1f21520c38c20d01f0a644ee33ea04e044058a2fbb81379057ebb90bab51beb2

Analysis

max time kernel
299s
max time network
307s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/08/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pluto External.exe
Size 74.9MB
Sample260805-wr98wsdb36
SHA256 1f21520c38c20d01f0a644ee33ea04e044058a2fbb81379057ebb90bab51beb2
MD5 546428077bc1abb9c703bc88c3e6240f
SHA1 f02258c50b4c549363e00ecffdcede0aeea9fc75
SHA512 3c462d8e52a23a433916731e7ccab6d7fec611d6096011ecb0617d987a3f84ae1e20da84367ecfbca703962b4fa3f0c581a08743035ab43fc977047d5cb07036
SSDEEP 1572864:dBuvk2E5TB9lG+QqE7bjZWvqgwUV6vLXET8N247pmi/cJxNoAIATabVJt7jetqy1:ac/5tsp7vSqgwO6vLXW47pmPJxNTvub4
TLSH
T1FB083350D6A508E3F2AB4EB5E4965980F5ECB8890B73E0DB162905F34F272D5BB2CF14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access defense_evasion discovery execution persistence pyinstaller spyware stealer

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
4516	NaviLogs.exe
2536	navi.exe
4868	NaviLogs.exe
780	navi.exe
2540	navi.exe
3336	navi.exe

Loads dropped DLL 64 IoCs

pid	Process
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
4868	NaviLogs.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe
780	navi.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\navi.exe\""	navi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\navi.exe\""	navi.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
17	discord.com
1	discord.com
3	discord.com
4	discord.com
7	discord.com
13	discord.com
14	discord.com
16	discord.com

Looks up external IP address via web service 1 TTPs 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
2	api.ipify.org
6	ipinfo.io
10	ipinfo.io
1	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x001900000002b6d5-6.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 33 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2900	cmd.exe
4120	cmd.exe
5212	cmd.exe
6088	cmd.exe
3540	cmd.exe
2448	cmd.exe
5956	cmd.exe
4600	cmd.exe
4440	cmd.exe
4520	cmd.exe
3596	cmd.exe
5484	cmd.exe
5524	cmd.exe
1588	cmd.exe
3184	cmd.exe
416	cmd.exe
4896	cmd.exe
2856	cmd.exe
5788	cmd.exe
2248	cmd.exe
6124	cmd.exe
3328	cmd.exe
1704	cmd.exe
2192	cmd.exe
2220	cmd.exe
2092	cmd.exe
5948	cmd.exe
5540	cmd.exe
2204	cmd.exe
5940	cmd.exe
2716	cmd.exe
4980	cmd.exe
3452	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3352	msedge.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1092	WMIC.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
4644	taskkill.exe
2744	taskkill.exe
5164	taskkill.exe
3324	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4648	schtasks.exe
2440	schtasks.exe
4876	schtasks.exe
5192	schtasks.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	taskkill.exe
Token: SeDebugPrivilege	2744	taskkill.exe
Token: SeDebugPrivilege	5164	taskkill.exe
Token: SeDebugPrivilege	3324	taskkill.exe
Token: SeIncreaseQuotaPrivilege	1092	WMIC.exe
Token: SeSecurityPrivilege	1092	WMIC.exe
Token: SeTakeOwnershipPrivilege	1092	WMIC.exe
Token: SeLoadDriverPrivilege	1092	WMIC.exe
Token: SeSystemProfilePrivilege	1092	WMIC.exe
Token: SeSystemtimePrivilege	1092	WMIC.exe
Token: SeProfSingleProcessPrivilege	1092	WMIC.exe
Token: SeIncBasePriorityPrivilege	1092	WMIC.exe
Token: SeCreatePagefilePrivilege	1092	WMIC.exe
Token: SeBackupPrivilege	1092	WMIC.exe
Token: SeRestorePrivilege	1092	WMIC.exe
Token: SeShutdownPrivilege	1092	WMIC.exe
Token: SeDebugPrivilege	1092	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1092	WMIC.exe
Token: SeRemoteShutdownPrivilege	1092	WMIC.exe
Token: SeUndockPrivilege	1092	WMIC.exe
Token: SeManageVolumePrivilege	1092	WMIC.exe
Token: 33	1092	WMIC.exe
Token: 34	1092	WMIC.exe
Token: 35	1092	WMIC.exe
Token: 36	1092	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1092	WMIC.exe
Token: SeSecurityPrivilege	1092	WMIC.exe
Token: SeTakeOwnershipPrivilege	1092	WMIC.exe
Token: SeLoadDriverPrivilege	1092	WMIC.exe
Token: SeSystemProfilePrivilege	1092	WMIC.exe
Token: SeSystemtimePrivilege	1092	WMIC.exe
Token: SeProfSingleProcessPrivilege	1092	WMIC.exe
Token: SeIncBasePriorityPrivilege	1092	WMIC.exe
Token: SeCreatePagefilePrivilege	1092	WMIC.exe
Token: SeBackupPrivilege	1092	WMIC.exe
Token: SeRestorePrivilege	1092	WMIC.exe
Token: SeShutdownPrivilege	1092	WMIC.exe
Token: SeDebugPrivilege	1092	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1092	WMIC.exe
Token: SeRemoteShutdownPrivilege	1092	WMIC.exe
Token: SeUndockPrivilege	1092	WMIC.exe
Token: SeManageVolumePrivilege	1092	WMIC.exe
Token: 33	1092	WMIC.exe
Token: 34	1092	WMIC.exe
Token: 35	1092	WMIC.exe
Token: 36	1092	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4488	WMIC.exe
Token: SeSecurityPrivilege	4488	WMIC.exe
Token: SeTakeOwnershipPrivilege	4488	WMIC.exe
Token: SeLoadDriverPrivilege	4488	WMIC.exe
Token: SeSystemProfilePrivilege	4488	WMIC.exe
Token: SeSystemtimePrivilege	4488	WMIC.exe
Token: SeProfSingleProcessPrivilege	4488	WMIC.exe
Token: SeIncBasePriorityPrivilege	4488	WMIC.exe
Token: SeCreatePagefilePrivilege	4488	WMIC.exe
Token: SeBackupPrivilege	4488	WMIC.exe
Token: SeRestorePrivilege	4488	WMIC.exe
Token: SeShutdownPrivilege	4488	WMIC.exe
Token: SeDebugPrivilege	4488	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4488	WMIC.exe
Token: SeRemoteShutdownPrivilege	4488	WMIC.exe
Token: SeUndockPrivilege	4488	WMIC.exe
Token: SeManageVolumePrivilege	4488	WMIC.exe
Token: 33	4488	WMIC.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 4516	5132	Pluto External.exe	80
PID 5132 wrote to memory of 2536	5132	Pluto External.exe	81
PID 4516 wrote to memory of 4868	4516	NaviLogs.exe	82
PID 4868 wrote to memory of 4980	4868	NaviLogs.exe	84
PID 4980 wrote to memory of 4644	4980	cmd.exe	86
PID 4868 wrote to memory of 5212	4868	NaviLogs.exe	87
PID 5212 wrote to memory of 2744	5212	cmd.exe	89
PID 4868 wrote to memory of 2092	4868	NaviLogs.exe	90
PID 2092 wrote to memory of 5164	2092	cmd.exe	92
PID 4868 wrote to memory of 1588	4868	NaviLogs.exe	93
PID 1588 wrote to memory of 3324	1588	cmd.exe	95
PID 2536 wrote to memory of 780	2536	navi.exe	96
PID 4868 wrote to memory of 6088	4868	NaviLogs.exe	97
PID 6088 wrote to memory of 1092	6088	cmd.exe	99
PID 4868 wrote to memory of 5948	4868	NaviLogs.exe	100
PID 5948 wrote to memory of 4488	5948	cmd.exe	102
PID 780 wrote to memory of 1816	780	navi.exe	103
PID 2540 wrote to memory of 3336	2540	navi.exe	107
PID 3336 wrote to memory of 5888	3336	navi.exe	108
PID 780 wrote to memory of 1704	780	navi.exe	111
PID 3336 wrote to memory of 3452	3336	navi.exe	110
PID 3452 wrote to memory of 5192	3452	cmd.exe	114
PID 1704 wrote to memory of 4648	1704	cmd.exe	115
PID 780 wrote to memory of 2448	780	navi.exe	117
PID 3336 wrote to memory of 3540	3336	navi.exe	118
PID 3540 wrote to memory of 2440	3540	cmd.exe	121
PID 2448 wrote to memory of 4876	2448	cmd.exe	122
PID 3336 wrote to memory of 3184	3336	navi.exe	123
PID 780 wrote to memory of 2856	780	navi.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1816	attrib.exe
5888	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Pluto External.exe
"C:\Users\Admin\AppData\Local\Temp\Pluto External.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Users\Admin\AppData\Local\Temp\NaviLogs.exe
  "C:\Users\Admin\AppData\Local\Temp\NaviLogs.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Users\Admin\AppData\Local\Temp\NaviLogs.exe
    "C:\Users\Admin\AppData\Local\Temp\NaviLogs.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe /T >nul 2>&1
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4980
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe /T >nul 2>&1
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5212
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe /T >nul 2>&1
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe /T >nul 2>&1
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1588
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6088
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        Suspicious use of AdjustPrivilegeToken
        
        PID:1092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5948
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488
- C:\Users\Admin\AppData\Local\Temp\navi.exe
  "C:\Users\Admin\AppData\Local\Temp\navi.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Users\Admin\AppData\Local\Temp\navi.exe
    "C:\Users\Admin\AppData\Local\Temp\navi.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:780
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +h C:\Users\Admin\AppData\Local\Temp\navi.exe
      4⤵
      Views/modifies file attributes
      PID:1816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "schtasks /create /tn "naviStartupTask" /tr "C:\Users\Admin\Desktop\navi.exe" /sc onlogon /rl highest /f"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1704
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "naviStartupTask" /tr "C:\Users\Admin\Desktop\navi.exe" /sc onlogon /rl highest /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "schtasks /create /tn "naviStartupTask" /tr "C:\Users\Admin\Desktop\navi.exe" /sc onlogon /rl highest /f"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2448
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "naviStartupTask" /tr "C:\Users\Admin\Desktop\navi.exe" /sc onlogon /rl highest /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
      4⤵
      Executes a command shell one-liner
      PID:2856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
      4⤵
      Executes a command shell one-liner
      PID:2900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
      4⤵
      Executes a command shell one-liner
      PID:3328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
      4⤵
      Executes a command shell one-liner
      PID:5956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
      4⤵
      Executes a command shell one-liner
      PID:3596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
      4⤵
      Executes a command shell one-liner
      PID:4600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
      4⤵
      Executes a command shell one-liner
      PID:4896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
      4⤵
      Executes a command shell one-liner
      PID:5940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
      4⤵
      Executes a command shell one-liner
      PID:5540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
      4⤵
      Executes a command shell one-liner
      PID:5524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
      4⤵
      Executes a command shell one-liner
      PID:5484

C:\Users\Admin\AppData\Local\Temp\navi.exe
"C:\Users\Admin\AppData\Local\Temp\navi.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Local\Temp\navi.exe
  "C:\Users\Admin\AppData\Local\Temp\navi.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\system32\attrib.exe
    attrib +h C:\Users\Admin\AppData\Local\Temp\navi.exe
    3⤵
    - Views/modifies file attributes
    PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "naviStartupTask" /tr "C:\Users\Admin\Desktop\navi.exe" /sc onlogon /rl highest /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "naviStartupTask" /tr "C:\Users\Admin\Desktop\navi.exe" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "naviStartupTask" /tr "C:\Users\Admin\Desktop\navi.exe" /sc onlogon /rl highest /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "naviStartupTask" /tr "C:\Users\Admin\Desktop\navi.exe" /sc onlogon /rl highest /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
    3⤵
    - Executes a command shell one-liner
    PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pornhub.com/
      4⤵
      PID:3220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x364,0x7ffbc1f7c188,0x7ffbc1f7c194,0x7ffbc1f7c1a0
        5⤵
        
        PID:4320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,8228719702856192286,16840287511776109302,524288 --field-trial-handle=2272,i,8610303408640151767,4789777621186013791,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,16011840938710694659,11082171921735559854,524288 --field-trial-handle=2272,i,8610303408640151767,4789777621186013791,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:13
        5⤵
        
        PID:616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1504,i,13908419870548985723,18191995758279885733,262144 --field-trial-handle=2272,i,8610303408640151767,4789777621186013791,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
        5⤵
        
        PID:3152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,580093288816369987,18415794618278371521,2097152 --field-trial-handle=2272,i,8610303408640151767,4789777621186013791,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        
        PID:5696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,16251712456212286925,7425565140379269345,2097152 --field-trial-handle=2272,i,8610303408640151767,4789777621186013791,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
        5⤵
        
        PID:4152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
    3⤵
    - Executes a command shell one-liner
    PID:2192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
    3⤵
    - Executes a command shell one-liner
    PID:416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
    3⤵
    - Executes a command shell one-liner
    PID:6124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
    3⤵
    - Executes a command shell one-liner
    PID:2220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
    3⤵
    - Executes a command shell one-liner
    PID:5788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
    3⤵
    - Executes a command shell one-liner
    PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
    3⤵
    - Executes a command shell one-liner
    PID:4440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
    3⤵
    - Executes a command shell one-liner
    PID:2204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
    3⤵
    - Executes a command shell one-liner
    PID:4520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
    3⤵
    - Executes a command shell one-liner
    PID:2716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start "" "https://pornhub.com""
    3⤵
    - Executes a command shell one-liner
    PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 47054411664841ec175e0c9339f6b0c9933f4aa50427eb33ff93d9850511a627
MD5 1ed4b552677a7acbc02ec20b219b1eb9
SHA1 9d0fff24847c004430276ef0016083a947634d2f
SHA512 5983409ac3c007473512e6cd2f1a8083481b4604fc50e161c7d4c9fb902adfa31bba99c84ff2a23b4dcbf2e8f89d82c2e4a4b5a21a22aae6ae19441a722b6251
SSDEEP 384:n5FiF9CcmyWCs38Ny8TUNTUlIxBydtCkjkpfb7oBUG1lWeI1yAhkP+lFYS/F+Hyj:2Fccps3Nwg/5JoCG1ljAhkoFYS/j
TLSH
T1B6C25B31EC59CDB7ECDA8A99F78A7A42EED001A3C58C9AD4DAC81D5D00DB2DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1768381c1cb8a6ef46092492867237d44f5e6c879d37cc9aa009fc07c35a2bdb
MD5 44ed094bec81ab3cab27d864af41b9e0
SHA1 2ce924cb344344fc86c5264922172306c2afc09f
SHA512 8ebf7481d19fc912109a2d098077ba241e28a657bd0fd775bc098c56be938eb6cbb274b4f3cac03c603544ad67f2c6d1467afcffbdc8273e9ffb560e4a6a53df
SSDEEP 384:n5FiF9CcmyWCs38NI8TUNTUlIxBydvlo7ajkpfb7oBUG1lWeADhkP+lFYS/F+Hyj:OFccps3bwg0U7JoCG1laDhkoFYS/j
TLSH
T11FC24A32EC98C9B7ECEA4F99E74A7A02EEE0016385885AD4DAC81D5D00DB1DD5707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NaviLogs.exe

Path C:\Users\Admin\AppData\Local\Temp\NaviLogs.exe
Size 19.1MB
SHA256 9f09095ecc1e4fcf9ddc75919380f5bf6e044bbf9eff55b0e8bdea471e28a051
MD5 3bf39c383ba97dc07709c5b0e6550f7a
SHA1 6ff0d193b2a86a5f1b4255666caa12e4b4c2f893
SHA512 a40c84af0aa64b6b2b3bb967a5c61d8062f9988c3369acfb4578bb31db79e430ccc7eb34163639f4dd4cc6a6e194fd9fe3b3ba807029e415b449185e9fcaf692
SSDEEP 393216:R85vzN4pLRolGjcOoqy5Xd/+z9suBU7JnGCnGjbi2bjRoXiKO2xJkvPNlzQz0Ky1:m5vzWpLRvjXoRldWzLYJnGCnkbi2nRcr
TLSH
T1461733A466C108E3EAC30936C8EB9965F6A8FE130731D0DF07A655651E336D2763EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA224.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI25402\Crypto\Hash\_SHA224.pyd
Size 21KB
SHA256 773fac9a1a65b31d22f79a5e4f035ddc00301b741873d334ee9902db1d1bebfd
MD5 f18df573602776a7449e4452aec66d99
SHA1 28a957f3b1a738a4d10452faf867f484c2ac743c
SHA512 ad6cd03b1ce8a01fe87ecdb403701e44c118a799e39fd36989be9997b9b29c8a4f52765a67d1cdce3bd9eeb2147020fdd898afde52a6f5855f1037e48cfae9e8
SSDEEP 384:JKXqHGcvYHp5RYcARQOj4MSTjqgPmzIHXqBJ93c3O9zMR7kLMhgZvRv:JP/Ytswv9HXM3c3hkLMKZZv
TLSH
T137A20B19AF3884A4E40E603AB333867B7BF47600D394B7EF8A505B991C263ED563465A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qt_help_en.qm

Path C:\Users\Admin\AppData\Local\Temp\_MEI25402\PyQt5\Qt5\translations\qt_help_en.qm
Size 16B
SHA256 9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85
MD5 bcebcf42735c6849bdecbb77451021dd
SHA1 4884fd9af6890647b7af1aefa57f38cca49ad899
SHA512 f951b511ffb1a6b94b1bcae9df26b41b2ff829560583d7c83e70279d1b5304bde299b3679d863cad6bb79d0beda524fc195b7f054ecf11d2090037526b451b78
MD5 SHA1 SHA512

Submit Download

_imaging.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\PIL\_imaging.cp313-win_amd64.pyd
Size 2.5MB
SHA256 88756e8e0e3f6180e518da25d379597c861e2d20d716ef001894789b515c1777
MD5 2a2cc91e89b4c2ffd8a3b7c9ff1ba501
SHA1 1b8f537b9c43be807913326947d363d3666ef081
SHA512 a84257af721b6c402fea294ac9e5250423917535dcc17d6e18a860e7e489a463911467d67dc473f8d79881a09679e180a845931285d23d6cbb8287dcf4c2b3bb
SSDEEP 49152:XgfxvpYq3LG6bjJ9HQUfBA9f21kExA+RERbF3:apY+G6bgU5AuAD
TLSH
T128C57C02F591589ADA724034CDAAD626E371780D1BF186F7B684A7F93A33BD03937385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_asyncio.pyd
Size 71KB
SHA256 2d13fa4b5ef94464bb94e2ec613eceb5bbad70c8e7e05f0e8ef25f6078397cdc
MD5 bf84f117fcbda7f64dceaff50a497bb3
SHA1 daf924ca0631b5a913e6ca35404220206dca95a3
SHA512 65a1b84c55db775deda25473d2ca080ed478911f26d6fc1b797f5a0e6d5243253287a4c923e0d19eed45ba78610b87ca65dd69e110f20d65007194ba2d680db8
SSDEEP 1536:hi9HXOnui7hkcKaC7mV7UoxIFvnky1Ni9pfIkPuA:hi9HXOnuiqDaC7mRTxIFvnRrA
TLSH
T130638F87A2A4418BDEA7A274D5636F92FBF0F6921901575F60A8C18E2F133D183FE711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_bz2.pyd
Size 84KB
SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
MD5 cf64abae18a5ce2c95b8e894fa5cfdc3
SHA1 76d87bef339e31af803a1a930b33a3e5dbc1c0cf
SHA512 7c4787b7cda291f49ce1bf9e1716ec5d50ae42a84425136c75c155c6fddbea00bc2900c6779f88f8d4cc47c0ed61f5f6c1caa433e660f0b8e5cb78e449ef35cf
SSDEEP 1536:NeFNPz7faNtxDCkrp43zOB2YHClj9l8sEsHiuP5IFLVAy1Ni9lfIL0qAO:4FVzzaww2DOsl9KsXCK5IFLV9dAO
TLSH
T1A4836D43B77461F6F9AF81B496810353F730BE960710A3AFB25482993F13B91EE68359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_cffi_backend.cp313-win_amd64.pyd
Size 176KB
SHA256 21b7160d4a6da9590794fdb38718982060b5c92d56fb0e441fc8b62ee789be8d
MD5 8401e66257d7a7c03e2783b8adcee482
SHA1 57f6a22162c76964675dfe35e79be229bd6e54e2
SHA512 e868dd99b1a8f1d0d5f84af461573aae35f9e4433dd5710a23fb2f7b3f552405255e7ebd048b206412e80cf327d10f093c510befc335e4dc2461229f9fae36f6
SSDEEP 3072:KBZr0elNwqlDYuhJsPXHDFYHuSQT9wPHeR4quOVstP7eBSTLEKXj25Mf78A+TVq:KTwqd8jFYHuSQxwPHROVQKBSTLrqg78Z
TLSH
T130046C5A329C11B6D5A2917886579B43E3B3B430171197CF01A0C7B62F1BBE67A7FB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_ctypes.pyd
Size 131KB
SHA256 75687620596877b0dde462e74ae12140d695b3c78df3c6c099d55717768dde42
MD5 744a8886e7187cb632da61e2d48ebafa
SHA1 e105fe498617813f2d34e578d48b82e23e56a972
SHA512 a362fc3eee1a7f71d9b82dc3b6b268e1d3115d20733b40e3891ab04469f9f8fbb1f6ee07d6a92a78cba82c7c53101bfde13c99f9a3feffa5430b94791ecae30c
SSDEEP 3072:/uZHKSoKYGYzZkdf/F2zy4PK8fUSlIFyPAT0:moZAf/F2zyIK+USC0
TLSH
T10DD37D0B736800AADAA79178C533AF47EFB1B453161057CF02A4C59A2F63B926E7F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_decimal.pyd
Size 279KB
SHA256 906964c01d04b360c316a2bb86d03d9ca9864e039baa01fa866815e6dce4a9b1
MD5 ad0735e6ae9d3488ddf108371c303399
SHA1 7a8cdc9b47baeb1b2bc76c054198342b81560baf
SHA512 b45696477eb7d391837d315e9df0ef01561c080592ad6aae6212dce773f70f6d02ad14e831710629087920901a7ad36ac7cefde1cf990c04f0a3756973338000
SSDEEP 6144:NqfsHaThoLc99xGspVHjAUKSsXmGqqM33fIWeAkMWl3r:Nda1o4jYspVHkUK7eXQr
TLSH
T135547C57A3490CA8EE73807485979E57F7B278960320D78F43E48AA73F937A2236D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_elementtree.pyd
Size 132KB
SHA256 98474a51706eaff41ec303e0ae3b91605fbf9112daad837007793e53f482f1c9
MD5 e526aacdddda96bfb3c04b8beb5eb567
SHA1 4ed54da3d17712c2a3982fc2d51019f296168c08
SHA512 7db744f2a8c6ee61e72def975ceab57e8a90c2890a5508c84c0582b397bed162b12131a00636fb9d9d1abd5415fdb75b7c15c82cd11ff08aa92262c592d7b182
SSDEEP 3072:HU1FeaSxqoarG330qDbjn5C5Qx55BVdk+hHGjYQNMWL5JIFzfFpnZ:01yb30qvtC5Qx5A8SXNMWtEZ
TLSH
T168D34B8B7265C06BE462503CD2A78F56EBF6F9A20D40879F2294F29C9F333813E59715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_hashlib.pyd
Size 67KB
SHA256 5eb4a2aa9e28b49cb2a4f6ecee21f3c2b629b43a0709bad1d7e6204bac74eac2
MD5 648a300c9deda89218f23faacd7b0d17
SHA1 fd5fda7807cbfbaa23d052fcd8140d7ff4e98ff6
SHA512 27a8dc1dc1dad7aeed93912b9544760a984e5e3da0014fce1b66170079992cfea36c18212024982336d415ddb17db114ca0c45c85dabf7218b9467bed2d3fe6d
SSDEEP 1536:XMqXn1yAu1lEAXfXhfcV5TaSZ6CAxIFvIdy1Ni9/kfIbH5OnM:B1w1uAJfcySZ6CAxIFvIFNT5Z
TLSH
T152637C95A6494092E92382B5C4A34F83F9B1F3521711ABDFA2A8C18D2F237C38777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_lzma.pyd
Size 155KB
SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
MD5 a6bd469ef44eb08284a417fd5aaa4096
SHA1 ca65c9e0ee9bfdd3e8abbe46eb78b6bba1d657a4
SHA512 85198fbfcf517a3da03e897333dc5af4deb3c8eceee61e172a3effe7e6f79de9c76e029049bd727aa782ac018feebcabef73804df9270c49a1b6e411f149cd59
SSDEEP 3072:vK1fxTOfpRnifp5/eNRFAznf59mNomURj5IF01SL5E:v6JTOjKsHWhYOXjQFE
TLSH
T17CF35B86B794F0E5F3328C38D6624F57E6F5795A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_multiprocessing.pyd
Size 37KB
SHA256 c04d2822d62f675df86d748ee552918e6ef2de5659ad2ce91dda5e10ecf35fc7
MD5 9969cd0a24b781e74978698c34ab5a25
SHA1 9151a2370a58b6ef3afc1da99d6d3fe9b7d43262
SHA512 e188019fc06520c4e7963ba52118363fb5b5b2ee47a0e486e004abbb06ba10cfbbdeef6b68072020b5d56e90a59630d30cae211bf4bd9ee30b64840d1d045680
SSDEEP 768:nsf5SZTKMQ6Dp2ssIFnt3y1KPuBL2Ip4KOTxf1mlIJhpp6:sfFH6Dp2ssIFnt3y1Ni95fIkhj6
TLSH
T101038C86A62C4087E9678631C1A3EF86F534F7D31A21971F31A4D2CE1E373C2636A359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_overlapped.pyd
Size 56KB
SHA256 579438a55311bf39b32145b8dec7846bd6830dfa461345236a37cc0c833a4a51
MD5 cfa143555a7afc3233518de4e6a443ca
SHA1 4acdb60a734bfdfdc89580a7b7b6816aaee1e0d1
SHA512 c960bc8aea3ac1b7018a8a72b82340e8decd952387288170307ace51b3d75c484187ccbeb41fabcc523b97c1f553ec062bb828c45be110a95d5ec6e49c3e1ab4
SSDEEP 1536:oSaLVGTbjGW2PZMYirp9IFWtfy1Ni9MfIYdg:eNPaRp9IFWt9n
TLSH
T153436B4A679401D6ED27C278D6639E43F774B3D70201A32F61A8D24A2F737A2A71F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_queue.pyd
Size 34KB
SHA256 6d77d15d668cb5ddff53cff1479dffc97db5858451d4b98f6e60a23cfb529e01
MD5 fee7303e90a0bb9197ec83a4a7ab7669
SHA1 c0a9edd7070a06f9a6c35002ec947abbe14644a1
SHA512 dedf77507ab46a6f2a9b34191f7c3e1b4a2af5ff6ee52f914653dde0d81f3fd8b580a73ce8742b47e175098649a1add77b2dc271616af68a3c3389273c32db3e
SSDEEP 768:H2Zhyt9jf8lIF9UJyy1KPuBL2Ip4PTxf1ml6Z+7U/Fg5U6:2+9jf8lIF9UUy1Ni91fILYqU6
TLSH
T133F26DC66B685047E663C630C1E7EE92F535F7D35A018B6F20A8D28A1E233C2D376359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_socket.pyd
Size 84KB
SHA256 ba944001aa6b53350f8c64e93643742abf1a08dd07c7dbbc13996e7d4d8a9efa
MD5 a40238c4b5c9821defaef7cbf70574c3
SHA1 cd478ef13743ff1fb0bdea95a5260b38e6fd0ae0
SHA512 abe79ecd594a1366de25e05f3be81f5a0da7616fb5d0481bf5cda156e55212680a6e9fb1966cde3ca470737e2d56dc167108b08aca8f314fa48ca38283895187
SSDEEP 1536:3Fl/fFBFu9aBvtgYKyNEyJw7QlyJ+i+nzmQwLvxtq388ZlIFywvy1Ni9JfIYbQ:3FR1u9mvPEyJw7QlyJL+nzmQSvxSxlII
TLSH
T1CE836B01A66040F6EB73C075C2639E63FB74B1C01395A75F0466C55A2F33782AF7AA86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_sqlite3.pyd
Size 128KB
SHA256 ff76e7c20008fa59e8cd9c6bb8ec47f689a2cc2dc0c9b8ad9e19572b37b9d7db
MD5 fe837834aa5d513bdf3717e6e90ef269
SHA1 7da69c6989920c6d754b8bf357646af6243de795
SHA512 b7c5e76a0f13ac210117ca8de4743f9a0d7932b7b9f07c8e1266294cf2cf66b5f90411cf6453ec76d3193275a119c97469cc37bb04cc9350a8484955cd5da78e
SSDEEP 3072:qNixQwcTa80myttKD/56SttOtN5p2xcTtPuTBxIFvQAt:UT/V/5GTNuTBy
TLSH
T137D35B5B6314009AF9B742B8C1734A03EB75F5625731439F55A0C68A2F377C3AE3AB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_ssl.pyd
Size 177KB
SHA256 1cf939510359f5aa3c5f51a0ad994d9b819f5603dd100872cd30a1e25cd83f05
MD5 d41518f976563868b1626afd2eafb825
SHA1 2d1189562e4d37949d8b254ee3b94825d3787e29
SHA512 f9e1284720bd98e9e53feb2f2d16a0b86a6ddef4245789a9593e3e0bf230595577f1509f9050fae26619850661c6f5892ca5d33429b92efc6976565dd47bb98e
SSDEEP 3072:L9fZJvjN6U2kGMlfV6Cv/1UOmI7IM/cbPuC/Je5IFL7Oa5:L9xJrEU2tqV6CvqOss05
TLSH
T1AB048C47B5945AF7D813E4F9C1234903EBB0F155331247DE48D6E64A0F03B4AAEAAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_uuid.pyd
Size 27KB
SHA256 e196b2a878b8a57976e9ab5d7610e35a85e2fe3043fd3952934a54b415bd2854
MD5 8339c4c57827e3a294b9f711652ee4a3
SHA1 f940f35834b04c9896c7f2cad36ff6443fc3cb54
SHA512 bc35fdcaf87d3135863e41dbbe97c454dd8b6eeda9297ce3bd051b70ab7384bbafbe7fb24138aa5a1001b7b53565b1291c90e602f41d1244eacbd6e41a274a6e
SSDEEP 768:1TNg5n5IF0w2y1KPuBL2Ip40zTxf1mlRaX1Cbel:1xg5n5IF0w2y1Ni9MfIY1ll
TLSH
T12BC26DCA9A748043FE5396B0C1F6DE83B939BBD35911976B317591860E133C1A31B36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_wmi.pyd
Size 38KB
SHA256 ca38a50c27413a5acfd14b30b0433fcf80a64ad0020e41aceeb3666f8439aba4
MD5 39bf31877dd6b64700451021a91cd32e
SHA1 dca8e58dfe221c74f22c8bf56871e49a4f187966
SHA512 340765268b60520f6cf72cd37e6e9b5d1f728448ce2fd29427823f2bbb9630ee6894799c68744cf5bf65685772ba8b514e7735b76a298b94f5fc557513cfee55
SSDEEP 768:Z2/EEqrVmjsuuD2cru5IFLi9y1KPuBL2Ip4ETxf1ml6Z+7UBFg58:UE9BEKD2cru5IFLi9y1Ni9YfILqq8
TLSH
T192037D86E6680082FA6BC674C5A5CE93F575F7D35B12838F326582590F233D1D73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd
Size 221KB
SHA256 58c25c988641247cc153a987d1080dceb65c3a5cea68be96f0ac5b29c700ab05
MD5 ebe91ea40d152dd778e975805369e4c3
SHA1 793150512a5cf9a5da394ea0882683e3d4fa5122
SHA512 8c1369dd31e13687dc9c2e059c98dcab175944e4f1a9eec3ac384599f4a79274a9899cc17015de08d74addd8460949fa7fd141f57eb05deab6d3b0cb3706e4e5
SSDEEP 6144:UYuBpEZSXmSFhx8cQxkP8VXaVlaz8fnt4HtFmiGJyMItUxCRv:fuBGZShx8crIl
TLSH
T140243A3662880062ED7752758C63E123DAF2B161473262CF05E0CBA55F27BDAB6FDB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\base_library.zip
Size 1.3MB
SHA256 d4244a7d473911c8c64ee2b7f061199b5c3cacc7d4b267e980590aab7d421c07
MD5 020fe8c21577c098a9e8da2fc4606862
SHA1 5184c263ebc72e1eb49ba5f9a0184fbc7067c20b
SHA512 9901dc13bef05ff70769f0668c87e1d1b0a617496e6f83d481c74bf7662082d949871cba5e6dc4d4b6e4e544f477098cc456b07b90996184122d591d651701ae
SSDEEP 12288:CW7WpOuIva80201jwCVRDVoioSYK6niwi2cPPdxhY+tYzGN8TxPl3wsEk55BL+DK:b7WpOz5cPPdxhYnSuTxhw/dZWwpFOr
TLSH
T10A651982B9527953FF54F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\certifi\cacert.pem
Size 234KB
SHA256 9cc2a774b5198dcff14d9be1e66091f538975d867ce029a96bce15a55dfd730f
MD5 eae6947de5ef7a283146da71e558021d
SHA1 9110158ba911882667460f8c81fbd7510353dfd7
SHA512 97678d7ef9beb4fae3d9dcda9869a7f40f61058de4ea1623b5f1e0599b34f6de0214d82a288c27faf80e06a0897bdb57eed262767c4995795a74dadce25c7947
SSDEEP 6144:0pl6RrqADwYCuCRT/QRSRqNb7c4u59hrh:0L6RrHnRWav309f
TLSH
T1E5347C954F2A9C092C9FE1C1CA9B1357DD3A027A99FEF0F1390A2408D24622B57FDD9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\charset_normalizer\cd.cp313-win_amd64.pyd
Size 10KB
SHA256 77e1c9c2679ea4855d5b97dba2666c6b4cfe32636945f5bb8399ff2c7ef1b050
MD5 83c5bb15d82a7ec2b207b9c38d6e1018
SHA1 3f065b16e1e2405861a72f6c9e287f317b3034ab
SHA512 062a5f098e8b134869e9daa2219de73ff9ce86945a975e7d472a929d4fa14804b3120b818e7e4498fa9e22e06265236910e3e74c58d35f88b2621043aaf9b8b3
SSDEEP 192:RD0eIaQYVYZuLnN6KxvecRo930aeG1TbhGuE9H7EuO5:jkYVVLN6Kxxo93wmAuEZ4l
TLSH
T1E522E54CFA568CF6DB25023989A70F5E31B5BA25179237CF53B0C12E1EE3BE65278580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\libcrypto-3.dll
Size 5.0MB
SHA256 09499e186cf0e434ffa17ad153aa9a66d6048c54a2c03b823e2a06c49d9affe4
MD5 6d0a1af0e9a539a749dd50add9c4c27b
SHA1 e484df936d4c1072f6aaa287ef41fe8ed238e87b
SHA512 485c01182e838488c93cdc6d526d5f568b52101ac49a5739461fb3480ec490110a50695f53f60079431c940880a3c049fdac8e562bb00e0930578b2cb947d5e4
SSDEEP 98304:uAH+4va7N1rRtynkJj2uSFPzy1CPwDvt3uFlDC/R:uuVv+1rRkMj2uSF21CPwDvt3uFlDC/R
TLSH
T111367B6AA7A80189E4BAC13CC9534617D2B1F85A57B097CF18A156BD0F37FCA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\libssl-3.dll
Size 776KB
SHA256 28c395290279fa4f4f54a57b85cd66d853895f925fefb8f6fdebc0d8b1cdd07c
MD5 08ce4a95de930fd27157c67117f9a613
SHA1 286599acbf6695aba6ce0db02d70ce93d08d8ec7
SHA512 36df1092ad0c6474781e6a3a4f12bc6de57619628d76ff49cc98c53ea05f6b7a81f78b19c01ea188b8703f986527f23fc55725d4478656317da306e728e7fd18
SSDEEP 12288:0ZTYMn3pvH8hSil3nuZEV+sIP+US9dFe9XbI:tMn3pvH8Uil3uZEV+sIP+xFe9XbI
TLSH
T1A7F44CADB37C05DCD8B6C17986934623E3B6F4562330EBEB065186790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\pyexpat.pyd
Size 216KB
SHA256 1037b8bfb0cd313119b09b4ee76ff85dffa49ba9a334f36013b8b871ad29d0e8
MD5 70142e7c67da85be5fc0d54dae12c957
SHA1 7c4d9b576aedca7bbf0c2c91a611afe72a04f0e1
SHA512 a000d618006ecc1687fa9df2bb247034b0eafdd417258cf096a04429eead42fc58b419568ea74a61432e0e12a993f8428fb0cc21aea12d0d2ce5ac878c22c730
SSDEEP 6144:+8aF/t03rvmzxO0WsXVWpOi3ZmTwXShYid9Yfm8:+pF/t038U5
TLSH
T18C247D5BB261C0EBD843C138D5978B17DAB2B86503909ACF52C4E77DAF2B751376A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\python313.dll
Size 5.8MB
SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
MD5 b0f3aa8a9fc7462f25b1f48f3174dfa5
SHA1 63243edfcf789b5fb9370e5baa27e9a07ba3ebaa
SHA512 07b83bd20ff501f4753273684e4e539a5722dd0eb2689c045665da12e5a1b0950c70ba9c8e4dd99be72057b9311ed4199b643639b8f49f1cba8c41c8c29bc57e
SSDEEP 49152:kYxOb4yPiEMqTGnJwYE2M8SMW+IC1f37M2nGyN7yd5va4ifhSBqVX0Yy13KR/x1n:gPzKWIHosdoBcqbei8I0CSvNHDMiEnsj
TLSH
T15D567C16729E40ACD97B8078CA17864BFBB27C013E60534B61E6BB5D2FB3362476E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\pywin32_system32\pywintypes313.dll
Size 133KB
SHA256 ea82e185e0bed58485a8df23712b62224f5e486dbb84d946115cad17512065cb
MD5 53e3a01abb3ed77219a364445b3f2c97
SHA1 4542d5390aa4cd5ec34992da4d7118b52d2f8bf7
SHA512 6605ed1550b8d7fe8b72a6ddb25c17298807f497bcf681c3cac2dcb3b128d4c9da2b5f2b209e345181d276da4729eed313284c807997541f7f4dbc72b0ea0ef1
SSDEEP 3072:0dyqdYmyWa5br4d1qfGHrY/rZ6Yr2laFU4LGUgl4jptIaiTa:04aYlWa9r61LrY/rPbFU4NgOjptI
TLSH
T167D33A47378684DAE96A937DCD771A02D3A2B0100711E3CF46A1C28B6F637E66D3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\select.pyd
Size 32KB
SHA256 a208997eb871b5c7785eb9bcc6a22ba8c43262255b59a3394fbe9912f38b4692
MD5 9583139460ba3a40961b03c76f12450f
SHA1 70f4d1e8015a98972eb82d3012fea6826254ca7e
SHA512 19e4865a001ecaf6ca7815b7779238e39a58e87e55e479fb4e47baa8e0262e886f8fef64304e0692577464fa92173b81d1f5e4c12a3e0f3244ffe1f1913d84de
SSDEEP 768:/pX5TZnELTaPlIF9Gzy1KPuBL2Ip40LTxf1ml9dHi7LL:hX5T5E/aPlIF9Gzy1Ni90pfIbHinL
TLSH
T1C6E28D8A6B345087EA63C671C6A2DE83F939B3E34651869F31B991991E137C1A33B314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\sqlite3.dll
Size 1.5MB
SHA256 22d25619e7ccea3e6d1038b5d28bdae5761a88c19a6e228dd867d0a7d5cf2c45
MD5 88154e1974ee6caca4504ae1f3f815c7
SHA1 18e1cd4fe39c0dd2bb9a4f324e9f166c0a8a5c99
SHA512 25d595fc95b079de0637b72ca971b264c9bb9687589e40bd4e899b3e900b766c25dc002f6e4b415fa18dabe6a29bec04da10965f5f631b031674724ee62b8426
SSDEEP 24576:fDKX0pwDaOrROsxNkJPcG/Z2ZQQSKTWzdPcZb0LJ0ZC5hJ07gf4UBd84ZD1fBX3a:r8pOsxNkJPcGxWQuWRP+bZ6Icf4vC1fQ
TLSH
T116759D4BF2B801ADD0A7C17A851B1707EBB1B4051B64A7DF1590CAA92F53FE217BE324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\unicodedata.pyd
Size 696KB
SHA256 7f8d28574732959cdb1188127fe3494c3618b602eede69c0a71846f0b5cc8a15
MD5 e812b4f088002142f39d1ec8cded9478
SHA1 44a5ef735de03a29384ce8797897fffc047298cc
SHA512 f4c848a024e62b302b9f2c3b985455d332cb24084809d8163667677b62ed3a4342b324774712443e91c65250ce7e448f28c21d1b3951ee116484eee881e60fd8
SSDEEP 12288:iegxeYedLI/X77mvfldCK1ihH32W3cnPSqrUgTNF:iegxeYeW7qNxq3cnPXTNF
TLSH
T13FE4F5D5BBCF8D26E68B363948E3710F5171C3B35F0A863AB2582361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32crypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\win32\win32crypt.pyd
Size 123KB
SHA256 773c9f0ef15a6b4fffb3d8748ceb3d1e062616f29aa18fbccfb5f6df23493a46
MD5 aa46dc5e212a86515ba32cfe80f6ecce
SHA1 8c1d915c558ae0335c4610ee744de129d8e2b001
SHA512 bb62dc623f6bfc06ee7aeef6ca88d815ad41ca9405df59a8ca08ad8ddfab6bacd7d9dd63f5a22fc2bc84df0faeffd73b0a7846500774541dce91a31d280023e6
SSDEEP 1536:xpsi8C3bAiE7bnJzSQoRhAceeVXBz1nqsdiO0yASc9YUNlFEQasuxN5E4d2E6Urt:xtdMimzV9OqnO09YUDux32E6UPa0
TLSH
T171C34C03729259CAE9AAD3BDC823A903E7A5B015171167CF0990C6DA0F67BE47D3E34D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/780-2484-0x0000024824500000-0x0000024824AC6000-memory.dmp

Download

memory/780-1324-0x00007FFBB0CF0000-0x00007FFBB0F53000-memory.dmp

Download

memory/3336-2485-0x00007FFBC1230000-0x00007FFBC1259000-memory.dmp

Download

memory/3336-2483-0x00007FFBB1C80000-0x00007FFBB1EE3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads