810c35575508511bc85251e275c72a5e470039bd2de23d1662ec3db6c550a6fd

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ping Pong.exe
Size 29.8MB
Sample260625-etasdahs3y
SHA256 810c35575508511bc85251e275c72a5e470039bd2de23d1662ec3db6c550a6fd
MD5 214960dafef5eaf1ea2e48e5bbed123f
SHA1 dc726d484218f76b1aa4c79c3047d9c8905cb34a
SHA512 58f725046d67b0d4b87d014c989cb474073b5008b6e6389c9d2688d27c400e53a3c57797c326e1bee3555018b26d9955cba4abb37d0bf8bb31d03b676e4af3fe
SSDEEP 786432:bii81JY7+HQH3+sqVtcQT1CD6n/1J0E/9qJpEP1wtQdn:+iyHI3+sacb6dh/9mEqtQd
TLSH
T16267330890A184ABF9E7D67EC252DC01B7B7D6527FA2D4CF5BC811500D27AA0573A3BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 56 IoCs

pid	Process
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe
6880	Ping Pong.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4564	Ping Pong.exe
6880	Ping Pong.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Ping Pong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Ping Pong.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Ping Pong.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Ping Pong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Ping Pong.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Ping Pong.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6880	Ping Pong.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6880	Ping Pong.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 6880	4564	Ping Pong.exe	89

C:\Users\Admin\AppData\Local\Temp\Ping Pong.exe
"C:\Users\Admin\AppData\Local\Temp\Ping Pong.exe"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\Ping Pong.exe
  "C:\Users\Admin\AppData\Local\Temp\Ping Pong.exe"
  2⤵
  - Loads dropped DLL
  - System Network Configuration Discovery: Internet Connection Discovery
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:6880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_bz2.pyd
Size 84KB
SHA256 b3dd7cea6d03342252834cebcc814af37d850b86d0627fa22b7f6990882f2f8b
MD5 77294e590d14a22d98862c141e7ea4ae
SHA1 88a64817b0699025fcb1dda533355a0b30bd92bf
SHA512 3dac79115a510fd09d384829ff1b45864c2bd20db34459c5ac84ccb65f2befe5d59e13cc232fa23c77232421886a8eefa8d6b5986199e32d2953fee92dad0abd
SSDEEP 1536:HdsvXm8z7+Cnqncm4WlTtdKSzBdIM8vOBs8iMdIsLVuyEJ7Q9bfIgHX:9svXm8zaYqRptX7IvvOC8hdIsLVyY
TLSH
T1B6837D86F36542B6F99BD1F886800793FB30BB950750A3AFF148C2992F13B916E5C219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_ctypes.pyd
Size 130KB
SHA256 dfa65498c77e71f038883337d2b5ffd92508489e79e6ee5e96ddec4ecf2a7fa1
MD5 0ac143334e94105facaddc5fb20fc691
SHA1 28cf13be0a0eb84f48c919e68f78852aa4856853
SHA512 00b1a76760b33f054a785be9e4818879121cf5cb60b716d19f2c22c8c58075eea32e626a0962385b18babfaf5d5e33244c09c2e481f99a93577cfeb1647a22e7
SSDEEP 3072:au1mymWLaxMd/w1KVMSf/Fa4IP0JrsFXI/1cswRIsyPyW4IiFx:ac4WLEMWmRf/FaFP2rsFy0zx
TLSH
T161D37D0B775800AAEAA79178C173AF47EBB1B453171187CF02A4C69A2F637D25E3E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_hashlib.pyd
Size 67KB
SHA256 1a3010b06c2fcd625dece3dd0883ca060e98b94adc062b06cb1a671cfc3b5caf
MD5 7573b8a4d0d7831380d7c12e7fbf0160
SHA1 769e7bb2af17942ee4ff51f077333ee1cb4c05ab
SHA512 d730a674cb1585b5adef712acbd2cf212f40824c8c516e958988cbaaae823422cbe5279da180a29a30457cf87a7abac45e24954eb51094a93b5bbf3d2bcff2dc
SSDEEP 1536:1qXn1xAu1lEAXfXQfcV5TaPutFCAVIsvIByEJ7Q98fIW44DKrd:W1l1uAofcyPutFCAVIsvI4W4Iqd
TLSH
T136637C91AA884092D96382B6C4E34F83F975F352571197CFA2A8C0CE2F237C39776756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_lzma.pyd
Size 155KB
SHA256 f20be6a9fee8fb5d53170c4bc24a39b48d3c0ccbe8e2000e60ff7d65b77c6ea1
MD5 a0e27c2f376dc80dfc3f884963a0f416
SHA1 f2738a7e6dc65cd9b915a33af354d2f04b768712
SHA512 6e0c50e52e48b29098fa3b7614f190ecc84ab12ed3b376e7e7148f84eceb3101b9ea6972f100b5478059f62d90aded0dff8522440728d0c0904d8c70457f734e
SSDEEP 3072:xqZ/boPLmhrKifqGDRJUs0znfB9mNoTvm28fgS+dIs01xMW4Iiy:xeTgLhyvUsq5YOTCfd+E9
TLSH
T178F35C86B794F0D5F7728C38D6628F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_queue.pyd
Size 34KB
SHA256 1e349a13913370369059a4ae5951157112b5eba53ed4389c18ffc5e00af1a037
MD5 922104c7bd756944703d7b93fe61bd99
SHA1 72e672f312d58b2c241fd08e4493add4b5206ba8
SHA512 8cb948d05a679292ca3aac6df32add50ca59af14e981aac0e12dbd5ccfe9cd2d303bc2eb093522fc0ea86c761727f56e8c400d9b28bd8f026230c8ad24d2aa56
SSDEEP 768:Y+Md/6rp7gVh6RIs9UH3ZyEFqU+Y7N2Ip4+oTxf1mltPRVDg+:Sip7gVIRIs9UpyEJ7Q9+UfIZR1v
TLSH
T1C5F26DCAAA684487E963CA70C1E3DE92F535F7D3961186EF2065C2CE1E173C1E369319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_socket.pyd
Size 84KB
SHA256 127a39d2198f17dd9b573904fe7e4040c7c8718753e6c4edee2ff6c35f487fac
MD5 c19dbee6c084ba12b0a7baa8ea3f8b50
SHA1 9cd0017fbeb1bbc2be40d89006fb73d144a49401
SHA512 5231af5ba642adcda980187744c448400d58f1179ab98974e9f465f8d7de64375635963d67e52fedd0b0900e0682eb3a9d19c93254a9dff2ff4153b07913a1d0
SSDEEP 1536:iVl/fxzeola7SVitdyJwoQlyJ+9+nzCK3Y4KxtS4DTDgRIsywQyEJ7Q9vfIU82c2:iVRdeoo7YoyJwoQlyJs+nzCgtKxB8RIs
TLSH
T132835A01A66050FAEBA3D071C2639E63FB74B5C11394A35F1066C65A1F333C2EF7AA95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_ssl.pyd
Size 177KB
SHA256 faf716d309349dbd54efd7fb402bd42ed21a537614ac0da89ed92ba307ecbf15
MD5 25da0255096a1b094ccba672a6b1d6dd
SHA1 2904e90fb039f7efa5be3aac3dd6c074647baea9
SHA512 69601cdfdfe07bd9131922a7a693ef2bcbc3a589dc68c455d12d4bfbffe173d61de3237107624144aa07c230136916c189a9c7de0e6879b30f085219ab1ea2dc
SSDEEP 3072:4ifuOjwYdI1bnMlfU6CPnzsvyII7IM/cbPuC/JWdIsL7PW4I9Q:4i20wYdknqU6CPwvySgd
TLSH
T1C7047C47B5945AF7E813E4F9C2234903EBB0F145321247DE48D6D64A0F07B4AAE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\_wmi.pyd
Size 38KB
SHA256 3be5e14e9a9dc49f099209dee98b9cb5e31ade3b0deab52277026bb14df5bdb6
MD5 b21b5ac59bc63da2f59feaa70de04f07
SHA1 5d5b0788b9bb91b8ea0a0ca6dc97219a1892cd0c
SHA512 133d4070481e1dc359893a040da88c1438f7c1c90522178c437c4244f549ece0fdd6ccae0d221637f002c1ba638b2ef79e6ba51bbad59d0d0b667b2cc98af286
SSDEEP 768:12/EEqrVmjsluFkc9+udIsLiJZyEFqU+Y7N2Ip4LwTxf1mltPRVygR:QE9BErFkc9+udIsLivyEJ7Q94fIZR8c
TLSH
T199038DC9E6680092EA67CA70C1A6CE53F575F7935712C38F326582990F233D1E739329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\base_library.zip
Size 1.3MB
SHA256 f5612b0b99270cede2a6e70eefddd3622c88bdeb48444b76162edf7c8182f894
MD5 0eee954a9340b70ed9053a1e617c6e06
SHA1 d387c7cefd41c0bf314e3bf35bf9958c47e15adf
SHA512 b2f9f0ed13dac23ece591677e76b62198440c4fd27f2b45eb2a7dd4f0adfc131ec006bb528570b81384803f9ed5af3b4e0ddfae96ccf4e7f90bc03a8f0b5c51d
SSDEEP 12288:OL+DYtYzGNcT1bMW7Wpn6VkdjdT4nD+EuIva80201jwCVRDVoioSYBhwtxqhTiya:vSeT1bt7WpwkdZ4lhOqT5cPPdxhYC
TLSH
T186551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pyexpat.pyd
Size 201KB
SHA256 719dc29fee125f0d5026319da9a3001c130c84419db7ef7c5473fb496d56cfc2
MD5 a877f83ec14b229921c9103c18be5fa7
SHA1 a63db675471ddac6a73eb9f161c6277f249c8351
SHA512 d6a663344fc7e6c719a094bb8e6774f0a0c9befba7c1af5e685a2eb86982f309c10e36ee0990b914a3459ffeff963464fced807b1e4c4cd5328750fe396d7d9d
SSDEEP 3072:j+hkhnGnW2mlktH8pEpe24Rd2atrIWkXXxqmqx+MNoJQaiJ+B/tN5rm/tN5MtN5/:LhGnPml0H8epe2TatrIWkx/dioPmevdj
TLSH
T1F0145C8BB2A5C0A7D8538038D6D78A17DAB1F86503509BDF22C4EB7D9F2B7413B68315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pygame\SDL2.dll
Size 2.4MB
SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
MD5 83c5ff24eae3b9038d74ad91dc884e32
SHA1 81bf9f8109d73604768bf5310f1f70af62b72e43
SHA512 38ff01891ad5093d0e4f222c5ab703a540514271bf3b94fb65f910193262af722adb9d4f4d2bd6a54c090a7d631d8c98497b7d78bd21359fdea756ff3ac63689
SSDEEP 49152:7Vj3jF2sAlo/43FCPLQ+Ebh8NsB+f94OKLvci5R77CuiY:RrjFiOmC/65TowxCui
TLSH
T1B9C52A0AB3F6179CF6F78E749676A7225832FC298910DAAE2150953D0C31F908975F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pygame\base.cp313-win_amd64.pyd
Size 30KB
SHA256 66d997da2dd61b2f20cb042bcdf4e50ce9e76af8cfa23ba0130aafe25ac407ca
MD5 96cf098621fe4974a8df174cbc9f22d2
SHA1 fbe226550e6f75c09bc479c9e69fa1cb45f6a97b
SHA512 e529b34d07dad82e137d1284f544dec091a49c7711417fa6f4e86ce21f2b30fbc953536ec63b77d0ae4a270a2c396babda1074e4b1ab58a80a88b27af457000f
SSDEEP 768:C555sk0CNWbKH9+xHsn1Nxb3ktmzKULOc05:65skBdGHYfzZLOR
TLSH
T1C6E22A49276304A6EAA1517AC4232E6AC5F2B2610753D3CF43B4C7671F27AC9B73E742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bufferproxy.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pygame\bufferproxy.cp313-win_amd64.pyd
Size 18KB
SHA256 1dfb23e182b9e115a17e162ac97f29e4b71a04b4291f863db9488bca04aec533
MD5 6364a8006e1339fecec64621dc629ff5
SHA1 772d8ed9851b9226c3e209c2140ceb7b8c79633c
SHA512 5e06d2809195d6c75dce5271610e3b0e893a17d280da292dc55d127b48ed52e732f3dec946229a01fd69dc9d06d2eb9ae7f447f7adb8b5f9aaad8d1c87398900
SSDEEP 384:2HW8LbssaCbJCfhLCep5FzqcNUNinfvsvyGncMb:jpLddj4IE9
TLSH
T16C821B0E7B905DEAD1664575C8639F4AD2B2B26A071193CF43B4D39F2F636832A3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

color.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pygame\color.cp313-win_amd64.pyd
Size 35KB
SHA256 293fafd79cc23feac8cfc270df306ad7285d192331b9b9436b6631024cea35d5
MD5 ea663f541015ff7d16028237fee12bb6
SHA1 8f0fbec735361dad6e53558f9bbd961be77f7d08
SHA512 450b3e26c85684f9f39ce00045dc1f992a0547571f281637a800091a202e8b1975c081450b241694d3d1d614f173fba35657372f3df180638b5d7bedd578569e
SSDEEP 384:/29VX93L6MLUdyxB+96FWjz9LRS2O8HSatvfb4tJyU+oais8zU1kj5sB8p+VupCb:+t3zA+WbyKK+oais8zRNcV3xDyaV
TLSH
T17AF23A0963A101E6D6E781B8D973B90AD9A17031071283CF47B0CA6E1F27BD66B7F742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

constants.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pygame\constants.cp313-win_amd64.pyd
Size 49KB
SHA256 c346ee23b6695ed6280f71d13cd4c5ecef569e12f331508008e60371e4350207
MD5 40cfea298503d9870042e28b375e9d29
SHA1 114eb8a09584b7c446dc4c51625bcd84355c6447
SHA512 eec873f8145cd8244859b68c4d4b680b1a7738424803f530a8e53d3fbc0647df0699b34b8233a785ff13103737dd710afb6e92ffeab007caa5aae74507f7cf37
SSDEEP 1536:eySNT4lbGDYTehOWBRQoKxGhJc7taNaG:eabwPwaeEhJc7sNaG
TLSH
T17F3393BCE38929F5CF69A0BCC2316627D17B70992990716F5661E365CF3F0236E90B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

display.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pygame\display.cp313-win_amd64.pyd
Size 44KB
SHA256 2b87801d06d55ee5eaf8c87d647a8e95f14e6fcf3b8e1d9a633a50c88b398920
MD5 314dd014557c4dc2077711707669d476
SHA1 561b7e25f0c3c2cefc85eab1079173102ccec43b
SHA512 b6d623ed3ffa658efc1164a577c46c8eb54d985b2061f2eb88af61dc65946c84eafbf0e8ae9ff22bee5ff4e5011909ee3561afb58887e4d959770673526f3613
SSDEEP 768:vY+L36eVmqVluCHfDmLlPAlOqTQ2RtEqMTv5ey/eZpKXb4:QAVduCbcQOGRt/MoyGOXs
TLSH
T1B6135B61765280EADFB1817488372F2BD2B1B0111B8167CF26A4C29D5FA37D3F22DA45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

draw.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pygame\draw.cp313-win_amd64.pyd
Size 49KB
SHA256 c8db798417679164d7a447147be1c7370c9cce5323cf9db741fc3ef5e4d42f3f
MD5 ed794a40667c2c9255e26e680f408ad2
SHA1 d2122e4072bc9802c620dd70261d051230218d96
SHA512 54d0e22a6dded23bd96cef31b087a570f855bb86d5819be96c75da783e5b7867690302e66d09d6b447db58d62a7feab77274985784c81141ac556cb2f102375c
SSDEEP 768:3regnM5r5K2GtWl7/IsrASETgrspoatqCjA779uUrTKtEW3gw7lz:3rRnMDB4Wl7/IeET3jMnKtD9z
TLSH
T180336B02F2C456E9C4B74874C876B81BF7907818572A47AF9B60E90D1F267D27B2FB06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

event.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pygame\event.cp313-win_amd64.pyd
Size 43KB
SHA256 494f7d0958ff406d826cc1b5fbd3df954cdf8dabebf30e3be74924c9355b324a
MD5 7787618a48bb2dc2ad2a0b08e92310ef
SHA1 5320244778957fd96d3c9b4926f4202d08680bb7
SHA512 acf9ed388b2f58e350d6418ac0b8a9d6ef36d019d4f792be9e70320683c2372a63b7754020b1f1f8b2b18fcb439f8742a4ccbafa97e4dfc42e99697363ffa94d
SSDEEP 768:7dPZ3f6O3ACvjah7joQwXXgyScjSuSixnKhXXRUwNBoRCeo:7dFfbQCvj9QwWcjS6xKhxxBo0/
TLSH
T1C9133C5762AC80BAC966807DD9332A1FC9B371A29B5193CF01B9C5CA3F529C311BFA45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

math.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pygame\math.cp313-win_amd64.pyd
Size 75KB
SHA256 1b217a687d7adf4732abd227b747465f0fc83a6bfb3064e9a4729075ac603159
MD5 68c0680149c0e1c3b9e5c6700be92116
SHA1 fd7950e8bdcc8e122aa28993d5b6cda10c6c24cb
SHA512 c1887a0d53232ab6fa140633a2c1eccf8db6a762161b7e993a23e4fdf9a3f210d8a17f653a7a49b731bfcc4a99188f372badf7f5deca5b2385717b594aeb79ae
SSDEEP 1536:ClKafjkaQHCTDn4h0OcJgxq6iqKqABnEZxGYR:WKaoaFTDe0OcJgxBKqwnIxG
TLSH
T1FE730744626451E9DC2360B8C82BAE83D360B0E28B5297CF1AF9C55D1F877D15F7FA82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rect.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pygame\rect.cp313-win_amd64.pyd
Size 44KB
SHA256 19c268113752ec69f0de20d93190fca397bdbdffcca20890ed4f8627e3e3f722
MD5 8286079e26b8c4bfcd74c6157204a71c
SHA1 426a8748c5c77003977b8c594790bd8c23665134
SHA512 078f52b84f7df35dc9679dd3f6f7f9843c45f865d451a4e22dc67ef38a6b805e88f2075363a9e20919bb978bf09035408d38e29fcff4a828960270b7465a24b3
SSDEEP 768:BKnMFhhdepGTzCNKJzSSh19tX63Fc7DYenOnno5sDrA//ypgm7dyun:gMFhWpGSeuSj9t8nouD0//CbRFn
TLSH
T1AF131946619140EAC9B2A179C83B3E63D6E1F011271297CF12A4C78E9F53BE3567EF42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rwobject.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pygame\rwobject.cp313-win_amd64.pyd
Size 19KB
SHA256 8393c52dcb1d0bef5a2712136dd7ff1a7ff3ce91ea72199b74d74e28c82e7093
MD5 9dd43deea865044c306111caa3f5073b
SHA1 a2059325ad714bc47a829a2828b390a57291b420
SHA512 00c6563d6ea9af6887d4982ac322a449eec782faecce649aeb84d786ab8054178ee88df7e30655828bc29f5016c02a5659d3bc862982b33d0398c5fc93c1296e
SSDEEP 384:U9ynDb2x/Ao6gjsJPt3P2JYrvSoxBNbJAvtO5pcNG:7D6xY9JNNbJlIG
TLSH
T1F8921A1AB68A05AFC6A36178C432791BE1B071122312F7DF03B0C7A52F226D66E7D703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

surface.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pygame\surface.cp313-win_amd64.pyd
Size 233KB
SHA256 358e005063a967b5c876caea1d4e72451fa1018693c140a45afbb1cafc860b4c
MD5 5af98f698f1a54d34f2c789030288815
SHA1 905efdf07259bc0d4a441eca87a0bc534df4a68c
SHA512 8aa0ff67f91cc19e3abf389c6e7ce4eb9f6023f1a830cb6c7cd503dcf24ae040a7ec3ae0f06170b60ea17441e77fc6cc15d1342e241a329cb5e191cb56541693
SSDEEP 3072:RIIImmkpkbkmk7mjmZmH4DX8+AkUU4r7H8Hn1Nrs6:RIIIXkpkbkmk7mjmZmH4DX8Jnz8Hn15
TLSH
T1C6341A9975279AE3FC13027C8A6BE64065A4B5AA034EBFF7F4D150586B273F0383C952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

surflock.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\pygame\surflock.cp313-win_amd64.pyd
Size 13KB
SHA256 2460b9d33675b20596f4a06b0d387fd09a0b0dc37a21a07cee72273e02585b65
MD5 d34dd22358c4f0cd18b9a564ce18b75c
SHA1 397cd72d651b70730a3521ad534561a52f453950
SHA512 a121526d39a8534e0286158e7c09dfc1477bf4c4f2a682a11b276929a1ed31513e38ca829223e2bc3b8d1712cf95442f8ed3092e2688e051d1a36efef8383ee1
SSDEEP 192:6eS1uoQjSpXF1eYn6BMf1LvJ6JF0SPU/ZMc2mU:6V1uoQjSpVuBMFvgF0SPcM9
TLSH
T17852F78CA76155AAD52B41B4CC234A0AEAF6712117916BCF037492DA2E73BD6323F790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\python3.dll
Size 70KB
SHA256 4ae581aa4e65fef9f92c84c428c990892da538b4d9289592df51fa31fd879770
MD5 6ca946631d8011ee1c2813637efe06fe
SHA1 46feb03c544c38d616d9af02ced161f2c44f8296
SHA512 0d35012e1345b7ce99251cc18b949a0790d0ee6ab2149fb530df0707ad6572a220f5321bebe92ace958fc40a21d5183b32cb1d227865165f0f71fe9d472c0f20
SSDEEP 1536:LotssyKcunV8PGRIsy0ZyEJ7Q97yfIW44D9rn:MtssyKxRIsy0u7W4IRn
TLSH
T171633BC25B5BF8A2D6F669FC78DDD9CD242B12CC53258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\python313.dll
Size 5.8MB
SHA256 41ec4fc4e5bc8b207258590238f7f050b13fdfee84c4a7b1ecff6e945d031a10
MD5 cfbfd5ca1d563466687e53a638eed93c
SHA1 63bffe9d62dcc870b1601ae7a04b042df88fa219
SHA512 0eb973271a12ff17dc443ee3289695bb2134d66120690d067b3f67b4b52a5ac2831f326fe85635ef43799b43574e4e1809e20db6ae1d32b5e5f4711cfa12df36
SSDEEP 98304:efqPAKrV+hOhkH0pwgJYt5FO8vUHDMiEJV0KL:DPAC+hOhZaic0A
TLSH
T11F568D12729D50ACD97B8078CA178A4BF7B27C113F60434B61E6BB5D2FB33624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\select.pyd
Size 32KB
SHA256 9cc1ef0264060099503592db57ee7d7c1f8d6bea689b2ed125919c7a30b7ab7f
MD5 7a066f58d43c0f3546944d046959ab0d
SHA1 03f2b88e97add974eff48a21454a3e609f943e57
SHA512 199d9f0a2fe47a0b7d25a5c2d6ee74e9507c67c166059985ade8292f4a2741824e91b934e391acad4da8ee187d94b007438a57b63496e91ab2ec7a5da14a0b8c
SSDEEP 768:EpX5KHfOmHzPRIs9GnZyEFqU+Y7N2Ip434bTxf1ml/6dHQzZ:AX5K/OmHzPRIs9GZyEJ7Q9IZfIgHU
TLSH
T110E27DCA6E785043EAA3CA71C5E2DE43F939B3E35611819F30A5C19A1E177C1E33A358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45642\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6880-249-0x00007FFC7D3D0000-0x00007FFC7D63C000-memory.dmp

Download

memory/6880-257-0x00007FFC7D3D0000-0x00007FFC7D63C000-memory.dmp

Download

memory/6880-247-0x00007FFC7D3D0000-0x00007FFC7D63C000-memory.dmp

Download

memory/6880-246-0x000000006A880000-0x000000006A8A7000-memory.dmp

Download

memory/6880-251-0x00007FFC7D3D0000-0x00007FFC7D63C000-memory.dmp

Download

memory/6880-253-0x00007FFC7D3D0000-0x00007FFC7D63C000-memory.dmp

Download

memory/6880-255-0x00007FFC7D3D0000-0x00007FFC7D63C000-memory.dmp

Download

memory/6880-245-0x00007FFC7D3D0000-0x00007FFC7D63C000-memory.dmp

Download

memory/6880-259-0x00007FFC7D3D0000-0x00007FFC7D63C000-memory.dmp

Download

memory/6880-261-0x00007FFC7D3D0000-0x00007FFC7D63C000-memory.dmp

Download

memory/6880-263-0x00007FFC7D3D0000-0x00007FFC7D63C000-memory.dmp

Download

memory/6880-265-0x00007FFC7D3D0000-0x00007FFC7D63C000-memory.dmp

Download

memory/6880-267-0x00007FFC7D3D0000-0x00007FFC7D63C000-memory.dmp

Download

memory/6880-269-0x00007FFC7D3D0000-0x00007FFC7D63C000-memory.dmp

Download

memory/6880-271-0x00007FFC7D3D0000-0x00007FFC7D63C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads