Overview

overview

10

Static

static

3

Output.exe

windows10-2004-x64

10

Output.exe

windows11-ltsc_2024-x64

10

Resubmissions

06/08/2026, 03:38

260806-d64qjsseng10

06/08/2026, 01:13

260806-bk9zbsbl4s10

Analysis

  • max time kernel
    599s
  • max time network
    550s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 03:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Output.exe
  • Size 9.9MB
  • Sample260806-d64qjsseng
  • SHA256 60b9360a0e99891642967ed3e3fcd7fbc35735f8f7b6bb9b0c5e4c9cf94a90bc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoveryxwormpersistencepyinstallerransomwareratspywaretrojan

Malware Config

Signatures

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Detect Xworm Payload 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Output.exe
    "C:\Users\Admin\AppData\Local\Temp\Output.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Users\Admin\AppData\Local\Temp\RookWare.exe
      "C:\Users\Admin\AppData\Local\Temp\RookWare.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3804
      • C:\Users\Admin\AppData\Local\Temp\RookWare.exe
        "C:\Users\Admin\AppData\Local\Temp\RookWare.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3692
    • C:\Users\Admin\AppData\Local\Temp\stable-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\stable-loader.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:6104
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5652
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5048
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:4504
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3412
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4020

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 595B
          • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          RookWare.exe
          • Path C:\Users\Admin\AppData\Local\Temp\RookWare.exe
          • Size 9.8MB
          • SHA256 f52bc52f31f53cc2301f7be7de05628e912f2332038852b5ec27691e3237481d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\VCRUNTIME140.dll
          • Size 117KB
          • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_bz2.pyd
          • Size 82KB
          • SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_lzma.pyd
          • Size 154KB
          • SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          auto.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tcl_data\auto.tcl
          • Size 20KB
          • SHA256 14d904e4ec854add991a71abf263b36110ac2f01a625a70058deb1606f66ebca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cp1252.enc
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tcl_data\encoding\cp1252.enc
          • Size 1KB
          • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          pkgIndex.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tcl_data\http1.0\pkgIndex.tcl
          • Size 746B
          • SHA256 77265723959c092897c2449c5b7768ca72d0efcd8c505bddbb7a84f6aa401339
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          init.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tcl_data\init.tcl
          • Size 25KB
          • SHA256 798732aee4e838670b9a4e37e3d6c4884019a1b101f9ab26344dd2e9bd179872
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pkgIndex.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tcl_data\opt0.4\pkgIndex.tcl
          • Size 620B
          • SHA256 61ac4633062d17210bef868d94c25ed0bb9285df0de3e0cf4108f38e98a5b278
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          package.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tcl_data\package.tcl
          • Size 23KB
          • SHA256 b547022feb2a72d8251d2a467bcfc8487cd8fef10bcef884465fde49176f6e35
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tclIndex
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tcl_data\tclIndex
          • Size 5KB
          • SHA256 36ef92ddab00ee8e3219d6d4eaf0b11f33d6c33a2c6abc2c7de30c23e90acc40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tm.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tcl_data\tm.tcl
          • Size 11KB
          • SHA256 a84cf30f218bb7bc793d1451a867a060f311f84b932601668b665c0f92a549c0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          button.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\button.tcl
          • Size 21KB
          • SHA256 1f5dd8d81b26f16e772e92fd2a22accb785004d0ed3447e54f87005d9c6a07a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          entry.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\entry.tcl
          • Size 18KB
          • SHA256 6ac78f764434f932d37e8183aa6db5d04eb1848b774c92f7abc243ecb7d4a59b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icons.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\icons.tcl
          • Size 10KB
          • SHA256 1264940e62b9a37967925418e9d0dc0befd369e8c181b9bab3d1607e3cc14b85
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          listbox.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\listbox.tcl
          • Size 14KB
          • SHA256 47c75f9f8348bf8f2c086c57b97b73741218100ca38d10b8abdf2051c95b9801
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          menu.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\menu.tcl
          • Size 39KB
          • SHA256 ae4ee8400174c798337b9c60867cbc94f811b249ebe6dea21ec6f960bcf5f8cb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          panedwindow.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\panedwindow.tcl
          • Size 5KB
          • SHA256 aa4f87e41ac8297f51150f2a9f787607690d01793456b93f0939c54d394731f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pkgIndex.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\pkgIndex.tcl
          • Size 376B
          • SHA256 1390f260ea7af5b0779549fa29615530ff9e3bc202806d2024ac644b1fac5dbc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          scale.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\scale.tcl
          • Size 8KB
          • SHA256 0747a387fdd1b2c7135eceae7b392ed52e1d1ebf3ffa90febe886dbc0981eb74
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          scrlbar.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\scrlbar.tcl
          • Size 12KB
          • SHA256 eec90404f702d3cfbfaec0f13bf5ed1ebeb736bee12d7e69770181a25401c61f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spinbox.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\spinbox.tcl
          • Size 16KB
          • SHA256 747889c3086c917a34554a9dc495bc0c08a03fd3a5828353ed2a64b97f376835
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          text.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\text.tcl
          • Size 34KB
          • SHA256 f7ecc5ae6eb297c79aad5cfc200b29c4e72409641fa369c5cdbba30ae41e982a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\tk.tcl
          • Size 23KB
          • SHA256 aea1f1f01e2df0cccd8c2010c4035deea297424a9174383e5ee016eb25484e5a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          altTheme.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\altTheme.tcl
          • Size 3KB
          • SHA256 ae0437fb4e0ebd31322e4eaca626c12abde602da483bb39d0c5ee1bc00ab0af4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          button.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\button.tcl
          • Size 2KB
          • SHA256 e38a9d1f437981aa6bf0bdd074d57b769a4140c0f7d9aff51743fe4ecc6dfddf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          clamTheme.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\clamTheme.tcl
          • Size 4KB
          • SHA256 cffc59931fdd1683ad23895e92522cf49b099128753fcdff34374024e42cf995
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          classicTheme.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\classicTheme.tcl
          • Size 3KB
          • SHA256 424bba4fb6836feebe34f6c176ed666dce51d2fba9a8d7aa756abcbbad3fc1e3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          combobox.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\combobox.tcl
          • Size 12KB
          • SHA256 68eed4af6d2ec5b3ea24b1122a704b040366cbe2f458103137479352ffa1475a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cursors.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\cursors.tcl
          • Size 4KB
          • SHA256 5b33f32b0139663347d6cf70a5a838f8e4554e0e881e97c8478b77733162ea73
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          defaults.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\defaults.tcl
          • Size 4KB
          • SHA256 49ae8faf169165bddaf01d50b52943ebab3656e9468292b7890be143d0fcbc91
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          entry.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\entry.tcl
          • Size 17KB
          • SHA256 f2cacb1b3a941cc7079627644e91f0d4729bf820c481c8ce7fa28c952b803e4d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fonts.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\fonts.tcl
          • Size 5KB
          • SHA256 6574067a91858506460ac44ddf8cf9270e81d67b2feff2a43b4d5f774568a5ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          menubutton.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\menubutton.tcl
          • Size 6KB
          • SHA256 0935fb97b6628f055baeb2e2babbf2a6c8905260e1107972b0e7a1df0752e180
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          notebook.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\notebook.tcl
          • Size 5KB
          • SHA256 b1210147f9daf3068de3d28d4b18c04ecfa8c8574e3e0ad275c1d0d75e9a99b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          panedwindow.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\panedwindow.tcl
          • Size 2KB
          • SHA256 20ee6ad9d701709724292a926af93c93784b254b48a656ecc140ef3a0fe10a11
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          progress.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\progress.tcl
          • Size 1KB
          • SHA256 697cc0a75ae31fe9c2d85fb25dca0afa5d0df9c523a2dfad2e4a36893be75fba
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          scale.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\scale.tcl
          • Size 2KB
          • SHA256 b909add0b87fa8ee08fd731041907212a8a0939d37d2ff9b2f600cd67dabd4bb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          scrollbar.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\scrollbar.tcl
          • Size 3KB
          • SHA256 6eaa336b13815a7fc18bcd6b9adf722e794da2888d053c229044784c8c8e9de8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          sizegrip.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\sizegrip.tcl
          • Size 2KB
          • SHA256 e92d77b5cdca2206376db2129e87e3d744b3d5e31fde6c0bbd44a494a6845ce1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          spinbox.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\spinbox.tcl
          • Size 4KB
          • SHA256 df286bb59f471aa1e19df39af0ef7aa84df9f04dc4a439a747dd8ba43c300150
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          treeview.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\treeview.tcl
          • Size 9KB
          • SHA256 c88b60ffb0f72e095f6fc9786930add7f9ed049eabc713f889f9a7da516e188c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ttk.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\ttk.tcl
          • Size 4KB
          • SHA256 2c48343b1a47f472d1a6b9ee8d670ce7fb428db0db7244dc323ff4c7a8b4f64b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          utils.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\utils.tcl
          • Size 8KB
          • SHA256 4aa041c050758b3331dc395381f7fbce81e387908fc7a3c6107c4e7140f56f2e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          winTheme.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tk_data\ttk\winTheme.tcl
          • Size 2KB
          • SHA256 ae82bccce708ff9c303cbcb3d4cc3ff5577a60d5b23822ea79e3e07cce3cbbd1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\_tkinter.pyd
          • Size 64KB
          • SHA256 a6851d7c25a1216d2c8fa5c1d2e9eca3d0392d60e3b7441ad9f66c23ffdd2f08
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\base_library.zip
          • Size 1.3MB
          • SHA256 8f44a6c61da35fe6b497b7bf915b4728a304b72835cf387bac11ebbea0af2221
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\python313.dll
          • Size 5.8MB
          • SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\tcl86t.dll
          • Size 1.7MB
          • SHA256 c861f39ad0f4fc7f3875850925f61442bff2bc1839bbbb3584a63bc4d6e5cea6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msgcat-1.6.1.tm
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\tcl8\8.5\msgcat-1.6.1.tm
          • Size 34KB
          • SHA256 6cc549a37c051d0c70a935b26c2098d1ca4a10b1a60bce03068be268b5e81ca1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\tk86t.dll
          • Size 1.5MB
          • SHA256 6425bf57abcc1dfbbe8662b1956883ae0c5ab8c2d9314e19692b3d86babc242c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zlib1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI38042\zlib1.dll
          • Size 142KB
          • SHA256 8c2ed3e1a90c9b0e3ef844be20e1af791ae8a1b665d4731162404f0eee1697dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          stable-loader.exe
          • Path C:\Users\Admin\AppData\Local\Temp\stable-loader.exe
          • Size 110KB
          • SHA256 fb46e94e592d9172240944270248df3e0b969ce206146b30f119162284860a0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3412-1101-0x000001F883A20000-0x000001F883A40000-memory.dmp
          Download

          memory/3412-1103-0x000001F893E60000-0x000001F893F60000-memory.dmp
          Download

          memory/3412-1139-0x000001F894700000-0x000001F894720000-memory.dmp
          Download

          memory/3412-1113-0x000001F883C80000-0x000001F883CA0000-memory.dmp
          Download

          memory/3412-1094-0x000001F8801E0000-0x000001F8802E0000-memory.dmp
          Download

          memory/3692-1031-0x00007FF920350000-0x00007FF920379000-memory.dmp
          Download

          memory/5068-2-0x0000000000EC0000-0x00000000018B0000-memory.dmp
          Download

          memory/5068-1-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp
          Download

          memory/5068-5-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp
          Download

          memory/5068-4-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp
          Download

          memory/5068-437-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp
          Download

          memory/5068-7-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp
          Download

          memory/5068-0-0x00007FF91322F000-0x00007FF913230000-memory.dmp
          Download

          memory/5068-3-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp
          Download

          memory/6104-439-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp
          Download

          memory/6104-441-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp
          Download

          memory/6104-1030-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp
          Download

          memory/6104-409-0x0000000000310000-0x0000000000332000-memory.dmp
          Download

          memory/6104-513-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp
          Download

          memory/6104-964-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp
          Download

          memory/6104-968-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp
          Download

          memory/6104-970-0x00007FF9130A0000-0x00007FF913A44000-memory.dmp
          Download