7116a4d7120b0f717de5ed6163918bd99df3bcc0b016c8054182c312ba67a320

Analysis

user interaction
yes
max time kernel
900s
max time network
476s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mrbenspammer.exe
Size 15.5MB
Sample260709-pgj6dsbs4x
SHA256 7116a4d7120b0f717de5ed6163918bd99df3bcc0b016c8054182c312ba67a320
MD5 0397a5fe57794e4bc859bac9f0ee9e55
SHA1 ef48f63119087bc10899cd242bad3c5082513156
SHA512 9cd455249f99a80422a9460daae31c52887abde086762f87bc625abf25fa14242a434f56e6288e0fa2a195efc0a40a04ceceb04be48919d62978c58921e2ec4a
SSDEEP 393216:CnVL/+PYDG1W+tHjdcyp6q27mypPO/wwcjYFbzPi:CVLtYW+NjSw26WPuwcPP
TLSH
T100F63319939401F3F4D695BF9566D6399930FE613782C6CBC76860A03A632E46E3FF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Loads dropped DLL 43 IoCs

pid	Process
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe
1248	mrbenspammer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 1248	2700	mrbenspammer.exe	89
PID 1248 wrote to memory of 784	1248	mrbenspammer.exe	90

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
784	attrib.exe

C:\Users\Admin\AppData\Local\Temp\mrbenspammer.exe
"C:\Users\Admin\AppData\Local\Temp\mrbenspammer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\mrbenspammer.exe
  "C:\Users\Admin\AppData\Local\Temp\mrbenspammer.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\SYSTEM32\attrib.exe
    attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winupdate.pyw
    3⤵
    - Views/modifies file attributes
    PID:784

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:3972

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5268

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_raw_cbc.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\Crypto\Cipher\_raw_cbc.pyd
Size 12KB
SHA256 84e071321e378054b6d3b56bbd66699e36554f637a44728b38b96a31199dfa69
MD5 a1b78a3ce3165e90957880b8724d944f
SHA1 a69f63cc211e671a08daad7a66ed0b05f8736cc7
SHA512 15847386652cbee378d0ff6aad0a3fe0d0c6c7f1939f764f86c665f3493b4bccaf98d7a29259e94ed197285d9365b9d6e697b010aff3370cf857b8cb4106d7d8
SSDEEP 192:HKF/1nb2eqCQtkrKnlPI12D0gacqgYvEn:A2P6KlPe2D4gYvEn
TLSH
T1BC42294AFAA589FDF82B8275C4730A49A5B6BA0037506BCF0371529A1D333D2333A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_cfb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\Crypto\Cipher\_raw_cfb.pyd
Size 13KB
SHA256 2a63e504c8aa4d291bbd8108f26eecde3dcd9bfba579ae80b777ff6dfec5e922
MD5 0dca79c062f2f800132cf1748a8e147f
SHA1 91f525b8ca0c0db245c4d3fa4073541826e8fb89
SHA512 a820299fba1d0952a00db78b92fb7d68d77c427418388cc67e3a37dc87b1895d9ae416cac32b859d11d21a07a8f4cef3bd26ebb06cc39f04ad5e60f8692c659b
SSDEEP 192:PRgPfqLlvIOP3bdS2hkPUDkfoCM/vPXcqgzQkvEmO:oYgAdDkUD1CWpgzQkvE
TLSH
T12D522809F79844BCF86B41B9C973091A9AB9B554331123DF0320919E2EA3BC13B3EBD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\Crypto\Cipher\_raw_ctr.pyd
Size 14KB
SHA256 b2b68de1d7e5997eb0c8a44c9f2eb958de39b53db8d77a51a84f1d1b197b58b1
MD5 785f15dc9e505ed828356d978009ecce
SHA1 830e683b0e539309ecf0f1ed2c7f73dda2011563
SHA512 16033b72be6d66ab3a44b0480eb245d853a100d13a1e820eff5b12ce0bb73e17d6e48b3e778d1b20d0c04fe1fb8a5723c02ed8af434ae64d0944f847796d98f2
SSDEEP 192:OJ1gSPqgKkwv0i8NSixSK57NEEE/qexcEtDrYDjRcqgUF6+6vEX:uE1si8NSixS0CqebtDErgUUjvE
TLSH
T13A621B19E69005B9F66642B888724E0EA7FEB4042342BBDF137592692E137C4333F7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\Crypto\Cipher\_raw_ecb.pyd
Size 10KB
SHA256 ea96505b38d27c085544fb129f2b0e00df5020d323d7853e6a6a8645ac785304
MD5 aec314222600ade3d96b6dc33af380a6
SHA1 c6af3edadb09ea3a56048b57237c0a2dca33bee1
SHA512 bbc00aa7fdf178bb6b2d86419c31967f2bc32d157aa7ee3ac308c28d8bf4823c1fafcde6c91651edc05c146e44d7e59e02a76283890652b27c52f509c3b9ef9a
SSDEEP 96:kF0KVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EpmFWLOXDwoUPj16XkcX6gbW6z:yVddiTHThQTctEEI4qXD61CkcqgbW6
TLSH
T1D222E88DFE9189EFEA2581B586630E4AE179B711171273CF0370962E1F663CB317A385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ofb.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\Crypto\Cipher\_raw_ofb.pyd
Size 12KB
SHA256 084e4b2da2180ad2a2e96e8804a6f2fc37bce6349eb8a5f6b182116b4d04bd82
MD5 4ed6d4b1b100384d13f25dfa3737fb78
SHA1 852a2f76c853db02e65512af35f5b4b4a2346abd
SHA512 276201a9bcb9f88f4bbac0cd9e3ea2da83e0fb4854b1a0dd63cff2af08af3883be34af6f06ece32fad2fd4271a0a09a3b576f1ed78b8a227d13c04a07eaf0827
SSDEEP 192:HjF/1nb2eqCQtkgU7L9D0u70fcqgYvEJPb:j2P6L9DHAxgYvEJj
TLSH
T110421889FAE589FDF5268276C4730A45A5B5BA1027906BCF0320525F1E233CA377A786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\Crypto\Hash\_BLAKE2s.pyd
Size 14KB
SHA256 55e20e1effe80f0d6655d690fa445659e0c692b800c4a01ecf3d43dfcb3324b2
MD5 c482fe81df435cddef783ab0d8ad78b6
SHA1 25e0e650f9135110234091d5263be1721b8fe719
SHA512 ef5a965b8505944e6b37581763cd9d525bbf1b877bfed319535aab675d0382b8655cd6a4f2832f608c1d89cfd0dae6005deda73a86b9d2d6e874953788ee0d36
SSDEEP 192:HvF/1nb2eqCQt7fSxp/CJPvADQJntxSOvbcqgEvcM+:f2PNKxZWPIDqxVlgEvL
TLSH
T139520855F6A544FEF96682F980B30A0D92F9BA12936177CF1320526A1D237C0727E3E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\Crypto\Hash\_SHA1.pyd
Size 17KB
SHA256 044b09a6351db40fe1f242c70942d865ce4cd42a12f24e358f84ae790677d92d
MD5 67e8ab67b5db0a50af2aedea886eb362
SHA1 a7d071a3be454b78a0a0bb100e5d9859c12f98e6
SHA512 b2e41422b6642e000d9220a1cf4188b1845a8cf9498338d66ca0dcc0724540694719a4d3eda017ca6f2f77c3d6a6c427c6c86db3910c686cecb58a40c5239e2e
SSDEEP 384:CIPHdP3MjeQTh+QAZUUw8lMF6DE1tgj+kf4:CaPcKQT3iw8lfDSej+
TLSH
T1AF823B95FA6998BCE62D8830C6934B1FA376B5074761A7CF03E002ED1C173E66934B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 f2718adadb6e9958081dcb5570ef737c66772c166a6ad8c0401adcd9a70f46a0
MD5 5738d83e2a66b6ace4f631a9255f81d9
SHA1 5b6ebb0b82738781732cf7cfd497f5aeb3453de2
SHA512 bb21b62fd7fee22dfa04274d0fa1aec666c7845cd2ec3f01f1a0418a2c68f228ec0ae451c793ccae3aa88f1efee5d6019138c0975497518f990b8511b2fd0e75
SSDEEP 96:k0yZVVdJvbrqTuy/Th/Y0IluLfcC75JiCKs89EMz3DOWMot4BcX6gbW6O:XQVddiTHThQTctEEO3DEoKcqgbW6
TLSH
T19722FA8DFE9249FFE62982B5C5774E0AE179B710171273CF1374966A1E623CB312A381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\_bz2.pyd
Size 84KB
SHA256 64d9fbb516e08a6780dca160e40d8c6723d2a659b5ca3020de7a041305b3a3d4
MD5 7098611e0258f8bd1ed5ecb971c88763
SHA1 009b95baaeb3cd8b1012a8af487d52c091381cb3
SHA512 ad44afc2962e746c9720d33b490445c05e0dbd6a70acf568d5e0bd1138d092d2e49f89c51aab6a2a6b5e6ac4bacc771816b76963bae15553e8ee630af70ccaff
SSDEEP 1536:udsvXm8z7+Cnqncm4WlTtdKSzBdzM8yOBs8iMtIeLV8yG5TT/9vfIZRzz:qsvXm8zaYqRptX7zvyOC8htIeLVmpSZl
TLSH
T1B7836D86F36552B6F99BD1B886800793F730BB950B50A36FF148C2993F13B916E5C319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\_cffi_backend.cp313-win_amd64.pyd
Size 176KB
SHA256 d5b09da2e726b4e90cf0edad5d2a0ec52f369dfd060e14d3807a32b2205031fa
MD5 f2eff52a9b6ed2534f84cc7b77379649
SHA1 05947063d4912dfc288ea1fb2a768b9d23c60dfd
SHA512 2ab45ab98af90433ca6c122136c9ef7b7cd9eafea306aae1b412fbb7df8e86407858bb9da5124ac5ff8a80a9f9f3aa8839a2c871952469bf3abe9965175fb504
SSDEEP 3072:DsI2F3Ar92NZtfmzsYDZhXkQ1ISuigE2QvHNjOhKQchdqS7xxSTL7KNCtRnh+HRS:Ds5tfmo231ISuig9QvHw8hsgxSTLOcda
TLSH
T1EF044B5B329C10B6D5A2517886675B53E3B3B471130197CF01A0C7B92F1BBE67A7FA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\_ctypes.pyd
Size 131KB
SHA256 b9c9e713f11e111daa55e4a62a135d7e385fa7aa0986d30b286d000e122b13aa
MD5 1606ace764f2b3ca8ab20cada221cf56
SHA1 ff63d15ea0b6b0c52deceab3f54c671a44e5e8f2
SHA512 658df5ed480cebc92685aa617c2ec5a5ff0c8613d420bcc3dbea0af0e1f7274c6963605f6284a69d3df40d075b02310fa35c361a176f5a2d80c2510db5290fc0
SSDEEP 3072:gaSQJ/VrFMXqvN2Ptf/Fm02R0JrsgvGzhIeyPxp5:oQJ/V1Ef/Fm082rsgAe
TLSH
T12DD37D0B776800AADAA39174C173AF47EBB1B453171047CF02A4C69A2F63792AE7F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\_hashlib.pyd
Size 67KB
SHA256 1e079c6b44488e273bc62d9bcb27cec519e9916b47b8c2878ebade0772e0f484
MD5 82c0261589ab1c473c765d3ff36f9f8b
SHA1 293d34cd3108861976373c4972e634fb83f70a4a
SHA512 3db1062db85fe5e6fb37b3e769c6d9fe459714761b27f597d7f693296522411912e2730f2d613c66601fa0dec97c3ad9563166775d9107bc59a36f5282e79822
SSDEEP 1536:xqXn1xAu1lEAXfXtfcV5TaPutFCAFIevIWyG5TT/9VfIW44Dkr2u:C1l1uA1fcyPutFCAFIevIcpYW4Ik2u
TLSH
T1D8637B95AA884092E96382B5C4A34F83FD75F35257119BCFA2A8C0CD2F233C39776756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\_lzma.pyd
Size 155KB
SHA256 999ba26fe0b0376b7898d50ddb2f5012e7a64228e31fcdca99a4d7079df669e3
MD5 b7100b8fb3c579c848d8960b927d322f
SHA1 f6303fd3e27b93b7f0ff8251ca85636d01dc19d9
SHA512 9e778f62e28dc105d54211a9b708fd51cff9e7b53e79b78e73461fdd495c78b9091dd11e2a6522a82088a76cb356fc7176706afe519f8bfab1287285aeb27f6f
SSDEEP 3072:IqZ/boPLmhrKifqGDRJUsTznfB9mNo9vm28fgS+tIe01Lfp2/Ih:IeTgLhyvUsv5YO9Cfd+Qfk
TLSH
T10BF35C86B794F0D5F7728C38D2624F57E6F5781A0320929A01CC976D2B1FB659A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\_queue.pyd
Size 34KB
SHA256 baa5a4cec6c369efc461f7109f1e6150c0afeef8ce53dbd9d673a00093cdadf8
MD5 24bd30234b4fa243007ac061bd7bc8a5
SHA1 c4d8b0d0c91e6112c08808dfdd11eee1d073dcff
SHA512 8f649ca916688edc10942a794a8f79a6d67d0ac2f257d2e4a469d96c0787f2e904e64339b5193b8a4ef0ff4df36fa9cfaff97d6ac31d74919cda86c73b9a6965
SSDEEP 768:8+Mds6rU7gVh6hIe9UVMdyG5TkKrLy2Ip4QzyTxf1mlWZG8vDkr/v:uNU7gVIhIe9UGyG5TT/9QufIW44Dkr3
TLSH
T1B5F26DCAAA68444BE563DA30C1E7EE52F435F7D3961197DF216981CD1E233C1A33A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\_socket.pyd
Size 84KB
SHA256 7acc6c44436bf77be3c425d39f0acba03b42119513ef9db31a7039c969e056bd
MD5 659d1aa860099428669dcdae9c7ab661
SHA1 324fcf8d090c3ffda1386c85f263f7bb104889a2
SHA512 3b87e0fd8c68c7fa829e1fad13e4e5d14b42a36d9e25ae1c5b7fb8f87bfe087183fafb51c7734a4169dd64ce833d19e47e8f11f7f5640b67ac00bbfff557798a
SSDEEP 1536:rVl/fxzeola7SVitdyJw3QlyJ+9+nzn3Y4KxtS4DTDghIeyw9yG5TT/9SfIZRwz:rVRdeoo7YoyJw3QlyJs+nz3tKxB8hIeE
TLSH
T1DF836C04A66050FAEBB3D075C2639E62FB74B1C11394A35F1066C65A1F333C2BF7AA95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\_ssl.pyd
Size 177KB
SHA256 738c579ed151498337026ea1f5dc7688197b41b74e39f4d9de05261bb35d9206
MD5 359e1c3e69044b4283223783ca406b95
SHA1 f322f7e99ccb604954cc18ac3e525e53480a22bf
SHA512 ca4e267d618f4eee91eca799ae99b5127612ca5debf9bbf76368c95502fc5c35049dc2ce973cf859a92f1f2fa833137522d9425c959d7afb632e89f0401730e5
SSDEEP 3072:fofuOjwYdI1bnMlfR6CPfzsvyII7IM/cbPuC/JWtIeL7zpaY9:fo20wYdknqR6CPIvySgTx9
TLSH
T144047C47B59459F7E813E4F9C2234903EBB0F155321247DE48D6E64A0F03B4AAE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\_uuid.pyd
Size 27KB
SHA256 a004b7f5b07333db6c7079244c3880d57aae4bdfa56bde8bca2c530dea824cd2
MD5 d4ed5f1a9dc9d9871aedd4b4bf55fe77
SHA1 726c7751fd81ceee4f4ba74f9d2efa3e7d338c9e
SHA512 78c34c83a96c0cb66581e6ddf61da66d68eb307d078ce3e67bcab78ad02a24fae75cd1a596e890c95c1860c178f432ef30acae047e0e52b591f82a76a6fa441b
SSDEEP 768:zxuVj5ntIe0w0dyG5TkKrLy2Ip4eTxf1mltPRVtgkP2p:zxuVj5ntIe0wIyG5TT/9+fIZRXtP2p
TLSH
T144C25BCAAA784057FA939B70C1F2DE42B939B7D34A1157AB3179D1850E133C1B32A369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\_wmi.pyd
Size 38KB
SHA256 6793bd216b5a329689cde8b1532858d6731707ec5063897f979a81e57077402c
MD5 f94e8c9a440cdac95d2f69a9045d937f
SHA1 95d49b1d987db3a751524712b49bc86ece3bbb86
SHA512 d2ac9607e9a1be542cedb92ca0caf98bdca4447f22b04d09e451a1031ad7d6771406ae29a4b366d2add08bc1bd7519d17bebe2d33cd21bbccbc12589cfe6f03e
SSDEEP 768:q2/EEqrVmjsNuEkc9+utIeLibdyG5TkKrLy2Ip4TTxf1mltPRVYgt:vE9BEfEkc9+utIeLiZyG5TT/9xfIZRWw
TLSH
T158037CC9E6680092EA67CA74C5A6DE52F531B7935B0187CF3265C2990F233D1E739339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\base_library.zip
Size 1.3MB
SHA256 0954ea4ae374b6f41dcc9813c997d0808711ea564d0016efc18fa6d4ba0302cf
MD5 622f9e8b17de4f47e66602ce3f90bebb
SHA1 d45406d3d825b2d6e09358105d5b2262f71df749
SHA512 64095eee694c5cc9ba9a8e742665dc4f14d593e89135c981fe3e6cef545bcfdae2170008b57b2a933b5abb5c54c8d929c32ef5c8f51f4597e68ee1c8835ed95a
SSDEEP 12288:SmifdjdTLuIva80201jwCVRDVoioSYBSFUDqf9mwtjkfqhTNW7WpGaL+DEi2cPPz:SjdZLlzjqm7Wp95cPPdxhYjSeT1Ne
TLSH
T112551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\charset_normalizer\md.cp313-win_amd64.pyd
Size 10KB
SHA256 89d8172b5f460c3fd85716c9641643fd7d893365a99867df4471b017f2995695
MD5 6197b1d14921c4b7c61e0f5973067db8
SHA1 1a2dcaeb19e787ccf747ddd56f3671bc2f63ff92
SHA512 2a485aa6bb0bce42e3eb26c47010b45f97a043c130d1c921129984b936baf2a1e2250d7bcb6f7eddd751dc052b4671d7fdeb511253145890e5ba49091b4cb25e
SSDEEP 192:M6IxGrmoX+sMl/++Ch9p8fBdisuOL58A0JH6:7Ix4m446oDZuI8Ae
TLSH
T1DE22085CFF7458EAD9268134C9375E4AB132BB22170277CF8370906A2FA37E66534785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
Size 124KB
SHA256 3ccacfdbf227750083980a7de0c982be26dfebac26e4fa599d1e7a5866e92a21
MD5 44e93983023d73f89ee8bfb43031ab9d
SHA1 72d2612bfedd418854cccfd52c44e4c86544e560
SHA512 4db1f2e0104d3ea30f1f2b41302d4a06da79b079fa7fbffbd73cc0843b1b57e3c19d6ba631d4d94ccf4f73827afbaeb2da67258b2c5232a9f0463eefc36013ba
SSDEEP 3072:jdOHcsVOUm2jVPoV9wsBOYtvsHgFXYwbOUw:Q8frBntIwbO
TLSH
T12AC30967529500B7C6634179CCB7A513D7E1B5610B3263CF04A4C7AA6F03BDAAEBEB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\pycparser-2.23.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\python3.DLL
Size 70KB
SHA256 9b179a9e44badc9c9d327182996040c87be183ad4c9469645280ed3e4a2d7694
MD5 04ba59ed5314652ec779f1389900913e
SHA1 83cc9297bf0aa85ce055710e3a178db4268c0323
SHA512 0cb3090721fac1d25aa0e4b3f9b6028bef80c30011b718dc217791b463085cab224cd058d5b63dc3e67ae1d3a099a444163234d465241df83b97f1385c413e8b
SSDEEP 1536:wotssyKcunV8PzhIey0lyG5TT/9vfIUX:XtssyK8hIey0lpW
TLSH
T15A633BC26B57F8A2D6F665FC78DDD9CD242B02CC57258D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\python313.dll
Size 5.8MB
SHA256 c9f98606d0d06f4e8ae75ae385021e58b57c90d4fd325c0313c8c42abe1ebf63
MD5 48edb6a0be2bfee5b83e2c31675511e5
SHA1 43a1c8df434401901a5529cac03a664a5e64be71
SHA512 2b6ea04ef35085355bd9ee077ef533f80481d85a5b7d60c1756d06369313c4c39157018e76e30f4974eabdc6abba81bf6ec7cecc477cdee350acde7796567122
SSDEEP 98304:I8uWXsdqWZobQdaehM91cnivzHDMiENKULAd:puWmqeobQdaepiFULAd
TLSH
T1EA567C12729E51ACD9778078CA038A4BF7B27C413F60534B61E6BB5D2FB33624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\select.pyd
Size 32KB
SHA256 01c8fef709b657b17e1db3754b05cb1070ad3e303dd531ef0f5545316df53aa2
MD5 c13138061da04f3fc3cd44c9fd3b9db0
SHA1 a7d03e1b9dc39065f76a3249fefe7355a69a500b
SHA512 04d907ab25d7fd4cde2cadefe8bced515dacf176ef93f72149341773938e0f2342f60076e1e8d8eaf42e0817c6118374b5c7a144ec1d09f4edf55ddfaf83f0bd
SSDEEP 768:WpX5/HfamHzPhIe9G+dyG5TkKrLy2Ip4STxf1mltPRVpgh:SX5//amHzPhIe9GGyG5TT/9KfIZRbI
TLSH
T16CE27CCA6E685087EA63C671C5E2DE42F939B3A38A1186DF31B581D91E277C0E336354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\unicodedata.pyd
Size 695KB
SHA256 cc1f066d88c26a21808ec6053c0989d702b6d46429bb4f363e4f29b67f311c89
MD5 daa6555238f525d8070b07484085a3b9
SHA1 b65d9a4f1b76baed46dbc79589e0627e1fce3d58
SHA512 f777e52308a41aefdaa99f5d9b9433161e1b8bf0e0120936817566432d1507e3b690bfaf4c4ce15534cc69b12f51bbaf6cb7c919f15c3f67802e3999c7e99bba
SSDEEP 12288:7YBdLI/X77mvfldCKGihH32W3cnPSqrUgYfM/:7YBW7qNxr3cnPXYk/
TLSH
T150E4F5D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backend_c.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27002\zstandard\backend_c.cp313-win_amd64.pyd
Size 513KB
SHA256 e05f3f106d6a907d3402a9543dbd0bef6cc28dbb63377685ebd65af87bfb03d1
MD5 6c66643348c8aa1de28fa4f8bf705946
SHA1 a98d31b1a4c47f940f22b231716f7109ec2dc5cb
SHA512 a67a83e59d2b7b875ffdb1d80ef052e9fe7af148896069a797500d33fec0a19635c51eade2dc9c11e807439c27f164da3ad881a6d5ba97b0e5611064a2dd2046
SSDEEP 12288:9FsJVaj218NV66XiemPd22xcynGflmWITN:9Nq196XiemPM2xew
TLSH
T1C5B48C83F29953EDD13BC478C66A9617FBB27409132466EF82D4DB653F13BA1963A300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winupdate.pyw

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winupdate.pyw
Size 37KB
SHA256 3873698a35cf42119549376c619c3bf3e0b04d45ef9226e470bbf97e5cd4d1cc
MD5 69cd4d32c0040fc6820aa0075498a9e2
SHA1 bb0de8e548916438eabb54e98aca7cb41e82edf1
SHA512 07d906beed931f1c991d96431dff9167c1809af20dec86b81672ec8b1081927763f2da0d3a64b5a6a25fcaeb01c3ac6c310cc56f54641a61e29b7bed481f9954
SSDEEP 768:FvCgBwr1U9wTHQiXJdVwbIvvh1qdkwN2dWO/O971fzB8FCZjH:FvwqSHF5dVwbIR1q/Nj975WCt
TLSH
T10D03F1EE13F6B7BC9154F46E24DA15850D8543CFEA4C966D33B9A2EC80B3E3680D1625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads