Analysis
- user interaction
yes - max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/10/2026, 21:40
Behavioral task
behavioral1
Sample
builder.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
builder.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target builder.exe
- Size 13.3MB
- Sample261022-1jdl6sas5m
- SHA256 0a7e8409ff2d2440e43cf49913a5d8e21a81cbde5bc18f731aef24e810e5b79a
- MD5 c98252ff3ae7558c76540fafd2decea8
- SHA1 470c182fdd864e0d716e373856645109aed28335
- SHA512 21323fcd9838ca96cbf16c83675e400acb727b8358c6d280cacbb69845df1534cdbc74695f516fadaf7137cae6b95a985d56a9c51d63b7017629a43e6a1ce846
- SSDEEP 196608:voFsZ0W8/Lap6uowgMoPrv4QEhs2SV5lien8aLMAo7h5kSZvxig/lVJIJ7TDcIN:QFzW8ohgNTv4fShB8CMbCU5h/lV6RvH
- TLSH T185E6336CB75608E5D89A6334A4F05276D9B27C7907B0C2CB16F54A612E732E5FF38382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 13 IoCs
pid Process 5780 builder.exe 5780 builder.exe 5780 builder.exe 5780 builder.exe 5780 builder.exe 5780 builder.exe 5780 builder.exe 5780 builder.exe 5780 builder.exe 5780 builder.exe 5780 builder.exe 5780 builder.exe 5780 builder.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3152 cmd.exe 1932 cmd.exe 4532 cmd.exe 5332 cmd.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c4c465366e62dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096fb4e366e62dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8ced5366e62dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4ef5f366e62dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000456167356e62dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fca72356e62dd01 SearchProtocolHost.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: 33 4828 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4828 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4828 SearchIndexer.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3368 wrote to memory of 5780 3368 builder.exe 90 PID 5780 wrote to memory of 5332 5780 builder.exe 91 PID 5780 wrote to memory of 3152 5780 builder.exe 92 PID 5780 wrote to memory of 1932 5780 builder.exe 94 PID 5780 wrote to memory of 4532 5780 builder.exe 97 PID 4828 wrote to memory of 948 4828 SearchIndexer.exe 101 PID 4828 wrote to memory of 1212 4828 SearchIndexer.exe 102 PID 4828 wrote to memory of 4168 4828 SearchIndexer.exe 103 PID 4828 wrote to memory of 1268 4828 SearchIndexer.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\builder.exe"C:\Users\Admin\AppData\Local\Temp\builder.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\builder.exe"C:\Users\Admin\AppData\Local\Temp\builder.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
PID:5332
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
PID:3152
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
PID:1932
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
PID:4532
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3488
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:948
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:1212
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 836 2800 2796 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4168
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 836 2816 2824 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:1268
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\VCRUNTIME140.dll
- Size 121KB
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- TLSH T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\_bz2.pyd
- Size 71KB
- SHA256 c46b2979e25b66827d0361a559e12879b8a250cf5c8771a54db94e4808e00685
- MD5 8d28cd65e4ce6ca79c326f9daf2e0a67
- SHA1 286b4fab4996a2d90e85664bd4dca3230dfd3ea6
- SHA512 8f5cd8c289be8ef87a94ed8314796f4e2be9d3f08c89dbca81452784723a4912142a58bb4d7565744c1a5691403b9d1084050f58bafe48b8ea3f902b800d3fd2
- SSDEEP 1536:AENENz793YK4ZnPnomCNsD+Zr/E/8dDCIaR0IKIECV:NENzxoKiomjKpEkdWIa2fIECV
- TLSH T11D634B56B7B666F4F46F90BD8A410323E330BA55036063AFF148829A3F13BD1AD78356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\_cffi_backend.cp311-win_amd64.pyd
- Size 175KB
- SHA256 0b5c05bf3e9da14c33566d2c546fb7618ac7fc2b89365a66cfb1082ffe3d898d
- MD5 87c57ea3f34d4226c596eb64f72763e7
- SHA1 4226786006bc8c924790bd770d07ab3634a6452d
- SHA512 2058e5c248cc7deca4d0cbab8ad3ae22ee7baaa2ebdf8289dd03ca7c1c888c8a1580b86cf3b1c017c46c660e0c2cddd4c4b40786bb176d0e043245751ec5f2d1
- SSDEEP 3072:kWkpON4k4KPLiOVX+ARhbUvyT2z243Zy5FthZQ2P7RFSTL7Ko3i3gA2Q:krKPLTVRhbUvyCz24sDFFSTLO8Sg
- TLSH T187046C5A328C11B2D6A6513886579B53F3B3B460174197CF01A0C7B52F1BBEA7A7FB80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\_decimal.pyd
- Size 237KB
- SHA256 5566518542e3ee6dd8cbecbae76e40a30015e82cc04ee4ea768a3cc9fb53f4ce
- MD5 a80ed1383173049f9b26ea01b27fa058
- SHA1 0e0c9361f18c4df41a8d13cea3c34c66367989ad
- SHA512 a8f60aff4123565e5aa2a4977e71e6de386deddf267f9cc3d1d8caa170d66fdf8b5518f54a1c9aee18fe8108cd99bb687ace83c524e05738c31a6621f4dc5856
- SSDEEP 6144:HXOksyljLGY7iCIH1VA2Bk9qWM53pLW1At/Idtz:HeTEjiY4H1VA6ln/IHz
- TLSH T1E6345B5AA2490DA4EE778074D8579F47E7B278940360C3CF43A48AA73F576A323BE744
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\_hashlib.pyd
- Size 52KB
- SHA256 5f17438d0e3091e6006048c873ce43e7e33d842a2a736500815a56aa8be4bf01
- MD5 1a99593df5483910489b9c16cce25b18
- SHA1 ef4f8488301577e7a53c2ae354acef37f24ea649
- SHA512 3033b22ff61ce6d7ebcaee1ebebd68811e07c5ad5c25a9def226e6982b04fa5ddfce55e6213a2db5c5e1f8a271aca26797c4fcf8b1a8d20fe7b560512bf566e5
- SSDEEP 768:lKyUPw0PnfpXx+TSRN24ENp+nfEZWKM0IyIEOIv:lKTY0Pnfph+2YzNafEZtM0IyIEOI
- TLSH T19F33490AF29100E8D56781B9C9A31E87E6F2F15417107BDF4368C28D2F237E396B6B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\_lzma.pyd
- Size 149KB
- SHA256 0369454200d4b8deb3959415aae9bb9926e681b14bcb4427e432381fe57ecb27
- MD5 38315a763b4266ad431762f51960bfc4
- SHA1 f0770073b92879bbd3dd4bcfc254cb233e30ec79
- SHA512 bfc3d1144078925d2a5f37c555d6deec3a85ce150e6a357cd2c146e19360f630b08bb504e1b77a30b6fa035c6e157fcb904be021e771ae813e3172e545ba3187
- SSDEEP 3072:ohyN1RbBHQrnoe6r5NJuAJKlo/CznfD9mNoKFz2QhskfIEZ1:eQvbBwcVN0FR7YOKFlsk
- TLSH T10FE31891B254F4D6F2228C34C9274F27E7F978495310A29E01DC837D6B2FBB56A6A313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\_socket.pyd
- Size 66KB
- SHA256 9bc8b64506c21e94457da274573e85777a06b67d4d6b98dddeab4b97172fcef1
- MD5 3a13308b8f79efd613fd25f8a092e84f
- SHA1 a8a09c96de0e37c117b7ace8adc3150cef1b4e23
- SHA512 5c300391a5155a50ca1f81cb1667072cd139f4a4a0ad926446040fbb20603151ece5c7bee3f5d49afdc231fa744742180937cb9d6a4c0fee9d669d963202141f
- SSDEEP 1536:3/mbt022h0Y9/s+S+pzMEnrIDOMQLF/0I+IELw:PytbxY9/sT+pzMEEDOtLqrIELw
- TLSH T150633A10A3A051B9D2B3D17AC6335F62F774F4811399A38F4564CA6E5F23782DE3AB81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\_tcl_data\encoding\cp1252.enc
- Size 1KB
- SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
- MD5 e9117326c06fee02c478027cb625c7d8
- SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
- SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
- TLSH T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\_tkinter.pyd
- Size 52KB
- SHA256 2cc987f71fe6a28e8ca5fc1f14c26bd6efa59b36e91d52901c17a5e57c4f0b2d
- MD5 034f018a889142741393a68907cbbdb7
- SHA1 1b907346845f73a947ee74c89af02a34badc8844
- SHA512 4062c4b7ce7c9b309d87b9b322575d88a974be75a3d6e3fb2e80af7235808073490ec23c0d47eb09d4990ca959bb7d63ba26a8db124ad46f9c887351a6f3ae2c
- SSDEEP 1536:hg8xkWmNCc8sLuQL81CY+s9zmjZ0IyIEOS:AWmNSUuKpY+s9zmjeHIEOS
- TLSH T1C8335C5AA765009ADEA7C07CC9734B13D2B5B8610B14A38F0294D25E2F337E393FAB14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\base_library.zip
- Size 1.4MB
- SHA256 af948abcbb1e245535f7ff6fff46258b11ecf38b91fa5c2f31eeb50280114ca0
- MD5 035d4b50742ad546ffac803da60de890
- SHA1 04ab6b340f93d6dd6473ebb6fd3960bd0accf8f0
- SHA512 79bc921f5d69cc52782161eada5850e27190765adad95d93eca6871caea943f98842a1d0124dd1a9293c32fa15f03ea7634ff1e437c6d8329e2cfb9d816f404c
- SSDEEP 24576:poHHkfRla5PydmzRQR5pga3NTK3cnz/bucEvUFieQjwhz:9fRIQR5pgasS
- TLSH T1DA6509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\cryptography\hazmat\bindings\_rust.pyd
- Size 9.5MB
- SHA256 6a42262974f0e086c1f2defaff4ccd9fb25046cf193422135e2dda5b4b29b2a2
- MD5 8b80c64e2853a8b5516531148dfeb4bc
- SHA1 069ed7c2b7e5852798c36c11bfd23ceb07672684
- SHA512 4eac69e27cc0efe93e25f1f07d639dfa3ce64f3b28503c8bf8f90b306c5f540066fea64bf7da8ff5a748d394312f9b77c42a4387945a83ef2f8e9123f719db07
- SSDEEP 98304:TAjr9vPjhGgKqrMlBXaP3TTo8Ur2O4Y5P1d4W/DhkmgFTkjZhQHgD+zopeV:C2td4W/qmgFT67QHqo
- TLSH T122A67C25B6A950A8D86AC4B8C34756339B7174DA1B347AFF49D486B92F36BF01B3D300
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\libcrypto-3-x64.dll
- Size 7.6MB
- SHA256 4ef4f59ddc79f232a76e7eee7a7fd91792974ba885011b00acada8debfc14173
- MD5 ea124141d5b123353e0141568c373c18
- SHA1 db302d86966ca87a30859654a86801cd12ca3519
- SHA512 b1befe38003b82c35da945f68f116af9a1f9be447618db88b36b89e2e87a70b8706bfce143fbd6f7c7e9efdf840f65ef0cab1062a727cfa22b8f7b62ad7fa5e4
- SSDEEP 98304:I1fp/3ffd/Mjy36hTn4pE7Qvy+b1CPwDvt3uF90CZW:SfpuHEaC1CPwDvt3uF90C
- TLSH T182862857F6BA10D5D8FAC1398293323BB970B86543B457D3A60095AA0F33BF8A93D744
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\python3.dll
- Size 54KB
- SHA256 8fda4948f6fc2bed1c7d1ece9596a3450c772775e48046c0bf701517d78ae9e3
- MD5 026590b165fd202775cb0927a3c958e7
- SHA1 2dd40f29c54113c9380e37d28d4dfa8cf828b187
- SHA512 36e5c98cfd93c9721b7f8f2ff483b59cf9d375feb73b75f8ba9f155a487ed9b96326dd2d25b9518c331545f718bb52223eb741b5d48646b3874d4f91dbbcc77a
- SSDEEP 768:Iw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJSh:v/5k8cnzeJe0I+IEL0
- TLSH T1B6431B52AB58F8A6D6F625FC38D29DCD143B12CC83ED88DCA57993D30E5A320A52734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\python311.dll
- Size 5.6MB
- SHA256 06cb189016f6d5a593aba0e4c53ae972f2b7a257373c502e7da80f35f37dc1c0
- MD5 0101e392844bad69ff3d24fecd3df2b9
- SHA1 1094e6a4a91bbce91d29a0e00fe1ada22fa43be2
- SHA512 a27d35bae06d16e35b8e92812ef731274ded6c464634d91382b916a8ef774b4ace936ce3e0294f891db5f67a1375aa24b97b404d796e980eb3617fd1023937e5
- SSDEEP 98304:M1T5+PMGxsz72Jbor8fhZUFHnMPHVjrK:M1T0xxS2JbowZPZ
- TLSH T17E466C21B26489A4C8BB8536EE6B435AC7717C106B11DB4B5164B3EE2F337530AEF349
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\select.pyd
- Size 18KB
- SHA256 ab91970ff8458849e59711e323dc49f09bafe7a650ddcf797fd7242343ebc49d
- MD5 c381e282961528e818c15688ee643dea
- SHA1 46e782d807af3b725c96be2acf51c09c2e929e6b
- SHA512 eded4e4554d9e29f49e0d94b2a6f88240f9ac0bb98520ad4f0e9adadf1adb24846d20641dce78477b720f58adba5018610ed0bc362f9116eee5742a5d11ba00b
- SSDEEP 384:Uar1fP1/pqOLlxHqP0smv7AzN57Elna0sj+IEQG:vh1Y4xHqiWOla0I+IEQG
- TLSH T107824C46BBB090E9E1A2C1B3C9770F11D936B631472543CF23A4866D2F27BC2A736B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\tcl86t.dll
- Size 1.8MB
- SHA256 59488f67a8e75a5d51c7cb865436b5581fbb16014e9233b34db0c22bea6d4765
- MD5 b1f6a8a870f9f3f1cd34e45b1fc52cdc
- SHA1 087b2f7a430c97ce6d4bb24931bc37d367c76ad4
- SHA512 03ac3343fd4af127a9e82b698ff29d4c7e308b8aac2b10b388239316c0176678bfbf6d0caff9343b44e8d81ded7f004e093e138bc4249242c4aac7250ba12bd4
- SSDEEP 24576:lNJSAyrJZwdI3xpXxBX4Crw9yilqy+uVUD5Wbsr+Qt682zhPlkPkGqTvI92jHBHo:lNgjid2LD5W4ac6xdLvIkhHP4ATdeD
- TLSH T14985AF1BE76411E8D4ABD1BCC227EA0BDBF1B4191350A6DB51A08F522F23FE1277A345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\tk86t.dll
- Size 1.5MB
- SHA256 e9a5815ad39619e22d581b7124bbaa4192e701229956a2edbaffc0c420864561
- MD5 4d1f4ab541f3304158a9b0069a4db658
- SHA1 c6115536dcf2628d581a7f10bc82ed2e8f1a964e
- SHA512 b28be87bad42d0dceb42f574579f598bb805e620b31177da6e1838ab8b6e60f7b85f834c428ec4fc877041d5035b7571358481daf4b76b11aea540b369da5ea3
- SSDEEP 24576:k1Bvnu8AyQD9FLi543GLUKuPO6EinYTVAiueFoC+vMvE58KOp0wd98ydeyRP/ec3:kIyQD9FU43GLUKuPO6EinYTVAFSvESK8
- TLSH T1BF654B06B2A1C198C26EA134C91796B6EBF17C04931457DB76A0BE6D3F33BD2277A314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d282\unicodedata.pyd
- Size 1.1MB
- SHA256 aa489115a8139de6aa0db51e2c8771c78df430fd7c3c65b714f385833ccc91fe
- MD5 6b6a5ea52f84c51f18279d668e620ee4
- SHA1 0d474d67a95fa0aef37671a8bc8d96c19b820c36
- SHA512 a1e2de1dc529b5b36ee69eef29c3378dfccc396cff53ae8933a1460ffb05414c31a83796fb55fb564cd07b146862bb86352dcf0fbc67b3872715405d2c52adb5
- SSDEEP 12288:VdlYbfjwR6nbeonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eDH3:1YbMT0IDJcjEwPgPOG6Xyd46H3
- TLSH T1DA354AC9BB828D66D87B317944D2212F1361C272476B233BB65513285C8B3B74EE6DEC
- MD5 SHA1 SHA512 SSDEEP TLSH