4eaba8437738a869701911dd65e684666ecf246ce592d32e7cb47480bc976c25

Analysis

max time kernel
151s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 79.3MB
Sample260810-dbczcatxdx
SHA256 4eaba8437738a869701911dd65e684666ecf246ce592d32e7cb47480bc976c25
MD5 34784aa8aab708ae8060a8e2769377fd
SHA1 d11261eee0ee17ad1f627e88b15d66e288ee2e7b
SHA512 556719e71d851c70e3ae2805acf26e8bdd24c0241c443dce452d8b33dc01db592e845139cf70ac11f542b07f037919f44a1d6ddd13c2c029531d8c16e437837f
SSDEEP 1572864:YYxhQL0OWtLjZwV1JMjZAxH0R51gqTcaNH21A/IlnGCnkqaV+BbnYJmgZtN9o+8a:YYxGL0O8LFwbRH0R5L7lxI9GCnkvV+Bc
TLSH
T13F0833CE7F8198C6F45A03765996C938AA19FE58472641AA47EC3C333C3B3D4C9B5A31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1364	CoteabMacro.exe
5668	CoteabMacro.exe

Loads dropped DLL 64 IoCs

pid	Process
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5668	CoteabMacro.exe
5668	CoteabMacro.exe
5668	CoteabMacro.exe
5668	CoteabMacro.exe
5668	CoteabMacro.exe
5668	CoteabMacro.exe
5668	CoteabMacro.exe
5668	CoteabMacro.exe
5668	CoteabMacro.exe
5668	CoteabMacro.exe
5668	CoteabMacro.exe
5668	CoteabMacro.exe
5668	CoteabMacro.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CoteabMacro.exe

Contacts third-party web service commonly abused for C2 1 TTPs 18 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
61	raw.githubusercontent.com
2	raw.githubusercontent.com
5	raw.githubusercontent.com
6	raw.githubusercontent.com
24	raw.githubusercontent.com
65	raw.githubusercontent.com
8	raw.githubusercontent.com
9	raw.githubusercontent.com
44	raw.githubusercontent.com
1	raw.githubusercontent.com
23	raw.githubusercontent.com
3	raw.githubusercontent.com
4	raw.githubusercontent.com
7	raw.githubusercontent.com
25	raw.githubusercontent.com
43	raw.githubusercontent.com
45	raw.githubusercontent.com
60	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
756	msedgewebview2.exe
1112	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	5668	CoteabMacro.exe
Token: SeDebugPrivilege	5668	CoteabMacro.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5668	CoteabMacro.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 4608	1932	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 4608 wrote to memory of 756	4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	91
PID 756 wrote to memory of 1428	756	msedgewebview2.exe	92
PID 756 wrote to memory of 4696	756	msedgewebview2.exe	93
PID 756 wrote to memory of 4696	756	msedgewebview2.exe	93
PID 756 wrote to memory of 4696	756	msedgewebview2.exe	93
PID 756 wrote to memory of 4696	756	msedgewebview2.exe	93
PID 756 wrote to memory of 2516	756	msedgewebview2.exe	94
PID 756 wrote to memory of 6064	756	msedgewebview2.exe	95
PID 756 wrote to memory of 6064	756	msedgewebview2.exe	95
PID 756 wrote to memory of 6064	756	msedgewebview2.exe	95
PID 756 wrote to memory of 2280	756	msedgewebview2.exe	96
PID 756 wrote to memory of 2280	756	msedgewebview2.exe	96
PID 756 wrote to memory of 2280	756	msedgewebview2.exe	96
PID 756 wrote to memory of 2280	756	msedgewebview2.exe	96
PID 756 wrote to memory of 2280	756	msedgewebview2.exe	96
PID 4608 wrote to memory of 1364	4608	2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 1364 wrote to memory of 5668	1364	CoteabMacro.exe	99
PID 5668 wrote to memory of 1112	5668	CoteabMacro.exe	100
PID 1112 wrote to memory of 564	1112	msedgewebview2.exe	101
PID 1112 wrote to memory of 1240	1112	msedgewebview2.exe	102
PID 1112 wrote to memory of 1240	1112	msedgewebview2.exe	102
PID 1112 wrote to memory of 1240	1112	msedgewebview2.exe	102
PID 1112 wrote to memory of 1240	1112	msedgewebview2.exe	102
PID 1112 wrote to memory of 4444	1112	msedgewebview2.exe	103
PID 1112 wrote to memory of 5576	1112	msedgewebview2.exe	104
PID 1112 wrote to memory of 5576	1112	msedgewebview2.exe	104
PID 1112 wrote to memory of 5576	1112	msedgewebview2.exe	104
PID 1112 wrote to memory of 4528	1112	msedgewebview2.exe	105
PID 1112 wrote to memory of 4528	1112	msedgewebview2.exe	105
PID 1112 wrote to memory of 4528	1112	msedgewebview2.exe	105
PID 1112 wrote to memory of 4528	1112	msedgewebview2.exe	105
PID 1112 wrote to memory of 4528	1112	msedgewebview2.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe --user-data-dir="C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --allow-file-access-from-files --disable-features=ElasticOverscroll --disable-gpu --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4608.2300.15001076466355969180 /pfhostedapp:c1d21fb2a4bd60012ea6f0cb4fc8e346e3ece9b1
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView /prefetch:4 /pfhostedapp:c1d21fb2a4bd60012ea6f0cb4fc8e346e3ece9b1 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x180,0x184,0x188,0x15c,0x190,0x7ffaabc45fd8,0x7ffaabc45fe4,0x7ffaabc45ff0
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView" --webview-exe-name=2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,3765585264712260319,9503210291806950376,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:2 /pfhostedapp:c1d21fb2a4bd60012ea6f0cb4fc8e346e3ece9b1
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView" --webview-exe-name=2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1892 --field-trial-handle=1764,i,3765585264712260319,9503210291806950376,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:3 /pfhostedapp:c1d21fb2a4bd60012ea6f0cb4fc8e346e3ece9b1
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView" --webview-exe-name=2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1764,i,3765585264712260319,9503210291806950376,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:c1d21fb2a4bd60012ea6f0cb4fc8e346e3ece9b1
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView" --webview-exe-name=2026-08-10_34784aa8aab708ae8060a8e2769377fd_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3412 --field-trial-handle=1764,i,3765585264712260319,9503210291806950376,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:c1d21fb2a4bd60012ea6f0cb4fc8e346e3ece9b1 /prefetch:1
      4⤵
      PID:2280
- - C:\Users\Admin\AppData\Local\Temp\CoteabMacro.exe
    C:\Users\Admin\AppData\Local\Temp\CoteabMacro.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\CoteabMacro.exe
      C:\Users\Admin\AppData\Local\Temp\CoteabMacro.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5668
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=CoteabMacro.exe --user-data-dir="C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --allow-file-access-from-files --disable-features=ElasticOverscroll --disable-gpu --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5668.3176.3267697465417831081 /pfhostedapp:fd62798e724e6a2c99e7d0c27199104666b33055
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:1112
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView /prefetch:4 /pfhostedapp:fd62798e724e6a2c99e7d0c27199104666b33055 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffaabc45fd8,0x7ffaabc45fe4,0x7ffaabc45ff0
        6⤵
        
        PID:564
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView" --webview-exe-name=CoteabMacro.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2584 --field-trial-handle=2588,i,6823528069856318126,7353224155626832501,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:2 /pfhostedapp:fd62798e724e6a2c99e7d0c27199104666b33055
        6⤵
        
        PID:1240
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView" --webview-exe-name=CoteabMacro.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3120 --field-trial-handle=2588,i,6823528069856318126,7353224155626832501,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:3 /pfhostedapp:fd62798e724e6a2c99e7d0c27199104666b33055
        6⤵
        
        PID:4444
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView" --webview-exe-name=CoteabMacro.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3312 --field-trial-handle=2588,i,6823528069856318126,7353224155626832501,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:fd62798e724e6a2c99e7d0c27199104666b33055
        6⤵
        
        PID:5576
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView" --webview-exe-name=CoteabMacro.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3348 --field-trial-handle=2588,i,6823528069856318126,7353224155626832501,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:fd62798e724e6a2c99e7d0c27199104666b33055 /prefetch:1
        6⤵
        
        PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 91863cc0a9a990b6cbff1717bbb9ad9c66d0a0d65dbef55ad94c971137d89362
MD5 4b1650cf1207ea1f857d8156e1e4a8a1
SHA1 68531e7c6901df5fe136ff54630030cd531543b0
SHA512 c2a7fe739c2c9115bf64148ac6d79ca943b83e433e39181a3598165b296b55f84a2e6f0e2d37d0f994f122820cd62c942043b88f9fb80ebea82ea96d589c1b40
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 43b94f2aeca06c108b1e778a384b15525f7712b97643ad924ad27a104746108f
MD5 5dcaee46046de9d5a6250f3fbdc66bd1
SHA1 622cc67f26bac63d61b839f187904177388b5709
SHA512 6de5c1634926877cc2c872571a4562b504e8be58b7a237da920ee3c71fe6f34e467be5697b19b99423542604f3e85aa80939c3a8e56229d5d15f256b4d21b05d
TLSH
T1CCD0121336515534C0213433100265481440C12B41456040542D869E1E0C6901D074A2
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5993da.TMP

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Default\Network\Network Persistent State~RFe5993da.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Default\Preferences
Size 5KB
SHA256 abb0cdce485be9e7f16959caa1974807ecde55522631ee4de23ad3b12a0d7e6c
MD5 2740067542309e0fa272c784598df5f7
SHA1 28c5184ffd9985e861d78c1db4678ced5b83768e
SHA512 eef7a58c2a831967cad36b74fbe7ee2550d7eccc88a1573a607b2a8064ab4da6ff7523a8008e365e07a98bb4520fc4315ac02c675c584cf57a4d44eb3d1ce51b
SSDEEP 96:rP/dyEhyfb9zkwdo5h16ZZs7/x+6Mhmuecmje6K+gzdI8XM1C7K:rXpCho+sV+FijuLg6K
TLSH
T1D9C174025E24797B4CCBE518BA36BA02D2FE602274D51E58E7F8962C08DB6DD231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5988ae.TMP

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Default\Preferences~RFe5988ae.TMP
Size 5KB
SHA256 8a2f11cce58e1192a5bd9e329671e9145803a41f383b414d59cf4021e41fa370
MD5 621996e8561db4dcc344a75c97772a66
SHA1 1456185bf0a765901e6a6b4c1cd400f0bc742bca
SHA512 97ce95c6222324766e6a2e61d4af0eee3cfaf1d3c3fb8e1b65e1b6e8015567b43b2ce876edf50410d7000e744d12b3e68fabc854418526ecb748114b674d039c
SSDEEP 96:rP/dyEhyfb9zkwdo616ZZs7/x+6Mhmuecmje6K+gzt28XM1C7K:rXpChojsV+FijujG6K
TLSH
T1CEC184025B28797F4CCBE108BA397A03D2FA643275D51D68E7F8962C08DB5DD631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Default\shared_proto_db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Local State
Size 3KB
SHA256 30b00b100efb7c135fc057fca57cb3be029d84efcb8f7750e1eaa70e2abca8a5
MD5 97b454c83f25c7b460930b0c586ee98d
SHA1 708408631c53cf85dc2c1a589c9007ccf31c710a
SHA512 5b38bd353d8571deb1107f91052fdb14aa9be25b650d912605347ecb7d952144c2af2a661df52c2013361060ccabef6b1aee4311e51d4ada059ef1e60ca86cb5
TLSH
T150718533A974AA3B8DF79544B9873B13A6E59027A5953FA9C6EC0F0C01D72DD2342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Local State
Size 3KB
SHA256 f10164ccb26f6efbd1e82e103a531320ad9e77e0d34ca96e476bd2be74fe40db
MD5 670f428587caa9379c3d25630d9f9f9b
SHA1 2fe7001a1505cea6aeba027eb5455aaa70cc0d74
SHA512 f6ae2d3df7666bc824744fd2e5cb4462b5f8c926604d62b956d43a6fe2c1a0293db9ff920b5ee4014a0f365bc4fb1df3af9ef7548e3d0179d0cb406844029dc6
TLSH
T175719423A970A93B9DF78545B9873B13A6A5902395D57FA9C6EC0F0C01C72DD1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Local State
Size 2KB
SHA256 93d306b3cdea3d574994acc96bd901a11b137de34ffc1d22ad357731142a8c3d
MD5 ed03932f0fb16b30053c25e641cce61b
SHA1 bbfcec69cd7edddb5088cf7006541a28c04a3bce
SHA512 e5b18fe8141046c2232f0179bb61142a34b5e2008a2ad680f44b4bab5edbf480baeb0901ff55bfddaa96fdfc2fec609138201e124db2819f7f6c75585c9fae6a
TLSH
T16B517573A9206B3BD9F7460479473B23CEFA90659A621F6597DC0B1C01C759D2341C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Local State
Size 3KB
SHA256 8a4aa10c684128907fdf76fa320728ab249380cc24bddfdfb12677633a406c10
MD5 87c516d091ea5872df689c925ca9e20a
SHA1 d2cb5178e657068af1b7ab35ac5172914d2a992c
SHA512 1cf538532f62491228cd7a2da1f14852c31211ff35527b8dd3de30fe340ac93edacfa2b73f5d0d1f29908ff348929926b41d2066acfec5d0e420b3ff7d72105e
TLSH
T1A96145379970AA3B8DF79A04B9872B12A6E59037E5953F69C7EC0F0C01C72982341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe595867.TMP

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330212\EBWebView\Local State~RFe595867.TMP
Size 1KB
SHA256 6270868a37574192d302bc6c5a8626214e424baf5fde738a710939be8d61860b
MD5 4f218658f9026d6fce501f64a69a591e
SHA1 cb595ebffb93ecee0ceeb85a226c58568d002ebe
SHA512 a3d564beadad1b2819b842bedea6e971d281e865f70568c9b993c07eec6f4651fb2bb2c6c01ca1fa1cd9c3edebe9945ce69536aef274dc8513c3b73f9268ed2f
TLSH
T1DA2132B3D5A05B37ECE312463653BB538EA5807A91614F04A3CD0B1C02D71DDA529C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 749969dbb047917911fbf1cc70e5beca98a63aa673bc048cdb9dcb6892524f85
MD5 5808ffe5034d82b2cdb52eaec387b451
SHA1 32d7043fee0ad18e6178ed32700acdc4a24b6c03
SHA512 6135ba4e306d669524bf91b55aae53d54e0085aa9a9ae7fb5d54c942ef90988a95130282daeab9410450b0f1aaac73dd4a7b11338d9b8c6d5dd30a2d712be240
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 42d0007df52403e4b04ba5e533486846fa03c5ef210b0bee0dd7f12635dec2b1
MD5 9e54fbad9cf87a02d3235b16ba532fa0
SHA1 55281b9cf15cce212a6da1f94a596d89a0485f85
SHA512 f86e279a44d866322e268cbe78a79ef95785592844fd20167a1afb4ed6473d6dc9e674dad31e2293c6817f678cb0a0456ef798ffec9dfb506ae69a4d6822ff6d
TLSH
T1C2D012267A010534CC2064730012E3880440C10F4116C041643CDE5D1E440900A03441
MD5 SHA1 SHA512 TLSH

Submit Download

38917d84-d383-42a2-95b3-06486255d9d3.tmp

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView\Default\38917d84-d383-42a2-95b3-06486255d9d3.tmp
Size 5KB
SHA256 33f2c992826a1996e2b7194bb7c8a0939b99e3a7c8f3b4d1fa0efb03a2845d20
MD5 ada732ec10ab78e0fb4f0ad6595d5bbb
SHA1 0410306dd97ac577ef933583cb6dbc1f186a04c4
SHA512 b3d070eaf33b92993ce5531c4d076f566671d532ece2a2a4c8d55adee5220fb39542d6e74a5568bcadaa679512ebfc8b5fa64512750402dca252fc59a2199e84
SSDEEP 96:sts/dyEOQuhb9kkoo5h16ZZs7/x+6MhmuecmjefK+gx+28XM1C7K:stgpDJo+sV+FijFL+G6K
TLSH
T19DC187025E28797B4CCAE119BE357B43D2FA603274D51E58E7F8462C04EB6DC631791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView\Default\ExtensionActivityComp
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView\Local State
Size 15KB
SHA256 90b3296abc64b0ff854da613da64e24ebcdb4abc187bbe7f1581dddc01631551
MD5 d131bdf54b6fe7fa82f652c70bbf3273
SHA1 1364dac7e9b64b4440fb5efe9b3e6030e750c61d
SHA512 2ea73dc54f95897ae6872c5a8ffd956b32b31200b59dda6b207940a527a6502fb4baf53f29cf9660cdf5c2a917e15420bd15cc0b47426972667d69cd27a0ecc5
SSDEEP 384:r+aQikB+z/xvxjg/qhEwNBS+nK1DAVdpAS9zO:K/UxvxjgC+GsDUbFO
TLSH
T12772AE2754393E33A5F7AA057A5D178BCBF994B294C12EB84AAD6F0D06C73E81302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView\Local State
Size 2KB
SHA256 30ebf680fd5d3a17f6885c4aac0aa1b6ca805f92432c8d8b36a76c8b5b21023f
MD5 ba623dc133f9e520be92ec443e57ae13
SHA1 925f818196284dc1a4351caaff510bd4820974ce
SHA512 b5d8a43f7c3f3b6e556401fa32736f22a2417a923d7573363e5bf2e451440da5c1f87607d5efc7c317036e272bd381f3c7d65f13c86810cb63a4f6be5cf36907
TLSH
T1D751A53368246B379AF746157A4A3B23CE6AA0A6AA511F64A7DC1F2C01D765C1302C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView\Local State
Size 3KB
SHA256 69f85acc4e62f62699e109944b84764ebef4634d254356230b7bfec32eac23c2
MD5 563cc8f64aae42cbcb84ca2d8cd8e8fe
SHA1 d627d741eb2f90ae33558bbb5b546260ecf9cf67
SHA512 75ccb30646677708f71e55de16fba1deefc1d3b8f7d07111c2170d9e485409b3d3a7eea08584ecfc1e1a6e40efc1ece3fb38750882e92e1842e3a2e5ed77dde7
TLSH
T1AB61A9335934AA374EF78A1579863B16A7969077E5813FA9D6EC0F1C01D739C1341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59bfeb.TMP

Path C:\Users\Admin\AppData\Local\CoteabMacro\WebView2UserData\Session_1786330242\EBWebView\Local State~RFe59bfeb.TMP
Size 1KB
SHA256 b5826e93863984639cdbd8ccf8c37f4d8675839fc59ddc585e7b32ae84f5262b
MD5 18d1fb50599eb20f23b6a0d12c4efac2
SHA1 6a13b9639649fa348ef050b7d2032127032817f6
SHA512 72246f93e2431dbf9673e705d311923416146ba392872c65c0ec265b5d24c7dc6931dd21509ae2ea5ede2b6a89121b1b5e2ffbe256ba3a809d20a6be82176bd6
TLSH
T16521627394341F33ADA612623256BA979E6390BF92404F5472DC8B2D02E638C922AC37
MD5 SHA1 SHA512 TLSH

Submit Download

config_aammi8o_.tmp

Path C:\Users\Admin\AppData\Local\CoteabMacro\config_aammi8o_.tmp
Size 50KB
SHA256 e030fe0c41f9d08dc5b4a4f4f76e47a38ea30c8fcb0457996aeb29a75a0f6fe0
MD5 44f1b1840ecff7af641329dda51f6038
SHA1 70101295adf8e56aefc1767ab89fe036511aba5f
SHA512 2232d5be5c635836b2eaab84d99d704478dc2f308d58b5d4e3e0cf34ab83b9f51375873cee1327f4258c6419f02ed0398ef21486b86eb7dc7619ffcf2587da17
SSDEEP 192:m0mZT56mHCyJKfAfWffwfftfOf+fcfSfmfxfEf+f8fOfnfzwLyMfO6y/MpyILcr5:gZpdkFUcJSouf0
TLSH
T1BC333832CA190D6D11BA837DD979D145E62983E7A0921C13B5BCA55C2FB31327BCBE0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

macro_logs.txt

Path C:\Users\Admin\AppData\Local\CoteabMacro\macro_logs.txt
Size 820B
SHA256 8623789a695cec0d48b20c1f955e5e20afb34a4ebcfc0a6930b90c5ae173bdae
MD5 5b3276aaeedd3630f176af0cbb4e409e
SHA1 2da7a34d7196b553a458834efd98aff4ef36d11b
SHA512 e0a5c6a349ead9160fbc25104d85bdb86ca39b42f67676bbc20f1a1b8edc41eb9de108d4b0af7e10951cab1f67a6ab34b5994ff457f2ad92b0e56eb6da78a865
TLSH
T1D401447C06EFB65EC94A8FCD1D58248E7214FF2202C8DF9292DC88CE48B451C29193DD
MD5 SHA1 SHA512 TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI13642\attrs-26.1.0.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

_imaging.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\PIL\_imaging.cp313-win_amd64.pyd
Size 2.5MB
SHA256 8a3b959721dc32f808dba6834b2bf167e98fe0068d067078b2bc544670d815bf
MD5 fcbbeb7c7ab8327e6e9d8d6ca08d6d01
SHA1 89103e66215f973bedc2a9629c382b4072fe9096
SHA512 fc5cdb62d61524be65bdda7ed0dbe9b364efd508c197e9c628e5533ba0d825fdf44008400d145dfc82eea6793651b185cf7b1faf3bbe85c1590e6b8bed02fb70
SSDEEP 49152:5Tn6pESaZDFg0zzT4xY+6Qnolv0idCl0knkEZGt:zjDQLidCxkK
TLSH
T12CC56C06E9D19599C6B28034CDAAC216E3B1780D17F187F77684A7F93E23BD0353A396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imagingft.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\PIL\_imagingft.cp313-win_amd64.pyd
Size 2.1MB
SHA256 9dc210ba1cb38382e5c350acba91133b0533e9a06e234f48bbef0e13e652d7ce
MD5 6f106ac9aaf72216a44bf044b3d80c0c
SHA1 94c7c0a255918c2b76101bd51e5ddad9585c2f26
SHA512 e3be306a12b17a7dab0831a2b13e5ed3bfe57c30878e25653fa3421700976a10a54691c64ac1005f23670e691e6f598363228253e9f4e4f87b1689841eadd6f9
SSDEEP 49152:xkzoyBIk5PwF/muFuhvwqIwH80ke/w+dylJwkE4RKu0Q:xpIuKu0Q
TLSH
T1DEA5BE46F29611A8C97BC174D293861BE3B574010305ABEB65E09B99BF23FF11BBE314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\_bz2.pyd
Size 84KB
SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
MD5 cf64abae18a5ce2c95b8e894fa5cfdc3
SHA1 76d87bef339e31af803a1a930b33a3e5dbc1c0cf
SHA512 7c4787b7cda291f49ce1bf9e1716ec5d50ae42a84425136c75c155c6fddbea00bc2900c6779f88f8d4cc47c0ed61f5f6c1caa433e660f0b8e5cb78e449ef35cf
SSDEEP 1536:NeFNPz7faNtxDCkrp43zOB2YHClj9l8sEsHiuP5IFLVAy1Ni9lfIL0qAO:4FVzzaww2DOsl9KsXCK5IFLV9dAO
TLSH
T1A4836D43B77461F6F9AF81B496810353F730BE960710A3AFB25482993F13B91EE68359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\_ctypes.pyd
Size 131KB
SHA256 75687620596877b0dde462e74ae12140d695b3c78df3c6c099d55717768dde42
MD5 744a8886e7187cb632da61e2d48ebafa
SHA1 e105fe498617813f2d34e578d48b82e23e56a972
SHA512 a362fc3eee1a7f71d9b82dc3b6b268e1d3115d20733b40e3891ab04469f9f8fbb1f6ee07d6a92a78cba82c7c53101bfde13c99f9a3feffa5430b94791ecae30c
SSDEEP 3072:/uZHKSoKYGYzZkdf/F2zy4PK8fUSlIFyPAT0:moZAf/F2zyIK+USC0
TLSH
T10DD37D0B736800AADAA79178C533AF47EFB1B453161057CF02A4C59A2F63B926E7F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\_hashlib.pyd
Size 67KB
SHA256 5eb4a2aa9e28b49cb2a4f6ecee21f3c2b629b43a0709bad1d7e6204bac74eac2
MD5 648a300c9deda89218f23faacd7b0d17
SHA1 fd5fda7807cbfbaa23d052fcd8140d7ff4e98ff6
SHA512 27a8dc1dc1dad7aeed93912b9544760a984e5e3da0014fce1b66170079992cfea36c18212024982336d415ddb17db114ca0c45c85dabf7218b9467bed2d3fe6d
SSDEEP 1536:XMqXn1yAu1lEAXfXhfcV5TaSZ6CAxIFvIdy1Ni9/kfIbH5OnM:B1w1uAJfcySZ6CAxIFvIFNT5Z
TLSH
T152637C95A6494092E92382B5C4A34F83F9B1F3521711ABDFA2A8C18D2F237C38777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\_lzma.pyd
Size 155KB
SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
MD5 a6bd469ef44eb08284a417fd5aaa4096
SHA1 ca65c9e0ee9bfdd3e8abbe46eb78b6bba1d657a4
SHA512 85198fbfcf517a3da03e897333dc5af4deb3c8eceee61e172a3effe7e6f79de9c76e029049bd727aa782ac018feebcabef73804df9270c49a1b6e411f149cd59
SSDEEP 3072:vK1fxTOfpRnifp5/eNRFAznf59mNomURj5IF01SL5E:v6JTOjKsHWhYOXjQFE
TLSH
T17CF35B86B794F0E5F3328C38D6624F57E6F5795A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\_queue.pyd
Size 34KB
SHA256 6d77d15d668cb5ddff53cff1479dffc97db5858451d4b98f6e60a23cfb529e01
MD5 fee7303e90a0bb9197ec83a4a7ab7669
SHA1 c0a9edd7070a06f9a6c35002ec947abbe14644a1
SHA512 dedf77507ab46a6f2a9b34191f7c3e1b4a2af5ff6ee52f914653dde0d81f3fd8b580a73ce8742b47e175098649a1add77b2dc271616af68a3c3389273c32db3e
SSDEEP 768:H2Zhyt9jf8lIF9UJyy1KPuBL2Ip4PTxf1ml6Z+7U/Fg5U6:2+9jf8lIF9UUy1Ni91fILYqU6
TLSH
T133F26DC66B685047E663C630C1E7EE92F535F7D35A018B6F20A8D28A1E233C2D376359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\_socket.pyd
Size 84KB
SHA256 ba944001aa6b53350f8c64e93643742abf1a08dd07c7dbbc13996e7d4d8a9efa
MD5 a40238c4b5c9821defaef7cbf70574c3
SHA1 cd478ef13743ff1fb0bdea95a5260b38e6fd0ae0
SHA512 abe79ecd594a1366de25e05f3be81f5a0da7616fb5d0481bf5cda156e55212680a6e9fb1966cde3ca470737e2d56dc167108b08aca8f314fa48ca38283895187
SSDEEP 1536:3Fl/fFBFu9aBvtgYKyNEyJw7QlyJ+i+nzmQwLvxtq388ZlIFywvy1Ni9JfIYbQ:3FR1u9mvPEyJw7QlyJL+nzmQSvxSxlII
TLSH
T1CE836B01A66040F6EB73C075C2639E63FB74B1C01395A75F0466C55A2F33782AF7AA86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\_ssl.pyd
Size 177KB
SHA256 1cf939510359f5aa3c5f51a0ad994d9b819f5603dd100872cd30a1e25cd83f05
MD5 d41518f976563868b1626afd2eafb825
SHA1 2d1189562e4d37949d8b254ee3b94825d3787e29
SHA512 f9e1284720bd98e9e53feb2f2d16a0b86a6ddef4245789a9593e3e0bf230595577f1509f9050fae26619850661c6f5892ca5d33429b92efc6976565dd47bb98e
SSDEEP 3072:L9fZJvjN6U2kGMlfV6Cv/1UOmI7IM/cbPuC/Je5IFL7Oa5:L9xJrEU2tqV6CvqOss05
TLSH
T1AB048C47B5945AF7D813E4F9C1234903EBB0F155331247DE48D6E64A0F03B4AAEAAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\_tkinter.pyd
Size 68KB
SHA256 fc9d4feb5f7e802f57cdf139c06b230c1a1aff28809bbcdb2e6da3adaba7d0ca
MD5 2067d4aa5289868d71171fc36bfcfede
SHA1 6b4d94d960290085025e2eb89c41069c87eb7565
SHA512 aba639571fbfa8cf4ea7a58f12e6bc1bb66afcbe260e03c6cfd012362e28fe2d0f3fe97c7240371d26e7f7ff579816fcc87d336d1964bd2ac79496019c4f33a1
SSDEEP 1536:C6f9aZoKcQRWhUDlU9oUq41su+46zyxIFvSTIy1Ni9tfIkeC:C6lJKDlPb41o43xIFvSTd2
TLSH
T117637D9BA7A4008BDEA7C135C5B39F13F675B6521A10920F01A4D39A2F333D3A7BA754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\_uuid.pyd
Size 27KB
SHA256 e196b2a878b8a57976e9ab5d7610e35a85e2fe3043fd3952934a54b415bd2854
MD5 8339c4c57827e3a294b9f711652ee4a3
SHA1 f940f35834b04c9896c7f2cad36ff6443fc3cb54
SHA512 bc35fdcaf87d3135863e41dbbe97c454dd8b6eeda9297ce3bd051b70ab7384bbafbe7fb24138aa5a1001b7b53565b1291c90e602f41d1244eacbd6e41a274a6e
SSDEEP 768:1TNg5n5IF0w2y1KPuBL2Ip40zTxf1mlRaX1Cbel:1xg5n5IF0w2y1Ni9MfIY1ll
TLSH
T12BC26DCA9A748043FE5396B0C1F6DE83B939BBD35911976B317591860E133C1A31B36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\_wmi.pyd
Size 38KB
SHA256 ca38a50c27413a5acfd14b30b0433fcf80a64ad0020e41aceeb3666f8439aba4
MD5 39bf31877dd6b64700451021a91cd32e
SHA1 dca8e58dfe221c74f22c8bf56871e49a4f187966
SHA512 340765268b60520f6cf72cd37e6e9b5d1f728448ce2fd29427823f2bbb9630ee6894799c68744cf5bf65685772ba8b514e7735b76a298b94f5fc557513cfee55
SSDEEP 768:Z2/EEqrVmjsuuD2cru5IFLi9y1KPuBL2Ip4ETxf1ml6Z+7UBFg58:UE9BEKD2cru5IFLi9y1Ni9YfILqq8
TLSH
T192037D86E6680082FA6BC674C5A5CE93F575F7D35B12838F326582590F233D1D73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd
Size 221KB
SHA256 58c25c988641247cc153a987d1080dceb65c3a5cea68be96f0ac5b29c700ab05
MD5 ebe91ea40d152dd778e975805369e4c3
SHA1 793150512a5cf9a5da394ea0882683e3d4fa5122
SHA512 8c1369dd31e13687dc9c2e059c98dcab175944e4f1a9eec3ac384599f4a79274a9899cc17015de08d74addd8460949fa7fd141f57eb05deab6d3b0cb3706e4e5
SSDEEP 6144:UYuBpEZSXmSFhx8cQxkP8VXaVlaz8fnt4HtFmiGJyMItUxCRv:fuBGZShx8crIl
TLSH
T140243A3662880062ED7752758C63E123DAF2B161473262CF05E0CBA55F27BDAB6FDB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\base_library.zip
Size 1.3MB
SHA256 d42a2e303f317a96f5b4744923a685767b05fc7c55d8284bf1b6524433447a4e
MD5 90939835ad032fd2337e51e70082eafa
SHA1 7719b28535b5a5723af2bf75f9a1987a4695d5a3
SHA512 9bd71d332699d8156c3229e05f09edbc85c4ed826e9689a71943a72103b248fdfe84496d444cc3671e76d5129c841deaa3c03ddd01f1e4869b6200f6b3487350
SSDEEP 12288:CL+D5uIva80201jwCVRDVoioSYwwsEDw3UKe155yW7WpdziOYv63tYzGN8Txii2C:T8wHwpU7WpdwSuTxi5cPPdxhYfdZFU
TLSH
T18C651982B9527953FF54F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\charset_normalizer\cd.cp313-win_amd64.pyd
Size 10KB
SHA256 77e1c9c2679ea4855d5b97dba2666c6b4cfe32636945f5bb8399ff2c7ef1b050
MD5 83c5bb15d82a7ec2b207b9c38d6e1018
SHA1 3f065b16e1e2405861a72f6c9e287f317b3034ab
SHA512 062a5f098e8b134869e9daa2219de73ff9ce86945a975e7d472a929d4fa14804b3120b818e7e4498fa9e22e06265236910e3e74c58d35f88b2621043aaf9b8b3
SSDEEP 192:RD0eIaQYVYZuLnN6KxvecRo930aeG1TbhGuE9H7EuO5:jkYVVLN6Kxxo93wmAuEZ4l
TLSH
T1E522E54CFA568CF6DB25023989A70F5E31B5BA25179237CF53B0C12E1EE3BE65278580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\libcrypto-3.dll
Size 5.0MB
SHA256 09499e186cf0e434ffa17ad153aa9a66d6048c54a2c03b823e2a06c49d9affe4
MD5 6d0a1af0e9a539a749dd50add9c4c27b
SHA1 e484df936d4c1072f6aaa287ef41fe8ed238e87b
SHA512 485c01182e838488c93cdc6d526d5f568b52101ac49a5739461fb3480ec490110a50695f53f60079431c940880a3c049fdac8e562bb00e0930578b2cb947d5e4
SSDEEP 98304:uAH+4va7N1rRtynkJj2uSFPzy1CPwDvt3uFlDC/R:uuVv+1rRkMj2uSF21CPwDvt3uFlDC/R
TLSH
T111367B6AA7A80189E4BAC13CC9534617D2B1F85A57B097CF18A156BD0F37FCA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\libssl-3.dll
Size 776KB
SHA256 28c395290279fa4f4f54a57b85cd66d853895f925fefb8f6fdebc0d8b1cdd07c
MD5 08ce4a95de930fd27157c67117f9a613
SHA1 286599acbf6695aba6ce0db02d70ce93d08d8ec7
SHA512 36df1092ad0c6474781e6a3a4f12bc6de57619628d76ff49cc98c53ea05f6b7a81f78b19c01ea188b8703f986527f23fc55725d4478656317da306e728e7fd18
SSDEEP 12288:0ZTYMn3pvH8hSil3nuZEV+sIP+US9dFe9XbI:tMn3pvH8Uil3uZEV+sIP+xFe9XbI
TLSH
T1A7F44CADB37C05DCD8B6C17986934623E3B6F4562330EBEB065186790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\psutil\_psutil_windows.pyd
Size 65KB
SHA256 9c7fc855d9d1614e70705c7dcc6f4ac3cdcab5adfeb6a67d382f5ade09eadc15
MD5 d30149d319efcaecf0a5c5e71ef6cb39
SHA1 99beeb17bfc69e8370036f9457edb4d6812b22e2
SHA512 b6fb265f0efed56fdd3455ed620e1fb581d40d2b23b92544cccbf331e30dc29592c4297e3faaf437a9d1a33099e0b48d5b2344943fb7b581a448f6c5806acec6
SSDEEP 1536:u9sgjR02IvVxv7WCyKm7c5Th4kBHTOvyyaZE:u7IvryCyKx5Th4k5OvyyO
TLSH
T187634A45B35800F4D95BA27C9AB36933E9B2B0520729A7DF45A0DA890F23BD7633DF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\python3.dll
Size 70KB
SHA256 16f109e8411bc08341497c87704b7cf0d22a2678f1e3a7dca416ea7bff995469
MD5 c460c13c3fa9038cf9c5e379b6d91281
SHA1 500df0f6ff1641983bf1abafd2829ce3c06912ff
SHA512 08eba88a8c9457568d201f6a64592ebeb037f33efe4cc081672a707a62fdc7cc5924520528386461c36a4ec5fdf16999ee0b99bc82f7ec6c2eabc0973f1289dc
SSDEEP 768:x+QEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxE:kotssyKcunV8PSlIFy0Ay1Ni9ifIkZE
TLSH
T113633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\python313.dll
Size 5.8MB
SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
MD5 b0f3aa8a9fc7462f25b1f48f3174dfa5
SHA1 63243edfcf789b5fb9370e5baa27e9a07ba3ebaa
SHA512 07b83bd20ff501f4753273684e4e539a5722dd0eb2689c045665da12e5a1b0950c70ba9c8e4dd99be72057b9311ed4199b643639b8f49f1cba8c41c8c29bc57e
SSDEEP 49152:kYxOb4yPiEMqTGnJwYE2M8SMW+IC1f37M2nGyN7yd5va4ifhSBqVX0Yy13KR/x1n:gPzKWIHosdoBcqbei8I0CSvNHDMiEnsj
TLSH
T15D567C16729E40ACD97B8078CA17864BFBB27C013E60534B61E6BB5D2FB3362476E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\pywin32_system32\pywintypes313.dll
Size 133KB
SHA256 ea82e185e0bed58485a8df23712b62224f5e486dbb84d946115cad17512065cb
MD5 53e3a01abb3ed77219a364445b3f2c97
SHA1 4542d5390aa4cd5ec34992da4d7118b52d2f8bf7
SHA512 6605ed1550b8d7fe8b72a6ddb25c17298807f497bcf681c3cac2dcb3b128d4c9da2b5f2b209e345181d276da4729eed313284c807997541f7f4dbc72b0ea0ef1
SSDEEP 3072:0dyqdYmyWa5br4d1qfGHrY/rZ6Yr2laFU4LGUgl4jptIaiTa:04aYlWa9r61LrY/rPbFU4NgOjptI
TLSH
T167D33A47378684DAE96A937DCD771A02D3A2B0100711E3CF46A1C28B6F637E66D3B746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\select.pyd
Size 32KB
SHA256 a208997eb871b5c7785eb9bcc6a22ba8c43262255b59a3394fbe9912f38b4692
MD5 9583139460ba3a40961b03c76f12450f
SHA1 70f4d1e8015a98972eb82d3012fea6826254ca7e
SHA512 19e4865a001ecaf6ca7815b7779238e39a58e87e55e479fb4e47baa8e0262e886f8fef64304e0692577464fa92173b81d1f5e4c12a3e0f3244ffe1f1913d84de
SSDEEP 768:/pX5TZnELTaPlIF9Gzy1KPuBL2Ip40LTxf1ml9dHi7LL:hX5T5E/aPlIF9Gzy1Ni90pfIbHinL
TLSH
T1C6E28D8A6B345087EA63C671C6A2DE83F939B3E34651869F31B991991E137C1A33B314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\tcl86t.dll
Size 1.8MB
SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
MD5 fa83a807131f3d4a6070eb884e682ad1
SHA1 226bf1cd0fc289034d9579c95ee0fe4df50cc6b8
SHA512 6e86f3725bb68af581e3e1b917c950f255e0f4348256fc02d8a560159cd225fe28303da2554c205636f2f82b9757072bf0c3460116bd7b09ef0bf01cc46125a2
SSDEEP 49152:D0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGP:YBUqMR7i6x9T+P
TLSH
T1E6859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\tk86t.dll
Size 1.5MB
SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
MD5 0da8eb1421517029c8d986519b0e5c63
SHA1 daa8395b9d691b5dfbdaa1f63256555a14010891
SHA512 f729f812901cc023111989d6e1eaa639d2ed2283bdb852c91abc283dee3d785295d3191f70f2ef535d268d454279a7ddd0339993f06be21b62d43d8ab27d70af
SSDEEP 49152:A76DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezf5:VQchLNqaJvARxr9DrTwylL1y5BEq8JTW
TLSH
T16E755A06B2A0C198C66FA134C91796BAE7F17C05931057DB72A0BE697F73BD2673A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\unicodedata.pyd
Size 696KB
SHA256 7f8d28574732959cdb1188127fe3494c3618b602eede69c0a71846f0b5cc8a15
MD5 e812b4f088002142f39d1ec8cded9478
SHA1 44a5ef735de03a29384ce8797897fffc047298cc
SHA512 f4c848a024e62b302b9f2c3b985455d332cb24084809d8163667677b62ed3a4342b324774712443e91c65250ce7e448f28c21d1b3951ee116484eee881e60fd8
SSDEEP 12288:iegxeYedLI/X77mvfldCK1ihH32W3cnPSqrUgTNF:iegxeYeW7qNxq3cnPXTNF
TLSH
T13FE4F5D5BBCF8D26E68B363948E3710F5171C3B35F0A863AB2582361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\win32\win32api.pyd
Size 135KB
SHA256 040d6a9ce12555d2585f89dce2aa4e25265c27dfa827eb9cae4c922e12ec731c
MD5 be180d10694c90e0b3e477c30b7620c7
SHA1 17dd8031f0008a15f4003d228d0661de5a8ae5ab
SHA512 c69c10c3ac8361ad682111d1f40c13f7736c2422967fdda2e0ade35a1bb970bff5d48bc17d8b6f0341963652425bb36b40a0d02108508b3643c6e9e58533ccb3
SSDEEP 3072:87AK00RjZk+uEIvPlRVlhLaN/PSexhlT9qTmP9bDm/GgUXJke:YAF0fu73lRVsPSexhbqyvcGg0
TLSH
T114D30683B35410C6D86AA37C81675F23DB72B8240725A7CF06A0C68A1F63BE97D3D795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32gui.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\win32\win32gui.pyd
Size 218KB
SHA256 b021c6ab915fd9370c659aebc90db1b52b3da7ccf61420687d40ff7eb813f20e
MD5 4d7b6ae4170817e0e2c51a5583793620
SHA1 044d4f741ec86fe300b0e84ac8ad9df65cd8a74f
SHA512 7ebbb43a4e2bca8871f9337ff152d1084fe7d9e85c6eaa00f2e7dc1e611ea20b1daad9cbb6e8c75fc75dc78f847ae200dc37a434dbc328a28207a2e390c0d399
SSDEEP 6144:d17Q3m78ggkAMXkfKVLEY1/H3ScssYJt:d1Qm72MUf8Qk4J
TLSH
T1E524D497B2955095D86AA1BC895B5E27F1B374300320ABCF0630CBBA1F1B7EA753D784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19322\zlib1.dll
Size 142KB
SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
MD5 eb3af30a0981219d851e6506db106bc2
SHA1 fd7b1b01dc01a7f32bd51f9a31bf717f4d55d09c
SHA512 8f55f4a86b747b5570d0f539c95dc1677eeba52bcd01850e8d86998b3415b99c92566ad9ece0e46b50e0e3a7eed6a4fe09604ec295f36f9bebf6e8f407ace468
SSDEEP 3072:0vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCoV:0sVD+RrFgvi7J9
TLSH
T1C8E37D9BA6E228BDC67780B052E78776F932B8214B309DEF5148C7741B12E506B197FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2280-1593-0x00007FFAD6990000-0x00007FFAD6991000-memory.dmp

Download

memory/4608-1472-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1468-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1489-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1490-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1486-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1511-0x00000154EB920000-0x00000154EB930000-memory.dmp

Download

memory/4608-1482-0x00000154EC2F0000-0x00000154EC2F8000-memory.dmp

Download

memory/4608-1481-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1480-0x00000154EBB40000-0x00000154EBB4E000-memory.dmp

Download

memory/4608-1479-0x00000154EC370000-0x00000154EC408000-memory.dmp

Download

memory/4608-1478-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1451-0x00000154EB920000-0x00000154EB930000-memory.dmp

Download

memory/4608-1476-0x00000154EBB40000-0x00000154EBB48000-memory.dmp

Download

memory/4608-1589-0x00007FFAB0CCF000-0x00007FFAB0CD0000-memory.dmp

Download

memory/4608-1588-0x00000154ED020000-0x00000154ED1EA000-memory.dmp

Download

memory/4608-1477-0x00000154EBB40000-0x00000154EBB48000-memory.dmp

Download

memory/4608-1602-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1475-0x00000154EBB40000-0x00000154EBB48000-memory.dmp

Download

memory/4608-1474-0x00000154EC790000-0x00000154ECD4A000-memory.dmp

Download

memory/4608-1473-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1452-0x00007FFAB0CCF000-0x00007FFAB0CD0000-memory.dmp

Download

memory/4608-1470-0x00000154EC1A0000-0x00000154EC1C2000-memory.dmp

Download

memory/4608-1471-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1653-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1664-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1469-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1713-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1488-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1467-0x00000154EBB50000-0x00000154EBB58000-memory.dmp

Download

memory/4608-1466-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1465-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-2031-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-2356-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1464-0x00000154EBB30000-0x00000154EBB38000-memory.dmp

Download

memory/4608-1463-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-2729-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1461-0x00000154EB9D0000-0x00000154EB9D8000-memory.dmp

Download

memory/4608-2801-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-3146-0x00000154ED020000-0x00000154ED1EA000-memory.dmp

Download

memory/4608-3221-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1454-0x00007FFABF270000-0x00007FFABF27A000-memory.dmp

Download

memory/4608-1453-0x00000154EB930000-0x00000154EB93A000-memory.dmp

Download

memory/4608-1462-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1460-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1459-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1457-0x00000154EBB10000-0x00000154EBB2A000-memory.dmp

Download

memory/4608-1458-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1456-0x00007FFAB0B40000-0x00007FFAB14E4000-memory.dmp

Download

memory/4608-1455-0x00000154EBB10000-0x00000154EBB84000-memory.dmp

Download

memory/4696-1582-0x00007FFAD6990000-0x00007FFAD6991000-memory.dmp

Download

memory/5668-3389-0x00000225CEB60000-0x00000225CED2A000-memory.dmp

Download

memory/5668-3229-0x00007FFAC6180000-0x00007FFAC618A000-memory.dmp

Download

memory/5668-3228-0x00000225B5450000-0x00000225B545A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads