e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe
Size 35.0MB
Sample261002-nbpcgsswet
SHA256 e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334
MD5 2c608aed092fb1b8434b2d6d06987694
SHA1 5256aef1fb6fb741b8902f405867047207bcab18
SHA512 59e88a159d58f5ad9f882726b5e6722f9290634be23209b0662fd2157f3e89a350a87b303aedad44f742c0d1c9828706476fccf02774b42f7e600a9f9ced741a
SSDEEP 786432:Z4R4Z9IzPcVkrdeKpZZCnrHbNbcYp2n41XExqeZ9qJbkwA:ZT3IzPcVOecfCnrHblczn4pEYeZ9W
TLSH
T11287336CE29419EFF9BB927FCB220805C25CF5406B61C8EB07C087551C67AE96F39399
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence pyinstaller trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Desktop Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5"	Desktop Service.exe

Executes dropped EXE 2 IoCs

pid	Process
5864	Desktop Service.exe
3424	Desktop Service.exe

Loads dropped DLL 28 IoCs

pid	Process
2196	e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe
2196	e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe
2196	e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe
2196	e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe
2196	e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe
2196	e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe
2196	e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe
3424	Desktop Service.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000d00000001c4b4-68.dat	pyinstaller

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Desktop Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Desktop Service.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1216	schtasks.exe
2952	schtasks.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2196	1140	e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe	90
PID 2196 wrote to memory of 4236	2196	e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe	91
PID 2196 wrote to memory of 1216	2196	e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe	93
PID 2196 wrote to memory of 3188	2196	e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe	95
PID 5864 wrote to memory of 3424	5864	Desktop Service.exe	98
PID 3424 wrote to memory of 1840	3424	Desktop Service.exe	99
PID 3424 wrote to memory of 2952	3424	Desktop Service.exe	101

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Desktop Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5"	Desktop Service.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe
"C:\Users\Admin\AppData\Local\Temp\e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe
  "C:\Users\Admin\AppData\Local\Temp\e65331bf4cd606c46122eaf1b64212a39251eeeddcc58c7384fbcf2d49489334.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Delete /TN "Desktop Service" /F
    3⤵
    PID:4236
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Create /TN "Desktop Service" /XML C:\Users\Admin\AppData\Local\Temp\ds_task_8wa7m40h.xml /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1216
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Run /TN "Desktop Service"
    3⤵
    PID:3188

C:\Users\Public\Documents\Desktop Service.exe
"C:\Users\Public\Documents\Desktop Service.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864
- C:\Users\Public\Documents\Desktop Service.exe
  "C:\Users\Public\Documents\Desktop Service.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3424
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "RMMAgent_Desktop Service"
    3⤵
    PID:1840
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "RMMAgent_Desktop Service" /tr "\"C:\Users\Public\Documents\Desktop Service.exe\"" /sc ONLOGON /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Desktop Service.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI11402\Desktop Service.exe
Size 27.4MB
SHA256 9f4f3b70b897ca4ff4f8b81bec045fa59887362bbf0c289a4a3d9a96d0792c04
MD5 a7a729958f65190857615f8cacfa8376
SHA1 6009a9d13174065b1783f8cea373f3ea2f279b8b
SHA512 fe157ccff81e585beb143861fb6d1c62dc36c309f7bd56882b9fef8d18eaf5127aa5ba253dca9aa40d261ca4259145ae6816f457714694c71388d7ae7c055cd5
SSDEEP 786432:JujmF/XktzTxbCPsqVtcQT1RYyh9qJ9BznE4WwSwOR:JXZkZTdCPsacaDh9iBrEiSwG
TLSH
T1E757339CB1D059DEFDBF823EC662580586ADB4C2ABB1C8EB178041520C57AF86F353A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11402\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11402\_bz2.pyd
Size 84KB
SHA256 b3dd7cea6d03342252834cebcc814af37d850b86d0627fa22b7f6990882f2f8b
MD5 77294e590d14a22d98862c141e7ea4ae
SHA1 88a64817b0699025fcb1dda533355a0b30bd92bf
SHA512 3dac79115a510fd09d384829ff1b45864c2bd20db34459c5ac84ccb65f2befe5d59e13cc232fa23c77232421886a8eefa8d6b5986199e32d2953fee92dad0abd
SSDEEP 1536:HdsvXm8z7+Cnqncm4WlTtdKSzBdIM8vOBs8iMdIsLVuyEJ7Q9bfIgHX:9svXm8zaYqRptX7IvvOC8hdIsLVyY
TLSH
T1B6837D86F36542B6F99BD1F886800793FB30BB950750A3AFF148C2992F13B916E5C219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11402\_ctypes.pyd
Size 130KB
SHA256 dfa65498c77e71f038883337d2b5ffd92508489e79e6ee5e96ddec4ecf2a7fa1
MD5 0ac143334e94105facaddc5fb20fc691
SHA1 28cf13be0a0eb84f48c919e68f78852aa4856853
SHA512 00b1a76760b33f054a785be9e4818879121cf5cb60b716d19f2c22c8c58075eea32e626a0962385b18babfaf5d5e33244c09c2e481f99a93577cfeb1647a22e7
SSDEEP 3072:au1mymWLaxMd/w1KVMSf/Fa4IP0JrsFXI/1cswRIsyPyW4IiFx:ac4WLEMWmRf/FaFP2rsFy0zx
TLSH
T161D37D0B775800AAEAA79178C173AF47EBB1B453171187CF02A4C69A2F637D25E3E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11402\_lzma.pyd
Size 155KB
SHA256 f20be6a9fee8fb5d53170c4bc24a39b48d3c0ccbe8e2000e60ff7d65b77c6ea1
MD5 a0e27c2f376dc80dfc3f884963a0f416
SHA1 f2738a7e6dc65cd9b915a33af354d2f04b768712
SHA512 6e0c50e52e48b29098fa3b7614f190ecc84ab12ed3b376e7e7148f84eceb3101b9ea6972f100b5478059f62d90aded0dff8522440728d0c0904d8c70457f734e
SSDEEP 3072:xqZ/boPLmhrKifqGDRJUs0znfB9mNoTvm28fgS+dIs01xMW4Iiy:xeTgLhyvUsq5YOTCfd+E9
TLSH
T178F35C86B794F0D5F7728C38D6628F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI11402\base_library.zip
Size 1.3MB
SHA256 6a90c0c42cd2d3a7ccef5a3a4be1060a000f83d3335f8eb33351d8d3c97cfaa1
MD5 9d9be7e5abcefabdbeb5ef4100b71ff7
SHA1 53a03aa545628138fc11dc59e34d105b1326ee34
SHA512 2cd107d88e58b3795a78b39121a679eb6fa524df4c8387e73eed1e8331008f746140c6bbe80ac77f5236cda74752f081a3c5675977e4d70d5e132ffeb67ad4f1
SSDEEP 12288:vzMwtrL+DOqhT0IdjdTIiMnuIva80201jwCVRDVoioSYBVZW7WpnRStYzGNcT1hc:QyqFdZqnle7WpRSeT1/5cPPdxhY8V
TLSH
T19F551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11402\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11402\python313.dll
Size 5.8MB
SHA256 41ec4fc4e5bc8b207258590238f7f050b13fdfee84c4a7b1ecff6e945d031a10
MD5 cfbfd5ca1d563466687e53a638eed93c
SHA1 63bffe9d62dcc870b1601ae7a04b042df88fa219
SHA512 0eb973271a12ff17dc443ee3289695bb2134d66120690d067b3f67b4b52a5ac2831f326fe85635ef43799b43574e4e1809e20db6ae1d32b5e5f4711cfa12df36
SSDEEP 98304:efqPAKrV+hOhkH0pwgJYt5FO8vUHDMiEJV0KL:DPAC+hOhZaic0A
TLSH
T11F568D12729D50ACD97B8078CA178A4BF7B27C113F60434B61E6BB5D2FB33624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11402\ucrtbase.dll
Size 1.1MB
SHA256 d93ce42cd625510b2355de086bcd19e2c11307ccade7bad62b09c7f340a866ba
MD5 24ebedc58aa4ff23043bf79b05d267d4
SHA1 c2e7bd18e4091f2a7f7c933a5734b05dd971f24c
SHA512 7f0563e814cc4aaf292683403888340bb5d95e6a7bdd35d81eebbd10bfb8e4e5130d0a626b8fb07ff3cafaae4a2698cf7103aabcae74e5d13449db482ec49bc9
SSDEEP 24576:2RmADWOBBIHv0XESwR5H7iFZBmai0gFcszUmxvSZX0ypm7:WtI045H+ZB7fgDz7
TLSH
T1C835AE28B76C02AAC57BE17DC923550EF972380447709ACB03A74BB93E277E956B7311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58642\PIL\_imaging.cp313-win_amd64.pyd
Size 2.4MB
SHA256 11b767175caa89e296d45d3dc029c9f299db5be5dcccc815baef97534937d762
MD5 95accce0dea4faff63820b2c85cdd40e
SHA1 6808b982af4851ae8e3c947bba04afd370075138
SHA512 9f1ea09aaccc922a20081842b9cb3da888e7514ff2de76b81b3c460a8ea52ab3174e81f2e5c905a4c85e652dee5ba99f2ae7086eb9404392b927cf2a2fd2c81c
SSDEEP 49152:ooMFfLnlJAkKlWW4OqewcH4eaQ/ooiVq0lqKD1yq/:o6SczaQNiVqs1T
TLSH
T1F2B56B06E5E19599C6B28034CDAA9112E3B1B80D17F187F77684A7F93F23BD0353A396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imagingft.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58642\PIL\_imagingft.cp313-win_amd64.pyd
Size 2.0MB
SHA256 948c9f338409979f34d4dda544b4c178f41626daed584e448287c68de2efa3b7
MD5 8c3aea5d252f1c4e6b30b583a975f7b5
SHA1 3e6ab6ef499a95f2d8f8ec72ee19320442c65c1e
SHA512 b0022a96cca5f7c7e456b9c7669ccabbfa0084db08f313f9d9d8da10617097f32d67ef1292ae0bd8baee7abd08e02071df0184c8600636367eab665b8ab7cb3c
SSDEEP 49152:GC1RwvDSkIaQn8gNfgZ3bhRVoVMozG/YMHIamcl5xR4upt:GPD2Upt
TLSH
T1BAA5AD46F29611A8C57BC174C692861BE3B574010305AFEF65E48A9ABF13FF12B7E318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58642\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58642\_hashlib.pyd
Size 67KB
SHA256 1a3010b06c2fcd625dece3dd0883ca060e98b94adc062b06cb1a671cfc3b5caf
MD5 7573b8a4d0d7831380d7c12e7fbf0160
SHA1 769e7bb2af17942ee4ff51f077333ee1cb4c05ab
SHA512 d730a674cb1585b5adef712acbd2cf212f40824c8c516e958988cbaaae823422cbe5279da180a29a30457cf87a7abac45e24954eb51094a93b5bbf3d2bcff2dc
SSDEEP 1536:1qXn1xAu1lEAXfXQfcV5TaPutFCAVIsvIByEJ7Q98fIW44DKrd:W1l1uAofcyPutFCAVIsvI4W4Iqd
TLSH
T136637C91AA884092D96382B6C4E34F83F975F352571197CFA2A8C0CE2F237C39776756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58642\_queue.pyd
Size 34KB
SHA256 1e349a13913370369059a4ae5951157112b5eba53ed4389c18ffc5e00af1a037
MD5 922104c7bd756944703d7b93fe61bd99
SHA1 72e672f312d58b2c241fd08e4493add4b5206ba8
SHA512 8cb948d05a679292ca3aac6df32add50ca59af14e981aac0e12dbd5ccfe9cd2d303bc2eb093522fc0ea86c761727f56e8c400d9b28bd8f026230c8ad24d2aa56
SSDEEP 768:Y+Md/6rp7gVh6RIs9UH3ZyEFqU+Y7N2Ip4+oTxf1mltPRVDg+:Sip7gVIRIs9UpyEJ7Q9+UfIZR1v
TLSH
T1C5F26DCAAA684487E963CA70C1E3DE92F535F7D3961186EF2065C2CE1E173C1E369319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58642\_socket.pyd
Size 84KB
SHA256 127a39d2198f17dd9b573904fe7e4040c7c8718753e6c4edee2ff6c35f487fac
MD5 c19dbee6c084ba12b0a7baa8ea3f8b50
SHA1 9cd0017fbeb1bbc2be40d89006fb73d144a49401
SHA512 5231af5ba642adcda980187744c448400d58f1179ab98974e9f465f8d7de64375635963d67e52fedd0b0900e0682eb3a9d19c93254a9dff2ff4153b07913a1d0
SSDEEP 1536:iVl/fxzeola7SVitdyJwoQlyJ+9+nzCK3Y4KxtS4DTDgRIsywQyEJ7Q9vfIU82c2:iVRdeoo7YoyJwoQlyJs+nzCgtKxB8RIs
TLSH
T132835A01A66050FAEBA3D071C2639E63FB74B5C11394A35F1066C65A1F333C2EF7AA95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58642\_ssl.pyd
Size 177KB
SHA256 faf716d309349dbd54efd7fb402bd42ed21a537614ac0da89ed92ba307ecbf15
MD5 25da0255096a1b094ccba672a6b1d6dd
SHA1 2904e90fb039f7efa5be3aac3dd6c074647baea9
SHA512 69601cdfdfe07bd9131922a7a693ef2bcbc3a589dc68c455d12d4bfbffe173d61de3237107624144aa07c230136916c189a9c7de0e6879b30f085219ab1ea2dc
SSDEEP 3072:4ifuOjwYdI1bnMlfU6CPnzsvyII7IM/cbPuC/JWdIsL7PW4I9Q:4i20wYdknqU6CPwvySgd
TLSH
T1C7047C47B5945AF7E813E4F9C2234903EBB0F145321247DE48D6D64A0F07B4AAE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58642\_wmi.pyd
Size 38KB
SHA256 3be5e14e9a9dc49f099209dee98b9cb5e31ade3b0deab52277026bb14df5bdb6
MD5 b21b5ac59bc63da2f59feaa70de04f07
SHA1 5d5b0788b9bb91b8ea0a0ca6dc97219a1892cd0c
SHA512 133d4070481e1dc359893a040da88c1438f7c1c90522178c437c4244f549ece0fdd6ccae0d221637f002c1ba638b2ef79e6ba51bbad59d0d0b667b2cc98af286
SSDEEP 768:12/EEqrVmjsluFkc9+udIsLiJZyEFqU+Y7N2Ip4LwTxf1mltPRVygR:QE9BErFkc9+udIsLivyEJ7Q94fIZR8c
TLSH
T199038DC9E6680092EA67CA70C1A6CE53F575F7935712C38F326582990F233D1E739329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI58642\base_library.zip
Size 1.3MB
SHA256 8c9f79e4d129303cb3f7dcab801cd13729a113e70ec97618c675e81d92c8d236
MD5 185a6a84bb2f873d8f0c9b44eff4f8d3
SHA1 8042d67e46d1e9995b0dbcd34a70f1a7b7ba9cf4
SHA512 2666ccc533726f24dd6bba5ac649fda9c478bba074e953b2ffad846fbd5eed97ed40effc616ac21997ab095ce3dd7015af4d0ef6ff24f966e0e6fd06b65e4264
SSDEEP 12288:mjuiqi2cPPdxhYZ67tYzGNcT1HSuIva80201jwCVRDVoioSYBMPyCMWfgqhTswtK:V5cPPdxhYLSeT1ylMqqi/7Wp8dZLUM
TLSH
T1E9550992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI58642\certifi\cacert.pem
Size 280KB
SHA256 9102e6a3644a071ba6cdbd4a53698f291c4a64b18450a08bc046548b6db5cc8b
MD5 64c9f8888c14aa49beb3f82634193c7a
SHA1 fec7b8c0a17c1c555fd33baee53678f31b7645ee
SHA512 60d1043f7c1205d3efe03a00d68451cd075cc6abb19f2186a081206bd01a83ee6da521070bc655606f9df18e6208ac94ab41902610f2cb24f3b33d28c523b209
SSDEEP 6144:3nB8fRRiplkXURrVADwYCuCCgT/QRSRqNb7d84u5Nahry:XiRiLWURrIdRWavdX08M
TLSH
T182546D964F2A9C052C9FE1C1CA9B1357DD3A027B99FEF0F139462448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58642\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58642\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58642\select.pyd
Size 32KB
SHA256 9cc1ef0264060099503592db57ee7d7c1f8d6bea689b2ed125919c7a30b7ab7f
MD5 7a066f58d43c0f3546944d046959ab0d
SHA1 03f2b88e97add974eff48a21454a3e609f943e57
SHA512 199d9f0a2fe47a0b7d25a5c2d6ee74e9507c67c166059985ade8292f4a2741824e91b934e391acad4da8ee187d94b007438a57b63496e91ab2ec7a5da14a0b8c
SSDEEP 768:EpX5KHfOmHzPRIs9GnZyEFqU+Y7N2Ip434bTxf1ml/6dHQzZ:AX5K/OmHzPRIs9GZyEJ7Q9IZfIgHU
TLSH
T110E27DCA6E785043EAA3CA71C5E2DE43F939B3E35611819F30A5C19A1E177C1E33A358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58642\unicodedata.pyd
Size 695KB
SHA256 1989628f16052f9123c5cf603e96490a75fde6228315457556f96a838bf9e904
MD5 cb468cb183404de9c2ba3c9b4489b348
SHA1 7ef19c9b9cf63dc225b0d1d337e4c1ab45bfb9e2
SHA512 ebe8defac7ae435c33b66fc4f7d288a00a95685b47aee7520309758f261d2d103a6cafc8b23da441350ffbf168224932430124042ffd614ad4bc05bd379a7cb2
SSDEEP 12288:rYvdLI/X77mvfldCKGihH32W3cnPSqrUgYMMe:rYvW7qNxr3cnPXYBe
TLSH
T137E4F5D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ds_task_8wa7m40h.xml

Path C:\Users\Admin\AppData\Local\Temp\ds_task_8wa7m40h.xml
Size 1KB
SHA256 ea705377c028a3d9c6662f068622baecf7ee1fd6bdaff01ee985f9d38c133e01
MD5 de31766260d888b98cb76518092516f2
SHA1 3bce7b30614d35fe2f299812c16398e0cb203993
SHA512 1a09494dbfc3faae54e58e24486c397c80a0288a29a758e31e42e498af231db08d3f9629648b4de004026f90feb9b3b07e7709092b4b67c90bc4ea9fbb0ec9c9
TLSH
T14041160367FE2209F1F35B9CAAB754119EABBD595C34D47D11BC060C0AB3962C9A0737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3424-213-0x000001D5A16B0000-0x000001D5A1BB3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads