Overview

overview

10

Static

static

3

Xeno-v1.3.55.exe

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    300s
  • max time network
    301s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    30/09/2026, 08:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Xeno-v1.3.55.exe
  • Size 25.8MB
  • Sample260930-ktcjvstfld
  • SHA256 a216cd84ece16de01175d5a21b9e9625f93588c9b7422678a714398d645fe40a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecutionpersistencepyinstaller

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 45 IoCs
  • Loads dropped DLL 47 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 39 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Windows directory 2 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 10 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe
    "C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.55.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Users\Admin\AppData\Local\Temp\bnd_0ed92183\Xeno-v1.3.55.exe
      "C:\Users\Admin\AppData\Local\Temp\bnd_0ed92183\Xeno-v1.3.55.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2228
      • C:\Users\Admin\AppData\Local\Temp\bnd_0ed92183\Xeno-v1.3.55.exe
        "C:\Users\Admin\AppData\Local\Temp\bnd_0ed92183\Xeno-v1.3.55.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4952
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "Unblock-File -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\bnd_0ed92183\Xeno-v1.3.55.exe'"
          4⤵
          • Enumerates connected drives
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1628
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\bnd_0ed92183'"
          4⤵
          • Enumerates connected drives
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4984
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Start-Process powershell -Verb RunAs -FilePath 'C:\Users\Admin\AppData\Local\Temp\xeno_fix.ps1'"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1596
    • C:\Users\Admin\AppData\Local\Temp\bnd_0ed92183\vxh0pj5jwemz3cmp.exe
      "C:\Users\Admin\AppData\Local\Temp\bnd_0ed92183\vxh0pj5jwemz3cmp.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2104
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" netsh advfirewall firewall add rule name=":98C>q}A>8LV>J" dir=in action=allow program="C:\Windows\xdwd_Microsoft67" enable=yes & exit
        3⤵
          PID:3536
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3660
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3572
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1472
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1284
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2616
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4532
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3812
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4372
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3672
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:560
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3040
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4604
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1372
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4812
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1232
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3196
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3604
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4880
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST & exit
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2456
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\xdwd_Microsoft67" /RL HIGHEST
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2636
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3764
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2876
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1860
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1740
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:5060
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3300
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4524
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1820
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2944
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2624
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2732
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3192
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2508
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2568
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4012
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2644
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4352
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4584
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4776
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1908
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3124
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:736
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1564
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3680
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3768
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4504
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2660
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3136
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:424
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3420
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2076
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3736
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2652
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3932
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4420
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3740
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1756
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3544
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:4424
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      PID:820
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      PID:708
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
      • Executes dropped EXE
      PID:2380
    • C:\Windows\xdwd_Microsoft67
      C:\Windows\xdwd_Microsoft67
      1⤵
        PID:2908
      • C:\Windows\xdwd_Microsoft67
        C:\Windows\xdwd_Microsoft67
        1⤵
          PID:2656
        • C:\Windows\xdwd_Microsoft67
          C:\Windows\xdwd_Microsoft67
          1⤵
            PID:5100
          • C:\Windows\xdwd_Microsoft67
            C:\Windows\xdwd_Microsoft67
            1⤵
              PID:4828

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  2
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Windows Command Shell

                  1
                  T1059.003

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Defense Evasion

                  Modify Registry

                  1
                  T1112

                  Credential Access

                  Discovery

                  Peripheral Device Discovery

                  2
                  T1120

                  Query Registry

                  3
                  T1012

                  System Information Discovery

                  3
                  T1082

                  System Network Configuration Discovery

                  2
                  T1016

                  Internet Connection Discovery

                  1
                  T1016.001

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  SDL2.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\SDL2.dll
                  • Size 2.4MB
                  • SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SDL2_image.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\SDL2_image.dll
                  • Size 122KB
                  • SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SDL2_mixer.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\SDL2_mixer.dll
                  • Size 285KB
                  • SHA256 2a0fc5e9f72c2eaec3240cb82b7594a58ccda609485981f256b94d0a4dd8d6f8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SDL2_ttf.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\SDL2_ttf.dll
                  • Size 1.5MB
                  • SHA256 fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VCRUNTIME140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\VCRUNTIME140.dll
                  • Size 117KB
                  • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VCRUNTIME140_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\VCRUNTIME140_1.dll
                  • Size 48KB
                  • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _asyncio.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\_asyncio.pyd
                  • Size 72KB
                  • SHA256 c77de90cad749087a0c5dc5e19d78d24f6ef44e7e5ac19b8420cfc0cea62395d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _bz2.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\_bz2.pyd
                  • Size 84KB
                  • SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ctypes.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\_ctypes.pyd
                  • Size 124KB
                  • SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _decimal.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\_decimal.pyd
                  • Size 255KB
                  • SHA256 aeacfead2befcc0768063a037bb64bd32109ae09cb144e5f571b04dd7965db9d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _hashlib.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\_hashlib.pyd
                  • Size 67KB
                  • SHA256 03d233dbace599168eaffec823de6ed7beec8c2a4ebfe9b8a3d8e042a59af3ba
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _lzma.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\_lzma.pyd
                  • Size 157KB
                  • SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _multiprocessing.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\_multiprocessing.pyd
                  • Size 36KB
                  • SHA256 2c636df7059cb0dd7e978dd735c7c5c8ddb09cf94754cf9e232296b96c5c545a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _overlapped.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\_overlapped.pyd
                  • Size 55KB
                  • SHA256 662126ff80c3a1b4cedf74074029c12ae4743e6d3b37376e39ac70aacb7d4d3c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _queue.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\_queue.pyd
                  • Size 32KB
                  • SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _socket.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\_socket.pyd
                  • Size 83KB
                  • SHA256 3efa4636cf9e350856f6927d67a4c2564bf9bd2758a00bbf17d3aece5b60016d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ssl.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\_ssl.pyd
                  • Size 175KB
                  • SHA256 0bc527d2dbc50009f43b2ed5d5982c4f63f4b647647ffa9eda612dcda80f6040
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _wmi.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\_wmi.pyd
                  • Size 39KB
                  • SHA256 a980f1e7a29842bd946863fc2693fbeb555a9dc0f9e1630dfed9a2fcdef3ece2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  base_library.zip
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\base_library.zip
                  • Size 1.3MB
                  • SHA256 1d4083bd072099d44d1cbc5e63a52e990bba8615561390fada57988e77ffefeb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  freetype.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\freetype.dll
                  • Size 639KB
                  • SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libcrypto-3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\libcrypto-3.dll
                  • Size 5.0MB
                  • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libffi-8.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\libffi-8.dll
                  • Size 38KB
                  • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libjpeg-9.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\libjpeg-9.dll
                  • Size 238KB
                  • SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libmodplug-1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\libmodplug-1.dll
                  • Size 259KB
                  • SHA256 0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libogg-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\libogg-0.dll
                  • Size 25KB
                  • SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libopus-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\libopus-0.dll
                  • Size 359KB
                  • SHA256 771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libopusfile-0.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\libopusfile-0.dll
                  • Size 45KB
                  • SHA256 ccaaca81810bd2d1cab4692b4253a639f8d5516996db0e24d881efd3efdcc6a4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libpng16-16.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\libpng16-16.dll
                  • Size 206KB
                  • SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libssl-3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\libssl-3.dll
                  • Size 776KB
                  • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libtiff-5.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\libtiff-5.dll
                  • Size 422KB
                  • SHA256 ebfe97ac5ef26b94945af3db5ffd110a4b8e92dc02559bf81ccb33f0d5ebce95
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libwebp-7.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\libwebp-7.dll
                  • Size 437KB
                  • SHA256 9a53563b6058f70f2725029b7dd2fe96f869c20e8090031cd303e994dfe07b50
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  portmidi.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\portmidi.dll
                  • Size 41KB
                  • SHA256 c9f8d9043ac1570b10f104f2d00aec791f56261c84ee40773be73d0a3822e013
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pyexpat.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\pyexpat.pyd
                  • Size 200KB
                  • SHA256 d615e193d1affcdbfe504e90d3621cbdcff94bf72b79d899126534507fd6d27a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  base.cp312-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\pygame\base.cp312-win_amd64.pyd
                  • Size 30KB
                  • SHA256 59fd2c87c8261f8de69fb70f881b41a13e522119503ae18fc068d607b4754bfe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  color.cp312-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\pygame\color.cp312-win_amd64.pyd
                  • Size 35KB
                  • SHA256 f1532048d8d89e0aff5a79f0dd96edaf7e75665c0292032c2b69a90374b4582a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  constants.cp312-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\pygame\constants.cp312-win_amd64.pyd
                  • Size 49KB
                  • SHA256 99ef70bf473e1241a433f33dc7ec89dff64c831999de68612f2e642fd4a1d5dd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  rect.cp312-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\pygame\rect.cp312-win_amd64.pyd
                  • Size 44KB
                  • SHA256 38d709cb73a98dd54d666689212bfdddc2a68fcc4541c3b59a741815e4688b7c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  rwobject.cp312-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\pygame\rwobject.cp312-win_amd64.pyd
                  • Size 19KB
                  • SHA256 b658da9b9b207f73325b9e9b84029258e64e324b8935671ce79b49f28a26b87e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  surflock.cp312-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\pygame\surflock.cp312-win_amd64.pyd
                  • Size 13KB
                  • SHA256 6c0c944037dc7a23e4ca6683d58085752453faf3be1e776a0ebd33f3d0fda8d5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  python312.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\python312.dll
                  • Size 6.6MB
                  • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  select.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\select.pyd
                  • Size 32KB
                  • SHA256 d4d7181b11db0bd22a6cd5cda6f8583d1f5c77615fd0a6ca33350619d6e0438a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  unicodedata.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\unicodedata.pyd
                  • Size 1.1MB
                  • SHA256 208ee1cd3cbad0828433ca7246b05be2b1ff5569983d27d296c0b38888585488
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  zlib1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI000008b42\zlib1.dll
                  • Size 106KB
                  • SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_nmujr5gf.dmf.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nmujr5gf.dmf.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Xeno-v1.3.55.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\bnd_0ed92183\Xeno-v1.3.55.exe
                  • Size 25.0MB
                  • SHA256 0bb43e2f7be87cae9390db1bb997f977c143e20f94950ce6e062f25ec723670c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vxh0pj5jwemz3cmp.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\bnd_0ed92183\vxh0pj5jwemz3cmp.exe
                  • Size 811KB
                  • SHA256 64f1f931437bfe9f9cfbb81721011b1938753a3d9d9ebd1de819cf56baaa6413
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/1628-239-0x00000265DA580000-0x00000265DA5A2000-memory.dmp
                  Download

                  memory/2104-42-0x000001B5AB400000-0x000001B5AB4CC000-memory.dmp
                  Download

                  memory/4836-0-0x0000000000F50000-0x000000000292E000-memory.dmp
                  Download

                  memory/4952-421-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-435-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-227-0x000000006A880000-0x000000006A8A7000-memory.dmp
                  Download

                  memory/4952-226-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-232-0x00007FFF58640000-0x00007FFF599D5000-memory.dmp
                  Download

                  memory/4952-230-0x00007FFF59F00000-0x00007FFF5A082000-memory.dmp
                  Download

                  memory/4952-231-0x00007FFF59E70000-0x00007FFF59EC1000-memory.dmp
                  Download

                  memory/4952-568-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-554-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-533-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-526-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-519-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-498-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-491-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-463-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-442-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-300-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-304-0x00007FFF59F00000-0x00007FFF5A082000-memory.dmp
                  Download

                  memory/4952-333-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-366-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-399-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-407-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-414-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-228-0x0000000068B40000-0x0000000068B7C000-memory.dmp
                  Download

                  memory/4952-428-0x00007FFF5A1A0000-0x00007FFF5A40C000-memory.dmp
                  Download

                  memory/4952-229-0x0000000062E80000-0x0000000062EA4000-memory.dmp
                  Download

                  memory/4984-276-0x0000020FA8060000-0x0000020FA806A000-memory.dmp
                  Download

                  memory/4984-274-0x0000020FA8020000-0x0000020FA8028000-memory.dmp
                  Download

                  memory/4984-275-0x0000020FA8050000-0x0000020FA8056000-memory.dmp
                  Download

                  memory/4984-273-0x0000020FA8070000-0x0000020FA808A000-memory.dmp
                  Download

                  memory/4984-272-0x0000020FA8010000-0x0000020FA801A000-memory.dmp
                  Download

                  memory/4984-271-0x0000020FA8030000-0x0000020FA804C000-memory.dmp
                  Download

                  memory/4984-270-0x0000020FA8000000-0x0000020FA800A000-memory.dmp
                  Download

                  memory/4984-269-0x0000020FA7F40000-0x0000020FA7FF3000-memory.dmp
                  Download

                  memory/4984-268-0x0000020FA7F20000-0x0000020FA7F3C000-memory.dmp
                  Download