mofksys | 508fad45dc497e24abfc698ab7cfd4a1bb50b82355d656b7a7a0aad6568e718a

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
Size 10.7MB
Sample261107-sk7mmsfc28
SHA256 508fad45dc497e24abfc698ab7cfd4a1bb50b82355d656b7a7a0aad6568e718a
MD5 3d0b2f5118e16a9f836b032318b5408c
SHA1 24d2fffd0c51948ddc50aa2870489ca20284485b
SHA512 ac160fbcd61bcbdde35ce9f6e69047b90e75c7c3f4c503efd491f0d747b80edd620fa6ed5d9dd7e3c4acb86b91e8cfa940da48606f3155ee161e95a547829d5c
SSDEEP 196608:zN3IuP0W8UA039W+t2PKMmj0+5g5Y6q4Jkz9Rwpr2Zwl6HlmWnM9q03UypM9O5:zhIdW8UNW+tHj3p6qLwqdZMwKUSh5
TLSH
T101B6339A7B4401E9F45A96B41890D57BB3217E310794888B27F05E673CB3292FEB172F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery mofksys persistence pyinstaller worm

Malware Config

Signatures

Family: Mofksys
Mofksys is a worm written in VisualBasic.
worm mofksys

Detects Mofksys worm 12 IoCs

resource	yara_rule
behavioral2/memory/4376-0-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/files/0x000f00000001c579-965.dat	family_mofksys
behavioral2/files/0x000a00000001c977-975.dat	family_mofksys
behavioral2/files/0x000a00000001c97b-1027.dat	family_mofksys
behavioral2/files/0x000a00000001c979-1031.dat	family_mofksys
behavioral2/memory/1068-1039-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/memory/4376-1041-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/files/0x000a00000001c97e-1040.dat	family_mofksys
behavioral2/memory/2808-1038-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/memory/4248-1035-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/memory/2488-1065-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys
behavioral2/memory/5568-1067-0x0000000000400000-0x0000000000440000-memory.dmp	family_mofksys

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Executes dropped EXE 7 IoCs

pid	Process
2088	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
1068	icsys.icn.exe
2488	explorer.exe
2808	spoolsv.exe
5568	svchost.exe
4248	spoolsv.exe

Loads dropped DLL 21 IoCs

pid	Process
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000d00000001c588-8.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1068	icsys.icn.exe
1068	icsys.icn.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
5568	svchost.exe
5568	svchost.exe
2488	explorer.exe
2488	explorer.exe
5568	svchost.exe
5568	svchost.exe
2488	explorer.exe
2488	explorer.exe
5568	svchost.exe
5568	svchost.exe
5568	svchost.exe
5568	svchost.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
5568	svchost.exe
5568	svchost.exe
5568	svchost.exe
2488	explorer.exe
5568	svchost.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
5568	svchost.exe
5568	svchost.exe
2488	explorer.exe
2488	explorer.exe
5568	svchost.exe
5568	svchost.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
5568	svchost.exe
5568	svchost.exe
2488	explorer.exe
2488	explorer.exe
5568	svchost.exe
5568	svchost.exe
5568	svchost.exe
5568	svchost.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
5568	svchost.exe
2488	explorer.exe
5568	svchost.exe
2488	explorer.exe
5568	svchost.exe
2488	explorer.exe
5568	svchost.exe
5568	svchost.exe
5568	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2488	explorer.exe
5568	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
4376	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
4376	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
1068	icsys.icn.exe
1068	icsys.icn.exe
2488	explorer.exe
2488	explorer.exe
2808	spoolsv.exe
2808	spoolsv.exe
5568	svchost.exe
5568	svchost.exe
4248	spoolsv.exe
4248	spoolsv.exe
2488	explorer.exe
2488	explorer.exe
3036	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 2088	4376	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe	88
PID 2088 wrote to memory of 3036	2088	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe	89
PID 4376 wrote to memory of 1068	4376	2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe	90
PID 1068 wrote to memory of 2488	1068	icsys.icn.exe	91
PID 2488 wrote to memory of 2808	2488	explorer.exe	92
PID 2808 wrote to memory of 5568	2808	spoolsv.exe	93
PID 5568 wrote to memory of 4248	5568	svchost.exe	94
PID 5568 wrote to memory of 1700	5568	svchost.exe	95
PID 5568 wrote to memory of 5792	5568	svchost.exe	101
PID 5568 wrote to memory of 5212	5568	svchost.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376
- \??\c:\users\admin\appdata\local\temp\2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
  c:\users\admin\appdata\local\temp\2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2088
- - \??\c:\users\admin\appdata\local\temp\2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
    c:\users\admin\appdata\local\temp\2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3036
- C:\Users\Admin\AppData\Local\icsys.icn.exe
  C:\Users\Admin\AppData\Local\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1068
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of hidden/system files in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - \??\c:\windows\system\spoolsv.exe
      c:\windows\system\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2808
    - - \??\c:\windows\system\svchost.exe
        
        c:\windows\system\svchost.exe
        5⤵
        Modifies WinLogon for persistence
        Modifies visibility of hidden/system files in Explorer
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5568
      - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4248
      - C:\Windows\SysWOW64\at.exe
        
        at 15:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1700
      - C:\Windows\SysWOW64\at.exe
        
        at 15:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
      - C:\Windows\SysWOW64\at.exe
        
        at 15:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-11-07_3d0b2f5118e16a9f836b032318b5408c_elex_glassworm_icedid_luca-stealer_njrat.exe
Size 10.5MB
SHA256 d9610995cbb327c8561c0c6b7a78505ba0ab705aae138284976b6a3c0fbd93ba
MD5 ca8c972c2a3ca041b50eb01501df74be
SHA1 ef7af843c65ab38644d6b66a86eb9cd005ff8279
SHA512 121d7b0dbf36f5198fe3029d712d5a38ad8959fdb7aa9abc00db0840dd8137fe81efd4b2d5a46426ac8828981485b391e95a5219296504d4263691c5f3fedfaf
SSDEEP 196608:53IuP0W8UA039W+t2PKMmj0+5g5Y6q4Jkz9Rwpr2Zwl6HlmWnM9q03UypM9O:lIdW8UNW+tHj3p6qLwqdZMwKUSh
TLSH
T114B633DD778806E4F49AA27958D0C43BA365BE2103A4C5CB6BF40C673DB72D8ED21B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_bz2.pyd
Size 84KB
SHA256 64d9fbb516e08a6780dca160e40d8c6723d2a659b5ca3020de7a041305b3a3d4
MD5 7098611e0258f8bd1ed5ecb971c88763
SHA1 009b95baaeb3cd8b1012a8af487d52c091381cb3
SHA512 ad44afc2962e746c9720d33b490445c05e0dbd6a70acf568d5e0bd1138d092d2e49f89c51aab6a2a6b5e6ac4bacc771816b76963bae15553e8ee630af70ccaff
SSDEEP 1536:udsvXm8z7+Cnqncm4WlTtdKSzBdzM8yOBs8iMtIeLV8yG5TT/9vfIZRzz:qsvXm8zaYqRptX7zvyOC8htIeLVmpSZl
TLSH
T1B7836D86F36552B6F99BD1B886800793F730BB950B50A36FF148C2993F13B916E5C319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_ctypes.pyd
Size 131KB
SHA256 b9c9e713f11e111daa55e4a62a135d7e385fa7aa0986d30b286d000e122b13aa
MD5 1606ace764f2b3ca8ab20cada221cf56
SHA1 ff63d15ea0b6b0c52deceab3f54c671a44e5e8f2
SHA512 658df5ed480cebc92685aa617c2ec5a5ff0c8613d420bcc3dbea0af0e1f7274c6963605f6284a69d3df40d075b02310fa35c361a176f5a2d80c2510db5290fc0
SSDEEP 3072:gaSQJ/VrFMXqvN2Ptf/Fm02R0JrsgvGzhIeyPxp5:oQJ/V1Ef/Fm082rsgAe
TLSH
T12DD37D0B776800AADAA39174C173AF47EBB1B453171047CF02A4C69A2F63792AE7F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_lzma.pyd
Size 155KB
SHA256 999ba26fe0b0376b7898d50ddb2f5012e7a64228e31fcdca99a4d7079df669e3
MD5 b7100b8fb3c579c848d8960b927d322f
SHA1 f6303fd3e27b93b7f0ff8251ca85636d01dc19d9
SHA512 9e778f62e28dc105d54211a9b708fd51cff9e7b53e79b78e73461fdd495c78b9091dd11e2a6522a82088a76cb356fc7176706afe519f8bfab1287285aeb27f6f
SSDEEP 3072:IqZ/boPLmhrKifqGDRJUsTznfB9mNo9vm28fgS+tIe01Lfp2/Ih:IeTgLhyvUsv5YO9Cfd+Qfk
TLSH
T10BF35C86B794F0D5F7728C38D2624F57E6F5781A0320929A01CC976D2B1FB659A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_queue.pyd
Size 34KB
SHA256 baa5a4cec6c369efc461f7109f1e6150c0afeef8ce53dbd9d673a00093cdadf8
MD5 24bd30234b4fa243007ac061bd7bc8a5
SHA1 c4d8b0d0c91e6112c08808dfdd11eee1d073dcff
SHA512 8f649ca916688edc10942a794a8f79a6d67d0ac2f257d2e4a469d96c0787f2e904e64339b5193b8a4ef0ff4df36fa9cfaff97d6ac31d74919cda86c73b9a6965
SSDEEP 768:8+Mds6rU7gVh6hIe9UVMdyG5TkKrLy2Ip4QzyTxf1mlWZG8vDkr/v:uNU7gVIhIe9UGyG5TT/9QufIW44Dkr3
TLSH
T1B5F26DCAAA68444BE563DA30C1E7EE52F435F7D3961197DF216981CD1E233C1A33A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_socket.pyd
Size 84KB
SHA256 7acc6c44436bf77be3c425d39f0acba03b42119513ef9db31a7039c969e056bd
MD5 659d1aa860099428669dcdae9c7ab661
SHA1 324fcf8d090c3ffda1386c85f263f7bb104889a2
SHA512 3b87e0fd8c68c7fa829e1fad13e4e5d14b42a36d9e25ae1c5b7fb8f87bfe087183fafb51c7734a4169dd64ce833d19e47e8f11f7f5640b67ac00bbfff557798a
SSDEEP 1536:rVl/fxzeola7SVitdyJw3QlyJ+9+nzn3Y4KxtS4DTDghIeyw9yG5TT/9SfIZRwz:rVRdeoo7YoyJw3QlyJs+nz3tKxB8hIeE
TLSH
T1DF836C04A66050FAEBB3D075C2639E62FB74B1C11394A35F1066C65A1F333C2BF7AA95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_tcl_data\auto.tcl
Size 21KB
SHA256 08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99
MD5 97efa9ebe840ea051f9706504c8bd783
SHA1 287dea14d47977dcd8edc525fe750c836264db5c
SHA512 ab9fc210f3bfd181cc2b93dd348415f67f763b2c7961179a88eba3f7f87e44b21a66ea4ea53715fb88784288c75b8270640f3bc6beafb0e8cc21966068a79bf2
SSDEEP 384:UqT9XC9VZvWQjCTzsCTV7672ORgS0myvxFRTX7Xvt3wBTnbXhCUquyvz:LT9XC9VZvhjCPsCp7JlmyvTxvt3gTnbW
TLSH
T1EFA2B7635F9542A630B1C22B553DB9A4EF2F81B70675801D38F8912C37F1815C6BEAEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

init.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_tcl_data\init.tcl
Size 25KB
SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
MD5 ffe4e47b5f4f96ec33fb31d52ef0b636
SHA1 3a625e493f8778277f65ffef1e0879fbec0e4d0d
SHA512 dbbfd92ab6d95672f7882f3affb75f31749281c7450c29fcef58b5bdfd4f42b6d1d9f3a50ae0d3aa27e95d48918ed55cde5149751f892538bdd2dc39c618927e
SSDEEP 768:+XrgPHudKlE7BG6Xg3tMo846ofRRECL9QDjr5v7hzx/i:igGdKlK4Ao846offLmNhNi
TLSH
T104C2A8112388917932B3533686B5E598EE7EC1F706A941BCBCCC825C777150A4AFDBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_tcl_data\package.tcl
Size 23KB
SHA256 b471cec9056b62d562020b14d69d4bd1f92dfe158afc8ba81c6341836211ca46
MD5 6a7b6485d3b290fc5d412ed1d62a170d
SHA1 50475e80e3969de279edfb1bf8d9c19694c36c0b
SHA512 36ced797ec18d4aa68fcce57f6eb510e78508d14646cf43ea2effb6f2cf88529d0cb5a4a136fb1252edbb95cba646bdcd19a8cd90a86b19fc28bb9611e2ccb73
SSDEEP 384:8xgrmNIpEHsDAW2UfnImRqXqQx6XmchmCWhzPLrXJjJh6PLfzd7lG:8xgrmNIwsDnvIm86QGRhLWhzDzJ9h6DS
TLSH
T14BB2C821B389915A34B153639B352D8CCF3EC0FF51A951BC78D482BC776092A0ADE7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tclIndex

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_tcl_data\tclIndex
Size 7KB
SHA256 577f042bbe640e2739606a1f76098abdb8bd1d1f31526402fb82b21091644f65
MD5 42ec37eee38d6dd33a9fdecd7f1cd0aa
SHA1 6c8c93e5e5350d93f63f3f99d587ab8fb5aa496b
SHA512 37d61f27da79c494d225543828c9a29f1397c57506d609481036bfa2a336ec3110e6d10670edcf211a5714629eeb7e16dbf04a8388bc6bb420584edc06dc534d
SSDEEP 192:eeV1ffxNFxI5XgipSSMw+5p3fphBr2tm87RtmAjm2G03BgPlKif8Qyly5mg2lkYf:eeV1ffxNFxI5XgipSSMw+5p3fphBr2t/
TLSH
T1C8E12C1AE354C51883E485174959DE983AFEE298D32CCC7EDAB491ED10B20176FEE4F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tm.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_tcl_data\tm.tcl
Size 11KB
SHA256 f0cc13daca21fee538cca757aa09e88a969a85174eda26e61e573dda6c7ba413
MD5 5746f2c35a7c434a78cc127f8d522e8c
SHA1 0b438de8ddc24b2d805a5db2c8c9432a52c6e53a
SHA512 0a9038474b7bdb9469b7684b5b3867982a29bebbdf017d2dd21edcdd79dd3f67f4d99cdc0a11b3aa7b170b25644ead896489edb9a9a692ca654c0e7bed95ff42
SSDEEP 192:55CjnlRfMf8aOH5bEcKBNkkrgpCmqkkuoBoh9PTYMsvSO+Hy1h/1uKisM68E:5q3MfmH5bEHBNkkrgomq/u5PTYMC+S1Z
TLSH
T15F42B512B3CA536A62B313155EBAF294DB2DD1FE17E5506C744D81A837208280B7F7CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_tk_data\pkgIndex.tcl
Size 376B
SHA256 6127926b94db2992ab450fc6cc2ec3d071f7bbc856656d0ae20cc3fd4036f547
MD5 62a8e4b5aeb35286e3b1d54973139a13
SHA1 1064e7e2765f9aea5d06ebdd932c689a877613d5
SHA512 919e9a1c7d02cc886bb3901fd0d2966df0f5456f4646310d5762cd74c5b78f2b1b542b3be78e22dc9b070ea1bbf401dda7ecba223b1b1851feea028047bcbe8d
TLSH
T1DCE068C84321AB1A4AA26543A894EE4C3FEE90BFD90CC18D301521DCEF12080A9DD8F5
MD5 SHA1 SHA512 TLSH

Submit Download

tk.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_tk_data\tk.tcl
Size 23KB
SHA256 b7fd24177b17f67da2ca671f711309c65cf246be1fd0cf4f1ab8f3ea9ca2c3f1
MD5 7e46d32c3e70dbf17663f57e17d18dfe
SHA1 394dd3cde6a7e41855917060f4388478a0a84668
SHA512 6125e9b6c213e48e4a7a47acc0be3b930ddd9aca2132817f1906a2453e0d0b8292e7b2090bab8712856d12d2cf4d119238f16fae0fb57dd66da4db8fb3d92b0d
SSDEEP 384:Nbyxt+WaB9USY15gSgC3DbTbXLXKr3aIIXyDAbK2LMGgtewT+3oFQRyH5bAy59HU:NbItNe9USZbeXysm7GgteoFQRYMESL
TLSH
T11DB2D5195DC062B3513BC12F53BB2A00D87558FB2B76A84978DC48B93F6483B06FE9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_tkinter.pyd
Size 67KB
SHA256 777c29860ce1afb27ea8fc4afaf9c608ff49e9d19673c766c75c6053db8fb6ca
MD5 e8c5d888b0ed27e68337c65e7f2c9360
SHA1 de4c8be9335cc8ecfb90d99408569fce1c288672
SHA512 bede7796367d7a09d526ade05ea8fc7fea8bc4fd5772cbb87ff688339573e0420760b1fc57c524619beb7563875e915f087a2e7c25772dd8f70c0ecb4d9f4c01
SSDEEP 1536:njkfY54GPbpVwB2lU9oeoVZeZ+JrFIevSwyG5TT/9nmfIZRU/:jU2p1lPLVZeI5FIevSqp9Z2
TLSH
T16C637E9BA768008BEEA3C175C5B3DE13E675B6925A20534F01A4D35A1F337D3A3B9704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\_wmi.pyd
Size 38KB
SHA256 6793bd216b5a329689cde8b1532858d6731707ec5063897f979a81e57077402c
MD5 f94e8c9a440cdac95d2f69a9045d937f
SHA1 95d49b1d987db3a751524712b49bc86ece3bbb86
SHA512 d2ac9607e9a1be542cedb92ca0caf98bdca4447f22b04d09e451a1031ad7d6771406ae29a4b366d2add08bc1bd7519d17bebe2d33cd21bbccbc12589cfe6f03e
SSDEEP 768:q2/EEqrVmjsNuEkc9+utIeLibdyG5TkKrLy2Ip4TTxf1mltPRVYgt:vE9BEfEkc9+utIeLiZyG5TT/9xfIZRWw
TLSH
T158037CC9E6680092EA67CA74C5A6DE52F531B7935B0187CF3265C2990F233D1E739339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\base_library.zip
Size 1.3MB
SHA256 77b1e730f04c544188b891586f1f7744ad8d75d7a333203cd78ba92928452eb1
MD5 955dbc92760a4b78e4b18a97eed03ab6
SHA1 74ae14a997e6b250a0b735cedebacb6162fc5424
SHA512 01e65002dcfd86717aa4b34ea8f33f1de2a959c8b13947f57c987ead45e5a75e852fda1e8e95dc5c595c2415ba1c9686371133f8b8fe9b0b3395664e5a7757dd
SSDEEP 12288:J5b6/uIva80201jwCVRDVoioSYBSziN+djdT6tYzGNcT1Btvi2cPPdxhYVqhTsm9:Il4dZbSeT1Tv5cPPdxhYVqV7Wp7y1
TLSH
T10E551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\psutil\_psutil_windows.pyd
Size 67KB
SHA256 039e4d17d9b8399162ceb7a40177e66a7bac46fcd0f722813670af11eeae5c22
MD5 e39daef5b11d63d7a41d3dc576e3442e
SHA1 e033ccda8e7a7f408a2fdeaf83be2beb9564b125
SHA512 3de2ba4ca303dba68977f1c0ac985e0ce971bc50a59740a3c96eadab88c26c5590830f2194bf79f00c001bf4b044e440a8c193c74c06f3107fceee1787db5250
SSDEEP 1536:xRDML4NHKwQ/mnH0Fl/Xq4XxvoHm9aTH:xekKub4Bim9
TLSH
T13E632885776900F8D92A913D8EB25A37E7B1B0A1133693CF0560C64E0FA3AD76E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\python3.DLL
Size 70KB
SHA256 9b179a9e44badc9c9d327182996040c87be183ad4c9469645280ed3e4a2d7694
MD5 04ba59ed5314652ec779f1389900913e
SHA1 83cc9297bf0aa85ce055710e3a178db4268c0323
SHA512 0cb3090721fac1d25aa0e4b3f9b6028bef80c30011b718dc217791b463085cab224cd058d5b63dc3e67ae1d3a099a444163234d465241df83b97f1385c413e8b
SSDEEP 1536:wotssyKcunV8PzhIey0lyG5TT/9vfIUX:XtssyK8hIey0lpW
TLSH
T15A633BC26B57F8A2D6F665FC78DDD9CD242B02CC57258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\python313.dll
Size 5.8MB
SHA256 c9f98606d0d06f4e8ae75ae385021e58b57c90d4fd325c0313c8c42abe1ebf63
MD5 48edb6a0be2bfee5b83e2c31675511e5
SHA1 43a1c8df434401901a5529cac03a664a5e64be71
SHA512 2b6ea04ef35085355bd9ee077ef533f80481d85a5b7d60c1756d06369313c4c39157018e76e30f4974eabdc6abba81bf6ec7cecc477cdee350acde7796567122
SSDEEP 98304:I8uWXsdqWZobQdaehM91cnivzHDMiENKULAd:puWmqeobQdaepiFULAd
TLSH
T1EA567C12729E51ACD9778078CA038A4BF7B27C413F60534B61E6BB5D2FB33624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\pywin32_system32\pywintypes313.dll
Size 132KB
SHA256 9bb6dece38380abc747dce9ba8b0834a2bec469bc942dbcc8658e30ebdfb59a4
MD5 f7fa93a0bc20b155e9b141b6705870f0
SHA1 72c6bf418a55806e86cf67b3d363a385ae9cfca6
SHA512 3d8b7ae0303020e6fed0066f08eb30ae437541de0918528561e50f923cd42654a6453f59e610f11c4676022552ce09fa63a8fc8b1e13b5a3a8de0378d54c5b2e
SSDEEP 3072:F54SfEA3X4IiyNHpFBiuQdY/r06YrfNaQQDElr4ohgmF+M90X3:j9TH4IiyNH7BodY/rk7NaY4wgs+M90H
TLSH
T19FD34A47374644DAE966E37D8C771E02D3A2B0100711E3CF06A5C2AB6F63BD66D3B646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\select.pyd
Size 32KB
SHA256 01c8fef709b657b17e1db3754b05cb1070ad3e303dd531ef0f5545316df53aa2
MD5 c13138061da04f3fc3cd44c9fd3b9db0
SHA1 a7d03e1b9dc39065f76a3249fefe7355a69a500b
SHA512 04d907ab25d7fd4cde2cadefe8bced515dacf176ef93f72149341773938e0f2342f60076e1e8d8eaf42e0817c6118374b5c7a144ec1d09f4edf55ddfaf83f0bd
SSDEEP 768:WpX5/HfamHzPhIe9G+dyG5TkKrLy2Ip4STxf1mltPRVpgh:SX5//amHzPhIe9GGyG5TT/9KfIZRbI
TLSH
T16CE27CCA6E685087EA63C671C5E2DE42F939B3A38A1186DF31B581D91E277C0E336354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\tcl86t.dll
Size 1.8MB
SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
MD5 fa83a807131f3d4a6070eb884e682ad1
SHA1 226bf1cd0fc289034d9579c95ee0fe4df50cc6b8
SHA512 6e86f3725bb68af581e3e1b917c950f255e0f4348256fc02d8a560159cd225fe28303da2554c205636f2f82b9757072bf0c3460116bd7b09ef0bf01cc46125a2
SSDEEP 49152:D0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGP:YBUqMR7i6x9T+P
TLSH
T1E6859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msgcat-1.6.1.tm

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\tcl8\8.5\msgcat-1.6.1.tm
Size 34KB
SHA256 adca186be560f2236265f538d4cb6df1171bed91192118796988bb9c08a4bc7c
MD5 e102bf017d302c494c1dbd449b040053
SHA1 58b16b222f881271e09f7775c46817bbc4bed81e
SHA512 7001af784de0663bbf634842c12d833e447221a0fef05723373db3281d5bb9545c3c12103413137451730fba6207a1dc318b662aa4da6a72fe6944577c199da2
SSDEEP 768:m3SQ0CzasW/rHPG2yfkZ0Kbh91iQQLnq5MIVYB8mbgijsPIAtw4qvUm:4SQ0CzasWDHPG2yW0kJQ2imXmUij6njG
TLSH
T10EF2D614334741AB36B2526799F9A2A4CE3CE23F10AB959EB89A801C7731F5D43F74D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\tk86t.dll
Size 1.5MB
SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
MD5 0da8eb1421517029c8d986519b0e5c63
SHA1 daa8395b9d691b5dfbdaa1f63256555a14010891
SHA512 f729f812901cc023111989d6e1eaa639d2ed2283bdb852c91abc283dee3d785295d3191f70f2ef535d268d454279a7ddd0339993f06be21b62d43d8ab27d70af
SSDEEP 49152:A76DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezf5:VQchLNqaJvARxr9DrTwylL1y5BEq8JTW
TLSH
T16E755A06B2A0C198C66FA134C91796BAE7F17C05931057DB72A0BE697F73BD2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32gui.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\win32\win32gui.pyd
Size 218KB
SHA256 6c545bd22720a7088c1353e5e554ded4db5db4c1b164689e7d42acf312561aca
MD5 e2f3ff5b57fb56e8db556e860d61959f
SHA1 14fe702037726a5f1dd40ce84926677fbea96515
SHA512 3a8f35c921044697679d5f7f68058ef428688fde232eb807ec8bbbfaafb72d0e7c34fec7bb153b64231914c772990213aad0e3ce6f6aa915dc550e9ab04e838c
SSDEEP 3072:AN35FEzbqwaiV6hPIeS8M1bU0K0JjvALDCG0rxXPFWsEsTjbVN:a35FEPqwDQQX8IekfFWs/TnVN
TLSH
T12524E557B29510A5D9AAE17C895B5E26F17374200320ABCF0630CBBA1F1B7EA793D7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32process.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\win32\win32process.pyd
Size 53KB
SHA256 9d99c96c6d2e15fc52ed9444dc880ebfb358fbcd1f659ddf8af1a233033294ce
MD5 2fd5b0398872e4c24197721330cef5ce
SHA1 87da4ce9ab3efb9c0dec144f1dfe9f6c4f2cd864
SHA512 143a0cbec5a446172e84ef8f285a01ed385b4474a4026399b3b78c7d696c94cd3729ce257eb65387dadcd45974e47f24382ed7e4b568d2fcdf53973d891df73d
SSDEEP 768:EH+WrlHOP/+p/K3TS0BIdbrEKnnud4yY0EFSrS/wgirzI:5i5O3+p/K3lKlrajY0EYrS//irzI
TLSH
T1DE33078B739A50C9C45AD5B9C1375E27E672B8140722A7DF0274C68B1F237E9B53DB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20882\zlib1.dll
Size 142KB
SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
MD5 eb3af30a0981219d851e6506db106bc2
SHA1 fd7b1b01dc01a7f32bd51f9a31bf717f4d55d09c
SHA512 8f55f4a86b747b5570d0f539c95dc1677eeba52bcd01850e8d86998b3415b99c92566ad9ece0e46b50e0e3a7eed6a4fe09604ec295f36f9bebf6e8f407ace468
SSDEEP 3072:0vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCoV:0sVD+RrFgvi7J9
TLSH
T1C8E37D9BA6E228BDC67780B052E78776F932B8214B309DEF5148C7741B12E506B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Users\Admin\AppData\Local\icsys.icn.exe
Size 206KB
SHA256 cfbea67f9693e386318264c73d0ae456a6ed318d604e539af1edf75afecaf21c
MD5 9d4c4dfec2db180b406f6f11c1206ed6
SHA1 5092bc67b15af1e162aba3271c84e8f57f0bd95f
SHA512 bb05a4382308c552c1b13a90f0d131055ca91fc85c344383afe607fe752b18f914d43c13fbdc4b431d9673586af29927b98263805afd2f13333afdfc486f5ff0
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unT:5vEN2U+T6i5LirrllHy4HUcMQY6I
TLSH
T18124FA27FD04702FE96389F1182A66E7BA212E350B919C5B23D0AB5538B1513F6F532F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mrsys.exe

Path C:\Users\Admin\AppData\Roaming\mrsys.exe
Size 206KB
SHA256 03c6620f787aae62e78eb4e5d572efd5aeae8057264bc09a92ab714cc45a22d2
MD5 4f816fc5813e59ccaef1bd579076d1f8
SHA1 898bec280108aad758847502f4a3f9ed2dc67800
SHA512 81dbc4c6ee3dc69a432541733f2539aebee64970a95d8357a970b1eaefa48550fea6b6a0e8e6e88c4c9c8970df038777ce8f5f006c1336b0abb6a95af8a03a7d
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6un8:5vEN2U+T6i5LirrllHy4HUcMQY63
TLSH
T1D824E71BEA04711ED4A7C6F05426B2A7B6223E261BE2AC4F23D19F853572543B1F532F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\System\explorer.exe
Size 206KB
SHA256 dd75246b6ca57df45d6fa0694b1bc45778a1b1dae52a13df3f0911b55cb72946
MD5 e0f5622eeea65fffec741782d833b03e
SHA1 15affa40d5c0f1bcb6c99cddad8c11762aa71584
SHA512 aa23f782711cca8b6522a6c4aa1eab17762c7688e10a51659908aa524cad51179b7e4c57d0b2deba98c719c69d26794cd19f8f4c8ccd026a3568325408394170
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unI:5vEN2U+T6i5LirrllHy4HUcMQY6L
TLSH
T1E424F96FFE04712EE853C6F06412A6AAFA315E251F91EC4F66909B463071623B1F532F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\System\spoolsv.exe
Size 206KB
SHA256 dfc9658a78b83298df6ad88ff85b8f1b430ae9c1e9dc752cbc335657f1996c17
MD5 a3821400fb0809ee0760a796c50b9876
SHA1 dbee514cb51b8fd473b8c9a64930bfef439c746d
SHA512 8ba29c3ad5d50a0bd6ed21b215f013820475aabec840125c8b6cae54ff29ef74adbdc0095dd8011e608b96653c52173b8737e3a5c01768afdcfe94dd70fffea4
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unX:5vEN2U+T6i5LirrllHy4HUcMQY6o
TLSH
T1AB24E92BFD10302FE89785F0686AA596FA252D321FD0AC0B6795AF4934B4643B1F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path \??\c:\windows\system\svchost.exe
Size 206KB
SHA256 1b9bc8f91365cfbac76145f6626939ca908a4b455dc6b178951657c567425600
MD5 f9e4e2037e0be3ae9767b1a8c928916e
SHA1 02f0117b353ff03dfb2f41f78652c505311aafcc
SHA512 2ed7c0d4fa457ebc1a324f143fdc405969b3e3d0b9206659157858a568cf4b2097ce911f1f72b7d641f8c0ab1ef72a41af1025b128a918d6049bb6ae0a2df4f8
SSDEEP 3072:5vEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6ung:5vEN2U+T6i5LirrllHy4HUcMQY6v
TLSH
T16724E92FFA44711ED8629AF0586671ABBA311E221B91AC4F67C1AF853471613F0F532F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-1039-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2488-1065-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2808-1038-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3036-1058-0x00007FFAD1180000-0x00007FFAD11A9000-memory.dmp

Download

memory/4248-1035-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4376-1041-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4376-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/5568-1067-0x0000000000400000-0x0000000000440000-memory.dmp

Download