2900cf477dcfe19cef54059c99a63097875ffce8c587f8ef5cb5e14e716a3c81

Analysis

user interaction
yes
max time kernel
9s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.exe
Size 8.3MB
Sample260815-3pr3vsac42
SHA256 2900cf477dcfe19cef54059c99a63097875ffce8c587f8ef5cb5e14e716a3c81
MD5 728224b43bd7771e47a9481b0ea3a0b2
SHA1 5d2466e3312902916bab9195c6e40ba7cab442de
SHA512 d6d92e49f147c1334f05ac132c5aed041125d54f0d76d098bc55fa34e5c219023c1d3557981d0ba23c0b666e9b020488c78c22b0c10250e35078cb82505d6621
SSDEEP 196608:co3d5tbW897GXPHMe81SF2RPUewytKZ2/HsMRq+bRgFtDU:cyd51wPsZg2Ke3K4/HsMRq+bYtw
TLSH
T1529633DB72A009BAD86A553B29715F52F361BCF10760C88BDB93631E2E772E528F5310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence privilege_escalation ransomware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 7 IoCs

pid	Process
4396	run.exe
4396	run.exe
4396	run.exe
4396	run.exe
4396	run.exe
4396	run.exe
4396	run.exe

Modifies system executable filetype association 2 TTPs 47 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\tabsets	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\lnkfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler	reg.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2980	cmd.exe
3372	cmd.exe
2728	cmd.exe
4316	cmd.exe
1120	cmd.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.drc	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rec	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0043-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0090-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B0BD075-929C-4E52-AAD1-458C81A10B24}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\.drf\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0195-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D253F053-0D9C-3A3B-80D8-22C3B55A45BE}\15.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D6E78E55-7EE7-4A31-BF3E-B01E819599BA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.tiff\Shell\setdesktopwallpaper\Command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.tod\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C03E5-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87184086-85E4-420C-A969-B5F12914A283}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CB-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-apprep	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pps	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00024434-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.RTF.8\CLSID	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Extensions\ContractId\Windows.Protocol\PackageId\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\ActivatableClassId\App.AppX90m889wv56yt2vfqvrd2hvh	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B3ADBA8F-26B0-3F9D-BC4B-FC8D508A972F}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.wma\shell\Enqueue	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0362-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2DDBF3D4-8CB8-43CF-B1CA-834987325EE1}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\otkloadr.WRAssembly\CurVer	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{3EB29914-F9A9-3C15-A03F-560885CFCB61}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F11B2572-8FF8-44AE-9876-AEF9A8B749A8}\15.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerPoint.OpenDocumentPresentation.12\shell\New\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{AE2C9E6A-5435-3BEC-A98B-8B5A730DF214}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AA14F9C9-62B5-4637-8AC4-8F25BF29D5A7}\AuxUserType\3	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0103-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.Windows.CloudExperienceHost_10.0.19041.1266_neutral_neutral_cw5n1h2txyewy\ActivatableClassId\Windows.Networking.Backgroun	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4F55F4-8F87-4D47-80BB-5808164BB3F8}\AuxUserType\3	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0052-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.Windows.ParentalControls_1000.19041.1023.0_neutral_neutral_cw5n1h2txyewy\ActivatableClassId\App.AppXvmpg6dcwprmasbfvsg724	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2434737943-167758768-3180539153-984336765-1107280622-3591121930-2677285773\Children	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m4v\shell\AddToPlaylistVLC	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.fff\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0365-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84A6A663-AEF4-4FCD-83FD-9BB707F157CA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0325-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{98DFBD12-96CB-4F07-90EA-749FF1D6B89D}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000209F0-0000-0000-C000-000000000046}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A37BBB42-E8C1-4E09-B9CA-F009CE620C08}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000208E2-0000-0000-C000-000000000046}\TypeLib	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DC-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53D75E21-2C99-57C1-AA81-585595E72DC1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F30CDE62-6AB3-303C-AFF8-C68389732559}\15.0.0.0	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0325-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Extensions\ContractId\Windows.Launch\PackageId\Microsoft.Windows.CapturePicker_10.0.19041.1023_neutral__cw5n1h2txyewy\ActivatableClassId\App	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{3089F9A7-3248-3D03-B473-DCEF554A3983}\15.0.0.0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{7AD902D0-2C9F-3A6B-A1B6-A242D1206BE9}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\1.0\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.eip\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0129-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DirectShow\MediaObjects\Categories\d990ee14-776c-4723-be46-3da2f56f10b9\4dda1941-77a0-4fb1-a518-e2185041d70c	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Extensions\ContractId\Windows.BackgroundTasks\PackageId\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002095B-0000-0000-C000-000000000046}\ProxyStubClsid32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Outlook.File.msg.15\shell\Print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.m1v\shell\AddToPlaylistVLC\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.OpenDocumentText.12\shell\OnenotePrintto\command	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2656	reg.exe
4888	reg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4396	4860	run.exe	85
PID 4396 wrote to memory of 3372	4396	run.exe	86
PID 3372 wrote to memory of 4048	3372	cmd.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\run.exe
"C:\Users\Admin\AppData\Local\Temp\run.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\AppData\Local\Temp\run.exe
  "C:\Users\Admin\AppData\Local\Temp\run.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "reg delete HKCR /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      Modifies system executable filetype association
      Modifies registry class
      PID:4048
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "reg delete HKCU /f"
    3⤵
    - Executes a command shell one-liner
    PID:2728
  - - C:\Windows\system32\reg.exe
      reg delete HKCU /f
      4⤵
      Modifies registry key
      PID:2656
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "reg delete HKLM /f"
    3⤵
    - Executes a command shell one-liner
    PID:4316
  - - C:\Windows\system32\reg.exe
      reg delete HKLM /f
      4⤵
      Modifies registry key
      PID:4888
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "reg delete HKU /f"
    3⤵
    - Executes a command shell one-liner
    PID:1120
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "reg delete HKCC /f"
    3⤵
    - Executes a command shell one-liner
    PID:2980
- - C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x38c 0x384
    3⤵
    PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\_bz2.pyd
Size 85KB
SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
MD5 b831ff0ab5f28a1f3bae6842896d45ff
SHA1 e96c4dc15ef8f55fa47eef0f5e3d4a184eeef764
SHA512 bdac51598e349a96aa399f8d6fc6ed46b8ff797bb70b372290a941581f4b63318df9578a557a297873b827b2de2eec8cc14e3c1241cf65f3e71f5653d7b034da
SSDEEP 1536:jGNqB8z7DyEXkmNf0/ixk+x5dxNkP88l3ub8zMDIGQIS3VvcycA89JfIYhE:CNqB8zSEJUoZlTkUGK8zJGQIS3VLV
TLSH
T189838D86F36552B6F99FD1B846840793F734BB860750A3AFF148829A3F13BD06E5C225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\_ctypes.pyd
Size 139KB
SHA256 a11d680d89f054584e6a5b2a03103d8731def86e367aff2f70cce8c6367f9025
MD5 208e7dd066f23080da03b4ebd20fbc43
SHA1 8b56760b26be7c98a6752cacb3e78716972089ba
SHA512 7841d4a3d6b04d00eff9e6a7ebdffea6d5a257bc095bfdfe33ffe78f2d0ce731af5021206b8e3b2e0da5ab0a27b0a65d149c346ea6c1d95fdd75087a411de40f
SSDEEP 3072:7Eyf/PRau5nIktyc7utl1OUIVi0I1sDdMIBU8ISGPiT:oy35aynVp0qUITGs7BUS
TLSH
T146D37E0B736440E6DAA78178C6739E57EBB1F0511A1087CF4264C9AB2F633A26E3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\_decimal.pyd
Size 283KB
SHA256 dcc9555eaf911af7997777b94beea78f802a10f1e4f3c3d4df2f254d44c71797
MD5 5bcfd857dc1088dce3cbd43bfebba363
SHA1 3fb3d6dc3fb5f6d9621c4a3a5168ada5eae5990a
SHA512 f7e455a732b6950606f6ceb17a75666e2c7fd76cf3b2f12728e5967e8980dbdd960e0301875e96e652411789385b199b75b4697c43b1b2ade1346e72a8018717
SSDEEP 6144:9VyJ3YE9GFkzC6/gHdKHFXsGqqM43fIWeA4QuMkXWHJCb7W:9VyJoE9+kzx/gHYdT7/kmU7W
TLSH
T1D2547D56A3490CA4EF778434CA879A57F7B2B8414360D78F43A48A972FA3393277E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\_hashlib.pyd
Size 67KB
SHA256 0c11671a2c572b4c016be263789f238125419df5711e281acdce8da50d9badda
MD5 4f7f664e8558a6cfc93ede2ae9d6974a
SHA1 0b5ed2b9c68120d5912f12c1d6038afe517547a1
SHA512 89cc41406f4b3da7ea46e15e12f86135ffe8c3fa2d906c8aa370402cfa4bd67fa00e2901e33e3e44daed075ddb9ac35c4dfd3181c44544d17c97522363227b85
SSDEEP 1536:aL0SOWZsPqJWvnKt6RfoISDI1ycA89tfIYke:ULYyJWvnKt6NoISDIYM
TLSH
T1A2636B4AA6984062DA2382B4C8E34F43FA74F652271197DF6779C18D2F233C3537A756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\_lzma.pyd
Size 157KB
SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
MD5 d412fca808a8dd9178ccf8bd9517859b
SHA1 6088ee0ee94f6a245bac0a0d1c0e664ca630cc07
SHA512 35afe64a19ff6737b662b9359e591bbb00c169e83609dff1c2ab1fac829316200b8a121d1bedb28bef832e7968a95e01986d20f8cb0d511e7b0d794010484e8d
SSDEEP 3072:M0m6DHDbBwiZfxA/VcNBznfx9mNoX3mfnbOQISI1jmT:MTCHDjfDNJpYOGfbO3+
TLSH
T1E8F35C86B394F0E6F7228C38D6614F57E7F5791A0320929A01CC976D2B1FB659A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\_socket.pyd
Size 85KB
SHA256 42b84410269af5a5578679a3fe7b17d75d28f77a0c3c09d589adadd9d2d3e5f6
MD5 b8732b29606a0d93be25bcd924b50239
SHA1 e7270350e71ce191d5fac5e4a6e5e7be0d0bd1d3
SHA512 489a3c09eb6665b6ee9b460303ac35f1228684723fabe34bb29c5de7b2b12d3fa8853e1eec8b8ba3eb3e80c517cdf1a263e6b963d4e0d2d092c52567a2ccca4d
SSDEEP 1536:QcVunc70XTxn1egypx97XP+N6wSz9GN7WQRcSqIP4fY8ISGwyycA89gfIbHqv:FEna2Dypx97XPs6wSz9+WQyS6fY8ISG7
TLSH
T109834A00AA6040F6EB76C176C6639E63FB74F5C112D4A75F1466C65A1F33382BE3AB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\_ssl.pyd
Size 180KB
SHA256 bc17486f149f7311839c70b1cda5a22e4546a9670d3136d665df95ff3cc43abd
MD5 6252eee501b79b472903a978872518c3
SHA1 dee9a3ab7444ae6ff203d585ed5b18f2af4b508b
SHA512 752947bce9d8177cb93100911a3c4fb74aa86c72f5b7f4b733636673459fe22f30812e9cfd34d7ee29e34e4ccef37b20559fd05b3f371be1f5d2ba89b64aac09
SSDEEP 3072:6QjyHsqUEao3kfF6Cu3qMX31Wzy4zXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UpnA:SJUEV3QF6Cu538zyAUBzbT0
TLSH
T1C5048C47B1846AF7E913E4F9C6234543EBB4F145332297DE48C6DA860F03346AE66B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\_zstd.pyd
Size 491KB
SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
MD5 225e0462bf8337155e78b36e3cf9fa79
SHA1 ae944f73defa8ac5ddb3069fbb4a9da5ecafef2c
SHA512 815201438564f8c9d57b0b8974d4b82d10bcd313e41277d85f290c0a3a94b9be8d31b5436da8704cb342f19fe68d258ee026642eca969bbb6518acd79ddb05b5
SSDEEP 12288:MPm5BlLPg/FcxTbwWo2iD4xjnsTrWl93W6Ct0:MPm5BNg/FcxTUWo2i0x7C0
TLSH
T1FAB49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\base_library.zip
Size 1.3MB
SHA256 b387fde669653cb4c0afd1173cab1ea65aacceb0c7735f51387ef7d0d60eb0e2
MD5 c5ba518dab3c743165583852e59cc5eb
SHA1 4652c93b02e34c92dca732476c2d3b4c999eb909
SHA512 fcd258ccb624d982ae328958ed2d03dfcb0c637bb6f5d21a12336c92057d35beeb264f3d1858e52138e2f69ca829cc3dcaae7efdb8026bafd5b3ee2b715689ff
SSDEEP 24576:MIAddRpaQL0OuUF9ui9QeOdP2m2df4elbl:OddRvuUF9uY/Qg
TLSH
T140552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\python314.dll
Size 6.4MB
SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
MD5 23b7bec4bb8cf109503029b50f5eadd5
SHA1 a5cb46bedfe2be49ae75bf0a95ab646c3256aee7
SHA512 d687ea3c15b7fdd08ecc29e73e5310195483bae18c7b49895b0b855b0df13b0b6955d75022f842725b17e3b2ef9e922d4eb90e8819f2c8be84890d7ee49a92a3
SSDEEP 98304:ctcc7EmUp55MA3l5vHi+LPL4G8hvGHDMiESkYD:cWc7EmUp55MMPHi9NikYD
TLSH
T1DC669E26737501A4D8BB8035C9074687DBB1BC04AB30D34B49A4B6DA3F773635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\select.pyd
Size 32KB
SHA256 a0f7b2e00144794e497d11fffc14e7a968f59e207c702ca7b262b7037065b5ba
MD5 6b181cf903a5903f9d8d711a731578d3
SHA1 0f2958ec2e4beb41dfedc912a6c635aeccddeba3
SHA512 c45f0f99bbbfc3d84a5e5782deb4440f6033e46e169209b60cbaf97ccd3c57baa5ee480aaf5239c75e0f2821c66d72a7ad973adcb69ee5666e5e145bd36e3920
SSDEEP 768:UB7YgHfWVHrF8ISRGqxycTOJh2Ip4JTxf1mlIJGp2:UB71/WVHrF8ISRGCycA897fIkGY
TLSH
T126E27DCA6B745047E9A2C631C5A2DF83F939B7A35721868F31B5919A0E233C1B336358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48602\unicodedata.pyd
Size 740KB
SHA256 64844c24f67e7eafb77142b4cbe4a430f4db3b16f59191586ba6596ca19fc775
MD5 d421eab157a93fd255554dc2d31b7a3a
SHA1 f6f8a395fe2f805299867022d1c8067eae636ea2
SHA512 9158db1315582cbc076e13360d764576f25f666996af07c377fff6170699f181702cb6e213f7d169a19fcc31a0dde9d4f19dd10038434c1a4cea4bb72a0a4b1d
SSDEEP 12288:lY0APtrZmDtBPcH+dEYJ5EAub+z70lDJPT36mwtW0N:lYx5ZmDPqO5ElDJPTMWo
TLSH
T15CF4E4F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads