e1e0aa13a155d695270679cc35cfcc57adef4bb2a81e4446d0f04804b127ca8668c02110be
SSDEEP 1536:4GNqB8z7qyEXkmNf0/ixk+x5dxNjP8AloDb8zMDIGwIM3V38y+kR9LfIgHL1:FNqB8zFEJUoZlTjUJ38zJGwIM3VUYB
TLSH
T18F838DC6F3A552B6F59F91B846840793F734BB960750A3AFF14882893F13BE06E5C225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\_ctypes.pyd
Size 138KB
SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
MD5 5860d45269a360d830807497fda7dd50
SHA1 e8088b3fa01d32a246129ac08ce75c53e6664e4e
SHA512 878bc79a6e6105038912dfa83be203239b438b53d739be502f7848193271de0a015e6bcde3acdbe5595356320a7756d4a0f8b83b8fcb4fbc5e9f4073c632214c
SSDEEP 3072:yLji9Bvmib0DLGru4h1O/IFsDzPsLdzUsIMGPsW4Ihn:ejibvuh4G/IGjsaJ
TLSH
T146D37F4B336844A6D6A78578C6739E47EBB1F4511A1083CF4268C99B1F633A2AF3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\_decimal.pyd
Size 280KB
SHA256 a33b1562acc8201411971f54444bd9c648f2d194d9914f0eb734904882213828
MD5 93b63bd1e89c4e96c37b498f7695da4a
SHA1 b296561205137cdf949a8376c7877de482980989
SHA512 7225f613c1c419dcdc03b012565d29671f05ad3b78facb9709616850a243d1885f4b4ff08b3ee41ad31e4224a328b7eac617fa53d4c9b21ec5dd110ecef03778
SSDEEP 6144:94R7esG0e0tZq2t+mmSIJ3eEmn9qWM23pLW1AkMk7kTt:94R7paEs2kmmbJeVHk7kJ
TLSH
T1B1547D56A2480CA4EE738074CA879A57F7B278854360D7CF43A48AA72F533A3777E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\_hashlib.pyd
Size 67KB
SHA256 052f824d5e3a046aa401efef86307c0c7746a0d8ff85c855d4225d6fe565bb07
MD5 d60cc3d94442491b3f8657d54225198f
SHA1 c5b75c895f593081308e82038ea0d23e8da9ee7a
SHA512 ae60189fdc30500952fd52f64d593c51444e7706e9ea44e15ee5fdf362792d80deeafe5a0d319caa31d0f75287bedc89d0ae4d90c248bc56310897d3cac4e804
SSDEEP 1536:WMRoOWZsPkJWvCGt6RUoIMDIf8y+kR9WfIU6H:7mYcJWvCGt6ioIMDIn/
TLSH
T1ED635B86A6984062DA1382B4C9E34F43FA75F652271197DF6339C18D2F233C3973A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\_lzma.pyd
Size 157KB
SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
MD5 47bfbdcb4b88b6d9e6fb7ca72f7929ca
SHA1 f4ac4210b1f5a290956e55d7ddf665dca95157ba
SHA512 a3e3c1edbbea4b2335dcd5adb79460fc8a2108e323b2c8ca84eb070cb0e8f54df2e82f17a3ba23c5b080ee108d595587b1237025cb41229758af0733f384fb59
SSDEEP 3072:O0m6DHDbBwiZfxA/VcNdznfx9mNooN4fnbOwIMI1dsZGK:OTCHDjfDNlpYOJfbOLaR
TLSH
T10EF34C86B794F0E6F7228C38D6614F57E7F5781A0320939A01CC976D2B1FB659A2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\_socket.pyd
Size 85KB
SHA256 6a016011e78e2476eb19dbe7330b373b9e2c66ff6c0be9bd64ff008ee53647ef
MD5 b042a4ce17bb4174ee2a927746f13f97
SHA1 24c32e42af77a808921f0d6e87a8b88c279c39fa
SHA512 33ce7df647c57529b365bc8633b4c168fe4d194e66e666dc2e545ccc43d1a08570bfcd91aaadb109a6174a90477db6951d279dbc7c145ce08770f77522de406d
SSDEEP 1536:HCzH6HTMXx87Rfypx97XP+N6wSzPeVFSeJScNsIMGwR8y+kR94NfIW44DFr6pr:KH6HTOoypx97XPs6wSzPeFSWScNsIMGI
TLSH
T161836B01A66040FAEB62C076C2679E63FB74B5C113D4975F1466C69A1F333C2BF3AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\_ssl.pyd
Size 179KB
SHA256 1edd9575243ae8322f6a21e9eecc933701c5820f05e7b0ebc0b51cb80592da77
MD5 0e79667c70090d09216d6a84f9c81273
SHA1 cfb45075d214a28dba7fa42ce421307975a92ee9
SHA512 df7a003ecba4e141ed2a23cf4fd4d604bb10ed7cfaf152a52dbbf67e3d647730ad07b19ae88ea642d3a47a6a9e2b2d1277578875e0d2b6d9a0a0a1ac41d0985f
SSDEEP 3072:HHqb8RUZrARopfh6CwdqMUUuGyU1y9MK9og5MFe82Iu5tyFjUdNcwPHIgqADwIMx:qkU5Xph6CwcRGyEYlI
TLSH
T1FE048C47B14429F7D913E8B9C6234543EBB4F145732297DE48C6DA860F0334AAE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\_zstd.pyd
Size 491KB
SHA256 74f64a5d724cad1c10ca9ba579b6af198178406b0a4f061685326e79cffa3eea
MD5 11e408a51564f9626db73bb282aeeefb
SHA1 890db1462cde82ab16ff6c0e6bb3b70d35cc5869
SHA512 65a5302758daebb2a59ed982d1a62cb1fabcfd0203f45baf900369bca11e3d70263db77dfb305e597e9846a9aa9cd92d3749e7a7f2f699d86a4b5ce8dc7c7af5
SSDEEP 12288:/Pm5BlLPg/FcxTbwWo2iD4xjnBTrWl93S9Ct:/Pm5BNg/FcxTUWo2i0x7e
TLSH
T135B49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\base_library.zip
Size 1.3MB
SHA256 5f0cf3e184e7876566d32ad63d7450daedb9484403c3f5cd40d7a8be70528f48
MD5 4132c9bd3fc25c342ed0fe7f1525ee5e
SHA1 0ad34d43e241e42761933cc0650b78507d642a15
SHA512 5fd8b78edea0833b945f1d69e5c01c454ccbde544a690addb9c793043449d4f057ebedcf02d3f3b341acb7def940e0696061aed6788c86e7b46be035cde4f7f1
SSDEEP 24576:bQeOdP2m2dfjeTOuUFvRaTdmtgLjlbCNu1x:b/FuUFvRIdU7uf
TLSH
T1AF552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\psutil\_psutil_windows.pyd
Size 67KB
SHA256 84a0ef5e448777816ca5f77da81eb96c2fbf0a4db614b8a33400ae888e4c7861
MD5 ea136a7548b95479a5dd6a938bfa54e2
SHA1 611e36d144bd5229d2e5cbd1f44390cac3c9ba08
SHA512 fb0ff70181c7984fd06c8c564e1803235a009e526a7b9e99abf05973873cbf514fceb3aed878e0e83c303bf24f92dce0080defb362b608d239cc9e8f7c5d8a6d
SSDEEP 768:Mz4g8brPBsduNMjD8TRrfGnllpsDIygJHxYDDXBb2TO4QaFFVUmeQQ3SqBWJnnmf:0mbEjwT0llp5HxIDXBb2a4GoJnnmf
TLSH
T1B7631985B36500F8D92B913DCEB26A33E2B1B061133693DF4561C64A0F63AE76A7DF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\python3.dll
Size 72KB
SHA256 27972cedfa8ca9f6835a2cbbff95336b15773a05b10067e3b084409095341068
MD5 79d62d130655743c0edbfe60adb57836
SHA1 fdb7b138dbef34e7536cf8226043f318bdfa6ef6
SHA512 5f06e2d8456980ee389e983c8f60971702560b18f24598eef343cddf47515d45495b4bfc2f86a271bb5f5b24a585d814dae552b543dad776b844442eb4bbd87f
SSDEEP 768:6QlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIE:vbTrnXngXMMsIMG0G8y+kR9efIUdHo
TLSH
T199734C4E6B54F8A2D6B629FC78D199CE242B12FC4F2984DFA47DD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\python314.dll
Size 6.4MB
SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
MD5 6c86b5a9512f313fc0ff2ebad8f6d47c
SHA1 4e4f7ee84898d274b399670aa5368ad65dda6e9c
SHA512 0d34c93842872992a4b15dae1837dcf2d428634f95875da8a112673365d1ec439f82caa10b0145a09e3de2cce8e1d15a7c385c0af6162ce8d7e56fba6d711a1e
SSDEEP 98304:UIuAsiTMRBKQ19BtjDm5lERFQYtNX2jivPHDMiE2GZ:FuAsYMRBKQ9Bdi5lERFLkiK
TLSH
T1E0669D26737501A4D8BB8035C9074687DBB1BC00AB30D34B49A47ADA3F773635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\pywin32_system32\pywintypes314.dll
Size 133KB
SHA256 74f036548f3321d312205085662b2b92c0654354a718a41c44e02fd4e01fedb9
MD5 97c0fbb6754c4ca45b39cae25b390e2c
SHA1 8768c0cbb6d9bb294c9f317f13b29ca8592d4dbe
SHA512 8a8f8cbc1d0fa0439085f3b0c641c1ce959e1b398db03bb0e69037cc6148eca04c1d8a16963e59f2c183302c0bf8bdc5ef824f50b9f0d874d87eb6bbd7c46fa9
SSDEEP 3072:3x+hyw7Jomer2JCDa3GOY/r06YrpdMzdKK4Ax3/gHG7Mj:3oH7JfeCJCe2OY/rkDMBJ4Axvgm7Mj
TLSH
T114D32A47374688DAE966A37DCD771E42C3A2B0000711E3CF06A1C2976F637E5AD3BA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\select.pyd
Size 32KB
SHA256 5c4103eef14aebd195425d42196895ffb87bf6a25ab4651242bebf0a6b25cf1d
MD5 b6021321b7fd33c8c8a4079131625fab
SHA1 b8a812e37647eff1f0dc0689ab0fc7c6dfdb70f1
SHA512 4f31fe858655e82575216e55bf940cff6606b2869db1e567e7966e96f1b09391fe4beea0d6c00225093ad8b7248ae63ba8652365e0b9f396c00f703b73ab8e20
SSDEEP 768:yB7Y4HfJeHrFsIMRGno8y++RYT2Ip46htTxf1mltPRVgg9:yB7R/JeHrFsIMRGo8y+kR96ZfIZR+c
TLSH
T1AEE26DCAAF645043EAA3C63186E2DE83F539B7E35611829F31B981990E173C1A337359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\shiboken6\MSVCP140.dll
Size 536KB
SHA256 d8fcd3b7619e7aa5623653afecbec42751358e56ac04aed7cc679cc494376ef1
MD5 898741f4c685897dd6692e580dcfdf91
SHA1 86fd5710d01cc4fb6afe15f7fbb1a4dccaa8c107
SHA512 2c5983a515510f41dbe0683fbc050ab16ed1d10094c36061d6d1cf0c4975f84581a57915ed0a932493537622aaafaa3906b8043354ded5170bb73e811f6f2ac6
SSDEEP 12288:BdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa64:BdnGoU/7m/V5WZ8dQEKZm+jWodEER74
TLSH
T1E9C42A27F74A06B0E195E3B8A1838702D7F1BC498322E3C752EB955D2F573D0A67B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shiboken.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\shiboken6\Shiboken.pyd
Size 32KB
SHA256 e44152f30538477225002e6f8bebf7ac2de1534da5ce5ad17402c9c8d6ce8045
MD5 e51c4b2c9415354a094aff80b957d34d
SHA1 b24927ac976368b97c7bd161d24b198db2d62029
SHA512 b2d09c914cc1a73f7597416350188b57d93000dba277d167537d6176d845d894254f53d6ef431ee4dee4dbdc4d2e139b6a8595f63e6908ef4158c6ab70dbd38b
SSDEEP 384:YHaDJinDUZ0gy6lR4vKbNYc0iTR4OOK0a9u3RHQIYiu9cEWfbZy8RbmL4nNyXNt:Yd4Z0Z84vWYKt4/zew5YiuijV5ALt
TLSH
T1DFE28C439958688EED11C67E45928D1AE5F0B5150791C3CF13ABC0DA5FA33C23E3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\shiboken6\VCRUNTIME140_1.dll
Size 40KB
SHA256 813c8808223f29b7d68589f62f2812d87e5e43b5d50ce7f351942a5c92cde5a6
MD5 b5aeb0b10e689d177d39928af9c9e089
SHA1 ba4a3cfc56096d608a36ef574cf91c959caf4339
SHA512 5c53c5d3c0347e660eb49eba18258caa5471e1d4b99fec1dd0437ca94cf331fc8e05faea031cc199b42f15d6c7707efa88075e8f90170caa33927d34e0ce40bb
SSDEEP 768:d3oZYctpzcx0pdESASv8375YiuiGOC5ALbOY:1c6wk3F7uPq
TLSH
T1D7037BA297B41845E46BD975D0D32E3BEB71F4256B9083CB03A8C21D1F627C07A7E366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shiboken6.abi3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\shiboken6\shiboken6.abi3.dll
Size 373KB
SHA256 ad3dd18c1cbb1641dc9bca5bed350e0a108d90d1799ae91f0e4a83997d2d5e09
MD5 4fa7f3ccbe54102dd4dca44f1e800944
SHA1 4ac15a88e7d77592557e76d0d6fb0f7da54158cc
SHA512 4fc6e187a262ef362c3ecd24e5958a7bbe973bb97ee7d9c79a3dee209b36d87c2113b3bd700670c6e87644ddafaba573846101873e0e8e4134e2b00266c9158b
SSDEEP 6144:+22Run5t8F2JRHZnIQt3i7fy4qvNYVOjirWI0G2X:+2Fv3KKEOjgP2X
TLSH
T164848E2BAF5410DCF667827C84639606D67670A2036097CF23F9C3D56B63AD93A7EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\unicodedata.pyd
Size 740KB
SHA256 552317719cb70d92b73d9cd0d54c314ebab2f4dd1c468221e49c3190f24a4e7e
MD5 62a8f384eff5516c5941261b8b8c9fd5
SHA1 a497464bcac193b07216ae9c87b8a1c6db83560b
SHA512 00827618788c4cc77b32622c9fd97ae6297c82ab34a686dc4c0898759bffa1bf78a50a467e42d9aa8f1077ef1e02cace55f772b2bdeb729ccb098a40229c91b6
SSDEEP 12288:GYJAPtrZmDtBPcH+dEYJ5EAub+z70lDJPT36mwtWQNm:GYq5ZmDPqO5ElDJPTMW8m
TLSH
T13DF4E4F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2582355D8EB3B44DD182E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\win32\win32api.pyd
Size 132KB
SHA256 903feb110c86dffa957259f3d2a33a1c0b3c8a635d9a44a642b9ab5852d59a61
MD5 30a73c1ce2de6f5b6c52b20daf7ea382
SHA1 532255794c8595007542d0fbc3803a3f613040c5
SHA512 7dbc39d86adb11ae054153c1a20512594c4426f826a5ee20b3dd6d320371847a4e409329ef8b816970b0643e6ccb2cc998689400d080c5e7de34a8509e7ce227
SSDEEP 3072:ircD2MGeEe37Z1h8Z94lRVFhLaNzvrXVUbmWcT2A/3Vf4L:p9Ge9Z1eZOlRVgvrFUeT2A/Fg
TLSH
T186D32883B34910D6C8AAE2BCC5775E63D732B4240721A7CF0660C28A1F637E97D79B95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32file.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\win32\win32file.pyd
Size 142KB
SHA256 82e4a7d6911f82fe8445fc8f76f85483a3f80ea4387ea44bc28ed1da9ff37da1
MD5 db11affa33ca0cf2d00a86fa29c2be57
SHA1 941ee61f3abcae949cefb5d92531b2f38c4dba81
SHA512 71fbe6339c38663c6cf926ce5d2898a41fb1bf169838553cc50af15f88d60c9673482e57188d49320a2f77b7b68002baf828e988f1d6e65718429caa81c9c4ea
SSDEEP 3072:Z3MBFDWCxvIE3svZ8k72iIhXtNKD4q6CjKejA9sDPhRILZ:ZMBFDWCxgE388MxIhdNK/6C+nOPhR0Z
TLSH
T15FE34AAB334510D6D95A92BDD9278E43F773B0240760A7CF0525CA6A0F273E97E79B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32job.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\win32\win32job.pyd
Size 28KB
SHA256 424ae073540641f49a838b2120ca36334a0bc7f7dfee78de93222706573a4ae8
MD5 8d8ca93264aebcbc7c22185d2517c7b6
SHA1 c99e0ea4ae4f7916c040fcdfe2048490580d906a
SHA512 2953720d306b293b4f5a8b92843f2414fb0bcc4fab61e8085bf99068d4067c989ce8b17455d8a02498b6748cf3bda0e2afbf44226cb1548a2465a892169da48b
SSDEEP 768:o1siMc5byNclbceXnE+Z6bEah2V/fyeraIX6o5/L1ABwDaP46miJ0yePnQDx2Puh:pwemdPmCu1f
TLSH
T116D2E8D66A48A4D4D95692F9C8335D53E1A1F42403A4A6CF02E6C25B6F733D0AF3DB0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32pipe.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\win32\win32pipe.pyd
Size 28KB
SHA256 a29bc88bad6e0f915a61cec01e0a3228522bf011c5a4791de1a3df50c0ef5dfa
MD5 945f176cc702dcb74d4a5736de3a253d
SHA1 08199e0c1931f7d2b97c31b95b5f70b65c08c55c
SHA512 b7aa5b36c5db0dc6c3a50db75cf419531dab774bf66b7f4dedbb01e3ebfca74d4fe6daa11af35e6691df9b5227a9f0d733bc917ab4e18d62ba3fcf822ea6fd1c
SSDEEP 384:l3rJmS6AKYlV/fPkKAJ5TkLhhz8T8rFRPqmsZGhCwqIe1D8iDeBU7x:9FmrANPjAfQr+msB9IkbH7
TLSH
T1C2D20952739540D4E91BC2B9C8A25E17D1B2B4254364D3CF43A289670E773F5BA39F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winsound.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32242\winsound.pyd
Size 32KB
SHA256 b23776248616522fcb09d35d2841edccf22703c292b16cb364a9293eb9bd8722
MD5 794afdd9d91cc67b2186c471fcc8f9cd
SHA1 4f4a1f7740aa03e2d5c38987286a832cbb6edaf4
SHA512 e619c2df48115a264ea6d63c79495268f23ff463507de1b591c3e0fa5b7a7eaca3bfd0757c6a8f214af1c62538dd8f2c514ea58c7b6b1581c88809b7f9ffff95
SSDEEP 768:Zxs75Zd4LWVOIZoIMD7Io8y++RYT2Ip4Z1tTxf1mltPRVagXn:DOZOLWVvZoIMD7p8y+kR9Z1HfIZRwon
TLSH
T142E28DC9A664048BEA67CA30C2E0EF43F539F7E35A21435F206D82951F273C2E716659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2924-215-0x00007FFFE7A90000-0x00007FFFE7DB5000-memory.dmp

Download

memory/2924-238-0x000001C1EF990000-0x000001C1EF9A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads