38e53b094339e6cd8dfa7b442012aa815f52f9db40457e5c63e52ae09c3215e4

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-it
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-itlocale:it-itos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 09:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
opsec.exe
Size 10.8MB
Sample260620-k91xdsft4z
SHA256 38e53b094339e6cd8dfa7b442012aa815f52f9db40457e5c63e52ae09c3215e4
MD5 58b1d3f4d1898eff9e37d50c1e5e2179
SHA1 af334ad83bbd66934d392f8666d4fa5b88d6d60d
SHA512 e8929c1f0a00cb263e4dbcbb7d34eee11b406bd78c8a712a3c62aeafc05a85601098f5fc38fbb731c5f6fedb89c2aecdfd1da2614bf02536b8b0682ad655f9ed
SSDEEP 196608:tcoYUmJSXMCHGLLc54i1wN+CZ2hokSaPA8oKnS6FFfcXKFGMW4uD3+AGEMl:uUmJSXMCHWUjZhodaI8oKSEgUxYd
TLSH
T1A2B63355A17046BFF8E7403A8AA6C716BA6778550721CBDB93F427353E330E11D38BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4232	netsh.exe

Loads dropped DLL 22 IoCs

pid	Process
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	discord.com
10	discord.com
3	discord.com
5	discord.com
6	discord.com
9	discord.com
11	discord.com
12	discord.com
1	discord.com
4	discord.com
7	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	opsec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	opsec.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2892	WMIC.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	opsec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	opsec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	opsec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	opsec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	opsec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	opsec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2892	WMIC.exe
2892	WMIC.exe
2892	WMIC.exe
2892	WMIC.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
4576	WMIC.exe
4576	WMIC.exe
4576	WMIC.exe
4576	WMIC.exe
4076	WMIC.exe
4076	WMIC.exe
4076	WMIC.exe
4076	WMIC.exe
2744	WMIC.exe
2744	WMIC.exe
2744	WMIC.exe
2744	WMIC.exe
5096	WMIC.exe
5096	WMIC.exe
5096	WMIC.exe
5096	WMIC.exe
5656	WMIC.exe
5656	WMIC.exe
5656	WMIC.exe
5656	WMIC.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe
2920	opsec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	opsec.exe
Token: SeIncreaseQuotaPrivilege	2892	WMIC.exe
Token: SeSecurityPrivilege	2892	WMIC.exe
Token: SeTakeOwnershipPrivilege	2892	WMIC.exe
Token: SeLoadDriverPrivilege	2892	WMIC.exe
Token: SeSystemProfilePrivilege	2892	WMIC.exe
Token: SeSystemtimePrivilege	2892	WMIC.exe
Token: SeProfSingleProcessPrivilege	2892	WMIC.exe
Token: SeIncBasePriorityPrivilege	2892	WMIC.exe
Token: SeCreatePagefilePrivilege	2892	WMIC.exe
Token: SeBackupPrivilege	2892	WMIC.exe
Token: SeRestorePrivilege	2892	WMIC.exe
Token: SeShutdownPrivilege	2892	WMIC.exe
Token: SeDebugPrivilege	2892	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2892	WMIC.exe
Token: SeRemoteShutdownPrivilege	2892	WMIC.exe
Token: SeUndockPrivilege	2892	WMIC.exe
Token: SeManageVolumePrivilege	2892	WMIC.exe
Token: 33	2892	WMIC.exe
Token: 34	2892	WMIC.exe
Token: 35	2892	WMIC.exe
Token: 36	2892	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2892	WMIC.exe
Token: SeSecurityPrivilege	2892	WMIC.exe
Token: SeTakeOwnershipPrivilege	2892	WMIC.exe
Token: SeLoadDriverPrivilege	2892	WMIC.exe
Token: SeSystemProfilePrivilege	2892	WMIC.exe
Token: SeSystemtimePrivilege	2892	WMIC.exe
Token: SeProfSingleProcessPrivilege	2892	WMIC.exe
Token: SeIncBasePriorityPrivilege	2892	WMIC.exe
Token: SeCreatePagefilePrivilege	2892	WMIC.exe
Token: SeBackupPrivilege	2892	WMIC.exe
Token: SeRestorePrivilege	2892	WMIC.exe
Token: SeShutdownPrivilege	2892	WMIC.exe
Token: SeDebugPrivilege	2892	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2892	WMIC.exe
Token: SeRemoteShutdownPrivilege	2892	WMIC.exe
Token: SeUndockPrivilege	2892	WMIC.exe
Token: SeManageVolumePrivilege	2892	WMIC.exe
Token: 33	2892	WMIC.exe
Token: 34	2892	WMIC.exe
Token: 35	2892	WMIC.exe
Token: 36	2892	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4576	WMIC.exe
Token: SeSecurityPrivilege	4576	WMIC.exe
Token: SeTakeOwnershipPrivilege	4576	WMIC.exe
Token: SeLoadDriverPrivilege	4576	WMIC.exe
Token: SeSystemProfilePrivilege	4576	WMIC.exe
Token: SeSystemtimePrivilege	4576	WMIC.exe
Token: SeProfSingleProcessPrivilege	4576	WMIC.exe
Token: SeIncBasePriorityPrivilege	4576	WMIC.exe
Token: SeCreatePagefilePrivilege	4576	WMIC.exe
Token: SeBackupPrivilege	4576	WMIC.exe
Token: SeRestorePrivilege	4576	WMIC.exe
Token: SeShutdownPrivilege	4576	WMIC.exe
Token: SeDebugPrivilege	4576	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4576	WMIC.exe
Token: SeRemoteShutdownPrivilege	4576	WMIC.exe
Token: SeUndockPrivilege	4576	WMIC.exe
Token: SeManageVolumePrivilege	4576	WMIC.exe
Token: 33	4576	WMIC.exe
Token: 34	4576	WMIC.exe
Token: 35	4576	WMIC.exe
Token: 36	4576	WMIC.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2920	1872	opsec.exe	88
PID 2920 wrote to memory of 2064	2920	opsec.exe	90
PID 2064 wrote to memory of 2892	2064	cmd.exe	92
PID 2920 wrote to memory of 3912	2920	opsec.exe	93
PID 3912 wrote to memory of 4576	3912	cmd.exe	95
PID 2920 wrote to memory of 5988	2920	opsec.exe	96
PID 5988 wrote to memory of 4076	5988	cmd.exe	98
PID 2920 wrote to memory of 4072	2920	opsec.exe	99
PID 4072 wrote to memory of 2744	4072	cmd.exe	101
PID 2920 wrote to memory of 2156	2920	opsec.exe	102
PID 2156 wrote to memory of 3652	2156	cmd.exe	104
PID 2920 wrote to memory of 1780	2920	opsec.exe	105
PID 1780 wrote to memory of 4232	1780	cmd.exe	107
PID 2920 wrote to memory of 3468	2920	opsec.exe	108
PID 3468 wrote to memory of 5096	3468	cmd.exe	110
PID 2920 wrote to memory of 2572	2920	opsec.exe	112
PID 2572 wrote to memory of 5656	2572	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\opsec.exe
"C:\Users\Admin\AppData\Local\Temp\opsec.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\opsec.exe
  "C:\Users\Admin\AppData\Local\Temp\opsec.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_videocontroller get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_videocontroller get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic memorychip get capacity, speed, manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic memorychip get capacity, speed, manufacturer
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic diskdrive get model, size"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5988
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get model, size
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic desktopmonitor get name, screenwidth, screenheight"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic desktopmonitor get name, screenwidth, screenheight
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show interfaces"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\system32\netsh.exe
      netsh wlan show interfaces
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:3652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh advfirewall show allprofiles state"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpComputerStatus get AntivirusEnabled, RealTimeProtectionEnabled"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\Microsoft\Windows\Defender path MSFT_MpComputerStatus get AntivirusEnabled, RealTimeProtectionEnabled
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic useraccount get name, fullname, disabled"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount get name, fullname, disabled
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

81d243bd2c585b0f4821__mypyc.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\81d243bd2c585b0f4821__mypyc.cp312-win_amd64.pyd
Size 214KB
SHA256 52056f4b964f1bc0419064a374a32e56ef85ccb161166971d26f46a7490bd238
MD5 81565857347db31694fd9d8e2c141118
SHA1 8860b27f384f62d8d042c2403692fe1d7a52a034
SHA512 d6b1638151934766ebc73f8958da322c42131a7008ec58e7f186794f3fe3723f815334d4b77db26723ae75f9e4ae3bd1b9d0b912e4ab78c2ec70bdec045bf0c6
SSDEEP 6144:RFNBeuZ2KmJTSMMjktLxxkP8VXaVHaT8fyFmiGJZMzQdAQF039H:RFNB/IzTSdkM25
TLSH
T132242A3A52480065DD7352758C63A523E9F2F662073252CF08E0C6795F17BEAB7BEB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\VCRUNTIME140_1.dll
Size 48KB
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57
SSDEEP 768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
TLSH
T1A3235A9057788486D4AB95B0C1D6EF537E7CFA924710928B0BA0E59C2F637D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\_bz2.pyd
Size 82KB
SHA256 160b5218c2035cccbaab9dc4ca26d099f433dcb86dbbd96425c933dc796090df
MD5 fe499b0a9f7f361fa705e7c81e1011fa
SHA1 cc1c98754c6dab53f5831b05b4df6635ad3f856d
SHA512 60520c5eb5ccc72ae2a4c0f06c8447d9e9922c5f9f1f195757362fc47651adcc1cdbfef193ae4fec7d7c1a47cf1d9756bd820be996ae145f0fbbbfba327c5742
SSDEEP 1536:ZWNz7JrA+VLsS53XtGHagwIF27YuLw8emTayR12FIvCVv7Sy+xJ:0Nzdb53XfoxKrbTBkFIvCVv4
TLSH
T161838D53E39566F5F86F80BA5AC10366E731B954075083EFF348C2692F02F826DAC369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\_ctypes.pyd
Size 122KB
SHA256 8250b4c102abd1dba49fc5b52030caa93ca34e00b86cee6547cc0a7f22326807
MD5 302ddf5f83b5887ab9c4b8cc4e40b7a6
SHA1 0aa06af65d072eb835c8d714d0f0733dc2f47e20
SHA512 5ddc2488fa192d8b662771c698a63faaf109862c8a4dd0df10fb113aef839d012df58346a87178aff9a1b369f82d8ae7819cef4aad542d8bd3f91327feace596
SSDEEP 3072:4LIBXrBDuYifTbergyzjsckxf/EfCODh1NlL5IvLPJjL:XBbBDuBf2HfUxf/EfBDn0
TLSH
T124C36C1B739400A6EBA35179C4B32E17D7B1B41B171093CF12A4C69A2F637A36E7E316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\_hashlib.pyd
Size 64KB
SHA256 b4cec162b985d34ab768f66e8fa41ed28dc2f273fde6670eeace1d695789b137
MD5 0abfee1db6c16e8ddaff12cd3e86475b
SHA1 b2dda9635ede4f2841912cc50cb3ae67eea89fe7
SHA512 0a5cae4e3442af1d62b65e8bf91e0f2a61563c2b971bbf008bfb2de0f038ee472e7bfcc88663dc503b2712e92e6a7e6a5f518ddab1fab2eb435d387b740d2d44
SSDEEP 768:mHhSlKxOZdShtmgHbGmZOEoSK3Ic0V3QBdIvOI25YiSyv/AMxkEU:CxO3I17DZRoh3Ic43WdIvOIM7Sy3xg
TLSH
T1EF537E0AA69144A8C9778178C8A35F57F9F2F1411B10A7EF4368C28D2F237C3A6BB755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\_lzma.pyd
Size 154KB
SHA256 b095fa2eac97496b515031fbea5737988b18deee86a11f2784f5a551732ddc0c
MD5 e3e7e99b3c2ea56065740b69f1a0bc12
SHA1 79fa083d6e75a18e8b1e81f612acb92d35bb2aea
SHA512 35cbc30b1ccdc4f5cc9560fc0149373ccd9399eb9297e61d52e6662bb8c56c6a7569d8cfad85aeb057c10558c9352ae086c0467f684fdcf72a137eadf563a909
SSDEEP 3072:kf7P77jrFDn7NjQDRX17znfV9mNoHnIjN1VbHNiFIvZ1AB:kf7j9OD9YOH+bHNiJ
TLSH
T173F34A96A394F0E5F7628C78D6624F57E7F5B809032092DA01CC876D2B1FB659E2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\_queue.pyd
Size 31KB
SHA256 bbe7736caed8c17c97e2b156f686521a788c25f2004aae34ab0c282c24d57da7
MD5 941a3757931719dd40898d88d04690cb
SHA1 177ede06a3669389512bfc8a9b282d918257bf8b
SHA512 7cfba5c69695c492bf967018b3827073b0c2797b24e1bd43b814fbbb39d1a8b32a2d7ef240e86046e4e07aa06f7266a31b5512d04d98a0d2d3736630c044546e
SSDEEP 768:g1zRmezk6rGq17W45IvQUcV5YiSyvRfAMxkE4:QRm0lGY7W45IvQUc77SyhxM
TLSH
T193E2AE93BA94481AD933C87194E24F35E971B387470187DF2229C24D2F327837EB97A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\_socket.pyd
Size 81KB
SHA256 ce3090fff8575b21287df5fc69ae98806646fc302eefadf85e369ad3debad92b
MD5 632336eeead53cfad22eb57f795d5657
SHA1 62f5f73d21b86cd3b73b68e5faec032618196745
SHA512 77965b45060545e210cdb044f25e5fd68d6a9150caf1cad7645dbafcf1ce8e1ccbdf8436fbdcbf5f9c293321c8916e114de30ed8897c7db72df7f8d1f98dfb55
SSDEEP 1536:3OYxHEUZql2HLSyypHb9/s+S+pzG8iFWmIHJqKN5IvLw767SyZxqND:+dUZqzyypHb9/sT+pzG8CxIpdN5IvLwD
TLSH
T111835A11A69050F9DB63C0BAC2635E23FBB5B4C013D5939F1166C66A1F33783BE79A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\_ssl.pyd
Size 173KB
SHA256 61f00b0543464bba61e0bd1128118326c9bd0cdc592854dd1a31c3d6d8df2b83
MD5 eea3e12970e28545a964a95da7e84e0b
SHA1 c3ccac86975f2704dabc1ffc3918e81feb3b9ac1
SHA512 9bd5c83e7e0ab24d6be40a31ac469a0d9b4621a2a279a5f3ab2fc6401a08c54aec421bc9461aed533a0211d7dbda0c264c5f05aeb39138403da25c8cda0339e6
SSDEEP 3072:V1l+KugCpMRjN/ft6X6k7GxOnvvkKuFBZd4rYcvsswCfyX0NoFFIvC75/:V1QKugCpAJHt6X6nKvv9gF5
TLSH
T11A047C07B5542EBBD813E4F9C1230913DBB1F055331257DE48D5D64A0F07B4AAEAABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\_wmi.pyd
Size 37KB
SHA256 b0ed1c62b73b291a1b57e3d8882cc269b2fcbb1253f2947da18d9036e0c985d9
MD5 fda7d7aada1d15cab2add2f4bd2e59a1
SHA1 7e61473f2ad5e061ef59105bf4255dbe7db5117a
SHA512 95c2934a75507ea2d8c817da7e76ee7567ec29a52018aef195fac779b7ffb440c27722d162f8e416b6ef5d3fd0936c71a55776233293b3dd0124d51118a2b628
SSDEEP 768:kEkKWSx+lZb+7iNEpPlFIvCiS5YiSyvxPAMxkERJ:kE9W5XyiNEvFIvCiQ7SyJPxj
TLSH
T113037E56E7940854D937CABD88E64E27F9B1B5925B11C3CF3314825D0F32381BA7A3B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\base_library.zip
Size 1.3MB
SHA256 df0cae01200fd9075df54ba9f4001b1859a4654e1e092515cd02547dc5bae89f
MD5 5ca8aa09839cff70d4ecd4d6ceeb00b9
SHA1 38f6f03528d8648865c02c2293808838b7781422
SHA512 23b18fe05fefae196478787d51b3b301261476e06aa617d0161b848ca9b0418031ccf4c600d5818c2d339c08bf6e84cf3679d0a99717cbf1d51097efa14f584b
SSDEEP 12288:DY6V9brmn9du8lJGUqSHbP+dmCdRJ/Rr2/He//SquMnVTVihlyixmpvQXMHY0:08b69I8lJGUZbP+dmI/t2/H23Hhf
TLSH
T15155D6817A92A5B3FC84F3BA04260A0EA3658571BF44C747389FC5E56F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\certifi\cacert.pem
Size 266KB
SHA256 fc9165a12403263e7ebfbdad7be7a3eac0fa5d325d3c70465f28d3690072ca28
MD5 7cec1f8cf3352074cc70f3c6595cc69a
SHA1 b47d7e19601ea93d81dd1fad2fde2916557f2b07
SHA512 59346b000274610016ef1eb57069edf809fab34622fdef6bcdcd01eee491a9335ff8a9ef596e8d2ca4f135fd144b9a7bc6020e7e92e2ed6cd99812d8ed1e7bd4
SSDEEP 6144:MnB8fRRiplrXURrqADwYCuCCgT/QRSRqNb7d84u5/hrB:CiRiLbURrHdRWavdX0/n
TLSH
T196447C964F269C092C9FE1C1CA9B1357DD3A027B99FEF0F1294A2408D24622B57FCD9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\charset_normalizer\cd.cp312-win_amd64.pyd
Size 10KB
SHA256 aec205186ce86077a5f8fb469e924cd5f7e183daed53f9de9362e77f3bf3637f
MD5 15ee9441b9b1901c82309c49a9989bb4
SHA1 c8d7f23de5888d3e6b93cc3b02d257c7072af35b
SHA512 7e07ae95528bc6cb965c5fdee755dab00283b09bec9a101cc106d5d1f40178cf01aa14f55b782b68d6de45498c8ed3720a77d19dcd1ee4cc68e1e7232becf668
SSDEEP 192:qxGrmoX+sMl/++Ch9p8PBdVpcjgeA0JH6:qx4m4468D3clAe
TLSH
T1C32208ACFE7458EAD9664534C5274E4AB035FB22170233CF8370916E2FA37E26534785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\libcrypto-3.dll
Size 5.0MB
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
TLSH
T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\libssl-3.dll
Size 774KB
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
TLSH
T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\psutil\_psutil_windows.pyd
Size 69KB
SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
MD5 0a66d22d2ac4f9d41e1605b8d05de77b
SHA1 062de44628065f96d8137a2f04d1a88cc560b56b
SHA512 aa246c8d757a5be47e529889376faf9c94a5e377b20b418c4c7fa83e00c01060b01a887ebc662ab7bd42a6dac53abaac3a41b48b6a6f336d798c2ae782f80b5a
SSDEEP 768:axgqyAz7MqVIiOSzTVCeur2wTljgUd+mZnJGL0kKoPVMDw4xulnFn9mcBQ3S3X/:uZzwq2+SBRJdpZnJbPoPVM04YnUjHmC
TLSH
T121631895B35900F8C91B913D9EB26A37E7B2B091132657CF0160D68A0FA3BD36E7DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyarmor_runtime.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\pyarmor_runtime_000000\pyarmor_runtime.pyd
Size 623KB
SHA256 bfd3aac8ae122cbcfff5b114d9460654657473c3ed2fa787176795d30d9abd42
MD5 735954133c3318ee43fdd2e6ddb37914
SHA1 e355038246bed7071ff5fe6dba64d8c3e1a48914
SHA512 5c5ada8e392c03af1e75dc639f0173ccb583815644640808af9b391c2b1aa2cc42483a77152082f0826aa0bd13b40054018d77a91ba0f3ac4809e542e6713b2b
SSDEEP 12288:Bkik8HD4FKctjdcg7fUoPFs/U/nElRs7vz:qCctjdcg7fUoPFs/U/nkS7v
TLSH
T120D43A4BE1FA19D0E6B6D17C478BF2337C3ABA488160775B355CE3A127D0A5212E1F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\python3.DLL
Size 66KB
SHA256 d52baca085f88b40f30c855e6c55791e5375c80f60f94057061e77e33f4cad7a
MD5 2e2bb725b92a3d30b1e42cc43275bb7b
SHA1 83af34fb6bbb3e24ff309e3ebc637dd3875592a5
SHA512 e4a500287f7888b1935df40fd0d0f303b82cbcf0d5621592805f3bb507e8ee8de6b51ba2612500838d653566fad18a04f76322c3ab405ce2fdbbefb5ab89069e
SSDEEP 768:XV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/c:XDmF61JFn+/Oi5IvL0b7Sykxr
TLSH
T155637052BB54F8A3DBFA69FC39D199CD142B12CC872584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\python312.dll
Size 6.6MB
SHA256 93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7
MD5 b243d61f4248909bc721674d70a633de
SHA1 1d2fb44b29c4ac3cfd5a7437038a0c541fce82fc
SHA512 10460c443c7b9a6d7e39ad6e2421b8ca4d8329f1c4a0ff5b71ce73352d2e9438d45f7d59edb13ce30fad3b4f260bd843f4d9b48522d448310d43e0988e075fcb
SSDEEP 49152:YeceS1L2qpQvgBciWdyVahNTjy8VtvUt1wX/n8gRymPMVTBl2XhXNtMH2lt6cSA/:+RzBHWwuVGij3vwHDMiEHtSzW
TLSH
T1BE666C567358C0A9C96B90B4CC13C68EE7B27C517F60930B70ABB71E2F73792969A344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\select.pyd
Size 30KB
SHA256 dca5e6d39c5094ce599143cb82f6d8470f0c2a4ce4443499e73f32ed13333fd0
MD5 7e871444ca23860a25b888ee263e2eaf
SHA1 aa43c9d3abdb1aabda8379f301f8116d0674b590
SHA512 2e260d3123f7ca612901513b90fe40739e85248da913297d4cca3b2ebd398d9697880d148830e168e474ebfc3d30ede10668c7316ed7668f8b39da7bca59e57d
SSDEEP 384:TRVBP9tKLhuosHfwTgDo90Y5IvQGsHQIYiSy1pCQzpuKAM+o/8E9VF0Ny33H:5FyMHfv2H5IvQGW5YiSyvIKAMxkEtH
TLSH
T108D28F536FA05885D963C972A8A64E26ED31B7568710C2CF3368C15D1F227C27FBA3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18722\unicodedata.pyd
Size 1.1MB
SHA256 64a162d6b11ba10cb11509f3cc445f17beb7acfd064f030b4d59faa1c9894b29
MD5 098cc6ad04199442c3e2a60e1243c2dc
SHA1 4c92c464a8e1e56e1c4d77cd30a0da474a026aaf
SHA512 73c28488b42a0bc2f0d2861fed3f5dcccf8959ce19d3121c13c998db496f2822deb40f36f86240c8d3954fd2dc2ba5d63c8a125b62324dcd92fb6c8ba49ff170
SSDEEP 12288:FrEHdcM6hbaCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcQoC:FrEX/Cjfk7bPNfv42BN6yzUQoC
TLSH
T10F354AC5BB828E66E87B31B944D1212F1360C273476B573BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2920-82-0x00000000648C0000-0x000000006496A000-memory.dmp

Download

memory/2920-83-0x00000000648C0000-0x000000006496A000-memory.dmp

Download