ec35ea6dabcfcab838d17879b631c162f800c34eb3fc57b9cefad040ea52fb69

Analysis

user interaction
yes
max time kernel
898s
max time network
502s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MeowNetLauncher-win-Setup.exe
Size 12.6MB
Sample261102-faq6paez2t
SHA256 ec35ea6dabcfcab838d17879b631c162f800c34eb3fc57b9cefad040ea52fb69
MD5 f8e49ab51a6c8b4f73c21bdd6bdf72ff
SHA1 ba26328d1dbe6eb6662237acd05b8e95166d8590
SHA512 608412a6945a5e29e072cf3c2960b09bb9c0cfef741891c529ca2bc9d86eaba5ad671c73b783e56ba36b3eb5fc79e8f60bd608528a1a64ef407d1450375ddfae
SSDEEP 196608:qbzaSZAdETgGk1h6I/nZ1tMc5LsG68p+QkzL9:qbzbZAdMgZ/j/Z1fwAeL9
TLSH
T1C8D6C013FA8694E8C0D9C97893879533B63178CB053AB5AF07C54A143FA9BB09F1D74A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery themida

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2184	MeowNetLauncher.exe
904	MeowNetLauncher.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0007000000024400-80.dat	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MeowNetLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MeowNetLauncher.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2840	MeowNetLauncher-win-Setup.exe
2840	MeowNetLauncher-win-Setup.exe
904	MeowNetLauncher.exe
904	MeowNetLauncher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
904	MeowNetLauncher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
904	MeowNetLauncher.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2184	2840	MeowNetLauncher-win-Setup.exe	85
PID 2840 wrote to memory of 904	2840	MeowNetLauncher-win-Setup.exe	86
PID 904 wrote to memory of 5040	904	MeowNetLauncher.exe	93
PID 904 wrote to memory of 1356	904	MeowNetLauncher.exe	101

C:\Users\Admin\AppData\Local\Temp\MeowNetLauncher-win-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\MeowNetLauncher-win-Setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\MeowNetLauncher\current\MeowNetLauncher.exe
  "C:\Users\Admin\AppData\Local\MeowNetLauncher\current\MeowNetLauncher.exe" --veloapp-install 1.6.3
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Users\Admin\AppData\Local\MeowNetLauncher\current\MeowNetLauncher.exe
  "C:\Users\Admin\AppData\Local\MeowNetLauncher\current\MeowNetLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\system32\tar.exe
    "C:\Windows\system32\tar.exe" -xf "C:\MeowNet\MeowNet.update.zip" -C "C:\MeowNet\.update-staging"
    3⤵
    PID:5040
- - C:\Windows\system32\tar.exe
    "C:\Windows\system32\tar.exe" -xf "C:\MeowNet\MeowNet.data.zip" -C "C:\MeowNet\.data-staging"
    3⤵
    PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sharedassets96.assets.resS

Path C:\MeowNet\.data-staging\RecRoom_Data\sharedassets96.assets.resS
Size 1.5MB
SHA256 6ab470d71d404f6d4392e2b93a746ce0340d9f008da905a30b741dd4c4690e11
MD5 89d52705fc6e8d09e0c7b86b3a14d5db
SHA1 f73d858788c209922f65e982eaca891860a80505
SHA512 d3212a7f5e79bcb8f8c4e192edd32e57a33e212894ec709dab0d8dfe4fe61a1ffa86905994d36ffb88ca33babefd385a0880052570aadbaf85b89814a721ab4c
SSDEEP 6144:EQ/tsOG05NxznvOdWSo/k+OwuWpjCNvshd5eYlOvuqwSrQkYpbEenkjruTyn:tw6xeorC4lsrQkM9nSaw
TLSH
T10F65FA431FB5E09F6C86222E08365DF1D1AF96F1C5D03FC2A677252493AF6A27A10DD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KittyPC.dll

Path C:\MeowNet\.update-staging\KittyPC.dll
Size 20.6MB
SHA256 44a230f61844d70ce444b3c1f18280746335eb3716e3d92da4629f0546b00e3d
MD5 ad41fce1803901ec10b9bcb0e5d414a9
SHA1 6a168ecd4f6395eccaa159fea6e5c35cf6c3e78c
SHA512 0090ffdd91f369052e13bb880c562b57285fbcdb64a365504a973b5c447357d854d11a35c4a4148c38d4bb4ecee5c7221ca11b0b53e8571c4b8e7d6a04163752
SSDEEP 393216:B1XKa2lLNCSU8rfqxHflINtMyjsw6TUZufsZ69w0Qaslo7JbzGKHTJ:XXNMil6txswmtEZ69wObKKzJ
TLSH
T1A2273382F1F20DA3D7DFB7F941E5EA844B8835BE44ED27FE2853BE5312524A2453A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEOWNET

Path C:\MeowNet\.update-staging\MEOWNET
Size 39B
SHA256 31987190d1efd9725bf4b06d22ff3184bf8a36a95a15edf75fe4d5fcde0364bc
MD5 75f4b54bc0fc8e15dfa5657035974718
SHA1 4d39d8ce1511427d34c03023908470ca10f51767
SHA512 9b42f6078eb5b7734fb9e723e064acfabcd5f271a67d539885962e3141beee44c95316aaf82bcfc8133e8a9e3115b096747f93d092517075f9569f47a7f8c186
MD5 SHA1 SHA512

Submit Download

NOTICE.txt

Path C:\MeowNet\.update-staging\NOTICE.txt
Size 17KB
SHA256 90cc7fce349de5c4061db956cf5f9fa7cd18d43ded04c49616e299bf3b3047cc
MD5 8c80805aa41397321c0f81052a713696
SHA1 eb62dcf3c1996c5313d14755ae71df71edd34deb
SHA512 d20d279d276c78a6afbc835a78640516874eb4137acc8fcc53c3dfb3b7d89446c70279870beb23fc187c57ee8039788b19a192093d8c881926250afd07117bcd
SSDEEP 384:UQY8PYTviL9Dersurs56mBhSyRbopTolQUvV+3zBwgrYbNbYuYxX:o8QToaTTmBhSIgSQUvV+3agkxk1
TLSH
T17182B63E7E4503730AC1C392AA5BE8CAF31EA06D765F2646306DD19C137692983FF598
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NineLives.dll

Path C:\MeowNet\.update-staging\NineLives.dll
Size 12.9MB
SHA256 6863de572279a2c1c13be9c9281ec5c2fae78791f5a4d1f618aeb50c5a599322
MD5 b805f0f080818f5832952033567b5979
SHA1 676feb93e28bd11d8fc7c837f57c32ef81a06e63
SHA512 f9d8965ed65a106925b8b56f48e299aec402b0f58fff84e2b1cc087bb6b81dd30ecf5409f7457db89c39689bf53856b07ca91501f29ca520602fb3d6b4af2585
SSDEEP 393216:5VfuuAh5Nhd6Qx1X3ZLwoxkezxyhnoJnnxsrlB:5+vgWXZVJzEhoJxUB
TLSH
T161D6338B120179E6D0AB3A3ACD4D0CDFB6A38467A8BC33597D42FBDD8681757D84D182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RecRoom.exe

Path C:\MeowNet\.update-staging\RecRoom.exe
Size 638KB
SHA256 ec64a34d8c7a06429b3876882385fc53e02619f30b2f9b4f00c0a2bf69a8ba6e
MD5 cd5f199a8316777b18b94884da69faee
SHA1 11b668fe3e5570ed49346ed583fd36666a328b50
SHA512 ba275cb276e56444d047924b142fd4f09bcc5746865194d29d6f57c0bdaac80f390e6b811d61b30bffef75b33eca964f6d013d6ed49603d310a19c94a85f5ae3
SSDEEP 12288:YoCCh/Vd56BKTqELIahkkkkkakPwJqLHkD:bJEAJv
TLSH
T1CAD4F6FCD8A843D4E17A1CB75C54AEACE276ACED0CDA0909514D03A19A33FD728758DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RecRoomLog.bat

Path C:\MeowNet\.update-staging\RecRoomLog.bat
Size 74B
SHA256 aa63362a09187af8c6794fdeed49f10d0133be27487b9a11709420a132f71c0b
MD5 2df0150dfe008a69ae1d939c3e04c7d1
SHA1 9bf715fed59f58a9de97a6bb3dbd738825d11c2b
SHA512 de78803b69e895149fda4c1c160b6df519e31be9575095dc0b4549d4c0fbf9ee4fe5bbd18bb60f035feeebcd7d481e395264017695a9b1085b30d61f782c0538
TLSH
T105A02202C22B8022C80F830C300B22E03033C2088B0CC320A28BC200C20B03C203338C
MD5 SHA1 SHA512 TLSH

Submit Download

Recroom_Release.exe

Path C:\MeowNet\.update-staging\Recroom_Release.exe
Size 1.2MB
SHA256 f12d2e1924584383cfe78de6264bf84d68c4a615c9054f47fa98243b081b5692
MD5 26270ea2d20209cc5d7268928728130d
SHA1 c57b0d2989cb451d79cee3f7c61300cde1882d47
SHA512 5aafff4675ab33f26f6ddbbe489fbadeb7c64bf6724457d1eb0f7fb94735713efb0e0d40c4895125cf1c211f291bdfce9dc7d79f8ffa54bd9b5142bc67143deb
SSDEEP 24576:pJyFj5UMLMYUOrwLJFWR5LE5MSb0a/k1kw5mbKITJ3sz:mcMLrrwLJFWR5LE5MGrkSw5meITJsz
TLSH
T19F45C09326D0D062EDBB0C720C60DE25927BFCA54D629E4BD2BC77685B32ED13E24197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityCrashHandler64.exe

Path C:\MeowNet\.update-staging\UnityCrashHandler64.exe
Size 1.1MB
SHA256 2149096538582113ee2e60cdfae2acd33def8b04d5db303cc5bf4eeaf54831df
MD5 04218c59636bf9610e6741013ada59a2
SHA1 488a02a6cb531ceee4e0186d630edb99a45ad1ee
SHA512 9f93e4ef59d3be5a491a81d2d8e79205c58f4526777470a1ccc6b7118d7f8d778f9bdad1c8d2be1f9447c912b345ef43d4d84ff0d613c9c7e2e2cf12b20bc257
SSDEEP 12288:u1HNlcYyeraLLuLiT2SSYHdSbM+Fh6wk2AdgoRZVQfz2fzA1W:clcYK2WTBSYHdWFUbdgdz+zA4
TLSH
T184356B6AAA6800F9D5678039C9564A0FF3F27C1503619BDF1390B7AB2F376D41E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnityPlayer.dll

Path C:\MeowNet\.update-staging\UnityPlayer.dll
Size 28.0MB
SHA256 c18fe00cbf13b36be72ed604de11e210173540a3d5b5ec158d61de8cc9946d98
MD5 f0718b2cf3c2fa05aad5452588ce1d3d
SHA1 57a85005b84d4160eca429606c7e548d29a997c4
SHA512 3245ed8de9222548f7898c2803ebba1dc057411fb9e5d272f6050103fd82b46aba934e2677f6b841db15faf76c90e4c5cbb7df3c7799ebed53ba1f74d980d6e6
SSDEEP 393216:cZHyxCKocAY/hvLLw3BhiKjW8kVKkrl5oGUowzkxoRf/kHBru33Se4YzoLoEAfFb:cG6Ib5Gmr++S
TLSH
T1FD579E9662B800D4C47BD078D65BA91BF7B1304A03718AEB13E14AA96F77BF0267F750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baselib.dll

Path C:\MeowNet\.update-staging\baselib.dll
Size 395KB
SHA256 7efbb390a85fc6846350ef0d3df807a11c9dcd62b6045c9ee2fa4b4e17496447
MD5 5d93e6b6e846544d9bba40af45e79632
SHA1 7947062f6c2045a983d7fd98a491dbc0272f2dda
SHA512 1e572d6a43ed35a4a02028e469bcba081c5a90cd9b08d17e82e845e30f335474bbc09f745d75f63172676b90ba7cdb44c35ea06ff106495ea987b3962dbb59d7
SSDEEP 6144:WmLYuq1+dNhJ6d0BNxcHqT4PxAVsyyhcm7vv78sdTW4FYVXpi6XVvfBH4A:tYuamvq+GyYoGd816A
TLSH
T14B846B9AF76408B5E56B9074C9B3890BE3B27C49076087CF23A4439A6F33F91563E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installscript.vdf

Path C:\MeowNet\.update-staging\installscript.vdf
Size 725B
SHA256 17d31db50bb2cdc99ec0e9f920eb228ff2abc662052f978594a644098359e54b
MD5 d5aa77e66a449d39f28f20479554c89c
SHA1 fbe06ab664137894aedb72fce4ce014c844e2acd
SHA512 33db6b49c383477e02709cbea45e980183b53111be2e3e1001540a986193acb1b0534aaad0f78775b9720ee6aa52ddc62e236306ec8fb56c45ea98ba72dc2fd5
TLSH
T18301C023AEB9B57850B848AD0DF6FC81044826A70AE098E37DDF5A0B8965E540969409
MD5 SHA1 SHA512 TLSH

Submit Download

last_update.txt

Path C:\MeowNet\.update-staging\last_update.txt
Size 6B
SHA256 f60516fc1dd70fa86a042bcab8fd60bc9f3c56f5727a1de04ab6fc79c2ea5c18
MD5 f4b5748b43006d5c376d420f2285e1dd
SHA1 c9de3427239f838f20293fc6f340b71ffa0782a3
SHA512 f6a3b1aa7eb3fd23e5e9b90d448fa3a3ef62cbe866cbda3160593d9d6cd8fdfb8148963da9bde13a604c12be4b739640bfa476ff3c776a2c9e3168bff5200d2a
MD5 SHA1 SHA512

Submit Download

steam_appid.txt

Path C:\MeowNet\.update-staging\steam_appid.txt
Size 6B
SHA256 b936276a258b3bb51765c52720da6321dbac8d3c8cb4488a9c6c92ccf81c108d
MD5 2bbec6b904297f2250b1e77dcbccd37e
SHA1 be17b33124a6da0f9b652e4e488302941f1ce70f
SHA512 a6720fe297080ad59a996a85e1ad12f055898655e01059a90b943ec63b86b75bd7606c88612c269de604dc6e8b97f53350465e89df4599ba549cd0f1c1ba63fd
MD5 SHA1 SHA512

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\MeowNetLauncher\Update.exe
Size 3.8MB
SHA256 d793d3156a062e5b1afecc8846eb4e1d4a69c8ee7ab9f92b1868c28ad1319bff
MD5 493a67059ead47855062b9f75d18acd0
SHA1 e851911d8815f32da8e86d74c224c021a5c15a04
SHA512 0ab794b001ad788cb25a785ea4ac80f90a9e822c400f91a44d1ad37df94182c7c47b7710e614ca12093461516b0903d2ce404292784c33ad10f2015022401689
SSDEEP 49152:z1u6NqyjbDkpKKZVLaa+6AB6FwooZKFpsFeRM+wwjlDK+dy+fr1lmbVPAikZOC+2:z1uujbAD/anV6F7oZIpsFKKcma
TLSH
T1C716AE62FF42D0FBC48A0175E42EF37D9A36A6159B3A85C383A94C4C6CE12B0995375F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MeowNetLauncher.exe

Path C:\Users\Admin\AppData\Local\MeowNetLauncher\current\MeowNetLauncher.exe
Size 5.1MB
SHA256 b35468226a52adbb4139878d04f9fc8271026836c51c9cd7468b3414ad128198
MD5 425f51fda27e7846c7ecb4a7820be1ea
SHA1 a51ae541996fd7e74965b75175e3642cb0185447
SHA512 550bd08a4000d5337eb6a28471ce2b5e00c79124c55a5e7f70dc47b4804dc5679529432e031e1122cb30b67d518cbe8fba0965cdbb69468b906835e12862f0f3
SSDEEP 49152:fhpvSMigUHnEdTaPG2qguiJ3LbwqheKSKeRnIXpYIU6i//nAwcnf/JPAsMmzNfwJ:fT2qgTvwoeWpn+cGqzNf/d
TLSH
T12146AE03A7C958EAD0B9C838864795235E6134CB8735E1FF96C6591A2E3DAF80F3CB45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sq.version

Path C:\Users\Admin\AppData\Local\MeowNetLauncher\current\sq.version
Size 515B
SHA256 5bbeef2c57d63d59757806862e4f07f104d8096012530699b08e7973af3d045c
MD5 89c39277e16bbe03c7627097339e5a41
SHA1 b6c5009a9c4e2e1bb76dcbb49327ed03a99d8a76
SHA512 ace7c0d47a3d6a04224287cc156071d648ed4ec8c739aead4f3d28462bc7ac3c03df96f75d531b891aa9e17d11fda1f78e16473c0a2b1e16d0ccc81f4efb1272
TLSH
T1ACF02E85D907D366D6EA131C9E88415D93FA69DF14C84870EC949C1C228D2CFAD1F9C9
MD5 SHA1 SHA512 TLSH

Submit Download

MeowNetLauncher-1.6.3-full.nupkg

Path C:\Users\Admin\AppData\Local\MeowNetLauncher\packages\MeowNetLauncher-1.6.3-full.nupkg
Size 5.4MB
SHA256 d4c90fc283b66015c2e2d369196df8ff47fce94eece1c46aa7fe9b1f80e9cb3e
MD5 cbee908b0ef17ace0298234e2da6365f
SHA1 6f0ab7596ce7c3b17dee7d2068d503e20ef4e28f
SHA512 058797e2729aca9f13562d46b32e5aa6c5181815e7a05fcc9c979dbb0aaaf5f2f30b0fe3c472063c2f65ad580435ad8ea1adda0552cc099308d4d95256560c09
SSDEEP 98304:i6AH/nZuw3rtnMRmI94SSmY6rULsG68vh+2bkUzuLIuCyF:i6I/nZ1tMc5LsG68p+QkzL9
TLSH
T16D4633D73C1628044C95B93E06D0EB8FDF390EB5BAE059055CDB33B0DAE2BA91F4552A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velopack_MeowNetLauncher.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_MeowNetLauncher.log
Size 1KB
SHA256 c0c7117919663c693e8fbd4cf2a930f74221f411e514fc55b61f65a0cddc2f96
MD5 1027398b24d222413457546f955eaed1
SHA1 03fc9d17a9efb937fb1cf2c731b4e03e00527c6d
SHA512 863b9a74cb5d71d40a25d8a1e0f13f52223fe3874e8555dc0b4dc2938820f1aa423f51a9b222651ef7ef000489aadd299f50457f6a2326a8b358c4632140f4ad
TLSH
T1C2113B0933C6736EF94D1D2D29A8197A40CD48673BC55FB187314B4839AEA4EB8FE062
MD5 SHA1 SHA512 TLSH

Submit Download