8687a42c7f89909cd142a08fe35203421c3e7f6a44bedf111a92e82a62d947d9

Resubmissions

20/06/2026, 11:32

260620-nnqfbaew5m9

20/06/2026, 11:18

260620-nelqrsew2m7

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
899s
max time network
487s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FOX OS PAID (BEST TWEAKS)/Disable Event Trace Sessions by CatGamerOP/Disable ETS by CatGamerOP.exe
Size 8.5MB
Sample260620-nnqfbaew5m
SHA256 8687a42c7f89909cd142a08fe35203421c3e7f6a44bedf111a92e82a62d947d9
MD5 8539a43543946460ecc638c05cbe3c80
SHA1 0781ca4016be802132cb8943646587546528cb36
SHA512 e052de1e14a9e7f3d36b02a62fd7cc3d7ffe568bb46cd2593cb16416fddc96f4c648a1cc5d1586419f7933a940f40b27ce3de72dfc506db0490ffb92523e6ed1
SSDEEP 196608:1sNTwhL8exA1HeT39Iig9SvKub75bcjWgbPVk0ax8ozfl5kjKB8+:PL41+TtIibvB5IjWqPfaxrz4
TLSH
T1259633B162A71DE5DAB3433445A2844ADAE1FC862771C6C743B43E8E1F372ED4EB9610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 11 IoCs

pid	Process
1504	Disable ETS by CatGamerOP.exe
1504	Disable ETS by CatGamerOP.exe
1504	Disable ETS by CatGamerOP.exe
1504	Disable ETS by CatGamerOP.exe
1504	Disable ETS by CatGamerOP.exe
1504	Disable ETS by CatGamerOP.exe
1504	Disable ETS by CatGamerOP.exe
1504	Disable ETS by CatGamerOP.exe
1504	Disable ETS by CatGamerOP.exe
1504	Disable ETS by CatGamerOP.exe
1504	Disable ETS by CatGamerOP.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1504	4956	Disable ETS by CatGamerOP.exe	89
PID 1504 wrote to memory of 6016	1504	Disable ETS by CatGamerOP.exe	90
PID 1504 wrote to memory of 5620	1504	Disable ETS by CatGamerOP.exe	92
PID 1504 wrote to memory of 1872	1504	Disable ETS by CatGamerOP.exe	94
PID 1504 wrote to memory of 6064	1504	Disable ETS by CatGamerOP.exe	96
PID 1504 wrote to memory of 2652	1504	Disable ETS by CatGamerOP.exe	98
PID 1504 wrote to memory of 3416	1504	Disable ETS by CatGamerOP.exe	100
PID 1504 wrote to memory of 4560	1504	Disable ETS by CatGamerOP.exe	102
PID 1504 wrote to memory of 4564	1504	Disable ETS by CatGamerOP.exe	104
PID 1504 wrote to memory of 1264	1504	Disable ETS by CatGamerOP.exe	106
PID 1504 wrote to memory of 2560	1504	Disable ETS by CatGamerOP.exe	108
PID 1504 wrote to memory of 4364	1504	Disable ETS by CatGamerOP.exe	110
PID 1504 wrote to memory of 236	1504	Disable ETS by CatGamerOP.exe	112
PID 1504 wrote to memory of 3260	1504	Disable ETS by CatGamerOP.exe	114
PID 1504 wrote to memory of 4436	1504	Disable ETS by CatGamerOP.exe	116
PID 1504 wrote to memory of 5424	1504	Disable ETS by CatGamerOP.exe	118
PID 1504 wrote to memory of 5516	1504	Disable ETS by CatGamerOP.exe	120
PID 1504 wrote to memory of 3408	1504	Disable ETS by CatGamerOP.exe	122
PID 1504 wrote to memory of 4696	1504	Disable ETS by CatGamerOP.exe	124
PID 1504 wrote to memory of 3900	1504	Disable ETS by CatGamerOP.exe	126
PID 1504 wrote to memory of 1100	1504	Disable ETS by CatGamerOP.exe	128
PID 1504 wrote to memory of 3612	1504	Disable ETS by CatGamerOP.exe	130
PID 1504 wrote to memory of 3968	1504	Disable ETS by CatGamerOP.exe	132
PID 1504 wrote to memory of 1188	1504	Disable ETS by CatGamerOP.exe	134
PID 1504 wrote to memory of 4996	1504	Disable ETS by CatGamerOP.exe	136
PID 1504 wrote to memory of 3316	1504	Disable ETS by CatGamerOP.exe	138
PID 1504 wrote to memory of 5400	1504	Disable ETS by CatGamerOP.exe	140
PID 1504 wrote to memory of 5324	1504	Disable ETS by CatGamerOP.exe	142
PID 1504 wrote to memory of 4848	1504	Disable ETS by CatGamerOP.exe	144
PID 1504 wrote to memory of 2584	1504	Disable ETS by CatGamerOP.exe	146
PID 1504 wrote to memory of 5412	1504	Disable ETS by CatGamerOP.exe	148
PID 1504 wrote to memory of 4400	1504	Disable ETS by CatGamerOP.exe	150
PID 1504 wrote to memory of 2052	1504	Disable ETS by CatGamerOP.exe	152
PID 1504 wrote to memory of 1388	1504	Disable ETS by CatGamerOP.exe	154
PID 1504 wrote to memory of 4988	1504	Disable ETS by CatGamerOP.exe	156
PID 1504 wrote to memory of 5232	1504	Disable ETS by CatGamerOP.exe	158
PID 1504 wrote to memory of 2752	1504	Disable ETS by CatGamerOP.exe	160
PID 1504 wrote to memory of 1460	1504	Disable ETS by CatGamerOP.exe	162
PID 1504 wrote to memory of 5432	1504	Disable ETS by CatGamerOP.exe	164
PID 1504 wrote to memory of 3340	1504	Disable ETS by CatGamerOP.exe	166
PID 1504 wrote to memory of 3492	1504	Disable ETS by CatGamerOP.exe	168
PID 1504 wrote to memory of 1268	1504	Disable ETS by CatGamerOP.exe	170
PID 1504 wrote to memory of 1544	1504	Disable ETS by CatGamerOP.exe	172
PID 1504 wrote to memory of 480	1504	Disable ETS by CatGamerOP.exe	174
PID 1504 wrote to memory of 3280	1504	Disable ETS by CatGamerOP.exe	176
PID 1504 wrote to memory of 2720	1504	Disable ETS by CatGamerOP.exe	178
PID 1504 wrote to memory of 2432	1504	Disable ETS by CatGamerOP.exe	180
PID 1504 wrote to memory of 1220	1504	Disable ETS by CatGamerOP.exe	182

C:\Users\Admin\AppData\Local\Temp\FOX OS PAID (BEST TWEAKS)\Disable Event Trace Sessions by CatGamerOP\Disable ETS by CatGamerOP.exe
"C:\Users\Admin\AppData\Local\Temp\FOX OS PAID (BEST TWEAKS)\Disable Event Trace Sessions by CatGamerOP\Disable ETS by CatGamerOP.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Users\Admin\AppData\Local\Temp\FOX OS PAID (BEST TWEAKS)\Disable Event Trace Sessions by CatGamerOP\Disable ETS by CatGamerOP.exe
  "C:\Users\Admin\AppData\Local\Temp\FOX OS PAID (BEST TWEAKS)\Disable Event Trace Sessions by CatGamerOP\Disable ETS by CatGamerOP.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SYSTEM32\logman.exe
    logman stop 8696EAC4-1288-4288-A4EE-49EE431B0AD9 -ets
    3⤵
    PID:6016
- - C:\Windows\SYSTEM32\logman.exe
    logman stop 1DSListener -ets
    3⤵
    PID:5620
- - C:\Windows\SYSTEM32\logman.exe
    logman stop AppModel -ets
    3⤵
    PID:1872
- - C:\Windows\SYSTEM32\logman.exe
    logman stop AutoLogger-Diagtrack-Listener -ets
    3⤵
    PID:6064
- - C:\Windows\SYSTEM32\logman.exe
    logman stop "Circular Kernel Context Logger" -ets
    3⤵
    PID:2652
- - C:\Windows\SYSTEM32\logman.exe
    logman stop CimFSUnionFS-Filter -ets
    3⤵
    PID:3416
- - C:\Windows\SYSTEM32\logman.exe
    logman stop DefenderApiLogger -ets
    3⤵
    PID:4560
- - C:\Windows\SYSTEM32\logman.exe
    logman stop DefenderAuditLogger -ets
    3⤵
    PID:4564
- - C:\Windows\SYSTEM32\logman.exe
    logman stop DiagLog -ets
    3⤵
    PID:1264
- - C:\Windows\SYSTEM32\logman.exe
    logman stop Diagtrack-Listener -ets
    3⤵
    PID:2560
- - C:\Windows\SYSTEM32\logman.exe
    logman stop iclsClient -ets
    3⤵
    PID:4364
- - C:\Windows\SYSTEM32\logman.exe
    logman stop iclsProxy -ets
    3⤵
    PID:236
- - C:\Windows\SYSTEM32\logman.exe
    logman stop FaceRecoTel -ets
    3⤵
    PID:3260
- - C:\Windows\SYSTEM32\logman.exe
    logman stop FaceUnlock -ets
    3⤵
    PID:4436
- - C:\Windows\SYSTEM32\logman.exe
    logman stop FilterMgr-Logger -ets
    3⤵
    PID:5424
- - C:\Windows\SYSTEM32\logman.exe
    logman stop LwtNetLog -ets
    3⤵
    PID:5516
- - C:\Windows\SYSTEM32\logman.exe
    logman stop Microsoft-Windows-Rdp-Graphics-RdpIdd-Trace -ets
    3⤵
    PID:3408
- - C:\Windows\SYSTEM32\logman.exe
    logman stop IntelRST -ets
    3⤵
    PID:4696
- - C:\Windows\SYSTEM32\logman.exe
    logman stop NetCfgTrace -ets
    3⤵
    PID:3900
- - C:\Windows\SYSTEM32\logman.exe
    logman stop NOCAT -ets
    3⤵
    PID:1100
- - C:\Windows\SYSTEM32\logman.exe
    logman stop NtfsLog -ets
    3⤵
    PID:3612
- - C:\Windows\SYSTEM32\logman.exe
    logman stop RadioMgr -ets
    3⤵
    PID:3968
- - C:\Windows\SYSTEM32\logman.exe
    logman stop ReFSLog -ets
    3⤵
    PID:1188
- - C:\Windows\SYSTEM32\logman.exe
    logman stop PlatformLicenseManagerService -ets
    3⤵
    PID:4996
- - C:\Windows\SYSTEM32\logman.exe
    logman stop ScreenOnPowerStudyTraceSession -ets
    3⤵
    PID:3316
- - C:\Windows\SYSTEM32\logman.exe
    logman stop TileStore -ets
    3⤵
    PID:5400
- - C:\Windows\SYSTEM32\logman.exe
    logman stop UserNotPresentTraceSession -ets
    3⤵
    PID:5324
- - C:\Windows\SYSTEM32\logman.exe
    logman stop WdiContextLog -ets
    3⤵
    PID:4848
- - C:\Windows\SYSTEM32\logman.exe
    logman stop WiFiSession -ets
    3⤵
    PID:2584
- - C:\Windows\SYSTEM32\logman.exe
    logman stop WindowsUpdate_trace_log -ets
    3⤵
    PID:5412
- - C:\Windows\SYSTEM32\logman.exe
    logman stop NVIDIA-NVTOPPS-NOCAT -ets
    3⤵
    PID:4400
- - C:\Windows\SYSTEM32\logman.exe
    logman stop NVIDIA-NVTOPPS-FILTER -ets
    3⤵
    PID:2052
- - C:\Windows\SYSTEM32\logman.exe
    logman stop SleepStudyTraceSession -ets
    3⤵
    PID:1388
- - C:\Windows\SYSTEM32\logman.exe
    logman stop Admin_PS_Provider -ets
    3⤵
    PID:4988
- - C:\Windows\SYSTEM32\logman.exe
    logman stop UpdateSessionOrchestration -ets
    3⤵
    PID:5232
- - C:\Windows\SYSTEM32\logman.exe
    logman stop MoUxCoreWorker -ets
    3⤵
    PID:2752
- - C:\Windows\SYSTEM32\logman.exe
    logman stop WiFiDriverIHVSession -ets
    3⤵
    PID:1460
- - C:\Windows\SYSTEM32\logman.exe
    logman stop UBPM -ets
    3⤵
    PID:5432
- - C:\Windows\SYSTEM32\logman.exe
    logman stop "Steam Event Tracing" -ets
    3⤵
    PID:3340
- - C:\Windows\SYSTEM32\logman.exe
    logman stop MpWppCoreTracing-20250422-153720-00000003-100000000 -ets
    3⤵
    PID:3492
- - C:\Windows\SYSTEM32\logman.exe
    logman stop SHS-04222025-153736-7-1ff -ets
    3⤵
    PID:1268
- - C:\Windows\SYSTEM32\logman.exe
    logman stop dfa2c640-651d-488d-a479-2fd7a7ca6e29 -ets
    3⤵
    PID:1544
- - C:\Windows\SYSTEM32\logman.exe
    logman stop MpWppTracing-20250422-133720-00000003-fffffffeffffffff -ets
    3⤵
    PID:480
- - C:\Windows\SYSTEM32\logman.exe
    logman stop TraceEventSession -ets
    3⤵
    PID:3280
- - C:\Windows\SYSTEM32\logman.exe
    logman stop CldFltLog -ets
    3⤵
    PID:2720
- - C:\Windows\SYSTEM32\logman.exe
    logman stop MSDTC_TRACE_SESSION -ets
    3⤵
    PID:2432
- - C:\Windows\SYSTEM32\logman.exe
    logman stop Terminal-Services-LSM-ApplicationLag-5456 -ets
    3⤵
    PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1136

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49562\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49562\VCRUNTIME140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
TLSH
T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49562\_bz2.pyd
Size 82KB
SHA256 706d4a0c26dd454538926cbb2ff6c64257c3d9bd48c956f7cabd6def36ffd13e
MD5 59d60a559c23202beb622021af29e8a9
SHA1 a405f23916833f1b882f37bdbba2dd799f93ea32
SHA512 2f60e79603cf456b2a14b8254cec75ce8be0a28d55a874d4fb23d92d63bbe781ed823ab0f4d13a23dc60c4df505cbf1dbe1a0a2049b02e4bdec8d374898002b1
SSDEEP 1536:RS7z7Sj2u5in5IVfC83zYxzbdK87kW1IACVw7SyrxX:I7z+jum3MJdN7kW1IACVwX
TLSH
T1D0838C93A76165B5F46B82BA99C10323E730FD550350939FF384831B2F22F92BD6536A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49562\_ctypes.pyd
Size 122KB
SHA256 f20dfa748b878751ea1c4fe77a230d65212720652b99c4e5577bce461bbd9089
MD5 2a834c3738742d45c0a06d40221cc588
SHA1 606705a593631d6767467fb38f9300d7cd04ab3e
SHA512 924235a506ce4d635fa7c2b34e5d8e77eff73f963e58e29c6ef89db157bf7bab587678bb2120d09da70594926d82d87dbaa5d247e861e331cf591d45ea19a117
SSDEEP 3072:DGR936Xz4mHFK0K+bRFOoP+Szlf/EZZBKYyucV6rOoZIALPEA:qQHLK+bvvPNhf/Ei6CoX
TLSH
T1B3C36B07335400AAEBA35178C5B36F07DBB1B45B4B2093CF02A4C69A2F637936D6E756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49562\_lzma.pyd
Size 155KB
SHA256 6216173194b29875e84963cd4dc4752f7ca9493f5b1fd7e4130ca0e411c8ac6a
MD5 b71dbe0f137ffbda6c3a89d5bcbf1017
SHA1 a2e2bdc40fdb83cc625c5b5e8a336ca3f0c29c5f
SHA512 9a5c7b1e25d8e1b5738f01aedfd468c1837f1ac8dd4a5b1d24ce86dcae0db1c5b20f2ff4280960bc523aee70b71db54fd515047cdaf10d21a8bec3ebd6663358
SSDEEP 3072:Fik7me1FFD+znfF9mNo+Mu6tmxzE41IAZ1Ak:FikSiUNYO+J1E4b
TLSH
T1B3F34A92A394F4D5F7628C78D6624F17E7F678090310829A02CCD36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI49562\base_library.zip
Size 1.3MB
SHA256 6fb7aac56fb8ce78de5a2a728d8f9cebb937bcd1e5219829cb163aaa932c52b8
MD5 2d76a7d064d13bf1a33b90a715bfc001
SHA1 003e07337a65eb1c2b0da9acb14e4f030161cdff
SHA512 b704953d45d97c02d6edf17d15ec1de68c28dd799368840796259b289f2e7a761d94e0776a7ad274ba422cac2a61393a7d777259d464dbb9d52b84dd9c2d400a
SSDEEP 12288:RVWjhaYcG7qYndsFxSgTttcY+bk1dVOmgR1HKPbdmcHtzJYTq+zYgEkA1qJuAr4:XW9aYc1M6TttcY+KVHChKPbdmctJm4
TLSH
T15B55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49562\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyarmor_runtime.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49562\pyarmor_runtime_000000\pyarmor_runtime.pyd
Size 624KB
SHA256 1a6c5318a94c24330e8b7eb02032a3cf611507a3d5a30684b8fee84be29b176d
MD5 e26521fa4d1d3c3c5c55c7557d748f72
SHA1 50d81b419cda25afe35c9eafe636327a9ef700b7
SHA512 c3c8f482094d20bf17c15a434ea04d2394fc207672a1dcad750a9d08f6ab8a2a5fa8f1e020bcd348095dc4ab75a2019da0a55861f5ce5f174204522344577ac9
SSDEEP 12288:Jf9xUCjtYwPDcctjdcg7fUoPwTAY7nEPVVB:JlCjctjdcg7fUoPwTAY7n+v
TLSH
T18DD4294BE1FA15D0E6B6E17C078BF2337C3ABA588160775B355CD3A127D4A5222E1F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49562\python312.dll
Size 6.7MB
SHA256 789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d
MD5 550288a078dffc3430c08da888e70810
SHA1 01b1d31f37fb3fd81d893cc5e4a258e976f5884f
SHA512 7244432fc3716f7ef27630d4e8fbc8180a2542aa97a01d44dca260ab43966dd8ac98b6023400b0478a4809aace1a128f1f4d6e544f2e591a5b436fd4c8a9d723
SSDEEP 49152:mz0oCxOqKWneF3o1VLCClOTNRpaOviXEYWyb3eOYTvuFsx/iac84YNFXiTlv5WF4:mooCcqKLHX+az2Ro8Kv7HDMiEB/
TLSH
T193665A127298C0B9D967A1B4CD13C28FE7B17C51BF10530B31AAB36E2F737A2465A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49562\pywin32_system32\pywintypes312.dll
Size 133KB
SHA256 2d1d60b996d1d5c56c24313d97e0fcda41a8bd6bf0299f6ea4eb4a1e25d490b7
MD5 da0e290ba30fe8cc1a44eeefcf090820
SHA1 d38fccd7d6f54aa73bd21f168289d7dce1a9d192
SHA512 bc031d61e5772c60cbac282d05f76d81af1aa2a29a8602c2efa05fc0ce1079390999336237560b408e6539a77c732f5066c1590b7feaedb24baa9371783f2a8f
SSDEEP 3072:ZaklTxm5xclSlX8fY/r06Yr0UWm63ELUAXkXrT4:wklTxm5xAhY/rkwNm2E4AXk
TLSH
T19ED33A47374644EBE976E3BD8C671A02D3A2B0140711E3CF06A1C29A6F63BD56D3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49562\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32gui.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49562\win32\win32gui.pyd
Size 216KB
SHA256 03f51355abfd83db4c61d38be6fa03c59d360b6ffbd76d869f7a4f7f1c0b724e
MD5 031d88e7ed78b4eed0e2da16bcec0acb
SHA1 d42861deafb1eeb0c44209a90c04911a336374b0
SHA512 a0b201ec097192dcf97487c5bd2253b6824d1705c54b9964155e2b8cfcd920e968f9d22825cffe2633b53632cfcfbe2cc5592e15199fe733551b0dac1beb01c2
SSDEEP 6144:4poPkYjQG6GdBbOH82nmely0DDp7LEGb:4mkY0IdBbOHvl57LLb
TLSH
T12924E497B29550A6D96A91BC945B5E16F1B374300320ABCF0630CBBA1F1B7EA753C7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1504-83-0x00000000648C0000-0x000000006496B000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads