xworm | 7236f23b0de1f6fe27a6fc5051d9b9455305c59803c1fd51b23027190e3bf6b0

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 26.3MB
Sample260825-2cparser4t
SHA256 7236f23b0de1f6fe27a6fc5051d9b9455305c59803c1fd51b23027190e3bf6b0
MD5 b7df093ff6998aff3f773356590999b0
SHA1 fc834a639f1bd512a933ac968e19cf947d04e393
SHA512 39b0dd9bed4723374e1aedfe452c52013739a5fe6721f19e80db2162b98f285d8aba561451ac4e1180e794050ed3b53dc5154d4ec04156858db869bd97c10c00
SSDEEP 786432:yBhmzH7rx7I7yZdsjdQuOCJuxRW8BOd90zQ6Cps:NZ7nij+CAxRWX
TLSH
T1AE57334A3305489AFCDDC237E4AE404616E6FDA647F0E4CF09A53A101E9BE907DB6F64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V5.6

185.227.69.37:54320

Attributes

install_file
USB.exe
localhost
127.0.0.1

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2916-1104-0x0000000000EF0000-0x0000000000F04000-memory.dmp	family_xworm

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/2916-1104-0x0000000000EF0000-0x0000000000F04000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4768	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
5836	svc_a27db9ec912e.exe
620	svc_a27db9ec912e.exe
2188	mssecsvc.exe
3328	mssecsvc.exe
2916	proc_7dd490eaed.exe
764	proc_7dd490eaed.exe

Loads dropped DLL 45 IoCs

pid	Process
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
620	svc_a27db9ec912e.exe
620	svc_a27db9ec912e.exe
620	svc_a27db9ec912e.exe
620	svc_a27db9ec912e.exe
620	svc_a27db9ec912e.exe
620	svc_a27db9ec912e.exe
620	svc_a27db9ec912e.exe
620	svc_a27db9ec912e.exe
3328	mssecsvc.exe
3328	mssecsvc.exe
3328	mssecsvc.exe
3328	mssecsvc.exe
3328	mssecsvc.exe
3328	mssecsvc.exe
3328	mssecsvc.exe
3328	mssecsvc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4768	powershell.exe

Discovers running processes 1 TTPs 10 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1356	tasklist.exe
3140	tasklist.exe
1452	tasklist.exe
5400	tasklist.exe
2648	tasklist.exe
3652	tasklist.exe
1724	tasklist.exe
2652	tasklist.exe
1400	tasklist.exe
3608	tasklist.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\mssecsvc.exe	svc_a27db9ec912e.exe
File opened for modification	C:\Windows\System32\mssecsvc.exe	svc_a27db9ec912e.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2572	sc.exe
4192	sc.exe
1828	sc.exe

Executes a command shell one-liner 1 TTPs 15 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3532	cmd.exe
2200	cmd.exe
4404	cmd.exe
2360	cmd.exe
5280	cmd.exe
3904	cmd.exe
696	cmd.exe
3064	cmd.exe
3964	cmd.exe
6052	cmd.exe
4964	cmd.exe
4244	cmd.exe
3160	cmd.exe
1340	cmd.exe
4844	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3372	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3228	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4768	powershell.exe
4768	powershell.exe
4768	powershell.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeDebugPrivilege	5400	tasklist.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeIncreaseQuotaPrivilege	4768	powershell.exe
Token: SeSecurityPrivilege	4768	powershell.exe
Token: SeTakeOwnershipPrivilege	4768	powershell.exe
Token: SeLoadDriverPrivilege	4768	powershell.exe
Token: SeSystemProfilePrivilege	4768	powershell.exe
Token: SeSystemtimePrivilege	4768	powershell.exe
Token: SeProfSingleProcessPrivilege	4768	powershell.exe
Token: SeIncBasePriorityPrivilege	4768	powershell.exe
Token: SeCreatePagefilePrivilege	4768	powershell.exe
Token: SeBackupPrivilege	4768	powershell.exe
Token: SeRestorePrivilege	4768	powershell.exe
Token: SeShutdownPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeSystemEnvironmentPrivilege	4768	powershell.exe
Token: SeRemoteShutdownPrivilege	4768	powershell.exe
Token: SeUndockPrivilege	4768	powershell.exe
Token: SeManageVolumePrivilege	4768	powershell.exe
Token: 33	4768	powershell.exe
Token: 34	4768	powershell.exe
Token: 35	4768	powershell.exe
Token: 36	4768	powershell.exe
Token: SeIncreaseQuotaPrivilege	4768	powershell.exe
Token: SeSecurityPrivilege	4768	powershell.exe
Token: SeTakeOwnershipPrivilege	4768	powershell.exe
Token: SeLoadDriverPrivilege	4768	powershell.exe
Token: SeSystemProfilePrivilege	4768	powershell.exe
Token: SeSystemtimePrivilege	4768	powershell.exe
Token: SeProfSingleProcessPrivilege	4768	powershell.exe
Token: SeIncBasePriorityPrivilege	4768	powershell.exe
Token: SeCreatePagefilePrivilege	4768	powershell.exe
Token: SeBackupPrivilege	4768	powershell.exe
Token: SeRestorePrivilege	4768	powershell.exe
Token: SeShutdownPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeSystemEnvironmentPrivilege	4768	powershell.exe
Token: SeRemoteShutdownPrivilege	4768	powershell.exe
Token: SeUndockPrivilege	4768	powershell.exe
Token: SeManageVolumePrivilege	4768	powershell.exe
Token: 33	4768	powershell.exe
Token: 34	4768	powershell.exe
Token: 35	4768	powershell.exe
Token: 36	4768	powershell.exe
Token: SeDebugPrivilege	2648	tasklist.exe
Token: SeDebugPrivilege	2916	proc_7dd490eaed.exe
Token: SeDebugPrivilege	3608	tasklist.exe
Token: SeDebugPrivilege	3652	tasklist.exe
Token: SeDebugPrivilege	764	proc_7dd490eaed.exe
Token: SeDebugPrivilege	1724	tasklist.exe
Token: SeDebugPrivilege	1356	tasklist.exe
Token: SeDebugPrivilege	2652	tasklist.exe
Token: SeDebugPrivilege	1400	tasklist.exe
Token: SeDebugPrivilege	3140	tasklist.exe
Token: SeDebugPrivilege	1452	tasklist.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 5348	3648	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 5348 wrote to memory of 5836	5348	2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 5836 wrote to memory of 620	5836	svc_a27db9ec912e.exe	91
PID 620 wrote to memory of 3904	620	svc_a27db9ec912e.exe	92
PID 3904 wrote to memory of 5400	3904	cmd.exe	94
PID 620 wrote to memory of 696	620	svc_a27db9ec912e.exe	96
PID 696 wrote to memory of 3228	696	cmd.exe	98
PID 620 wrote to memory of 4768	620	svc_a27db9ec912e.exe	100
PID 620 wrote to memory of 2200	620	svc_a27db9ec912e.exe	102
PID 2200 wrote to memory of 2572	2200	cmd.exe	104
PID 620 wrote to memory of 3064	620	svc_a27db9ec912e.exe	105
PID 3064 wrote to memory of 4192	3064	cmd.exe	107
PID 620 wrote to memory of 4404	620	svc_a27db9ec912e.exe	108
PID 4404 wrote to memory of 1828	4404	cmd.exe	110
PID 2188 wrote to memory of 3328	2188	mssecsvc.exe	112
PID 3328 wrote to memory of 2360	3328	mssecsvc.exe	113
PID 2360 wrote to memory of 2648	2360	cmd.exe	115
PID 3328 wrote to memory of 2916	3328	mssecsvc.exe	116
PID 3328 wrote to memory of 3964	3328	mssecsvc.exe	117
PID 3964 wrote to memory of 3608	3964	cmd.exe	119
PID 620 wrote to memory of 764	620	svc_a27db9ec912e.exe	120
PID 620 wrote to memory of 4844	620	svc_a27db9ec912e.exe	121
PID 4844 wrote to memory of 3372	4844	cmd.exe	122
PID 3328 wrote to memory of 4964	3328	mssecsvc.exe	124
PID 4964 wrote to memory of 3652	4964	cmd.exe	126
PID 3328 wrote to memory of 3532	3328	mssecsvc.exe	127
PID 3532 wrote to memory of 1724	3532	cmd.exe	129
PID 3328 wrote to memory of 5280	3328	mssecsvc.exe	130
PID 5280 wrote to memory of 1356	5280	cmd.exe	132
PID 3328 wrote to memory of 4244	3328	mssecsvc.exe	133
PID 4244 wrote to memory of 2652	4244	cmd.exe	135
PID 3328 wrote to memory of 3160	3328	mssecsvc.exe	136
PID 3160 wrote to memory of 1400	3160	cmd.exe	138
PID 3328 wrote to memory of 6052	3328	mssecsvc.exe	139
PID 6052 wrote to memory of 3140	6052	cmd.exe	141
PID 3328 wrote to memory of 1340	3328	mssecsvc.exe	142
PID 1340 wrote to memory of 1452	1340	cmd.exe	144

C:\Users\Admin\AppData\Local\Temp\2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-23_b7df093ff6998aff3f773356590999b0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Users\Admin\AppData\Local\Temp\svc_a27db9ec912e.exe
    C:\Users\Admin\AppData\Local\Temp\svc_a27db9ec912e.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\svc_a27db9ec912e.exe
      C:\Users\Admin\AppData\Local\Temp\svc_a27db9ec912e.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:620
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3904
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:696
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:3228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableIOAVProtection $true"
        5⤵
        Disables one or more Microsoft Defender components
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "sc create "MsSecSvc" binPath= "C:\Windows\System32\mssecsvc.exe" start= auto DisplayName= "Microsoft Security Center Service""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2200
      - C:\Windows\system32\sc.exe
        
        sc create "MsSecSvc" binPath= "C:\Windows\System32\mssecsvc.exe" start= auto DisplayName= "Microsoft Security Center Service"
        6⤵
        Launches sc.exe
        
        PID:2572
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "sc failure "MsSecSvc" reset= 60 actions= restart/5000"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3064
      - C:\Windows\system32\sc.exe
        
        sc failure "MsSecSvc" reset= 60 actions= restart/5000
        6⤵
        Launches sc.exe
        
        PID:4192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "sc start "MsSecSvc""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4404
      - C:\Windows\system32\sc.exe
        
        sc start "MsSecSvc"
        6⤵
        Launches sc.exe
        
        PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\proc_7dd490eaed.exe
        
        C:\Users\Admin\AppData\Local\Temp\proc_7dd490eaed.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:764
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\melt.bat"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4844
      - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:3372

C:\Windows\System32\mssecsvc.exe
C:\Windows\System32\mssecsvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\System32\mssecsvc.exe
  C:\Windows\System32\mssecsvc.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\System32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2648
- - C:\Windows\TEMP\proc_7dd490eaed.exe
    "C:\Windows\TEMP\proc_7dd490eaed.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Windows\System32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\System32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\System32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5280
  - - C:\Windows\System32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Windows\System32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\System32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\Windows\System32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1340
  - - C:\Windows\System32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_Salsa20.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\Crypto\Cipher\_Salsa20.pyd
Size 13KB
SHA256 19d5f8081552a8aafe901601d1ff5c054869308cef92d03bcbe7bd2bb1291f23
MD5 30f13366926ddc878b6d761bec41879e
SHA1 4b98075ccbf72a6cbf882b6c5cadef8dc6ec91db
SHA512 bdcec85915ab6ec1d37c1d36b075ae2e69aa638b80cd08971d5fdfd9474b4d1cf442abf8e93aa991f5a8dcf6db9d79fb67a9fe7148581e6910d9c952a5e166b4
SSDEEP 192:SF/1nb2eqCQtkluknuz4ceS4QDuEA7cqgYvEP:o2P6luLtn4QDHmgYvEP
TLSH
T1C8520886F2A781F9F92B4075CDA30A8B9A79B500275137CB6360C1475D233E6323E7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\Crypto\Cipher\_raw_cbc.pyd
Size 12KB
SHA256 9d0a5c9813ad6ba129cafef815741636336eb9426ac4204de7bc0471f7b006e1
MD5 0c46d7b7cd00b3d474417de5d6229c41
SHA1 825bdb1ea8bbfe7de69487b76abb36196b5fdac0
SHA512 d81b17b100a052899d1fd4f8cea1b1919f907daa52f1bad8dc8e3f5afc230a5bca465bbac2e45960e7f8072e51fdd86c00416d06cf2a1f07db5ad8a4e3930864
SSDEEP 192:BF/1nb2eqCQtkrAUj8OxKbDbzecqgYvEkrK:t2P6EE8OsbD2gYvEmK
TLSH
T1C142094EFAA546F9F95B4178C4731A09A5B6B910374077CB0372829A1D23BD1373A7C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cfb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\Crypto\Cipher\_raw_cfb.pyd
Size 13KB
SHA256 5ea310e0f85316c8981ed6293086a952fa91a6d12ca3f8af9581521ee2b15586
MD5 3142c93a6d9393f071ab489478e16b86
SHA1 4fe99c817ed3bcc7708a6631f100862ebda2b33d
SHA512 dcafec54bd9f9f42042e6fa4ac5ed53feb6cf8d56ada6a1787cafc3736aa72f14912bbd1b27d0af87e79a6d406b0326602ecd1ad394acdc6275aed4c41cdb9ef
SSDEEP 192:YTI1RgPfqLlvIOP3bdS2hkPUDk9oCM/vPXcqgzQkvEmO:YTvYgAdDkUDDCWpgzQkvE
TLSH
T1B3522909F79844BCF85B81B9C977091A9AB9B554331123DF0320929E2EA37C13B3EBD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\Crypto\Cipher\_raw_ctr.pyd
Size 14KB
SHA256 4f74bcf6cc81bac37ea24cb1ef0b17f26b23edb77f605531857eaa7b07d6c8b2
MD5 a34f499ee5f1b69fc4fed692a5afd3d6
SHA1 6a37a35d4f5f772dab18e1c2a51be756df16319a
SHA512 301f7c31dee8ff65bb11196f255122e47f3f1b6b592c86b6ec51ab7d9ac8926fecfbe274679ad4f383199378e47482b2db707e09d73692bee5e4ec79c244e3a8
SSDEEP 192:SJ1gSPqgKkwv0i8NSixSK57NEEE/qexcEtDr+DjRcqgUF6+6vEX:6E1si8NSixS0CqebtD+rgUUjvE
TLSH
T128620A1AE79105B9F66642B488B24E0E97FEB4042352BBDF137592692E137C4333F794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\Crypto\Cipher\_raw_ecb.pyd
Size 10KB
SHA256 6248fdf98f949d87d52232ddf61fada5ef02cd3e404bb222d7541a84a3b07b8a
MD5 dedae3efda452bab95f69cae7aebb409
SHA1 520f3d02693d7013ea60d51a605212efed9ca46b
SHA512 8c1cab8f34de2623a42f0750f182b6b9a7e2affa2667912b3660af620c7d9ad3bd5b46867b3c2d50c0cae2a1bc03d03e20e4020b7ba0f313b6a599726f022c6c
SSDEEP 192:PzWVddiTHThQTctEEI4qXDc1CkcqgbW6:PzWMdsc+EuXDc0YgbW
TLSH
T19C22FB8DFE9189EFEA2581B585730E4AA075B710175233CF0370962E1F663DB357A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ofb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\Crypto\Cipher\_raw_ofb.pyd
Size 12KB
SHA256 13c34a25d10c42c6a12d214b2d027e5dc4ae7253b83f21fd70a091fedac1e049
MD5 a13584f663393f382c6d8d5c0023bc80
SHA1 d324d5fbd7a5dba27aa9b0bdb5c2aebff17b55b1
SHA512 14e4a6f2959bd68f441aa02a4e374740b1657ab1308783a34d588717f637611724bc90a73c80fc6b47bc48dafb15cf2399dc7020515848f51072f29e4a8b4451
SSDEEP 192:BF/1nb2eqCQtkgU7L9D0T70fcqgYvEJPb:t2P6L9DWAxgYvEJj
TLSH
T1A542198DFAE589FDF5664276C4730A45A5B57910379077CF0320529B0E233CA377A786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\Crypto\Hash\_BLAKE2s.pyd
Size 14KB
SHA256 1c340d2625dad4f07b88bb04a81d5002aabf429561c92399b0eb8f6a72432325
MD5 06d3e941860bb0abedf1baf1385d9445
SHA1 e8c16c3e8956ba99a2d0de860dcfc5021f1d7de5
SHA512 6f62acff39b77c1ec9f161a9bfa94f8e3b932d56e63daee0093c041543993b13422e12e29c8231d88bc85c0573ad9077c56aa7f7a307e27f269da17fba8ee5a3
SSDEEP 192:mF/1nb2eqCQt7fSxp/CJPvADQZntxSOvbcqgEvcM+:c2PNKxZWPIDexVlgEvL
TLSH
T153520956F6A444FEF96642F980B30A0D92FABA12936173CF1360565A1D237C0727E3E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_MD5.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\Crypto\Hash\_MD5.pyd
Size 15KB
SHA256 2e8bb88d768890b6b68d5b6bb86820766ada22b82f99f31c659f4c11def211a1
MD5 39b06a1707ff5fdc5b3170eb744d596d
SHA1 37307b2826607ea8d5029293990eb1476ad6cc42
SHA512 98c3c45eb8089800edf99acea0810820099bfd6d2c805b80e35d9239626cb67c7599f1d93d2a14d2f3847d435eaa065bf56df726606bb5e8a96e527e1420633d
SSDEEP 192:RZ9WfqP7M93g8UdsoS1hhiBvzcuiDSjeoGmDZNbRBP0rcqgjPrvE:sA0gHdzS1MwuiDSyoGmD/r89gjPrvE
TLSH
T1F5625C0CFA6045F9FAA981B8C0634E16A7B57529636167CF03B592AE0E337D0F376781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\Crypto\Hash\_SHA1.pyd
Size 17KB
SHA256 8970df77d2f73350360dbe68f937e0523689ff3d7c0be95eb7ca5820701f1493
MD5 9d15862569e033c5aa702f9e4041c928
SHA1 11376e8cb76ad2d9a7d48d11f4a74fb12b78bcf6
SHA512 322f0f4947c9d5d2800deebfd198eabe730d44209c1b61bb9fd0f7f9ed5f719ae49f8397f7920bdb368bb386a598e9b215502dc46fbe72f9340876cf40affc8a
SSDEEP 384:bPHdP3MjeQTh+QAZUUw8lMF6D+1tgj+kf4:xPcKQT3iw8lfDUej+
TLSH
T145823C89FA6958BCEA2D8830C6934A1FA376B50B4760A7CF03E003ED1C173E65934B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA256.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\Crypto\Hash\_SHA256.pyd
Size 21KB
SHA256 44eed167431151e53a8f119466036f1d60773ddeb8350af972c82b3789d5d397
MD5 352f56e35d58abe96d6f5dbbd40d1fea
SHA1 5f0c9596b84b8a54d855441c6253303d0c81aa1b
SHA512 cb4862b62abb780656f1a06dadd3f80aea453e226c38efae4318812928a7b0b6a3a8a86fcc43f65354b84fc07c7235ff384b75c2244553052e00dc85699d422a
SSDEEP 384:jljwGpJpvrp/LtaqvYHp5RYcARQOj4MSTjqgPmJDcbegjxo:hjw4JVZYtswvqDcb7j
TLSH
T192A21A1CDF3C41A4F90E603AAB73466A77B9B510D394B3EF8B1149291C2B3EE563474A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_scrypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\Crypto\Protocol\_scrypt.pyd
Size 12KB
SHA256 149027958a821cbc2f0ec8a0384d56908761cc544914ced491989b2ad9d5a4dc
MD5 6229a84562a9b1fbb0c3cf891813aadd
SHA1 4fafb8af76a7f858418aa18b812feacadfa87b45
SHA512 599c33f81b77d094e97944bb0a93da68d2ccb31e6871ce5679179fb6b9b2ce36a9f838617ac7308f131f8424559c5d1a44631e75d0847f3cc63ab7bb57fe1871
SSDEEP 192:YTIekCffqPSTMeAk4OeR64ADpki6RcqgO5vE:YTNZMcPeR64ADh63gO5vE
TLSH
T125422A09FAA484F9F56B8139C4734A0AAAB9B61423517BCF0361D36A1D737CA323D7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 b5899a53bc9d3112b3423c362a7f6278736418a297bf86d32ff3be6a58d2deec
MD5 3d566506052018f0556adf9d499d4336
SHA1 c3112ff145facf47af56b6c8dca67dae36e614a2
SHA512 0ac6a1fc0379f5c3c80d5c88c34957dfdb656e4bf1f10a9fa715aad33873994835d1de131fc55cd8b0debda2997993e978700890308341873b8684c4cd59a411
SSDEEP 192:PzVVddiTHThQTctEEaEDKDnMRWJcqgbW6:PzTMdsc+EaEDKDnCWvgbW
TLSH
T1FC22D98CFE9289FAEA298179C5674E4BA179BB11171273CF1370967A1E623C7313A341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 af76a5b10678f477069add6e0428e48461fb634d9f35fb518f9f6a10415e12d6
MD5 fae081b2c91072288c1c8bf66ad1aba5
SHA1 cd23ddb83057d5b056ca2b3ab49c8a51538247de
SHA512 0adb0b1088cb6c8f089cb9bf7aec9eeeb1717cf6cf44b61fb0b053761fa70201ab3f7a6461aaae1bc438d689e4f8b33375d31b78f1972aa5a4bf86afad66d3a4
SSDEEP 96:P/ryZVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EMz3DIWMot4BcX6gbW6O:PzQVddiTHThQTctEEO3DSoKcqgbW6
TLSH
T1BD221B8DFE9249FEE62D82B5C5674E0AA175B710171273CF1374966A1E623CB313A341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\VCRUNTIME140.dll
Size 96KB
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
TLSH
T1E0A37D4A77A542BBC06ED274C1A39906F7B0B840877063CF07B5466A5F23BE19E3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_asyncio.pyd
Size 62KB
SHA256 97ed94f8d35445573177ba75e17dcf4c667e3c236c0b4d436fa97f8c862cc0bd
MD5 4ab3a456c59f6aed0d147c31fab59604
SHA1 36cf52fce6accb5896e9b9d0cdda816f870347d3
SHA512 31b48c7891aee3fb1600f4d29b6bbbb138f8b561bd252b233b69054536c6118225cb9711fa56a0d11a619968c7befc11ec9b31936a346dfd795515934ca8e00f
SSDEEP 1536:9vV7Wh3eT4k53MR4mj6YFro9I45n4N7Sy1Px:9v5WhuJ5MR4mj6qo9I45nO/x
TLSH
T130538D46D2908199D997A1B8C8730F46E7B1F5944B0013CF6268D29E3F733528BFEB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_bz2.pyd
Size 81KB
SHA256 190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2
MD5 23dce6cd4be213f8374bf52e67a15c91
SHA1 dfc1139d702475904326cb60699fec09de645009
SHA512 c3983e2af9333a8538f68f7048b83c1bb32219c13adac26fd1036c3dc54394a3e2c1e4c0219232badd8e2c95418019b9b22906bdb23a19601447573a93c038a0
SSDEEP 1536:LsRz7qldca26V6bw3haLRFcja8Ed7jjWHCFI4tV87SyzPxA:YRzGgohaQ9Ed7jjWiFI4tV81xA
TLSH
T14E839E52F6A496B5F01BA27A95B14353E331FE49039093EFF684831B2F03B917C6935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp310-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_cffi_backend.cp310-win_amd64.pyd
Size 175KB
SHA256 c379126647af2cbfb592d6a921f6218da59b886e2a56e9b82f8159aced6f1100
MD5 04fd1a452e91605545a267cb04cdd78f
SHA1 482d3bc8b0059d7c755cff695c0366be402c86ba
SHA512 12549b3a03e869998cc808079da1ca13e00949efa7c15ba97aa510feca2e481bdc74eefa12ab1f6a08d9cca06957a6d4769aa67e9973b59ad4fb9ef04a95b37b
SSDEEP 3072:1X9Iup1Rz9vapoU+EX+QRhbUvpzLcmIXPpSfJ0KN3kS7ORSTL7K3gqFb2HF:1jL0poIFRhbUvpncmIUGDRSTLOwU2H
TLSH
T140046C5A329C10B6D6A6513886579B53E3B3B430174197CF0160C7B52F1BBEABA7FB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_ctypes.pyd
Size 120KB
SHA256 7adcea3a5568752a6050610cfbe791a4f8186aaaa002f916b88560a1ddab580f
MD5 2abeebe2166921a4d8b67b8f8a2b878a
SHA1 21f0fff00cba76a0ea471c3e05179e4b4cc1ebd0
SHA512 54c802d532c9ef9f3668d5e9bf23b69a58f87ec545af7fd4eab1055bfb8ee66481f361458076a364a17ddddd6550a70f5442c2bbe6562553472c0839346b1a35
SSDEEP 3072:KKCJyJvjdYIih4Aa44kfrSS9cu08hwk/5I4QPnzx:KfsVSa4TfrSKL/
TLSH
T1EEC35B1B279410AAEA679078C4B35E07DB71F8591B1083CF0294C69E2F637E36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_decimal.pyd
Size 242KB
SHA256 2bab2833c24eb4e07fe082d291013eed000a5cfc22df49311c729e7a57fe632e
MD5 b6acb44c2f580991df7b1358a0fc0b69
SHA1 f2d3d2ce5439197637b02e8dd414f8e6dddb6678
SHA512 0e73b00db220794aa291b4e710ad7abbfb06a78fa63e1f313963472009f77a48d2ef9bca24d350bc2c94d2a14d3b676e9132ab79b33da5b09a3b90cceeb816b0
SSDEEP 6144:Gs3pt2wLuP4XSNc2VR6qEv4B9qWMa3pLW1Ak7N4u1cn:N2wQ4XSRVR6t43a7eu1cn
TLSH
T1ED345C16A2490DA4DE778074C89B9B57E7B278944360D3CF43A4CAA63F537A323BE744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_elementtree.pyd
Size 124KB
SHA256 0f35db36f3768bd096727c731aa76879650246d550c503af381cd96adee35258
MD5 23844dc840c287df4fdf3adf76a751f1
SHA1 f8cfb71363288d15a4cd8c8a34007b5020da4322
SHA512 4305e3910eea3f9c55877b2fc29330d35a4da04fe6b078564fa44b2abccfa051a0e9192339292e5516a878a43a89d1ede54d02717a1a41a2777b9abac1d17c72
SSDEEP 3072:yyaTDrPxv8RwXQYk2wHC4YkTQNlyI/0O/0t/0S/0GRvnT24Z1I41f38xr:InPxv8SZk2wbnQaItWlzT24Z
TLSH
T156C34A5B62A5C0AFE462007C96A74F46D7B2FC610E4187CF6298F6AC9F333923E59315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_hashlib.pyd
Size 60KB
SHA256 23063b56aa067c3d4a79a873d4db113f6396f3e1fe0af4b12d95d240c4cf9969
MD5 477dd76dbb15bad8d77b978ea336f014
SHA1 3ee56105b71c3676c2e4fdaeb7d561f68cf03b9e
SHA512 3a97c0a860e3cf97ae53b1f75623c52dcad9b64b70d329511781058a3477bc9faea32c2b8dc4852e7a8c4b0a02c8e3d027cf27e91187069cb35fb4d78d4e73ef
SSDEEP 1536:oxTlJFWaIKsZbdqzOgB1f9I45IX7SyMDPxok:CT36nZbdqzXf9I45IXsxj
TLSH
T167536D05A68440B9D8674278CAE31F5BEAB1F0405751ABEF1358C1CE2F237C3D6BA796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_lzma.pyd
Size 154KB
SHA256 5361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209
MD5 401eca12e2beb9c2fbf4a0d871c1c500
SHA1 7cfc2f94ade6712dd993186041e54917a3dd15ae
SHA512 da6b63ba4e2e7886701ff2462c11dd989d8a3f2a2a64bb4f5eed7271b017d69e6cfe7347e3d515fdf615ec81d2bb58367bcc1533b8a5073edf9474a3759f6d7c
SSDEEP 3072:sc+sMZ4drcsAF5FRm1YznfI9mNoxapHVZKeFI4e1QGxK:r+sMAIt5dwYOxatKeV
TLSH
T1DFF32982A394F4E5F7728C78D6624F13D7F678490310929A12CCD36E2B1FB659A2E713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_multiprocessing.pyd
Size 32KB
SHA256 b28e94b921d5d539cbd5f97ff4926e4f186791af1b364de7be7fcce3970172f7
MD5 d9f27a0d595c8b044f78e7bb25fd107a
SHA1 443badbdb08af2fdae772a9c1247bbd3d8512ddf
SHA512 a4969ee0e56d20313ab3b9391b8f9796fa091969fcc0ffe4ec188f0d710d45a6c9cf388e0f2336540128afb81d6260dacc180606eeb05429fecc30b5295b46c9
SSDEEP 768:aHI6RwgJ5xeyg2edhnJ8tI4Rt+8YiSyvDPxWEe3:iIoJ5Uyg2edhJ8tI4Rt+87Sy7Pxw
TLSH
T13CE27D439E54289AE437C57598E35F29EA31F6560B1083DF2358C24E1F323837BE679A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_overlapped.pyd
Size 47KB
SHA256 370b4ad06881c3cb781be0f78476eaeb5e440c60498f5791c3d413860fdc9b5e
MD5 04f8440ff4724eb61a35ac13f3643ae9
SHA1 ca0f01c4cff9cf2433326d407d143278940346b9
SHA512 b575ddc7804ddb634077cece18dc4ec83d7c7e1d0de913abada64b2666f77bd413b4494aa96a172a0b0897695e2772edc72bcb549c314317e613f37510c88e38
SSDEEP 768:Wy4KxRzX8sGAQRxcSVNdQwBlLXTSVsGxI4st7YiSyv9fgmPxWEZO:eKxYNDnSVsGxI4st77SylfpPxO
TLSH
T177237D416B5404DADE7B8279E4A35F12E67174A14311C38F622CCA4E1F723D1AFAA3D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_queue.pyd
Size 29KB
SHA256 24c23d04d274a4c1234f1a1a35b1805e1f17f99968f8baeec0c3b5295f05608a
MD5 8eabd51d536276f3b3257ee975e50bfc
SHA1 1a13f707b29b895647a7de254031a6c80eb2cb7a
SHA512 cfa027a1e01204078ccab3c2e1910e5806e0294d3ff0225d4713ea3b16cf07589005a0cc342688c3bb0bb6aa31b5401760c3890d46b39038b046072ad7b02b81
SSDEEP 768:Lez/DFB6r3GkrAIe5I47UYYiSyvN0PxWEZokD:LeDK3GkrAIe5I47UY7SyWPxnD
TLSH
T104D28E43ABA45CD6D437C17094E71E25F931F652970183EF3318C25E2F327826BA676A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_socket.pyd
Size 75KB
SHA256 71f014c3c56661ec93500db1d9f120e11725a8aedabc3a395658275710065178
MD5 4ceb5b09b8e7dc208c45c6ac11f13335
SHA1 4dde8f5aa30bd86f17a04e09a792a769feb12010
SHA512 858c271b32729762773562ab3dbda8021aa775ba4606f57e891be18d9fe27518a48db0811eff9aafe53fb44557186431c672bbec204fa17a8ae6b86765a02d07
SSDEEP 1536:MjYndNP4/Iujb9/s+S+p+E2i8k/DDzCfi5I4Qwi7SyKjPxI:2YnrP4wujb9/sT+p+E2fk/XGfi5I4QwI
TLSH
T15A735A12A69051B9E2B38079C2635E23FB70F48103D593CF5265C66E6F23782AF79BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_ssl.pyd
Size 155KB
SHA256 4e496cb3b89550cf5883d0b52f5f4660524969c7a5fa35a3b233df4f482d0482
MD5 dcb25c920292192dd89821526c09a806
SHA1 79c9af3a11b41d94728f274b45a7c61dc8bbf267
SHA512 ae4ed1a66eef0b0c474c6ee498cd1388ef41f3746905257c7f5c0f73abbe3262eb47bb5748d47d55f1bd376308335a089c2b4c15ffe5d7fc21f2a660a4a93ba4
SSDEEP 3072:VOoLGtbSpE3z/J/PUE9u/85J2oEPwu3rE923+nuI5Piev9muFI4t761xu:VOoitbSpE3zhHPu/mE8nuaF9mud
TLSH
T1B9F37C47F24419A7E817E4BDC2230A53EBB5F045231147CE49D6D68A0F13B46AFBAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_testcapi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_testcapi.pyd
Size 127KB
SHA256 0b422b8f859c05b419487002c1fa873f1ec72229bbb933a13049ae146106845a
MD5 ec77f1cfb6283f7bd197d5a7e54b8562
SHA1 a0d9ac515659f3a4740593e4ee646a3ab2e882bd
SHA512 b69c890b611f152eeca0456693a1a271fb8b7e79e8485d99490e59a10024e99dcad74a6eec1607ab070bde40616db1f5f532da0b7bbe03a5384705bcf5b268c9
SSDEEP 3072:PiHY7hI9AXx+JzmdfW/NkfTsvffepwFwp0w5Jgw9w/hem81wffhFaM/5fVgu7FbN:qHY7Gq+k8n1z/QuHheWz
TLSH
T111D329576385208AEDA695BCC8739F23AB61F061535053CF04A0C64D4F237DA6FBEB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_testinternalcapi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_testinternalcapi.pyd
Size 29KB
SHA256 239242c4525fabada2913b5d721620881ff82e6ba27b034ace366e92773fbe54
MD5 e81806b71147aef22838f78e6add27be
SHA1 14260c5f5afae144ec5e5c03635ba68ef4fe8fef
SHA512 69975786ce763d34273f978f72c0a13d91e021941076f1b07bdab5b99b82acea4859f3c0cb7e1a937a4faa83c474f864fa5f4d56b75eaadea0297cfc19f203ed
SSDEEP 384:BDVe53RLXcsWg3OLOCEDgT89EuAtI46NpIYiSy1pCQqaRPxh8E9VF0Nyql6:GLlcKzAtI46N+YiSyvLPxWEso
TLSH
T144D26D5AE7905499ED37C930D8F64D26A871B780872182DF3328812E1F717C16BBBBB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\_tkinter.pyd
Size 63KB
SHA256 a6849cc7f7075924cbebe3000d6daa88d1724c1d869d6683a2bf9664cfb0e9ab
MD5 e625a7b147aa41022eae5eff336b9a52
SHA1 71aa2bf19265b161809feeca9d9a455881b6cb90
SHA512 e419600e66314fe4c8a90d067e1cd998899f61489d6f233b771d606cd876ad2cac8d449b11f7d03084c6890ae8e21109101adf70c485ea403f78db30e516b783
SSDEEP 1536:dMazUiVl77hR81C/LCYrz9I45S47Sy7Px:d3zUMp/LCYrz9I45S4tx
TLSH
T1FB538DAB6BA4009ACE67C17CC5734F13EA75B4410A10924F0298D35A2F737E3A7FAB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\base_library.zip
Size 859KB
SHA256 d9d2aecb7fa91322fad8ba7182b0e6bec926de1b34af6e951e6f6e05ff518cf6
MD5 f8b450892de0224b9587480ea0ac2840
SHA1 686ef4f0467f8dd8d45d52aedcd5bdc16b860561
SHA512 791cb2981bb42e5d2ed74f3426585516ac319f20db14395dcd7594092cf8c22dd8fe0bc101669689f711b27e6b2490f21b4dd0d879032fcd7b2197012d8dacd9
SSDEEP 12288:LEHYKmhxWSBC6SOI1qNA4a2Y42dqVwxffpE7epgSLMNx:LEHYN1BxLa213VwxffpE7ehMNx
TLSH
T199153A8069911ED7FD05F278815F8E3C069AB33ADB89D543BA4FC2D8BF472E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\libcrypto-1_1.dll
Size 3.3MB
SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
MD5 6f4b8eb45a965372156086201207c81f
SHA1 8278f9539463f0a45009287f0516098cb7a15406
SHA512 2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
SSDEEP 49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
TLSH
T1B5F58D5AA3AC0184E9BAC17CC9574727E7B1B45A93B09BCF08A681780F17BD6373DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\libssl-1_1.dll
Size 686KB
SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
MD5 8769adafca3a6fc6ef26f01fd31afa84
SHA1 38baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA512 fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
SSDEEP 12288:UUnBMlBGdU/t0voUYHgqRJd7a7+JLvrfX7bOI8Fp0D6WuHU2lvzR:UN/t0vMnffOI8Fp0D6TU2lvzR
TLSH
T1ADE44B95ABB51498D9E6C17C86534A33E37AF4141330AFCF06A5853E0F17BD82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\pyexpat.pyd
Size 193KB
SHA256 30eb08571a88165b84bc0783c3ffbf19e9d99c5634ab274c73a8ddca163cafda
MD5 2aa10c44252c9d241a01557700df12af
SHA1 fa4d4de5f8d2eb2d6c633d17113347316cb3024c
SHA512 2448c39ba6711093855f115c0ce22e1403b2f276092db9d61d76fdc55839b1a19898bba7ee39625b7ec41aa9a996a4429363bf42571b02775730148049c142e9
SSDEEP 3072:xkPTyqdACxzyNgfN/ONLuCGqbRSfL0duV5iRpmZzv7kr9Gd1NZdDdvdByzo0OYUl:Omq+OfNGGaRSfL0dujwZoNXV5Rr
TLSH
T1A7146B5B71A6C0EBD8938038D6974A0BDBB2F865038097CF1294E77D5F27B423E69319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\python310.dll
Size 4.3MB
SHA256 c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948
MD5 54f8267c6c116d7240f8e8cd3b241cd9
SHA1 907b965b6ce502dad59cde70e486eb28c5517b42
SHA512 f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1
SSDEEP 49152:+xWM30WEuKdhbvd9aCLYjiNME9KnPdZkAMnu08M2c3MrOEJ8wwoJCzSy4I0mUHJq:+eV7bkwMVPZRHqzt0XHaMZqSH1jze
TLSH
T124266B22A26401A5D9B79477C523864BCBF1FC552F20D34B41A4BAD92F73BA306EF706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\select.pyd
Size 28KB
SHA256 8b4b5d37b829ba885281134d9948f249e0ecd553ae72deda6a404619fdf4ccc5
MD5 a7863648b3839bfe2d5f7c450b108545
SHA1 10078d8edb2c46a2e74ec7680d2db293acc5731c
SHA512 a709865709abe0c39d68e2ced4aa4387cd173ea9aa0a04c9794733b5bf3584d50256a9f756fee1dec144a9d724b028264763196eeb7b89ab2697ff26d83db843
SSDEEP 768:KeS+FwhCwHq7mI5I47GZYiSyvd87PxWEY:KeS+ahHK7mI5I47GZ7SyV87Px
TLSH
T109D29F47AB9058C9D833C571A8E64E02EA34B6914B50C2CF3369C26D1F627C377F67A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\tcl86t.dll
Size 1.8MB
SHA256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
MD5 75909678c6a79ca2ca780a1ceb00232e
SHA1 39ddbeb1c288335abe910a5011d7034345425f7d
SHA512 91689413826d3b2e13fc7f579a71b676547bc4c06d2bb100b4168def12ab09b65359d1612b31a15d21cb55147bbab4934e6711351a0440c1533fb94fe53313bf
SSDEEP 24576:aNJSAyrJZwdI3xpXxBX4Crw9yilqy+uVUD5Wbsr+Qt682zhPlkPkGqTvI92jHBH9:aNgjid2LD5W4ac6xdLvIkhHP4ATdeD0
TLSH
T1A785AF1BEB6411E8D4ABD1BCC227EA0BDBF1B4191350A6DB51A08F512F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\tk86t.dll
Size 1.5MB
SHA256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
MD5 4b6270a72579b38c1cc83f240fb08360
SHA1 1a161a014f57fe8aa2fadaab7bc4f9faaac368de
SHA512 0c81434d8c205892bba8a4c93ff8fc011fb8cfb72cfec172cf69093651b86fd9837050bd0636315840290b28af83e557f2205a03e5c344239356874fce0c72b9
SSDEEP 24576:C1Bvnu8AyQD9FLi543GLUKuPO6EinYTVAiueFoC+vMvE58KOJ0wd98ydeyRP/ecr:CIyQD9FU43GLUKuPO6EinYTVAFSvESKI
TLSH
T178655B06A261C198C26EE134C91796BAEBF17C04931457DB76A0BE6D3F33BD2277A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36482\unicodedata.pyd
Size 1.1MB
SHA256 a3aa957cf891a411a4e22e41aa4053265eccba4d47b5abe6475789ebba7fcca0
MD5 cf1eda3f804dfa64ac00cad29ab243e1
SHA1 3b0f08fa679227fa635490725e17460a9de8092d
SHA512 1ba213a7e5916fe628d80efdeade35de7db88cc8118f8ac348dc7f7a7c5977975c9cf63d774136259fc055790eb96644bde2ee19c044126f1d59d665e4bc8d97
SSDEEP 12288:xcYYMmuZ63NPQCb5Pfhnzr0ql8L8koM7IRG5eeme6VZyrIBHdQLhfFE+uzH:aYYucZV0m8wMMREtV6Vo4uYzH
TLSH
T169355909BAC24EE6E88B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EE653C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2916-1104-0x0000000000EF0000-0x0000000000F04000-memory.dmp

Download

memory/4768-1079-0x000001A069510000-0x000001A069532000-memory.dmp

Download

memory/4768-1083-0x000001A0695C0000-0x000001A069672000-memory.dmp

Download

memory/4768-1082-0x000001A0695A0000-0x000001A0695BE000-memory.dmp

Download

memory/4768-1084-0x000001A069690000-0x000001A06969A000-memory.dmp

Download