xred | f5fca3bc67f6d1d336d91b1ce6806eaf0b870dcfbe409b8375b2b8c12ce26ffe

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 19:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Logs to txt Version 1.0.exe
Size 16.4MB
Sample260910-x1tsyaxvas
SHA256 f5fca3bc67f6d1d336d91b1ce6806eaf0b870dcfbe409b8375b2b8c12ce26ffe
MD5 34f964b51f9cc902a5f6d4ad271c40ef
SHA1 7e2a984d4fe63c8212264490e654bf0f400207a4
SHA512 7d29ec64ec8c83a5cade511325210e6a9c1bad783c2678479de5dc443d765d5cdc671ff3b1d80199505266e62b7be3db0627de96b63f1bcb03ea4702d85b16ec
SSDEEP 393216:z8UKOltJsQp2KK6ocm+f6p26DQbfoQtkXXgNxMCmO8kSUJCJL:oUKaJ3p2KK6oIfZ9/oYp/JCJL
TLSH
T15507232A6A51CD3FDD213BB88CDAA3F8845C77A13D3AE50E66A57D4C4E6A74438011F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution xred macro persistence pyinstaller

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000800000001ca18-1256.dat

Executes dropped EXE 5 IoCs

pid	Process
2040	._cache_Logs to txt Version 1.0.exe
4672	Synaptics.exe
4408	Synaptics.exe
836	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe

Loads dropped DLL 24 IoCs

pid	Process
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe
2244	Ysrdnujudrzlbp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Logs to txt Version 1.0.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000c00000001c58e-131.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logs to txt Version 1.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Colors	Ysrdnujudrzlbp.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Synaptics.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Ysrdnujudrzlbp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Ysrdnujudrzlbp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Ysrdnujudrzlbp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Ysrdnujudrzlbp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Ysrdnujudrzlbp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Ysrdnujudrzlbp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	Ysrdnujudrzlbp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	Ysrdnujudrzlbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Ysrdnujudrzlbp.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2904	EXCEL.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2244	Ysrdnujudrzlbp.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2904	EXCEL.EXE
2904	EXCEL.EXE
2904	EXCEL.EXE
2904	EXCEL.EXE
2904	EXCEL.EXE
2904	EXCEL.EXE
2244	Ysrdnujudrzlbp.exe
2904	EXCEL.EXE
2904	EXCEL.EXE
2904	EXCEL.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2040	1136	Logs to txt Version 1.0.exe	89
PID 1136 wrote to memory of 4672	1136	Logs to txt Version 1.0.exe	90
PID 2040 wrote to memory of 836	2040	._cache_Logs to txt Version 1.0.exe	94
PID 836 wrote to memory of 2244	836	Ysrdnujudrzlbp.exe	97
PID 2244 wrote to memory of 4996	2244	Ysrdnujudrzlbp.exe	98

C:\Users\Admin\AppData\Local\Temp\Logs to txt Version 1.0.exe
"C:\Users\Admin\AppData\Local\Temp\Logs to txt Version 1.0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Users\Admin\AppData\Local\Temp\._cache_Logs to txt Version 1.0.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_Logs to txt Version 1.0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\Ysrdnujudrzlbp.exe
    "C:\Users\Admin\AppData\Local\Temp\Ysrdnujudrzlbp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Users\Admin\AppData\Local\Temp\Ysrdnujudrzlbp.exe
      "C:\Users\Admin\AppData\Local\Temp\Ysrdnujudrzlbp.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies Control Panel
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:4996
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4672

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2904

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 753KB
SHA256 f63fcd8ffeddd3f0d648dbcba8ba3c4c5987bdaa874267ed99d7d6f7397b4d58
MD5 81456231ca1acbbf45050b1b6d9d1617
SHA1 0e952162fac0b646805b7275c6f00daa605ce26b
SHA512 c9817797f7410460d0db2c00b21d437ec0d15357db13e0dbaaf0b2b17980849649f11b41cda9b8210229a2014a0aeb4c712df16c224d46ec1278b4ecf8ac0ed1
SSDEEP 12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ilr:ansJ39LyjbJkQFMhmC+6GD9W
TLSH
T1A0F46D32F2D18437D1721A3D9C5BA3A9582ABE512E38794E3BF91E4C5F3D68138252D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_Logs to txt Version 1.0.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_Logs to txt Version 1.0.exe
Size 15.7MB
SHA256 8439ef6dadd0106c39852bffabdb07f921c994d46ac06967819ca1518f00a556
MD5 bc027d327240e341c0112b8426b15228
SHA1 f63ca0cc8898cc519371cd93da546167cbc97a67
SHA512 190fc728b1166c4ff027e4da61addef902a04188a275e33290d98ae93a5b47dfc068fd0e07b062cf144aeb290a9592341539aa3fdb6261e85a78c7a24285bbdf
SSDEEP 393216:8UKOltJsQp2KK6ocm+f6p26DQbfoQtkXXgNxMCmO8kSUJCJ:8UKaJ3p2KK6oIfZ9/oYp/JCJ
TLSH
T1D4F6336E0E24DE1FEE143BF488C4B7FC86CC43E1396BD21D951AB5854AABB0878415F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ysrdnujudrzlbp.exe

Path C:\Users\Admin\AppData\Local\Temp\Ysrdnujudrzlbp.exe
Size 15.7MB
SHA256 9ca9a1f859fed8945364f69213f5c2374b10773c43e2127a63deb662a8298e5f
MD5 c7c6ca44f89ddbb63113bdd41cb676e3
SHA1 f42068b1fce946b3e82f5b12eeee888dfa2125c7
SHA512 8729efcebe11f5c32bd150b08c7411c239dac4e12d6b3ceebfeadbd7ea91844e14e3c3fe9f86439e32063662cd0098f7fc2f66d9610a32a2c8a5b7979c9a952d
SSDEEP 393216:x45SaLuSxW814XMCHWUjccuIIeT7/PxY+lfxMsgyYIGEa:x45STSxW814XMb8JT3/bGlEa
TLSH
T190F633883B9508DEECD11078D9D592A6D5D9B0F707B4C29B87F81E922AB72C0DE39713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\PIL\_imaging.cp313-win_amd64.pyd
Size 2.2MB
SHA256 3970e5acec7e890d5279f14e29dd5982c9435262cbb36bcbfd5db493fa7c192a
MD5 ef228c0b3bec799db695ca6f8bbed5d6
SHA1 1f41f2e5e970e64627a232e4e565d3b448394204
SHA512 dcd13dbbe9c5be45596f721c9289aed01205f54fbc50fa2361fd92890c28c0db235617c801d26e3eff64a4199faa54d50e1915a445819a135f97247686fecb37
SSDEEP 49152:g0+3q7PeY2+jBy/aDlrlh3EPsoU06xR5:CmS4r7EPsoU06
TLSH
T114B55A02E6A15596C6B28034CDABD616E7B1780D17F186F7B2C4A7F83E23BD0353A395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\_bz2.pyd
Size 82KB
SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
MD5 cb8c06c8fa9e61e4ac5f22eebf7f1d00
SHA1 d8e0dfc8127749947b09f17c8848166bac659f0d
SHA512 e6da642b7200bfb78f939f7d8148581259baa9a5edda282c621d14ba88083a9b9bd3d17b701e9cde77ad1133c39bd93fc9d955bb620546bb4fcf45c68f1ec7d6
SSDEEP 1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
TLSH
T16F838E42E3A56AF5F86B80B956C10367E771B954075093EFF348C2693F02F426DAC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\_ctypes.pyd
Size 128KB
SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
MD5 a55e57d7594303c89b5f7a1d1d6f2b67
SHA1 904a9304a07716497cf3e4eaafd82715874c94f1
SHA512 ffa61ad2a408a831b5d86b201814256c172e764c9c1dbe0bd81a2e204e9e8117c66f5dfa56bb7d74275d23154c0ed8e10d4ae8a0d0564434e9761d754f1997fc
SSDEEP 3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
TLSH
T1A2D36C0B735800AADA779178C5736F47DBF1B456171087CF02A8C5AA2F63BA26E7E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\_hashlib.pyd
Size 62KB
SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
MD5 32d76c9abd65a5d2671aeede189bc290
SHA1 0d4440c9652b92b40bb92c20f3474f14e34f8d62
SHA512 49dc391f4e63f4ff7d65d6fd837332745cc114a334fd61a7b6aa6f710b235339964b855422233fac4510ccb9a6959896efe880ab24a56261f78b2a0fd5860cd9
SSDEEP 768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
TLSH
T1F5536C01A68080A4C96782B8D9934F5BE6F2F5415791ABDF0318C1CD1F23BC3DAFA796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\_lzma.pyd
Size 154KB
SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
MD5 1ba022d42024a655cf289544ae461fb8
SHA1 9772a31083223ecf66751ff3851d2e3303a0764c
SHA512 2b888a2d7467e29968c6bb65af40d4b5e80722ffdda760ad74c912f3a2f315d402f3c099fde82f00f41de6c9faaedb23a643337eb8821e594c567506e3464c62
SSDEEP 3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
TLSH
T1B9F34982A794F4E5F7728C78D6624F17E7F5781A032092DA01CC876D2B1FB659E2A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\_queue.pyd
Size 32KB
SHA256 b9cf502dadcb124f693bf69ecd7077971e37174104dbda563022d74961a67e1e
MD5 1c03caa59b5e4a7fb9b998d8c1da165a
SHA1 8a318f80a705c64076e22913c2206d9247d30cd7
SHA512 783ecda7a155dfc96a718d5a130fb901bbecbed05537434e779135cba88233dd990d86eca2f55a852c9bfb975074f7c44d8a3e4558d7c2060f411ce30b6a915f
SSDEEP 384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
TLSH
T1C8E28D87AB940856D477C875D4E65E35F9B2B6414B0083CF2218C25D1F723836FBABAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\_socket.pyd
Size 81KB
SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
MD5 fe896371430bd9551717ef12a3e7e818
SHA1 e2a7716e9ce840e53e8fc79d50a77f40b353c954
SHA512 67ecd9a07df0a07edd010f7e3732f3d829f482d67869d6bce0c9a61c24c0fdc5ff4f4e4780b9211062a6371945121d8883ba2e9e2cf8eb07b628547312dfe4c9
SSDEEP 1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
TLSH
T141836C11A69050FADFB3C0B5C5675E23FBB4F4801395979F0166C66A1F33382BE7AA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\_ssl.pyd
Size 177KB
SHA256 63ae2fefbfbbbc6ea39cde0a622579d46ff55134bc8c1380289a2976b61f603e
MD5 1c0e3e447f719fbe2601d0683ea566fc
SHA1 5321ab73b36675b238ab3f798c278195223cd7b1
SHA512 e1a430da2a2f6e0a1aed7a76cc4cd2760b3164abc20be304c1db3541119942508e53ea3023a52b8bada17a6052a7a51a4453efad1a888acb3b196881226c2e5c
SSDEEP 3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
TLSH
T179047B07B5946DB7D813E4FAC1230113EBB1F055331297DE44D6DA460F13B4AAEAABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

init.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\_tcl_data\init.tcl
Size 25KB
SHA256 798732aee4e838670b9a4e37e3d6c4884019a1b101f9ab26344dd2e9bd179872
MD5 06cff726f594eddc36f5152824139625
SHA1 b102300c147b1d664f87ecf29343fdcd18b66bc5
SHA512 be272de405740c5a0ccd09732dfbbfc5982506bce3a6fd1cc4fb37be1d9c787674f41265f8c1f6d8998f2b52cd09bf5ee10103446b9a6ef76a8a1d538b3c39ba
SSDEEP 768:BXugPHudKlE7BG6Xg3Qomm6ofRRECLSQDjr5vkhzx/i:ogGdKlK4aomm6offLzehNi
TLSH
T10BB2B6112388917932B343368AB9B598ED7EC1F705AD41BCB8CC825C777150A4AFDBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tclIndex

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\_tcl_data\tclIndex
Size 5KB
SHA256 36ef92ddab00ee8e3219d6d4eaf0b11f33d6c33a2c6abc2c7de30c23e90acc40
MD5 9078aa0d1c876d910ed65e9837d08cd7
SHA1 f17aea3bb439afec1bb6bc1c7b81d72f4dc4c57c
SHA512 e0aa87a624fbb074acd2b390c2085df407f4959284fb0cdac41c25701679e9a47373f73c222842c23b88718cff725c022fbd205419bc51bfb95750d79ea7a322
SSDEEP 96:eOaVhNUMUuUQU2UsUIUbUEUEeUkgU6UWhSO0DT5RTdcvsilrvs+jscMK57ehXowX:ejVHRRLP3LWDXewTbhSO0DT5RTdcvsiu
TLSH
T193C1311AA756C72803F481074999FE287ADED1E4D33DC93E99A491CD10B30076FEE9E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\_tkinter.pyd
Size 64KB
SHA256 a6851d7c25a1216d2c8fa5c1d2e9eca3d0392d60e3b7441ad9f66c23ffdd2f08
MD5 edffcea2091a5661f451ccd83ad4527d
SHA1 f81847c0adc0f58134b195a13486d851911fc516
SHA512 abc9fbf7bfbd705016a9d0430243358a1e8f7c4e398b6ba0fc5b1a147f0a1f635e27b859d742e4184ae9d396a68572b169476703312babc3e7530d698ff9ab48
SSDEEP 1536:Lx2s2VF41qe6gwfdHd5MlU9oBilPrdIJvSi7Sy7z:Lv2VNe6Lfd9alPIlPrdIJvSiJ
TLSH
T1C0537D9BAB64008ACE67C079C4B35F13EA75B5414A10938F02A8C35A1F73793ABFE755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\_wmi.pyd
Size 37KB
SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
MD5 1c30cc7df3bd168d883e93c593890b43
SHA1 31465425f349dae4edac9d0feabc23ce83400807
SHA512 267a1807298797b190888f769d998357b183526dfcb25a6f1413e64c5dccf87f51424b7e5d6f2349d7a19381909ab23b138748d8d9f5858f7dc0552f5c5846ac
SSDEEP 768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
TLSH
T136037E56E7940855D937C6BDC8E64E27F5B1B5825711C3CF3318826D0F32382AA7A3BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\base_library.zip
Size 1.3MB
SHA256 df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19
MD5 a9cbd0455b46c7d14194d1f18ca8719e
SHA1 e1b0c30bccd9583949c247854f617ac8a14cbac7
SHA512 b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528
SSDEEP 12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
TLSH
T100551A92B9527953FF14F37B80B7484CF32E86A2EF00C207355A42661FFEAB49D59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\certifi\cacert.pem
Size 292KB
SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
MD5 50ea156b773e8803f6c1fe712f746cba
SHA1 2c68212e96605210eddf740291862bdf59398aef
SHA512 01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0
SSDEEP 6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
TLSH
T1E8547C964F269C052C9FE1C1CA9B1357DD3A027B99FEF0F1394A2448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\charset_normalizer\md.cp313-win_amd64.pyd
Size 10KB
SHA256 002697227449b6d69026d149cfb220ac85d83b13056c8aa6b9dac3fd3b76caa4
MD5 56fe4f6c7e88212161f49e823ccc989a
SHA1 16d5cbc5f289ad90aeaa4ff7cb828627ac6d4acf
SHA512 7c9d09cf9503f73e6f03d30e54dbb50606a86d09b37302dd72238880c000ae2b64c99027106ba340753691d67ec77b3c6e5004504269508f566bdb5e13615f1e
SSDEEP 96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
TLSH
T13E222A0CFA6458D9DA164178C52B5E0BB0B5B710176273CF0370D57B3EB63D6AA3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
Size 122KB
SHA256 c393098e7803abf08ee8f7381ad7b0f8faffbf66319c05d72823308e898f8cfc
MD5 10116447f9276f10664ba85a5614ba3a
SHA1 efd761a3e6d14e897d37afb0c7317c797f7ae1d6
SHA512 c04461e52b7fe92d108cbdeb879b7a8553dd552d79c88dfa3f5d0036eed8d4b8c839c0bf2563bc0c796f8280ed2828ca84747cb781d2f26b44214fca2091eae4
SSDEEP 3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
TLSH
T15DC3291762990073CA63417ACCB76513DBE2B5510B3253CF04B4C6AA6F17BDAADBEB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\libssl-3.dll
Size 774KB
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
TLSH
T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\pyexpat.pyd
Size 196KB
SHA256 d3e81017b4a82ae1b85e8cd6b9b7eb04d8817e29e5bc9ece549ac24c8bb2ff23
MD5 cf2c3d127f11cb2c026e151956745564
SHA1 b1c8c432fc737d6f455d8f642a4f79ad95a97bd3
SHA512 fe3a9c8122ffff4af7a51df39d40df18e9db3bc4aed6b161a4be40a586ac93c1901acdf64cc5bfff6975d22073558fc7a37399d016296432057b8150848f636e
SSDEEP 6144:cAPHiRwroqoLHMpCSNVysh9CV2i6P/1vTg:6wrExSU6PdvTg
TLSH
T1E8145A5B71A2C0EBD8938038D6D74B07CAB2B865038197DF12D4DB7D9F27B423A29365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\python313.dll
Size 5.8MB
SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
MD5 b9de917b925dd246b709bb4233777efd
SHA1 775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
SHA512 f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33
SSDEEP 49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
TLSH
T1E9568D16729D40ADC97B8078CA038A4BF7B27C417F60534B61A6BB5E2F733624B6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\select.pyd
Size 30KB
SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
MD5 20831703486869b470006941b4d996f2
SHA1 28851dfd43706542cd3ef1b88b5e2749562dfee0
SHA512 4aaf5d66d2b73f939b9a91e7eddfeb2ce2476c625586ef227b312230414c064aa850b02a4028363aa4664408c9510594754530a6d026a0a84be0168d677c1bc4
SSDEEP 384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
TLSH
T1A7D28E47AF605846D923C972A8E28F26ED35B752875082CF3268C15D0F627C27B7B3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\setuptools\_vendor\inflect-7.3.1.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\setuptools\_vendor\jaraco.functools-4.0.1.dist-info\LICENSE
Size 1023B
SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
MD5 141643e11c48898150daa83802dbc65f
SHA1 0445ed0f69910eeaee036f09a39a13c6e1f37e12
SHA512 ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
TLSH
T12B11A82E735107721C5713B0557568D8B17B715F7B6B2784146EF240232A06CC1FBC40
MD5 SHA1 SHA512 TLSH

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL
Size 92B
SHA256 189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
MD5 43136dde7dd276932f6197bb6d676ef4
SHA1 6b13c105452c519ea0b65ac1a975bd5e19c50122
SHA512 e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1
TLSH
T1BDB01214054049FA2154EE079024A5711360850E64591035B4871240550AD4406C9C5A
MD5 SHA1 SHA512 TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\tcl86t.dll
Size 1.7MB
SHA256 c861f39ad0f4fc7f3875850925f61442bff2bc1839bbbb3584a63bc4d6e5cea6
MD5 8587238932b4f7f394ce587ad169846b
SHA1 6cdc9c1751e812be3a11bb411a145e7ab6885def
SHA512 c88506e5b78ab1459c25de4c7ef65b3c9e24e0f79ab2132e8fdc7a02195af2e137874512a0f423c80d558969e42e2a4bc7d2cddee696624dbd230b32c44f88f2
SSDEEP 49152:ehk299wKFi8C2Qt6IHCmGViSIV8JryqL3eD0:qN9wdeIAvt
TLSH
T11D858E1BE76410A8D8ABD1BCC227A60BEFF174191350A7DB51B08B912F23FE1277A355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\tk86t.dll
Size 1.5MB
SHA256 6425bf57abcc1dfbbe8662b1956883ae0c5ab8c2d9314e19692b3d86babc242c
MD5 6f06390d3ac095827df2f1a8ed5dae0c
SHA1 879f24522821f597c0341ca091e474163764b343
SHA512 27b975e15f6e1b9bc8e3e41152baee25f4b400de3aa6e334c61b2165fecd27560fa5c4296a9b3ff0eb1103173cfb61c348ba11e01a44cbadbecf308b5d7c5095
SSDEEP 24576:tvVYTm+MKYeCmXNrhMMjMt41GZsbTYsgG04ChR3mxOl8v07B62sUCcmxNFClwdbR:tNY7YReNrhMMi41GZsbTYsgG04ChR3mB
TLSH
T1D9754A06A261C198C66EA134C56796BAEBF17C04931057DB72A0FE6D3F73BD2273A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\unicodedata.pyd
Size 693KB
SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
MD5 0902d299a2a487a7b0c2d75862b13640
SHA1 04bcbd5a11861a03a0d323a8050a677c3a88be13
SHA512 8cbef5a9f2d24da1014f8f1ccbddd997a084a0b04dd56bcb6ac38ddb636d05ef7e4ea7f67a085363aad3f43d45413914e55bdef14a662e80be955e6dfc2feca3
SSDEEP 12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
TLSH
T1F9E4F6D5BBCF8D26E69B363A48E3710F5171C2735F0A863BB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8362\zlib1.dll
Size 142KB
SHA256 8c2ed3e1a90c9b0e3ef844be20e1af791ae8a1b665d4731162404f0eee1697dc
MD5 3a46a119c9860c477f13fe98c878452c
SHA1 e0bcbe5b30ef2a2f58e1206c650672ee3f85abc9
SHA512 0d3d4e8a2c8886fd6e480aecc5051644f39c1e06b1113def7273369f771c4429c757aed13bd8082f4768f617ca3499cd81b79a0893b5a2955fb4b68c8b571c71
SSDEEP 3072:dvEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCf/:dsVD+RrFgvi7Ju
TLSH
T152E37D9BB6A224BDC67781B051E78776F932B8214B309EEF5148C7741B12E406B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hlOEASoH.xlsm

Path C:\Users\Admin\AppData\Local\Temp\hlOEASoH.xlsm
Size 22KB
SHA256 40989b4de2dbf8e6a77571dd1e769c4c2e70bfc508292c95bd67722211f28f88
MD5 8c9627e59dc744f8cf471aeecc2aa911
SHA1 dd72c77c3b3d173b12c1c822503c4a807814b49f
SHA512 85f3c91ac228a933c7d2f1a0fd1cac1f004c7189f7959c80555c2400ef6a22e0ad3e859bf780c492103bba271751fdd626816694e2be3356270332ec08a32e0b
SSDEEP 384:MvY9F4S+1p+o5buKd8aElKXCKmu3XdMrpAZmkBc2LdBP+C7I0Y7IO4VvGh:MvYro4o5buCXHmVmZmkB5XA0Y70Gh
TLSH
T1D0B2D01AE512EC12F423B43DBA1C5275E6583B027107B3EA2E1261715607DE327AF4EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hlOEASoH.xlsm

Path C:\Users\Admin\AppData\Local\Temp\hlOEASoH.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-123-0x0000000000400000-0x000000000146A000-memory.dmp

Download

memory/1136-0-0x0000000003230000-0x0000000003231000-memory.dmp

Download

memory/1136-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/2040-119-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2040-124-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2040-132-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2040-61-0x00007FF83E9BF000-0x00007FF83E9C0000-memory.dmp

Download

memory/2040-127-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2040-113-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2040-118-0x0000000000480000-0x000000000142E000-memory.dmp

Download

memory/2040-143-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp

Download

memory/2244-1318-0x00007FF84A750000-0x00007FF84A779000-memory.dmp

Download

memory/2904-142-0x00007FF81EEF0000-0x00007FF81EF00000-memory.dmp

Download

memory/2904-136-0x00007FF821C20000-0x00007FF821C30000-memory.dmp

Download

memory/2904-133-0x00007FF821C20000-0x00007FF821C30000-memory.dmp

Download

memory/2904-144-0x00007FF81EEF0000-0x00007FF81EF00000-memory.dmp

Download

memory/2904-134-0x00007FF821C20000-0x00007FF821C30000-memory.dmp

Download

memory/2904-135-0x00007FF821C20000-0x00007FF821C30000-memory.dmp

Download

memory/2904-137-0x00007FF821C20000-0x00007FF821C30000-memory.dmp

Download

memory/4408-139-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/4672-1115-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/4672-1317-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/4672-1345-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads