aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
Size 11.9MB
Sample261102-xe74faex7n
SHA256 aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012
MD5 e38fe5e5bcf6d8f34e7b2f817d1116e5
SHA1 54f9de2d1e4b1368e717efd61889488fe97d596d
SHA512 b47412ca4f7b162bff89a4d8369541c58120226d8074a7e3134721345fd4a78a538af011f7a28a348ad2a69aa59fd0d571f5b23e2651d928e43537a2e8607b6e
SSDEEP 196608:ULKmAEnX/Cg8rsW4gXyTntTFqq8N3tteukAJaHsGXq/hpXFEFE7z+:ULKmFX6g8rGtZq5XteXAJaHsGXq57EJ
TLSH
T1FBC63389B3C40CA6F85B223C5AD28B5B93D1F4220761CDDE23E25A791EB72D4CD35B94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 13 IoCs

pid	Process
4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe

Discovers running processes 1 TTPs 46 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1664	tasklist.exe
3828	tasklist.exe
216	tasklist.exe
1212	tasklist.exe
1848	tasklist.exe
3856	tasklist.exe
2168	tasklist.exe
4104	tasklist.exe
3376	tasklist.exe
1412	tasklist.exe
3236	tasklist.exe
5028	tasklist.exe
3228	tasklist.exe
2440	tasklist.exe
1760	tasklist.exe
2520	tasklist.exe
4720	tasklist.exe
3240	tasklist.exe
1904	tasklist.exe
1732	tasklist.exe
3316	tasklist.exe
4940	tasklist.exe
1880	tasklist.exe
1924	tasklist.exe
3248	tasklist.exe
2204	tasklist.exe
4484	tasklist.exe
4652	tasklist.exe
2332	tasklist.exe
4792	tasklist.exe
5080	tasklist.exe
2928	tasklist.exe
1756	tasklist.exe
3964	tasklist.exe
3292	tasklist.exe
2508	tasklist.exe
540	tasklist.exe
1940	tasklist.exe
1528	tasklist.exe
3028	tasklist.exe
4428	tasklist.exe
4832	tasklist.exe
2732	tasklist.exe
4708	tasklist.exe
864	tasklist.exe
4520	tasklist.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	3240	tasklist.exe
Token: SeDebugPrivilege	4708	tasklist.exe
Token: SeDebugPrivilege	1412	tasklist.exe
Token: SeDebugPrivilege	1756	tasklist.exe
Token: SeDebugPrivilege	3236	tasklist.exe
Token: SeDebugPrivilege	5028	tasklist.exe
Token: SeDebugPrivilege	3856	tasklist.exe
Token: SeDebugPrivilege	3248	tasklist.exe
Token: SeDebugPrivilege	1528	tasklist.exe
Token: SeDebugPrivilege	864	tasklist.exe
Token: SeDebugPrivilege	3228	tasklist.exe
Token: SeDebugPrivilege	540	tasklist.exe
Token: SeDebugPrivilege	4520	tasklist.exe
Token: SeDebugPrivilege	2204	tasklist.exe
Token: SeDebugPrivilege	3028	tasklist.exe
Token: SeDebugPrivilege	1904	tasklist.exe
Token: SeDebugPrivilege	1732	tasklist.exe
Token: SeDebugPrivilege	1664	tasklist.exe
Token: SeDebugPrivilege	3828	tasklist.exe
Token: SeDebugPrivilege	216	tasklist.exe
Token: SeDebugPrivilege	2440	tasklist.exe
Token: SeDebugPrivilege	3316	tasklist.exe
Token: SeDebugPrivilege	3964	tasklist.exe
Token: SeDebugPrivilege	4428	tasklist.exe
Token: SeDebugPrivilege	4484	tasklist.exe
Token: SeDebugPrivilege	4940	tasklist.exe
Token: SeDebugPrivilege	2168	tasklist.exe
Token: SeDebugPrivilege	1760	tasklist.exe
Token: SeDebugPrivilege	4652	tasklist.exe
Token: SeDebugPrivilege	1212	tasklist.exe
Token: SeDebugPrivilege	2332	tasklist.exe
Token: SeDebugPrivilege	1848	tasklist.exe
Token: SeDebugPrivilege	4104	tasklist.exe
Token: SeDebugPrivilege	1880	tasklist.exe
Token: SeDebugPrivilege	2520	tasklist.exe
Token: SeDebugPrivilege	4832	tasklist.exe
Token: SeDebugPrivilege	4720	tasklist.exe
Token: SeDebugPrivilege	1924	tasklist.exe
Token: SeDebugPrivilege	3292	tasklist.exe
Token: SeDebugPrivilege	2508	tasklist.exe
Token: SeDebugPrivilege	2732	tasklist.exe
Token: SeDebugPrivilege	4792	tasklist.exe
Token: SeDebugPrivilege	1940	tasklist.exe
Token: SeDebugPrivilege	3376	tasklist.exe
Token: SeDebugPrivilege	5080	tasklist.exe
Token: SeDebugPrivilege	2928	tasklist.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 4404	3568	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	83
PID 4404 wrote to memory of 3240	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	86
PID 4404 wrote to memory of 4708	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	90
PID 4404 wrote to memory of 1412	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	93
PID 4404 wrote to memory of 1756	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	97
PID 4404 wrote to memory of 3236	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	99
PID 4404 wrote to memory of 5028	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	101
PID 4404 wrote to memory of 3856	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	103
PID 4404 wrote to memory of 3248	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	105
PID 4404 wrote to memory of 1528	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	108
PID 4404 wrote to memory of 864	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	111
PID 4404 wrote to memory of 3228	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	113
PID 4404 wrote to memory of 540	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	115
PID 4404 wrote to memory of 4520	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	117
PID 4404 wrote to memory of 2204	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	119
PID 4404 wrote to memory of 3028	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	121
PID 4404 wrote to memory of 1904	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	123
PID 4404 wrote to memory of 1732	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	125
PID 4404 wrote to memory of 1664	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	127
PID 4404 wrote to memory of 3828	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	129
PID 4404 wrote to memory of 216	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	131
PID 4404 wrote to memory of 2440	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	133
PID 4404 wrote to memory of 3316	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	135
PID 4404 wrote to memory of 3964	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	137
PID 4404 wrote to memory of 4428	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	139
PID 4404 wrote to memory of 4484	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	141
PID 4404 wrote to memory of 4940	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	143
PID 4404 wrote to memory of 2168	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	145
PID 4404 wrote to memory of 1760	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	147
PID 4404 wrote to memory of 4652	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	149
PID 4404 wrote to memory of 1212	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	151
PID 4404 wrote to memory of 2332	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	153
PID 4404 wrote to memory of 1848	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	155
PID 4404 wrote to memory of 4104	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	157
PID 4404 wrote to memory of 1880	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	159
PID 4404 wrote to memory of 2520	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	161
PID 4404 wrote to memory of 4832	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	163
PID 4404 wrote to memory of 4720	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	165
PID 4404 wrote to memory of 1924	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	167
PID 4404 wrote to memory of 3292	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	169
PID 4404 wrote to memory of 2508	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	171
PID 4404 wrote to memory of 2732	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	173
PID 4404 wrote to memory of 4792	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	175
PID 4404 wrote to memory of 1940	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	177
PID 4404 wrote to memory of 3376	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	179
PID 4404 wrote to memory of 5080	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	181
PID 4404 wrote to memory of 2928	4404	aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe	183

C:\Users\Admin\AppData\Local\Temp\aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
"C:\Users\Admin\AppData\Local\Temp\aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Users\Admin\AppData\Local\Temp\aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe
  "C:\Users\Admin\AppData\Local\Temp\aadfca87d6f9a67a99f1f14d9fea69bdde52d7a87f22840b6ab569df42a18012.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3240
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1412
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3236
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5028
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3856
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3248
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3228
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:540
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1904
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:216
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2440
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3964
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4428
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4940
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2168
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1848
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2520
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3292
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2508
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1940
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3376
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- - C:\Windows\System32\tasklist.exe
    C:\Windows\System32\tasklist.exe /FI "IMAGENAME eq maya.exe" /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\_bz2.pyd
Size 86KB
SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
MD5 28cea50945ec6972c8ec096bf562fb9e
SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
TLSH
T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\_ctypes.pyd
Size 139KB
SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
MD5 fdda26bd63d43178c9aca5003f6a7e42
SHA1 48037f1f68aad29e1002573337d2357f8972d045
SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
TLSH
T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\_decimal.pyd
Size 283KB
SHA256 1ee2247153ec6c6e5b3b49402f294b2b7325385ad489a5522e6fa9b406575e8b
MD5 bc63a4bb65d50f6de111deecd8de3457
SHA1 60ffbdc52782ddffad0c74774896159ec8eeb5d0
SHA512 60479c96b9fafb34e1c2d93970d69f53694c998cc6667fdde731e61675eb62d0a4bf875e5a3b939ebdcd7dfea8621a30d9ee30f6d7a0c7b83e058d77e36a1dd9
SSDEEP 6144:IBEAqz+G/rY2HvCnv4mrqGqqM43fIWeAxMoWl0:IuAERbvuvzVooWl0
TLSH
T14B547E96A3490CA4EF778474CA479A57F7B2B8414360D38F43A48A972F933A3673E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\_hashlib.pyd
Size 67KB
SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
MD5 ff7c390260b2c94396abcc5323db052e
SHA1 adc7babe127c3586c81f321ad20ff87785945795
SHA512 0c99f558cbbc21ae59932fb7eae56dc956e282609da9fa4715e28eb885bb228772496dd2d08d95ee6e37743c6b908e6190da4680935b557a01e2c0261189e855
SSDEEP 1536:1PooOWZsPAJWv52zRUQIjDItFyYiS9vUfIkb2L:5xY4JWv52ziQIjDIfdJL
TLSH
T192636C86A6984056DA1382B5C4E38F43FAB0F2522B1197DF6279C1CD2F233C3577A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\_lzma.pyd
Size 157KB
SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
MD5 1f2c927c6f1773093e6939e0f0075997
SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
TLSH
T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\_queue.pyd
Size 35KB
SHA256 acf60e246f6a83a914fb6c411f04bd3eb8bba83070612ca44af99d74f06c5524
MD5 8ac260b670f58c4d08ba0a7e5512133d
SHA1 3ac300d794c60ac58c68961ebd10c7fed8585fda
SHA512 a523efb322f7863033f7bb8101134a9ce6a137979665ed0daf2072eebf016a3b89bf0c386f4c3b84c3b2455814bc482581cf07a6606cdcef7df22b96e6a4fa2e
SSDEEP 768:mJe4W6rB0Bwh6EIjRUYSyYTegc2Ip4NMTxf1mlIJxp1:EhSBwcEIjRUYSyYiS9NgfIkxz
TLSH
T1A9F28DC6A65C4097E663C970C1A2DF92F975FBD39B0146DF2178C1890E237C2A73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\_socket.pyd
Size 85KB
SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
MD5 893ee6bcfa6b5a527b61eceb80257871
SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
TLSH
T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\_ssl.pyd
Size 180KB
SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
MD5 b9acce051643c39e5ac4c36110388724
SHA1 69f9743a13c57f699ce68270d915159aa812103b
SHA512 4b2854acd84ae8d2a89c3817bd4f901ceb61c5c83cf02ca7d0bc0936d54a4dd730b180aec7953924fd40ad6093d788876246604af6227ab33baa812bab9995a3
SSDEEP 3072:kSj0a+17gAx5pW3kfI6CMZqMK3wYLizXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UQ:J+17gAA3QI6CM+3bLOUBDW
TLSH
T10D048C47B1946AF7D903E8F9C2234543EBB4F145332287DE48D6D6860F03746AE6A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\_tkinter.pyd
Size 67KB
SHA256 14f0b750f800ed529a06052369428f75f204005be1633400c9fe0ca544d82f85
MD5 8f88a89243cd2cd254a31c2001accb3e
SHA1 bf73246b339970ccc9162719c3dc9c24746a8bd8
SHA512 dfb2230504bec8717cffb08ee4029c144addda6a87adaf2948fe1d7dc10e08a2b581489dccff60c26854e5728ed687df231bbfa42a78a3ac312b3a89601c12ca
SSDEEP 1536:MoTKqNDDa/Tf3gOrlU9oo6ptbQIjDStcyYiS95fIbH0ns2L:MoOjllPo6ptbQIjDStFTQ
TLSH
T1C0637D9AA764008ADE67D578C5B79F13E679F9520910534F00A4D38E1F333F2ABBA714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-console-l1-1-0.dll
Size 11KB
SHA256 8f8b79150e850acc92fd6aab614f6e3759bea875134a62087d5dd65581e3001f
MD5 07ebe4d5cef3301ccf07430f4c3e32d8
SHA1 3b878b2b2720915773f16dba6d493dab0680ac5f
SHA512 6c7e4df62ebae9934b698f231cf51f54743cf3303cd758573d00f872b8ecc2af1f556b094503aae91100189c0d0a93eaf1b7cafec677f384a1d7b4fda2eee598
SSDEEP 192:KFOWWthWzWf9BvVVWQ4mWqyVT/gqnajKsrCS81:uZWthWeN01IlGsrCt
TLSH
T106422B838EFC9403F9966DB046D9E9837D3D6BCB291190662199F2AD2CD33C1DB04B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-datetime-l1-1-0.dll
Size 11KB
SHA256 913eaaa7997a6aee53574cffb83f9c9c1700b1d8b46744a5e12d76a1e53376fd
MD5 557405c47613de66b111d0e2b01f2fdb
SHA1 de116ed5de1ffaa900732709e5e4eef921ead63c
SHA512 c2b326f555b2b7acb7849402ac85922880105857c616ef98f7fb4bbbdc2cd7f2af010f4a747875646fcc272ab8aa4ce290b6e09a9896ce1587e638502bd4befb
SSDEEP 192:PUWthW6Wf9BvVVWQ4SWZifvXqnajJ6HNbLet:MWthW3NhXll6HZm
TLSH
T102322B838BBC8043FAA66E7012E8D9937D3D67DB7910815516A9F1DC2C837C5EB00B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-debug-l1-1-0.dll
Size 11KB
SHA256 58a8d69df60ecbee776cd9a74b2a32b14bf2b0bd92d527ec5f19502a0d3eb8e9
MD5 624401f31a706b1ae2245eb19264dc7f
SHA1 8d9def3750c18ddfc044d5568e3406d5d0fb9285
SHA512 3353734b556d6eebc57734827450ce3b34d010e0c033e95a6e60800c0fda79a1958ebf9053f12054026525d95d24eec541633186f00f162475cec19f07a0d817
SSDEEP 192:tlWthWFWf9BvVVWQ4mWIzWLiP+CjAWqnajKsNb7:/WthWANnWLiP+CcWlGsNb7
TLSH
T152322A829FF89483F9976E709294EA93BD3DA7C62A1181590659F1A82CD37C1E700F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-errorhandling-l1-1-0.dll
Size 11KB
SHA256 46079c0a1b660fc187aafd760707f369d0b60d424d878c57685545a3fce95819
MD5 2db5666d3600a4abce86be0099c6b881
SHA1 63d5dda4cec0076884bc678c691bdd2a4fa1d906
SHA512 7c6e1e022db4217a85a4012c8e4daee0a0f987e4fba8a4c952424ef28e250bac38b088c242d72b4641157b7cc882161aefa177765a2e23afcdc627188a084345
SSDEEP 192:1mxD3+HWthWiWf9BvVVWQ4WWuhD7DiqnajKswz3:19HWthWfN/GlGswz3
TLSH
T1013219828BFC8003F9A76D7012A5EA43BD3D67D72951919906ADF2993C933C2DF10A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-file-l1-1-0.dll
Size 14KB
SHA256 5c9bc70586ad538b0df1fcf5d6f1f3527450ae16935aa34bd7eb494b4f1b2db9
MD5 0f7d418c05128246afa335a1fb400cb9
SHA1 f6313e371ed5a1dffe35815cc5d25981184d0368
SHA512 7555d9d3311c8622df6782748c2186a3738c4807fc58df2f75e539729fc4069db23739f391950303f12e0d25df9f065b4c52e13b2ebb6d417ca4c12cfdeca631
SSDEEP 192:RaNYPvVX8rFTsoWthWgWf9BvVVWQ4SWfMaPOoI80Hy5qnajslBE87QyX:HPvVXqWthWlN2WlslEE87Qw
TLSH
T10B620B93D9B4E25BF98FAE315192C8436D3843C6042580D91BD8D3AD3CE73C6E398A9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-file-l1-2-0.dll
Size 11KB
SHA256 629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086
MD5 5a72a803df2b425d5aaff21f0f064011
SHA1 4b31963d981c07a7ab2a0d1a706067c539c55ec5
SHA512 bf44997c405c2ba80100eb0f2ff7304938fc69e4d7ae3eac52b3c236c3188e80c9f18bda226b5f4fde0112320e74c198ad985f9ffd7cea99aca22980c39c7f69
SSDEEP 192:jlWaWthWAWf9BvVVWQ4WWloprVP+CjAWqnajKsNWqL:jIaWthWFNxtVP+CcWlGsNxL
TLSH
T17C322A939BBC9087F5976EB052A4EA93BD3D67C62910815905AEF19D2C933C1E700E2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-file-l2-1-0.dll
Size 11KB
SHA256 dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf
MD5 721b60b85094851c06d572f0bd5d88cd
SHA1 4d0ee4d717aeb9c35da8621a545d3e2b9f19b4e7
SHA512 430a91fcecde4c8cc4ac7eb9b4c6619243ab244ee88c34c9e93ca918e54bd42b08aca8ea4475d4c0f5fa95241e4aacb3206cbae863e92d15528c8e7c9f45601b
SSDEEP 96:imdzvQzEWthWwMVDEs3f0DHDsVBIwgmqvrnDD0ADEs3TDL2L4m2grMWaLN5DEs3r:v3WthWyWf9BvVVWQ4SWVVFJqqnajW2y
TLSH
T1A4323BD19BA8D443F697AD7042D8D6537E3D67D72C50905A1998F2982CD33C2EB00A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-handle-l1-1-0.dll
Size 11KB
SHA256 0b3dfb8554ead94d5da7859a12db353942406f9d1dfe3fac3d48663c233ea99d
MD5 d1df480505f2d23c0b5c53df2e0e2a1a
SHA1 207db9568afd273e864b05c87282987e7e81d0ba
SHA512 f14239420f5dd84a15ff5fca2fad81d0aa9280c566fa581122a018e10ebdf308ac0bf1d3fcfc08634c1058c395c767130c5abca55540295c68df24ffd931ca0a
SSDEEP 192:frWthWFWf9BvVVWQ4SWNOfvXqnajJ6H4WJ:frWthWANRXll6H4WJ
TLSH
T1E6322B82CB7C9043FA666E7042D4D9937D3D67CB6920C1A505A9F6DD2C933C1EB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-heap-l1-1-0.dll
Size 11KB
SHA256 c43075b1d2386a8a262de628c93a65350e52eae82582b27f879708364b978e29
MD5 73433ebfc9a47ed16ea544ddd308eaf8
SHA1 ac1da1378dd79762c6619c9a63fd1ebe4d360c6f
SHA512 1c28cc0d3d02d4c308a86e9d0bc2da88333dfa8c92305ec706f3e389f7bb6d15053040afd1c4f0aa3383f3549495343a537d09fe882db6ed12b7507115e5a263
SSDEEP 192:txlkWthW2Wf9BvVVWQ4SWBBBuUgxfzfqnaj0OTWv:txlkWthW7NkIrloFv
TLSH
T165423ACACBAC9103F56B6E7052D5E9937C3CE7C72560C0691A99F1982C933C1D721B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-interlocked-l1-1-0.dll
Size 11KB
SHA256 c23fe8d5c3ca89189d11ec8df983cc144d168cb54d9eab5d9532767bcb2f1fa3
MD5 7c7b61ffa29209b13d2506418746780b
SHA1 08f3a819b5229734d98d58291be4bfa0bec8f761
SHA512 6e5e3485d980e7e2824665cbfe4f1619b3e61ce3bcbf103979532e2b1c3d22c89f65bcfbddbb5fe88cddd096f8fd72d498e8ee35c3c2307bacecc6debbc1c97f
SSDEEP 192:4TWthWckWf9BvVVWQ4mWQAyUD7DiqnajKswzjdg:4TWthWcRNqGlGswzji
TLSH
T18B322D928BBC5407F6E76E7042D4D9937D3CA7D7295081660AA9F19C2CD33C1DF14A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-libraryloader-l1-1-0.dll
Size 12KB
SHA256 f320f9c0463de641b396ce7561af995de32211e144407828b117088cf289df91
MD5 6d0550d3a64bd3fd1d1b739133efb133
SHA1 c7596fde7ea1c676f0cc679ced8ba810d15a4afe
SHA512 5da9d490ef54a1129c94ce51349399b9012fc0d4b575ae6c9f1bafcfcf7f65266f797c539489f882d4ad924c94428b72f5137009a851ecb541fe7fb9de12feb2
SSDEEP 192:Us13vuBL3B5LoWthW7Wf9BvVVWQ4mWgB7OQP+CjAWqnajKsN9arO:Us13vuBL3B2WthWmNVXP+CcWlGsN9P
TLSH
T104422AC2CAA89483F5EA6E7081A4D5437C3967C72525C0AD46A9F29D3CE33C1EB10F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-localization-l1-2-0.dll
Size 14KB
SHA256 8664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2
MD5 1ed0b196ab58edb58fcf84e1739c63ce
SHA1 ac7d6c77629bdee1df7e380cc9559e09d51d75b7
SHA512 e1fa7f14f39c97aaa3104f3e13098626b5f7cfd665ba52dcb2312a329639aaf5083a9177e4686d11c4213e28acc40e2c027988074b6cc13c5016d5c5e9ef897b
SSDEEP 384:On2OMw3zdp3bwjGfue9/0jCRrndbZWWthWdNHhfVlGsSH:/OMwBprwjGfue9/0jCRrndbLEKv
TLSH
T12B622992D6E4D207F88DE9717167E8437D3C66860422D59507E2FB6838E33C5EB9072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-memory-l1-1-0.dll
Size 11KB
SHA256 5d9767d8cca0fbfd5801bff2e0c2adddd1baaaa8175543625609abce1a9257bd
MD5 721baea26a27134792c5ccc613f212b2
SHA1 2a27dcd2436df656a8264a949d9ce00eab4e35e8
SHA512 9fd6058407aa95058ed2fda9d391b7a35fa99395ec719b83c5116e91c9b448a6d853ecc731d0bdf448d1436382eecc1fa9101f73fa242d826cc13c4fd881d9bd
SSDEEP 192:2E+tWthWvWf9BvVVWQ4mWxHD7DiqnajKswzGIAf:T+tWthWiNcGlGswzLAf
TLSH
T1C1423C868BBC9403F5D32D305394DA97BD3E57C71861C06A16B9F2962CD33C1EB10A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-namedpipe-l1-1-0.dll
Size 11KB
SHA256 8e015cdf2561450ed9a0773be1159463163c19eab2b6976155117d16c36519da
MD5 b3f887142f40cb176b59e58458f8c46d
SHA1 a05948aba6f58eb99bbac54fa3ed0338d40cbfad
SHA512 7b762319ec58e3fcb84b215ae142699b766fa9d5a26e1a727572ee6ed4f5d19c859efb568c0268846b4aa5506422d6dd9b4854da2c9b419bfec754f547203f7e
SSDEEP 192:vdWthW8Wf9BvVVWQ4mWG2P+CjAWqnajKsNt:lWthWJNUP+CcWlGsNt
TLSH
T1A5323B918AA8D583F95B6EB052D4D653BC3DA7CA2511C06512AAF5EC2CD33C1E720F2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-processenvironment-l1-1-0.dll
Size 12KB
SHA256 058eb7ce88c22d2ff7d3e61e6593ca4e3d6df449f984bf251d9432665e1517d1
MD5 89f35cb1212a1fd8fbe960795c92d6e8
SHA1 061ae273a75324885dd098ee1ff4246a97e1e60c
SHA512 f9e81f1feab1535128b16e9ff389bd3daaab8d1dabf64270f9e563be9d370c023de5d5306dd0de6d27a5a099e7c073d17499442f058ec1d20b9d37f56bcfe6d2
SSDEEP 192:GFPWthW5Wf9BvVVWQ4mWc0ZD7DiqnajKswzczr:GFPWthWsNiGlGswzq
TLSH
T1FF421AC29ABCA003F6C67D3001A8F9A77D3C57E72C10806915A9F7692CD7781EB44B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-processthreads-l1-1-0.dll
Size 13KB
SHA256 a5b733e3dce21ab62bd4010f151b3578c6f1246da4a96d51ac60817865648dd3
MD5 0c933a4b3c2fcf1f805edd849428c732
SHA1 b8b19318dbb1d2b7d262527abd1468d099de3fb6
SHA512 b25ed54345a5b14e06aa9dadd07b465c14c23225023d7225e04fbd8a439e184a7d43ab40df80e3f8a3c0f2d5c7a79b402ddc6b9093d0d798e612f4406284e39d
SSDEEP 192:/uUk1Jzb9cKcIzWthWzaWf9BvVVWQ4mWmrcLUVT/gqnajKsrCOV:/bk1JzBcKcIzWthWzXNz1IlGsrCOV
TLSH
T1EA5219D289BCD183F48A6D706295E5633D3A978A193A813105E9F2E93DEB3C2D61493C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-processthreads-l1-1-1.dll
Size 11KB
SHA256 1ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c
MD5 7e8b61d27a9d04e28d4dae0bfa0902ed
SHA1 861a7b31022915f26fb49c79ac357c65782c9f4b
SHA512 1c5b35026937b45beb76cb8d79334a306342c57a8e36cc15d633458582fc8f7d9ab70ace7a92144288c6c017f33ecfc20477a04432619b40a21c9cda8d249f6d
SSDEEP 192:7oDfIeVWthWZWf9BvVVWQ4mWaHvP+CjAWqnajKsNZ:7oDfIeVWthWMNVP+CcWlGsNZ
TLSH
T135423CC2DABC9043F5DB6E705295E6537D3EA7C62521C06911A5F2AC2DD33C1E700B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-profile-l1-1-0.dll
Size 11KB
SHA256 e63550608dd58040304ea85367e9e0722038ba8e7dc7bf9d91c4d84f0ec65887
MD5 8d12ffd920314b71f2c32614cc124fec
SHA1 251a98f2c75c2e25ffd0580f90657a3ea7895f30
SHA512 5084c739d7de465a9a78bcdbb8a3bd063b84a68dcfd3c9ef1bfa224c1cc06580e2a2523fd4696cfc48e9fd068a2c44dbc794dd9bdb43dc74b4e854c82ecd3ea5
SSDEEP 192:gR7WthWTVWf9BvVVWQ4mWg2a5P+CjAWqnajKsNQbWl:gVWthWkN/P+CcWlGsNMg
TLSH
T1F2321AD2DBB85443F9A36E7052D4DA93BC3E67C7395081590669F1A82C933C1DB00E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 11KB
SHA256 91508ab353b90b30ff2551020e9755d7ab0e860308f16c2f6417dfb2e9a75014
MD5 9fa3fc24186d912b0694a572847d6d74
SHA1 93184e00cbddacab7f2ad78447d0eac1b764114d
SHA512 95ad31c9082f57ea57f5b4c605331fcad62735a1862afb01ef8a67fea4e450154c1ae0c411cf3ac5b9cd35741f8100409cc1910f69c1b2d807d252389812f594
SSDEEP 192:zGeVfcWthW+Wf9BvVVWQ4mWMiSID7DiqnajKswz5g:zGeVfcWthWjN6SIGlGswza
TLSH
T1B8422CD69BB85003F6933E7042A5EE937D3D67C72494816605A9F6AC1CD33C4EB10A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-string-l1-1-0.dll
Size 11KB
SHA256 f3a7a9c98ebe915b1b57c16e27fffd4ddf31a82f0f21c06fe292878e48f5883e
MD5 c9cbad5632d4d42a1bc25ccfa8833601
SHA1 09f37353a89f1bfe49f7508559da2922b8efeb05
SHA512 2412e0affdc6db069de7bd9666b7baa1cd76aa8d976c9649a4c2f1ffce27f8269c9b02da5fd486ec86b54231b1a5ebf6a1c72790815b7c253fee1f211086892f
SSDEEP 192:qyMv0WthWPWf9BvVVWQ4mWIv/r+YVqnajKsSF:qyMv0WthWCNBfVlGsSF
TLSH
T1C1323C925AB89007FAE75DB05399E9977E3CA7C72920C1A90554F59C2CD33C1EF00B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-synch-l1-1-0.dll
Size 13KB
SHA256 d6708d1254ed88a948871771d6d1296945e1aa3aeb7e33e16cc378f396c61045
MD5 4ccde2d1681217e282996e27f3d9ed2e
SHA1 8eda134b0294ed35e4bbac4911da620301a3f34d
SHA512 93fe6ae9a947ac88cc5ed78996e555700340e110d12b2651f11956db7cee66322c269717d31fccb31744f4c572a455b156b368f08b70eda9effec6de01dbab23
SSDEEP 384:miwidv3V0dfpkXc0vVauzIWthWLN3fVlGsStY:nHdv3VqpkXc0vVaKbiYlY
TLSH
T127522A52E2E4F547F99BED7042DAC553AD3857C70920C0661695E6AD3CE33C0EB1462E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-synch-l1-2-0.dll
Size 11KB
SHA256 72c639d1afda32a65143bcbe016fe5d8b46d17924f5f5190eb04efe954c1199a
MD5 e86cfc5e1147c25972a5eefed7be989f
SHA1 0075091c0b1f2809393c5b8b5921586bdd389b29
SHA512 ea58a8d5aa587b7f5bde74b4d394921902412617100ed161a7e0bef6b3c91c5dae657065ea7805a152dd76992997017e070f5415ef120812b0d61a401aa8c110
SSDEEP 192:TtZ3KjWthWzWf9BvVVWQ4mWXU0P+CjAWqnajKsN2v:TtZ3KjWthWeNwP+CcWlGsNa
TLSH
T1BB424BD3DBA89143F597EDB042D5E5937D3D57C62A20805515AAF16D2CE33C2E700E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-sysinfo-l1-1-0.dll
Size 12KB
SHA256 76d8e4ed946deefeefa0d0012c276f0b61f3d1c84af00533f4931546cbb2f99e
MD5 206adcb409a1c9a026f7afdfc2933202
SHA1 bb67e1232a536a4d1ae63370bd1a9b5431335e77
SHA512 727aa0c4cd1a0b7e2affdced5da3a0e898e9bae3c731ff804406ad13864cee2b27e5baac653bab9a0d2d961489915d4fcad18557d4383ecb0a066902276955a7
SSDEEP 192:vgdKIMFYJWthW2Wf9BvVVWQ4SW2zZ7uUgxfzfqnaj0OGWh:0hJWthW7NBzIrloYh
TLSH
T14D420793DAB8A103F55B6E7052D9E6833D3897C66425C01D069AF3AD6CA33C9D710A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-timezone-l1-1-0.dll
Size 11KB
SHA256 b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34
MD5 91a2ae3c4eb79cf748e15a58108409ad
SHA1 d402b9df99723ea26a141bfc640d78eaf0b0111b
SHA512 8527af610c1e2101b6f336a142b1a85ac9c19bb3af4ad4a245cfb6fd602dc185da0f7803358067099475102f3a8f10a834dc75b56d3e6ded2ed833c00ad217ed
SSDEEP 192:Ha2WthWKOWf9BvVVWQ4mWNOrVT/gqnajKsrCkb:Ha2WthWKTNz1IlGsrCo
TLSH
T13342F7D2CBA89403FDDB6F7007E9E5937D3C67DB1820816A15DAE1A92CD7385DB00A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-core-util-l1-1-0.dll
Size 11KB
SHA256 f28a8fe2cd7e8e00b6d2ec273c16db6e6eea9b6b16f7f69887154b6228af981e
MD5 1e4c4c8e643de249401e954488744997
SHA1 db1c4c0fc907100f204b21474e8cd2db0135bc61
SHA512 ef8411fd321c0e363c2e5742312cc566e616d4b0a65eff4fb6f1b22fdbea3410e1d75b99e889939ff70ad4629c84cedc88f6794896428c5f0355143443fdc3a3
SSDEEP 192:jWthWYWf9BvVVWQ4mWd8l1P+CjAWqnajKsNeCw:jWthW9NnP+CcWlGsNex
TLSH
T18F3219D3DBB8D443F9976E704294DA937C3DA7C62950919915A9F2A82CD33C1EB00F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 e677497c1baefffb33a17d22a99b76b7fa7ae7a0c84e12fda27d9be5c3d104cf
MD5 fa770bcd70208a479bde8086d02c22da
SHA1 28ee5f3ce3732a55ca60aee781212f117c6f3b26
SHA512 f8d81e350cebdba5afb579a072bad7986691e9f3d4c9febca8756b807301782ee6eb5ba16b045cfa29b6e4f4696e0554c718d36d4e64431f46d1e4b1f42dc2b8
SSDEEP 192:fSWthWvWf9BvVVWQ4mWFl5P+CjAWqnajKsNifl:aWthWiN+5P+CcWlGsNiN
TLSH
T176421783AAFC9943E5435B70A2F5DBD3BE3927C225506069455AF1683CC33D6BB01A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 5cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639
MD5 4ec4790281017e616af632da1dc624e1
SHA1 342b15c5d3e34ab4ac0b9904b95d0d5b074447b7
SHA512 80c4e20d37eff29c7577b2d0ed67539a9c2c228edb48ab05d72648a6ed38f5ff537715c130342beb0e3ef16eb11179b9b484303354a026bda3a86d5414d24e69
SSDEEP 192:yjQ/w8u4cyNWthWYWf9BvVVWQ4mWhu1BVT/gqnajKsrC74m:8yNWthW9Np1IlGsrCEm
TLSH
T1F562C64366E43E26EA9F177221FE97E36A391786155143B4C207D19C38837C2BE97C1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607
MD5 7a859e91fdcf78a584ac93aa85371bc9
SHA1 1fa9d9cad7cc26808e697373c1f5f32aaf59d6b7
SHA512 a368f21eca765afca86e03d59cf953500770f4a5bff8b86b2ac53f1b5174c627e061ce9a1f781dc56506774e0d0b09725e9698d4dc2d3a59e93da7ef3d900887
SSDEEP 192:vWOPWthWAWf9BvVVWQ4mWWbgftmP+CjAWqnajKsNURPblh:BWthWFN+f8P+CcWlGsNURzv
TLSH
T1EA421B828FB89443FA976E7082B4EA937D3967D639108139066AF15C2CD33C1FB11A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 7102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86
MD5 972544ade7e32bfdeb28b39bc734cdee
SHA1 87816f4afabbdec0ec2cfeb417748398505c5aa9
SHA512 5e1131b405e0c7a255b1c51073aff99e2d5c0d28fd3e55cabc04d463758a575a954008ea1ba5b4e2b345b49af448b93ad21dfc4a01573b3cb6e7256d9ecceef1
SSDEEP 192:WxSnWlC0i5ClWthWTWf9BvVVWQ4mW+hkKVT/gqnajKsrCw/:WxSnWm5ClWthW+NkK1IlGsrCY
TLSH
T1C352F78387E8AD13EAA71F7112FDD7D73F3D5A8614538262800AE16839D33C07F16999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f
MD5 8906279245f7385b189a6b0b67df2d7c
SHA1 fcf03d9043a2daafe8e28dee0b130513677227e4
SHA512 67cac89ae58cc715976107f3bdf279b1e78945afd07e6f657e076d78e92ee1a98e3e7b8feae295af5ce35e00c804f3f53a890895badb1eed32377d85c21672b9
SSDEEP 192:YFY17aFBRQWthWIWf9BvVVWQ4mWHhOP+CjAWqnajKsNngJ:YQtWthWNNdP+CcWlGsNI
TLSH
T1BA421A939ABC5943F9937FB061E4E7C77D3A67C27950816A4157F1A82C833C0BB11A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 2eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e
MD5 dd8176e132eedea3322443046ac35ca2
SHA1 d13587c7cc52b2c6fbcaa548c8ed2c771a260769
SHA512 77cb8c44c8cc8dd29997fba4424407579ac91176482db3cf7bc37e1f9f6aa4c4f5ba14862d2f3a9c05d1fdd7ca5a043b5f566bd0e9a9e1ed837da9c11803b253
SSDEEP 192:m8qWthWLWf9BvVVWQ4WWLXlyBZr+YVqnajKsS1:mlWthWWN0uZfVlGsS1
TLSH
T1C0422B838AFC5443F5D36EB056B8EB8B7E3D67C3291581590156F5A82C833CCAF41A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-crt-math-l1-1-0.dll
Size 20KB
SHA256 a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0
MD5 a6a3d6d11d623e16866f38185853facd
SHA1 fbeadd1e9016908ecce5753de1d435d6fcf3d0b5
SHA512 abbf32ceb35e5ec6c1562f9f3b2652b96b7dbd97bfc08d918f987c0ec0503e8390dd697476b2a2389f0172cd8cf16029fd2ec5f32a9ba3688bf2ebeefb081b2c
SSDEEP 384:rQM4Oe59Ckb1hgmLRWthW0N0JBJ1IlGsrC5W:sMq59Bb1jYNABHJc
TLSH
T17E92C5474ADCFF67D18F17B701F08BCE6A381AA664D6B1B5C81B91C834A27C07E83959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 3af38920e767bd9ebc08f88eaf2d08c748a267c7ec60eab41c49b3f282a4cf65
MD5 074b81a625fb68159431bb556d28fab5
SHA1 20f8ead66d548cfa861bc366bb1250ced165be24
SHA512 36388c3effa0d94cf626decaa1da427801cc5607a2106abdadf92252c6f6fd2ce5bf0802f5d0a4245a1ffdb4481464c99d60510cf95e83ebaf17bd3d6acbc3dc
SSDEEP 192:uFdyqjd7NWthWxWf9BvVVWQ4mW+JZD7DiqnajKswzR1:YQsWthWkNfZGlGswzR1
TLSH
T14342F987CBF81557E6A31F3041F9DB83BF3B97D75810916A8866F09D3883391AB2192D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198
MD5 f1a23c251fcbb7041496352ec9bcffbe
SHA1 be4a00642ec82465bc7b3d0cc07d4e8df72094e8
SHA512 31f8c5cd3b6e153073e2e2edf0ca8072d0f787784f1611a57219349c1d57d6798a3adbd6942b0f16cef781634dd8691a5ec0b506df21b24cb70aee5523a03fd9
SSDEEP 192:eUW9MPrpJhhf4AN5/KihWthWBWf9BvVVWQ4mWRXwsD7DiqnajKswzK:eUZr7HWthWUNkGlGswzK
TLSH
T14072E6438AF87F17E6872B3316F9DBC75E36638626108179C867F09838C3781BD5661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb
MD5 55b2eb7f17f82b2096e94bca9d2db901
SHA1 44d85f1b1134ee7a609165e9c142188c0f0b17e0
SHA512 0cf0770f5965a83f546253decfa967d8f85c340b5f6ea220d3caa14245f3cdb37c53bf8d3da6c35297b22a3fa88e7621202634f6b3649d7d9c166a221d3456a5
SSDEEP 192:hA2uWYFxEpahDWthWDWf9BvVVWQ4mWR3ir+YVqnajKsSO:hIFVhDWthWONlfVlGsSO
TLSH
T14B82B48395EC7F02E28787732AFAFBDB5B35578228047178C503E99839C63997E0355A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 1a916c0db285deb02c0b9df4d08dad5ea95700a6a812ea067bd637a91101a9f6
MD5 9b79965f06fd756a5efde11e8d373108
SHA1 3b9de8bf6b912f19f7742ad34a875cbe2b5ffa50
SHA512 7d4155c00d65c3554e90575178a80d20dc7c80d543c4b5c4c3f508f0811482515638fe513e291b82f958b4d7a63c9876be4e368557b07ff062961197ed4286fb
SSDEEP 384:jvEvevdv8vPozmVx0C5yguNvZ5VQgx3SbwA7yMVIkFGlPWthWXNjqujGlGswz7:2ozmT5yguNvZ5VQgx3SbwA71IkFFaJft
TLSH
T1E782A44346F83F02DACF57B359FACBC31A384F8621415275C467A59C38827A6BE6B90D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0
MD5 1d48a3189a55b632798f0e859628b0fb
SHA1 61569a8e4f37adc353986d83efc90dc043cdc673
SHA512 47f329102b703bfbb1ebaeb5203d1c8404a0c912019193c93d150a95bb0c5ba8dc101ac56d3283285f9f91239fc64a66a5357afe428a919b0be7194bada1f64f
SSDEEP 192:ENDCWthWHWf9BvVVWQ4mWG5xqcVT/gqnajKsrC/V:TWthW6N/xqc1IlGsrC/V
TLSH
T16A52F98386E4AA0BFAC71B7112FDD7D77B3953C2298061768117D4A83A83384FE5396D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1
MD5 dbc27d384679916ba76316fb5e972ea6
SHA1 fb9f021f2220c852f6ff4ea94e8577368f0616a4
SHA512 cc0d8c56749ccb9d007b6d3f5c4a8f1d4e368bb81446ebcd7cc7b40399bbd56d0acaba588ca172ecb7472a8cbddbd4c366ffa38094a832f6d7e343b813ba565e
SSDEEP 192:ZjfHQdufWthWCWf9BvVVWQ4mWMlUteSP+CjAWqnajKsN0c:ZfZWthW/Nd4P+CcWlGsN0c
TLSH
T1914209978AA85943F6972F7052E4EBC3BD3D6BC2292182664156F19C3C837C1FF11A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\base_library.zip
Size 1.3MB
SHA256 7e875882b7f7d60472b313470fd651897036e52a33961439271b7e277ddf0987
MD5 17f01c4150747183b7ec2f0b6cb0063d
SHA1 1ff61b68307ad5e2e0eb6d5d8d220170c5042711
SHA512 4dc0236b2d3116719ba2abeb0f7e442bd1d52e7c98ff912407523f729e1b9add2b8a9a2469cd60e781cd4afdea486e8ca95b044ece4a006e4247cd1ae806d3de
SSDEEP 24576:9YuUFeQeOdP2m2dfbqlb4Rp930LyHzdWaL:uuUFe/NRP3DTdX
TLSH
T180552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\libcrypto-3.dll
Size 5.0MB
SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
MD5 9751638ed5684f53f07ef6b4c7e8a786
SHA1 896a535cb1e49daa88e9aea693f52926c7e6f1a4
SHA512 b461c99c6115be95baac937f07038decd5ab2917aaaf12df8d1a44b1bc4ab28cde5ef748d1575d33b18d5e46d67f4ebc9c30333f3974c349c6f8a3c4edd86472
SSDEEP 98304:1H+q/MS7XFmXiTpdFGUPB1CPwDvt3uFlDC5g:J9/7XFmXwpdFGU51CPwDvt3uFlDCS
TLSH
T145367B6AA7A80189E4BAC13CC9534613D2B1F85A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\libssl-3.dll
Size 776KB
SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
MD5 a643b4a012da0d4b5653a01a458cabb7
SHA1 4e788bee34f620e671f426cc356e846c5ef51db8
SHA512 d8ac85fbf3dccb071d6fa4349d9af08116e1057da127016fcda45c9b643e4e1ef4166e0b6ef3d64f2e4d6e9a6f06122f2f8aec7fe2d5916e820b079148ff533f
SSDEEP 12288:ORPyn2nh9MXVkVJ1Ylrl3cfXJaizeTWMldFe9XbBR:wPXnh9MX2V3Ylp3cfXJaizCFe9XbBR
TLSH
T1BAF45CADB37805DCD8B6C17986934623E3B6F4562330EBEB0651C6790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\python314.dll
Size 6.5MB
SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
TLSH
T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\select.pyd
Size 32KB
SHA256 8c3ee20776d8eb7c441f2006ed46b9ba932060c6b66df4c1e156dcf7738d56ce
MD5 9e31eff5c36a868a6010be873e0f58b5
SHA1 9cdc5190fd0d821b5b22f53c8a86c62b7e64642e
SHA512 b5cee6769f229874e5905d80699975fcf9472dfa2d09f01c38d2d41872885a3e6853cf6599ec214c66e9431e6ccde95e7324f1eba860f68fe849f75497447ea4
SSDEEP 768:rB7YKHfIaqFEIjRGOyYTegc2Ip42Txf1ml9dHb7Ls/HV:rB73/IaqFEIjRGOyYiS92fIbHbns/1
TLSH
T189E27DCA6B345047E6A3C57185A2DE83FA39F7A39A11869F31B6918D0E137C1B337358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\tcl86t.dll
Size 1.8MB
SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
MD5 fa83a807131f3d4a6070eb884e682ad1
SHA1 226bf1cd0fc289034d9579c95ee0fe4df50cc6b8
SHA512 6e86f3725bb68af581e3e1b917c950f255e0f4348256fc02d8a560159cd225fe28303da2554c205636f2f82b9757072bf0c3460116bd7b09ef0bf01cc46125a2
SSDEEP 49152:D0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGP:YBUqMR7i6x9T+P
TLSH
T1E6859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\tk86t.dll
Size 1.5MB
SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
MD5 0da8eb1421517029c8d986519b0e5c63
SHA1 daa8395b9d691b5dfbdaa1f63256555a14010891
SHA512 f729f812901cc023111989d6e1eaa639d2ed2283bdb852c91abc283dee3d785295d3191f70f2ef535d268d454279a7ddd0339993f06be21b62d43d8ab27d70af
SSDEEP 49152:A76DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezf5:VQchLNqaJvARxr9DrTwylL1y5BEq8JTW
TLSH
T16E755A06B2A0C198C66FA134C91796BAE7F17C05931057DB72A0BE697F73BD2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\ucrtbase.dll
Size 1011KB
SHA256 6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232
MD5 849959a003fa63c5a42ae87929fcd18b
SHA1 d1b80b3265e31a2b5d8d7da6183146bbd5fb791b
SHA512 64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09
SSDEEP 24576:EsKxVJ/pRRK0Y/9fCrl4NbpjONcncXEomxvSZX0yp49C:lKxDPHQCrlQBXxw
TLSH
T10D25AF64FA5D0EA9D57BE13DC51B560FD572380207608ACF03E64BB96E2BBD91637320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\unicodedata.pyd
Size 740KB
SHA256 a7a2bfeed5d0480d8c458b3a61ee32c478ae10c694e8be61c3ba0e8cc2a6e1c6
MD5 624ffa84aa15efced4c1fd8e5ccf0b95
SHA1 2c08e87703b662828be085b4fe07e5b28b723e8a
SHA512 8f531ade03ad048c5f9d1de307e45960822e2dfd50bb27a71173a7ccb90f1a49028b70848046d34b81f130341cae4d7853db171f3167554e8c0c5a2cad40cc61
SSDEEP 12288:xPYzAPtrZmDtBPcH+dEYJ5EIub+z70lDJPT36mwtNh+:xPY05ZmDPqO54lDJPTMNh+
TLSH
T1D3F4F5F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI35682\zlib1.dll
Size 142KB
SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
MD5 eb3af30a0981219d851e6506db106bc2
SHA1 fd7b1b01dc01a7f32bd51f9a31bf717f4d55d09c
SHA512 8f55f4a86b747b5570d0f539c95dc1677eeba52bcd01850e8d86998b3415b99c92566ad9ece0e46b50e0e3a7eed6a4fe09604ec295f36f9bebf6e8f407ace468
SSDEEP 3072:0vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCoV:0sVD+RrFgvi7J9
TLSH
T1C8E37D9BA6E228BDC67780B052E78776F932B8214B309DEF5148C7741B12E506B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4404-1050-0x00007FFBF43E0000-0x00007FFBF4409000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads