148fd3f9c83a7709637aa27b81fc2aba5b0dbac5945f601c55e5484f42f33d44

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_015498187b7b0ca25235d3a5b093656d_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Size 8.1MB
Sample260901-2dx93afa83
SHA256 148fd3f9c83a7709637aa27b81fc2aba5b0dbac5945f601c55e5484f42f33d44
MD5 015498187b7b0ca25235d3a5b093656d
SHA1 1599ceafc01e2a25ed7d9762f43dc9b95b3747d6
SHA512 bae334860e82e1a2bdc79427ea57bd69e51ba96744f1a7f1d91302b4299c94308aa9864bdb41a7bcc38699737ba1d1bc853ea109c6a7307134e7a6d5be8bfa63
SSDEEP 98304:J5q3f2GAGTxED4cXNkg/p4MWWtvEH2GG6OCGdOZ7ZEq/sYO:Kv2GAmSHWWSHZG6OCD9ZXsYO
TLSH
T122867C07E89559A9C1AED231C9B292537B71BC484B3223D72B60F73D2F76BD46A79300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution spyware trojan

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c744-484.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 2 IoCs

pid	Process
4896	uv.exe
3848	python.exe

Loads dropped DLL 6 IoCs

pid	Process
3848	python.exe
3848	python.exe
3848	python.exe
3848	python.exe
3848	python.exe
3848	python.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5988	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-09-01_015498187b7b0ca25235d3a5b093656d_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-09-01_015498187b7b0ca25235d3a5b093656d_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	2026-09-01_015498187b7b0ca25235d3a5b093656d_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-09-01_015498187b7b0ca25235d3a5b093656d_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 6b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-09-01_015498187b7b0ca25235d3a5b093656d_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df06b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a2000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-09-01_015498187b7b0ca25235d3a5b093656d_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c0000000100000004000000800100006b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf15761419000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-09-01_015498187b7b0ca25235d3a5b093656d_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-09-01_015498187b7b0ca25235d3a5b093656d_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4896	4724	2026-09-01_015498187b7b0ca25235d3a5b093656d_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe	90
PID 4896 wrote to memory of 3848	4896	uv.exe	91
PID 3848 wrote to memory of 5988	3848	python.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-09-01_015498187b7b0ca25235d3a5b093656d_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_015498187b7b0ca25235d3a5b093656d_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe"
1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\.local\bin\uv.exe
  uv sync --link-mode=symlink
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\python.exe
    "C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\python.exe" -I -B -c "import sys; sys.path = [\"C:\\Users\\Admin\\AppData\\Local\\uv\\cache\\.tmp8sl3bO\"] + sys.path; from python.get_interpreter_info import main; main()"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:5988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uv.exe

Path C:\Users\Admin\.local\bin\uv.exe
Size 39.5MB
SHA256 b5d230c79ffa3629422f48bfce0766e9827769608a79bbb4e4e540081f59d97c
MD5 aa4efbbbcff5c7d3102293c34ac2c830
SHA1 703f4b83b68e32572fff25f5a3602ccaf9d72acd
SHA512 6fb7e0ca8153caf46487862643b5b17f7529378ba217c77fd7bed9699268bd1e46fb94fa589b18f3e695b4323e4169395f6ae0b0705d0d8e010cf27b9b24d7e0
SSDEEP 393216:3C1z2hq31pLDe8hfmf/llu5Lsm/wQvCgh:3C1koPVhMllMLskCg
TLSH
T1C1974A53F26441E9C1AEC078939A9633EB61BC8E4724BADB5BE04B212F25FD0633C755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.python-version

Path C:\Users\Admin\AppData\Local\Temp\ZeuZ_Node-v21.6.0\.python-version
Size 5B
SHA256 49a506dd32096b010d75205acf3430c9ae6c40351888129499e5a5e487126c93
MD5 c0479ff484dacd51dc5ba0461b16b9bf
SHA1 56d82d930855f2b801ddc5b7b28abae5a86ee034
SHA512 076b09402e7aca5ffb5cb97a995687f210544a83bf839c833a70ad01437dcc87c3ddfb87bf6a90e412b0462d8744f088ba873a688b2bd8e4701cb126e3c6e318
MD5 SHA1 SHA512

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Local\Temp\ZeuZ_Node-v21.6.0\Framework\Built_In_Automation\Desktop\__init__.py
Size 34B
SHA256 7048a817465bd257a461616f71a8fd1f01baa7f82500d89684fe7d07b5300a08
MD5 dd9f6a0a3c8746aae97ae4493c5f0174
SHA1 409b4bac45c58daeb990469b607c74ed53858f04
SHA512 29bf7ae6d9fe3af1a9e8116043d93849defa8176f838ecf0ff922256d2dcde18f17777ee52150b667d05de43b4c46fd888c2401d3648484e38a365a39eb62ea5
MD5 SHA1 SHA512

Submit Download

hi_char.txt

Path C:\Users\Admin\AppData\Local\Temp\ZeuZ_Node-v21.6.0\Framework\easyocr\character\hi_char.txt
Size 340B
SHA256 24467e4e88f8b7fa39ddcc68ae2822a55694663992495a216e390d555f5a3413
MD5 2a4b0391dc65e0bce716e0469664ef30
SHA1 1102b0cae1598191d2986f2c945da8864275b399
SHA512 076f090e303e0fce89a66f6680aea582ae7d96e5ab6c056c732d25594412794d9cc97e84385017292ea11e6fdc3d7be8a7c5507a1236ee9bb8466aaa1ee3e01a
TLSH
T1C0E097037E844D2FC780A334B10C487281C2D40124DE832488E9B96E310AA70D12DB03
MD5 SHA1 SHA512 TLSH

Submit Download

inh_char.txt

Path C:\Users\Admin\AppData\Local\Temp\ZeuZ_Node-v21.6.0\Framework\easyocr\character\inh_char.txt
Size 200B
SHA256 bba366844d8a5fc18fc7d793e118d78a554000537b003a1e8897c04b206caa68
MD5 676d355beadd729a2b6632253d2401ea
SHA1 17ed02e8f789da74da22884582c0b6798e07d097
SHA512 39bcb4ea8a2f822288aa9e5ab5bf32c3ec82ea060702ef2c78edbd924e0985e1432613915ee30c9a5fb630f5e9d75698f553474e97271539cb0cb476f55f10de
TLSH
T1DBD08C70E533614F2A615B65A84026606C8D208DE2CD2A2A95CC89E13EC05A882CE87A
MD5 SHA1 SHA512 TLSH

Submit Download

pyproject.toml

Path C:\Users\Admin\AppData\Local\Temp\ZeuZ_Node-v21.6.0\pyproject.toml
Size 3KB
SHA256 943d4346024ef7bc46507bf9a292312b2916d448afcf4424102f46916a58dd9c
MD5 2c759dc8b478095d56fa08541ad0b198
SHA1 3058d825a4f09f5db9c6d888cb58a52d6cc5f16d
SHA512 bc17f65f0f750447371db430bc2a49603f8cb2b38628230cd5499fdb8a7c9976c3f2f49c950d5eae56a0041b4778e7298ffe1eee590ca24acb8d363fa6693801
TLSH
T18B81AA40C7669DA14B7A948A5CC94401A1A251676DD2F84E3BC2C2CC0F1E9EFF2B4F7E
MD5 SHA1 SHA512 TLSH

Submit Download

get_interpreter_info.py

Path C:\Users\Admin\AppData\Local\uv\cache\.tmp8sl3bO\python\get_interpreter_info.py
Size 27KB
SHA256 d9bbb0c9b40eb916a17abc866a3b29b9a928b1757aeb4c8ddc67c2dcf07215c1
MD5 01710e3c630e97ee9a989fcd2329c8d5
SHA1 314dc52e42a036407d23a1d8dcda90c651c7d7cb
SHA512 eff2c21cf9d192e6d68c8c4b7c78372818a28e0bfee4b90c0da1a8e03bc1a7cbf0dd1202cc8fb1125b1e7d1e7f0e0528b5f5fef9c3d389c60904aaad2c36097d
SSDEEP 768:wdzYtrmOxf7HaI5XyabMfN7FDSH1Rk50a1rVK0iotv8FL+xAYOaWCNI:wdctrmOx7aI5CabMfN7FDSH1Ra0a1rVC
TLSH
T141C2D71B99085D3717432BAE8CEF9180B73265A32DA0641CB8EC505C2F19A7E5376B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\uv\python\.temp\.tmpqeIuRS\python\Lib\site-packages\pip\_vendor\requests\LICENSE
Size 9KB
SHA256 09e8a9bcec8067104652c168685ab0931e7868f9c8284b66f5ae6edae5f1130b
MD5 34400b68072d710fecd0a2940a0d1658
SHA1 57aed0b0f74e63f6b85cce11bce29ba1710b422b
SHA512 3705b1ce56dd19764b7b9e363936e36cbeb8309ceb0f36aaf94d7f9ef1dbd45bff9deadbb73ee7f56210703d5e199dcb4125744c3e459d2647fa15b2c0eb0b77
SSDEEP 192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLhx:U9vlKM1zJlFvmNz5Vrr
TLSH
T1A822522FBB48037B06C20162A79764CBF31E903F3B552568314CD1781F5B96593FB6AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\uv\python\.temp\.tmpqeIuRS\python\Lib\site-packages\setuptools\_vendor\jaraco.text-4.0.0.dist-info\LICENSE
Size 1023B
SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
MD5 141643e11c48898150daa83802dbc65f
SHA1 0445ed0f69910eeaee036f09a39a13c6e1f37e12
SHA512 ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
TLSH
T12B11A82E735107721C5713B0557568D8B17B715F7B6B2784146EF240232A06CC1FBC40
MD5 SHA1 SHA512 TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Roaming\uv\python\.temp\.tmpqeIuRS\python\Lib\site-packages\setuptools\_vendor\jaraco_context-6.1.0.dist-info\INSTALLER
Size 2B
SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
MD5 45210da832f9626829457a65e9e7c4d0
SHA1 ad5dd33dfa81a91517182f453879cc056a9f1230
SHA512 00a0bdd98e82b3077db4b7cf7746140c204af743c208484934d7cb46b1c55bd31c8a29bd756d3c1eab8737df20f565c0b2a1c4e19b7c9a2785ca091696761cbc
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\uv\python\.temp\.tmpqeIuRS\python\Lib\site-packages\setuptools\_vendor\tomli-2.4.0.dist-info\licenses\LICENSE
Size 1KB
SHA256 b80816b0d530b8accb4c2211783790984a6e3b61922c2b5ee92f3372ab2742fe
MD5 aaaaf0879d17df0110d1aa8c8c9f46f5
SHA1 9da6ca26337a886fb3e8d30efd4aeda623dc9ade
SHA512 eecd0c29febf51adefb02f970e66efe7e24d573686dfdb3beea63cefea012a79ce3c49a899b4f26e9b67dc27176b397f6041909227281f9866beedc97389095c
TLSH
T11411755E725147B618AB13605978ACD9F23BB25F7A6F2A84246DF345233A06CC6FF840
MD5 SHA1 SHA512 TLSH

Submit Download

WHEEL

Path C:\Users\Admin\AppData\Roaming\uv\python\.temp\.tmpqeIuRS\python\Lib\site-packages\setuptools\_vendor\wheel-0.46.3.dist-info\WHEEL
Size 82B
SHA256 1b68144734c4b66791f27add5d425f3620775585718a03d0f9b110ba3a4d88db
MD5 eca1d2e32987c5c9fd85f21a0c92d672
SHA1 918c96cf4b87d846161401284f9bf811c56b5fcf
SHA512 c4256b480eefa97b455e5e0f716884b554edb99c7a3e4b116a46590c63acf14ea14ff52c5814f5c8bfca2b4a309bda65de07b72fe8731a235478eb7e5e7e2d7c
TLSH
T170A01218014004F80090FE034239A1281A308509646500B5948101445545D0802C8DBA
MD5 SHA1 SHA512 TLSH

Submit Download

copyreg.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\__pycache__\copyreg.cpython-311.pyc
Size 8KB
SHA256 55115fd5c8f79aa83df50d670590a1b95fc8e886493b1d61d5557ef0b454746c
MD5 ebc034ae0c2e0d34bb60fccae7f03a51
SHA1 c6678f88e073406783a5bc6f5175cb821b33bc82
SHA512 091c40e9f3aec14c15f5d4e350cb36a7abbf8ffb37621b624b380bc9406766f25f11daa6987907defc050d4e8853510e0b498a7c4023af4fe05b65f4432955df
SSDEEP 192:E4DHjuV75o+5D8Ga7lU0WecVL4MvX46yyfhm+Hj8TCCfHbTgsdM:E4DDG5oED8/xUFnyYj5QxC
TLSH
T1B002A5C1AA81E1ABFDA6F67DC0060613F354C4F6B294CB23195BC02B9D5F569ACA0DDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

enum.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\__pycache__\enum.cpython-311.pyc
Size 85KB
SHA256 02b7752d92c82dce111164fa69b550a38e65dee41991a410cef56f142455cc03
MD5 15fff91e8f791dedc3240a8f74adc7dd
SHA1 3744d7cce9cceff524e45eab022ef7737ab706e0
SHA512 ba7e5668374de1803a24a07020bebdef1f5c23370c306604c1f07348f5e7b1e22f46b575b0bf496b39b432f370fc3e3f40330218b54842db2eed4a4365d6b1e4
SSDEEP 1536:BN4Z2rI5gQmqkvRP9HuOpFRpGg+qdj3+sjQ/Fe2AZk9jWIWWtLB8KRR:BNZogQXgRP9HuOpFRxLoe2DtLB1RR
TLSH
T11383D6857961C67BFD95F3F9841B0A0AB324C9F2B3508B17326F802A6F13A647C659DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

functools.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\__pycache__\functools.cpython-311.pyc
Size 45KB
SHA256 1ceaf73ee70cb0caffa2d176ee22071423f0ca71c9e122f8178b8b64eaed5e0b
MD5 6df5fffae76e52a8147a627449c9f91a
SHA1 30afc739a9aad3590069896d65bbdf84d8e926d9
SHA512 d8a35a137aaa8cd0b13e112bce15ebb9a0483b990b337bf1d301f8fa1658d7406406b55b0b69cb1d6027307f210b54efcb129637d10d81113dc79783dd54cc6d
SSDEEP 768:4k3KwleoM2htEKsojq0Tpf+gy4Rrhp1MN9SMFYIp1CQzsnruDvFERRrlwJKmS:Eie52htpqupGgy4MTxFz1XzGwGRRqUJ
TLSH
T17023F8853951D2BBFC96F3F98216060AB36484F66310C703756AC0BE5F56E686EB2CDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keyword.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\__pycache__\keyword.cpython-311.pyc
Size 1KB
SHA256 9f0070634e724afd3ec4a07e3061a21d99ee17d4c0fe3a0a62e16915768a4a56
MD5 54fdf9d38993044c9217466309c51a47
SHA1 16dd8f921edb04572e081ebf4cab81a4cc36a9f8
SHA512 02a64694239cfac1093fc4b2d44f202dc1f8b4e5cfde8f83398d9502a19cab4235f4393107dc22d9fe49b4fbb48d7e9601da752fc2c2a8ad9ff4757e5fb8f2d3
TLSH
T142216341598BCD34CE11D2788931D07835A4F4F73208D13E347CD941BF67E141AA95E2
MD5 SHA1 SHA512 TLSH

Submit Download

operator.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\__pycache__\operator.cpython-311.pyc
Size 18KB
SHA256 22f64a33f1201c06fb561fa0c5a18de7712a32f16acac002eac9c1d459d466cb
MD5 0f70e3bcfacc20c6b19e7fc4f4b5a44a
SHA1 45b214fd6f852cadad184278c5b4f83bea0b4226
SHA512 2f619e7150bff658a2cb0bf12b7423ab2fe5460636f27526b6baa0e5b3ecb89a2e6623ea1345592fd9b822bee8e04d2044458ef34f851355aa3d8ab24c236dc1
SSDEEP 384:KM6Yqe+7+VSYFdSSy2KoJbFBIvB4U+Klr:KKq5ZYF+2KozCZd+Kp
TLSH
T11182939015C269BBF4B4F2B984D91585FB758872B38B4B631913C4269C1EBC5AC37CDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platform.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\__pycache__\platform.cpython-311.pyc
Size 42KB
SHA256 fd5d5f5e4c874a50a8987173a378daa97dd283a51d9544960b55d835a1c086fd
MD5 22f07a3fe0b8eb1aa105580b4938562d
SHA1 eeb958e896af0ff45285922ee9d5bae89da2561c
SHA512 0f1f623cd797a8789ec064c82c22774f32c0c94b6f866d47ba3ad33c7c73dfb008b3621e01c8a3e0ee5da040feb0ef3c08575437ad3eef51569214015825654f
SSDEEP 768:jBZUjD4MBuAcBeHqnlJ9iPERxJhiu8qjJ0zsdrS95+q4qCQQn6M/Zf:jBan4McdaPERxJhiqFrS9Yqlu6Md
TLSH
T1A513F7853A61CA77F801F3B5849B115AB73484F77311D72735AEC025BF82A686E329EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reprlib.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\__pycache__\reprlib.cpython-311.pyc
Size 9KB
SHA256 e77d6e7c32ed0b97fdfb5f6a4426751b30b258bc55ea7607f3d41742ad9a80dd
MD5 3e8ed01b65642f3faa8a3856f45c054b
SHA1 9203df153f246bd4e71a43ba463a03fabe76d516
SHA512 642604034adee36b510245de998fa8a8bdbc717467725290af8256c56ad111ab2c88db97f8ab2a2f36d5196418d2d88f34eac27a474b894bbbbef407ff6c1507
SSDEEP 96:80pjnD3j++yveK/y3kSgME0z9vTagi0EeNWS6zJYUHwVyHPyWcHNzadagaPyEERb:vpiO3kSfMoNgNY9VyHqXHl7gaP/9Q
TLSH
T1C21285816A93DD6BFC66F3BAC02B150DF334C4F1B615D723A52A816A2F0B7206D506DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

struct.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\__pycache__\struct.cpython-311.pyc
Size 442B
SHA256 4f580ab086218283f0ce0fdb3d03647c09ca88403c7bced14b4fb8ec2f89e9c1
MD5 f3d5d6a2c6d1719ec10be95145aa574e
SHA1 f1037ba05343c11f065eb4d14b5a0dfdaa722b70
SHA512 6be8fedb75f5a651099e8599ce33eb1788451ee1b07bd0eecf777ac3e6f2ca0b2332b755606c116eb80edf12996bb723ffcbba143a2b6ed5e890c9e7acf4e385
TLSH
T1BEF02B929A33C0ABF895C179CE965370D0AFFFF4B7D5432349195258091F681DCB0655
MD5 SHA1 SHA512 TLSH

Submit Download

sysconfig.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\__pycache__\sysconfig.cpython-311.pyc
Size 31KB
SHA256 47bf666a76715a73b0b05fd95573c909eb4314fa1086bad9869c97cbf8b1fa14
MD5 d07b4d6c1a4931de53981185156b15aa
SHA1 a4a328b0ef9f906f08b4969c62899de4907ea8a4
SHA512 bd92f3e467425f1ee0e34a2f648e3d52b4601f9b371f7837af649d2f9695249ce86990ec2e41b1a396d40defe408bb5e4055966a84dfe55adf106f636e5a69a8
SSDEEP 768:4NU28waZvemV3dn9/xrOJM37qzaIuBd+uZ5C:4NU28J5emV3dBxSIqzZc+u3C
TLSH
T1BEE2E7C56B82C577FC90B37AC85A025BB370C5F1B710C71B67A6912AAF42B587C221ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

types.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\__pycache__\types.cpython-311.pyc
Size 14KB
SHA256 5a1b1af01dde0c58f4182a4406db55b175764bfd83b4a840c77c2aea1077e0e6
MD5 acc1203a31f578f7ada159f2c8871215
SHA1 d78fd587f662b5d4d9303c6a86204245623452e5
SHA512 55c5cf00c3584e8d82acd65545f12bba085144543e42a7a329b70b5c7aff41f689909fde49e94b549f223f3397b34bcee9af87e72bb68ccfa682f5b8fbd56350
SSDEEP 192:+1wNPooYge5EVuRGLvp6jxGlehUjaNpP4/i8mScKiL3YhC:+1w1oodVuUvp6lGchUjafQ/i8mSGIg
TLSH
T10E62C481B981D1BAFC42F3BDC4271159F321C9F6B312871326BB605B8D2B9A45EA59CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

warnings.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\__pycache__\warnings.cpython-311.pyc
Size 24KB
SHA256 6ca8e99a22a49ece0ef33d05e695567f92f6d47a0c2ad685a5c3456114b4d4fe
MD5 0e9eedd3334c9dfea48dc7e5fc1c94a2
SHA1 f2e6be646548e6741e2f70c1203d950c8bbfacd6
SHA512 4970b8aca5779b9134d82e68fcc59866bbaca18b28c72952e79d45c9879b70ebd90a8ec6653bacb55074c1f98ffd957f0a229a671e92b91d0cdeadd130751cef
SSDEEP 768:oGzqP2gTWo666Wo+aViBbnGYtoGaCg5YbQw7ibysw:t+Oo66doZoPp7iWsw
TLSH
T1C3B2E8823A41CA7BFC54F3F6E012164AB3A4C5F2B241D713729DC16A4F876A46E716EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\collections\__init__.py
Size 50KB
SHA256 64b09e7062bb7f41e080900d414988c289624aea0ee6ca4037f1e317a11374ee
MD5 2d40da4d1efe797d3c56a0501e4d7db5
SHA1 f8c7eea86b86cc5b9078e6d528573d1482d9a275
SHA512 88fc484ca83ccddbe7bc544485b85a7fb7576585e9bd6e580f406354c815d524ac603b359105815859ec96db35f6638c70f8a3a60e3aa337e51a3ed077f768bb
SSDEEP 1536:aylSOlujQXts/laFzDRBPoTIqgKCbh0APNXtQo9ndR6l:zlSOlujStJK
TLSH
T15733439A2997B451D78BC47E449FE413A71978139D4F602CBCFCA0286F93824D2F4EE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\collections\__pycache__\__init__.cpython-311.pyc
Size 76KB
SHA256 3aec8b7358e2a6f5464b22c1c589be0058b55979abe7cd04d15fc8b69ef0ae50
MD5 bd67dfab19e5c924c090742f41e696e5
SHA1 af6d0995a84c25cc643a348595d8ec7ffaddd71e
SHA512 b77ac0c122e03e2e5894235ddcee4d59464a64d726be70fcafdbbba682962cc67ec3d32453d88073c76a1a67b81663a1c736b6ff746ee6bd94e43246681a4f7a
SSDEEP 1536:CrRCPTmRyR7yMBDRBPoVIBXhbh0ALk01NRQZG9wBXbYqjloDXY:+gSRyd/wpYqjwY
TLSH
T13F73938574A1D93BF866F2FC84161549B3B1C9F2F600D71B349F906AAF0BB99AC205DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

copyreg.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\copyreg.py
Size 7KB
SHA256 5499e1be7ba52d4715a911ae65ef2d703db9379d21fff2a07fad8877c318e070
MD5 1002260a9ed8ecb081d3f07205465c64
SHA1 b307860d06d26ee2bb65f85bc5b33926d299b923
SHA512 6457fd666e0c16997b112e7652cf06c7fb6085fdb81a44942840560e393ea6dece3335c2c703627d640e151443a86f3c97bd7f49f23ae7847d0adfb0a2f91ccd
SSDEEP 192:VWYgRLssTXZuEfhJfRyPLxfv9nM43Izp3fMHKVR2ZTdaHTcT15DH:V5ILsYUafRy59nM0YdfkYR7K5DH
TLSH
T10DF17318DD24A86B8377C0AE8C2BE111E71D6C57620421B8BDDCC3EC2F11275E3F9A99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\encodings\__init__.py
Size 5KB
SHA256 78c4744d407690f321565488710b5aaf6486b5afa8d185637aa1e7633ab59cd8
MD5 dbb71460fc6b291bade1cd8ef33224a9
SHA1 65f685d945af5d3a6ba88aa8b053dd93854485c4
SHA512 5f12614d6a4561d4506201bba64af6d41bf607bd7fdd27fef040ed30e32fb615bb3c27539fc2481067f0c6abd1b0cf5fdda1c39973f43e7b2839efbc69c62741
SSDEEP 96:VHIYGspF3e06Q0YoKf9m/6kaTC+mWkJ4q3m0gByAroIEJY1937VbHIDB:+YLpFkYowTWn4q3gAAroIEexbHIDB
TLSH
T136C1315AFA30672387D64628349FC158123D386327011EBC7DED83A46F41779C2B2EAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\encodings\__pycache__\__init__.cpython-311.pyc
Size 6KB
SHA256 98bb59c4546910bebd03188b0e045f20f4b6dbdb8696e7d0e853a0ca449c69ef
MD5 632f557a7f6086a7a96d975f3c469d55
SHA1 8d9943c457e5b72e13670c9a0363fd713e34f61b
SHA512 e6bafbb68263c88196359d34a8f10fcc8dae6bb6b39ea1aaaf2ddb69105382a9c4e149973b9b3ab9294727c8e1c31801eb31de830a79c05cbe408921a025e45e
SSDEEP 192:rYLpFkYgvDX49quL0NYjxJQ6X0ZVXsDczpbkoP2Cv:kNngLXMFLSzXsDQ6sv
TLSH
T192D1F846F361D637F8112BB1F0875A4DE32894FB23549AD73B6D81489F95220BC515FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aliases.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\encodings\__pycache__\aliases.cpython-311.pyc
Size 12KB
SHA256 2d5075e17df67ac782dd99f5f9512559a8d0effed892f67c4ebbeee3e896c685
MD5 2259e2e0b8037873d577c64307df7344
SHA1 4189f6d9b821fae352025dfa130f5310ad5711fb
SHA512 ae5f66e0d9a0024196b5f7551f2ff1dce59a7c31aa07064ebd3c083f3bcd73613eb6dd231fda89ffa6d615ca98789517ae0077c64cf085f6358e106167fadac8
SSDEEP 384:PEXG0bueBU6uHc+x7PUfxYtwI9CwZIb0xZ:PYG0Y/sfmtwJiIqZ
TLSH
T11A4263CDB3C465E339977352182121864219529D8FC823D83DDCE0CBD6A99D9DFCAC6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\encodings\__pycache__\cp1252.cpython-311.pyc
Size 3KB
SHA256 8408b64fe94822a5648422204d6a00f705febd98eba5f00a2072f19bc4eb329c
MD5 5544bd2e6f9720cfee3421671cada480
SHA1 47b0cc1c2db0817bbb4c41f4e780bab39c1941be
SHA512 e3be794c7bc18cf3f2d763a1d5480feb837a154b017d561df139c32507626d0f76ea56baf03a7a02f97d08f681fe59fb146d749f1bec6622aed838f84f7f833a
TLSH
T14D613283F8C1A956FD55F6FC4419650C0BAD45BCF108C30BBAAEC266CC562643C6DACC
MD5 SHA1 SHA512 TLSH

Submit Download

utf_8.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\encodings\__pycache__\utf_8.cpython-311.pyc
Size 2KB
SHA256 410ad0d41547e28aadb70f28134a015aa81d5e9ada3a95997e1fe6cfe02b08be
MD5 ec6167e06ef42ec6cdbcc6a2a8c34cd0
SHA1 02427b62c364cf7fedb5c41888f819c86f10d0ae
SHA512 37f7b8e4ff98433881c5f1e3a1dd4465870a52cee7faedf3eca00118bcd75f4d13112ba24dc448627fa6cc101e47ab5f055fb15891249a580da8797d1937dc12
TLSH
T1834105C1D891963AFC58FFBD003A1E191B9E49E5608893177E77D224C896C8C3C91DDC
MD5 SHA1 SHA512 TLSH

Submit Download

aliases.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\encodings\aliases.py
Size 15KB
SHA256 6fdcc49ba23a0203ae6cf28e608f8e6297d7c4d77d52e651db3cb49b9564c6d2
MD5 7961acc2151f5b444d3765837e4dc265
SHA1 65423de933b270a471a02373a0d77922a65b5851
SHA512 b35feebcc53318befe243a65129b62a8ae33efb7944d536088dfc272181716c9c2b00d9002d555a53d4765f6c5bdf7c7361dc08a915998e46be660c46009a904
SSDEEP 384:W8qpsfOQcOOCYcWA38zGzVy8f0gVCLRqgdx924B8xCsiTWm:9qzRzGzHkshm
TLSH
T12662C2F810DFE93B2C91129369AC693A309D5C434D59B14E3DACD2580FE9699F37093B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\encodings\cp1252.py
Size 13KB
SHA256 19aa5bee667f5fb387924a813aec9fa1dda47769d09e8483a748bdb202be6a84
MD5 836246320a751cee0348ff6d493b9937
SHA1 41aca88d201193ea6396d95496f35750209ddb7f
SHA512 8168efcf570e135b79980ca76a45369235f4d677a8c2b210a7d07f0cf439667657d8207a3882232222b50b108f51eb74867eb32be00fcfa02bb3971ca445b49a
SSDEEP 192:OnM5uEBDUtyd93jmxTi5zpCd01dsEwlkkOHuht1:DBKi5zprUxlkk53
TLSH
T13552BE702A932838B77A9B3BDEDB4AD4816451C308F5AE8E784FD1C19FF1716D900A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utf_8.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\encodings\utf_8.py
Size 1005B
SHA256 ba0cac060269583523ca9506473a755203037c57d466a11aa89a30a5f6756f3d
MD5 fbc08635fd9413de90e83848a69e83a7
SHA1 5e3b79f2908de224771061ef88ff5570008afde1
SHA512 95049358d08c3094a543836d5010b0957235b10784b4c39a57b7e3b243c9e0007ca4ce79de11c085c2c0af789c44b5538c4d8631800a757530c18eb1352d697d
TLSH
T189119ECA1C519851DB2F457B1903DE0C508D3AA3951528647DFE83B43FD8E24B5B2B7C
MD5 SHA1 SHA512 TLSH

Submit Download

enum.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\enum.py
Size 77KB
SHA256 01addb65722daecee235caf6b345e4a910b1882aacc29e4fb846e0e0904043e6
MD5 ff1409a8149d30188fa1e3588a9abc22
SHA1 081b51b68e5dba3639b24362af58f48a29c5f7bc
SHA512 12b43f78886b245ab25218b6c0edc906f4342b5e316f48314bd6f3a9af252c61cb7887249bc67505c718534dd5a1876e81620ba217943544beec4ff8e2157f7b
SSDEEP 1536:kcgtcx92ehfymdDjjUtiJokwDny/aQmNaHfM+bjxYbuxcO6tfkMP5QzNuKoWFii1:kcAcb2ehfymdDHUtiWkwRQmNaHE+bjxl
TLSH
T1C7735237AD01A9768A4BC4B90CABE8413B146D07930015FC7CFC95692F53925E2FBAEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

functools.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\functools.py
Size 37KB
SHA256 6d80018a3fa9fed44c5b78f881987ee3ab3fb1238b077b4e6dcb4b76da7db73b
MD5 870aa638febe4d69ee29112836caa61e
SHA1 cd239e58f62e6dea6c41299a2c91af43150dfb3a
SHA512 512c46aa9ed1cf4dac34eda1e689e84dd8c0744cc2befcb4ded54bc00dfae5fa9ad35e47061f53a19f505e1778e6a8633aa8de376cc8c26f3e108a09855ef700
SSDEEP 768:WL3KwaoYsQCeSaS2brvB6iI643gyMCiqm/iWwKvqNmfj:WuldCeSaSK/43gyMCtZTLm
TLSH
T15603C59A6D47B562C747E4BE479BE415A3193C131F0B1468B8ECD2A81F16424C3FAEEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\importlib\__init__.py
Size 5KB
SHA256 49ad4fdc8139026f7f3773e3f50f09207ff6bd8e92a2c382545525235448e525
MD5 8f5053714b9feff971f456e6ee52a274
SHA1 b8c5e5bd1b259e1257c1425c1308590af839cd24
SHA512 2a54df13bfe14c337690910c5f9355959359d8e0d0f829b0ef3feec0cdd37b0c9b1af0581b2d7f8c8ccbd6046c0073c1652e5da8311e89cd26d6c6f657e69b52
SSDEEP 96:4m/wqXuVW0N+NcXrSNUaeTLSN7lKIZUcBk0RM6oL80y8zxK1GEaYURHw7zmysPg3:N/OVXrSNwTLSNMcG0p0K14YURmmfCN
TLSH
T1C1C14322CF605593E302CDADB86DC4604BE55C772E8319393EEEA3BC5F855328AF6584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\importlib\__pycache__\__init__.cpython-311.pyc
Size 6KB
SHA256 50b018b69732248d2dbec3f78852f6776ef2a8ed9aad230b09e3d3f5180bb2c4
MD5 ccb912418e513cc17e43fca147a940a9
SHA1 ac0cfcbd5d2ee1e13045387a58d1f5992414c63d
SHA512 1055f47597c2cd51a32812c528025f63d076a037b38ea8f5772ea97c741ed79faace525fc1ab892b00f79fa9106c9709a3059e7ab916111b87daed04b1db72cf
SSDEEP 192:9OIMk0Z+Vp5mWFNbyUK1pQ/KLb8xtmhNqSjtSuMRlb:A+lFNp8pQGbVhoflb
TLSH
T15CD1F8425F22C1F7F809A67BA0610A11F3988EF332588A53379B827D4FDB9155E622DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\json\__init__.py
Size 13KB
SHA256 d5d41e2c29049515d295d81a6d40b4890fbec8d8482cfb401630f8ef2f77e4d5
MD5 1b08a80fb9db3b613627cb5c23842627
SHA1 a55a77b742153cf9d318590f4f7a600539442376
SHA512 82214a989ff0a6f8185f3bb32d7384a4ff745cd3e1e67d59677b03e8783bdd94644dbbf7da6f2e03fa2437fba68193d5d5852697972a4aaac37b9e5e9c4b00ac
SSDEEP 192:VM0k26nv6B7+vx1GkRGqnHtKv72vx1GkRGqnVsklOVQkQsx1LBwQkQsxTAdHlDhB:VM0Q9vxb3vxLCZrIZrrs
TLSH
T1CB52B92F6E80C9E24B1B58B8500FD404A3085D6F7A58B1983CDCD6F47F42A7685B7ABD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\json\__pycache__\__init__.cpython-311.pyc
Size 13KB
SHA256 531c00699ee629e282ef8136c8430b50c1ccca2706896701d34edaa38bb6f792
MD5 b103691f76a92fcc3827984ad406933d
SHA1 eb1b0050fca65eb16e5f1908daff2951e130bd9b
SHA512 b39cd88f4900e030244afb394d87a3edc009919987c22a535251b51a136d0328a818d90d49fc2a28aa77830b0fc4b405b40e6845ab7b25655bbeb53f69e30a5c
SSDEEP 192:rM0k25NAbr56B7+vx1GkRGqFYvcxtKv72vx1GkRGqCZv9U6QRQkQsx1LfWQkQsxS:rM0TNAb3vx/YvI3vxgZvwZrpWZryh
TLSH
T1CA52E71B3AC1C9E1FE1B74B4900F8115A3149877636CF14A38DCE2B5AF43AB9493A4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decoder.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\json\__pycache__\decoder.cpython-311.pyc
Size 14KB
SHA256 6faf067cd0d931ed4a0e4ebbe3b3c9f4e629bbbc0b01d616b92d218884bcc72e
MD5 123f34316012c1fcc59016b7a2ecb263
SHA1 f7fce8d2d67c59e2e4c6133aaeaafa634929f432
SHA512 3fc319ca899ffbbb6982b754d4d71b812330794519c0e5eb318b71458d6072cb75d1aac83ab3f531143a962380f185f4e2b1610a4c58a300e50fc0af37bfcd65
SSDEEP 384:iwTeA6j8n/GjRKRXif48muIPS2uhooxtleef:Kj0Sw8muPtlTf
TLSH
T1DE62E8852E80C672F856F7B5801B0559F36449F72310D2833D8CD2B99F866A43E3E9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

encoder.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\json\__pycache__\encoder.cpython-311.pyc
Size 16KB
SHA256 834ef693ac0b470642c50d41c7662fe16155b30eb317878a2e9abc7e5a3bb901
MD5 45b7f3db38c96726e12c05703876d3f1
SHA1 ab88886d89534123795c16573f20e3d325796427
SHA512 a168be3f275d116330aa838e1daede952e07b2df9ae73c837f19fd923cb0cb8fe3cb950c4f4aeb007e181f2f98fe1fd336f27637d2e802babd2f7030589046a4
SSDEEP 384:x0cx6MUnd4KUMiwT987v6xrkgXX6X9qKnE92:x0cgn7UMiwB87v6xQrXnE92
TLSH
T1AB72D7146D81C2FEFC66F7BA84290809F31485FBE61197517CAE99218F427789D3D8EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scanner.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\json\__pycache__\scanner.cpython-311.pyc
Size 3KB
SHA256 d08ba77ada4a55215036b7acbe2a188bedd32d6e587023dd0e49e1ceabf813fc
MD5 ba69efbb7f75c9c2d7cad48a371c0f42
SHA1 aab146fe7f398c439c4ede149f1edf88810a8738
SHA512 d8536f1ec1cf37cbcbcd65af17654fd0c57bbc59333a87ddf434ffff70f9483bdb777a07903c044239938e26102819162eb1ec4eb803c00075c4ba15d5a268b1
TLSH
T1D571756CA451D32BF63AF27AD59C4E0476210D8431908613F65AFC32FE87C60B993ECA
MD5 SHA1 SHA512 TLSH

Submit Download

decoder.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\json\decoder.py
Size 12KB
SHA256 9f02654649816145bc76f8c210a5fe3ba1de142d4d97a1c93105732e747c285b
MD5 453b30ee4f3b20e3ea0c7c5bef5585a6
SHA1 e06c178a30b4ff52509b33e78f79a62de300c229
SHA512 13943d4ddd8a48dcebd2fed4cf434e1fb4eb8ea58e5217d087270d0add6b430e68f292e895daf2c82fef243af5faf6853162daf44aa4106b957bd41a1bfc51bb
SSDEEP 192:UxD4+sdKum+6NJvwdLKc6ZiAWVEcAqFNPnmpwHgwAF8mbANHFThJt7AeUabtf:o4Lm+No8muBf
TLSH
T12F4294674D019B32435BC828445BD811D7085837025C6DA83CFCE1F89F8697B96FEEEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

encoder.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\json\encoder.py
Size 15KB
SHA256 af7bd40a0d0d0a3e726a9b4b3a2a543019f6ab97a340d0162a9c29ca9da97869
MD5 2d572e6105d5a80ddadd02d036fda331
SHA1 ae07a47f811993c7258caef85ac7fc72621abf69
SHA512 86f62b76e2a3b24f6a2dc8c0ebdf085c4d8bf2ec4d6438dd5950ca0bafcb526730edcb7bff4a2717d6dcdae2956ac09bdd9842e1e35a57f388325920b5f1baaa
SSDEEP 384:QMUnd47CVCwggJdz6dNIRSyMv4XXeAhxnMvan0XeAhsqdcH3:gn/VCwggJdz6dRyy4XeAhxnyS0XeAhsH
TLSH
T1A7723211EE81C0708F27CE6A6C97980AD71B797B81103674BDDC5258AF11725C3FDABA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scanner.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\json\scanner.py
Size 2KB
SHA256 8604d9d03786d0d509abb49e9f069337278ea988c244069ae8ca2c89acc2cb08
MD5 4a1a7741d18f59dfc633e787f878956c
SHA1 af81dc5523af03f4468b565f9a2cb57c731e39ab
SHA512 07e565c3fbf7768fab53586fd0573fcc743370c52263df66c1a45d02a0348e6bfac013995d0120e9d61e6b42e901976153c2883d925b36f8bfae9e3967ac5650
TLSH
T1A241CBB51A918A218E2ECA280C8BD042D3047E23581468B5F4FCE0F8EFA1166D5F7EA4
MD5 SHA1 SHA512 TLSH

Submit Download

keyword.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\keyword.py
Size 1KB
SHA256 afbe73afb68d32fa998e5ff3d081090deec457152470f5331cc2bd430a0e9d2a
MD5 4f099ee9fcd9eb9735963c09769b6c15
SHA1 e102117ebe09ac0fc1fef77ec11d523e75cb5243
SHA512 d8231aaa5952f61846cf609c8281a15e3f9b746db717ff9674f34484acc4976ab22218a69f2f541ba87ed244c109978581cf3be8645ae1dc22427065f82ee369
TLSH
T13F11D0375C07CCA40981D10F8DED80767AA4E4571E08785D3EB8CA49AFDD40C82F96F2
MD5 SHA1 SHA512 TLSH

Submit Download

operator.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\operator.py
Size 10KB
SHA256 b2af20f67667203c1730e686cc5d0427becc94db4c97f1d3efe3ed2158473f6a
MD5 643e1b1a75e7d0fa6fe576c7ef3ed9aa
SHA1 5940bcbca7c52a3f5c05e98f9d85e5631dfec0a3
SHA512 91e989d967e3aa997e18cf4ed5eb293b0303cda1f41b58b20ce7eb18ee9e09a4f2e558fa513d037be7452c4a2b505dbcc5e7848732e5365d8677a278d4dff6c1
SSDEEP 192:jwY9LnucI+XURNQJBbyeG+N2pHrdGTDQGIgQoevQSMWx35KV4YLQmGn/v2l4mGrr:AYGPF5KV4Y6tv
TLSH
T1A832EEB9AA43ADAAC24B912C8477D4C3BA5C6D23824D2CF4B59C70583F5D842D3F49ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platform.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\platform.py
Size 41KB
SHA256 4a3cc68ba7354f8d5cc28c55315a7d77b77dcdbbaa3a092572a636b5fb5b6938
MD5 13712d5635b9237e9d007c028b6fe06b
SHA1 d7f093e62a5127c92b10bfdfa21734492912d161
SHA512 d26febb6a2de4a13f40d56bc3f96c36128afe3c1a2193a1d1d681d44fd4cf3623fc7e67a01102bc18231c2f4037d3400120cbe93f359bbde008a9990432dbd46
SSDEEP 768:3EY6iwzS1+Bq3eaUDnmkHreYO1RxwRk618gxD4sM2gmYKhSONdmDOG3XdDcEQstn:T6NBqen+1RyRk61xdM2gmbZ49cEJV
TLSH
T19313A426EA55A97B92428A6E49DF8180A739682F2B41A53CBCDCC1143F5107DC3F7BF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\re\__init__.py
Size 15KB
SHA256 029ead61f362489e9bb034f4c2503abee95462056541e9ad07715de3c353b0da
MD5 d33dc6f31adff6340e9feb4827d969d8
SHA1 95b2d63671fde72a2abe99816109da6043ca5f7e
SHA512 88147c7161ed04eaf72c0e88a4484997db3fbd86e10ffe264e294e9a4bacf7fdbe4e584d1ed94093f052ab68be1b473d0d00ccf7cdd8af5869bef2f6897ac616
SSDEEP 384:xq8uPJsiNcNOfPa5gKkFEtST5xRm+kRtSyKKMyKjeY+UVwph2X:48CJssYYPa5gKYEtO5xRmPRtJK0KjeYb
TLSH
T1F16265BAED8D1F628703C59D545E9081DB86D4372F3414AAFDCC47282F0B8A4927D9FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\re\__pycache__\__init__.cpython-311.pyc
Size 18KB
SHA256 aa3dc94038d24d8078b88cba718081e6ec9e8ca65ded2ed7ff83e8b4044548b9
MD5 d21b28d031af857745ef19a1d1030595
SHA1 c76d2e2c8c1b14ed3106249f11773002b1bc99e3
SHA512 623915e434020d7bf095630e47b97173c73fc0cd55a5af3a18e2fc63b424c856354f50e4b398c438855d591e405662359984653796d1eb1c1a30eb67b5f127db
SSDEEP 384:suPJsiNMTkmpkRaRqaRM7YPe11fTrz89ZwIaH:sCJssMnKRaRqJee7fTrz89ZwI2
TLSH
T1DE92C7D661858B77F912A7FE906F1085FB55C0F2773482A7F98D40282F0B6B459318ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_casefix.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\re\__pycache__\_casefix.cpython-311.pyc
Size 1KB
SHA256 6b283d2a4fe2f2ef7bafaab0305e723039451bcac7bb0bedafb490f419354aff
MD5 c616396657769643b964404f46242b56
SHA1 ec81dfa9acf3911c997f837f082fa9c15f0e3d16
SHA512 ab2eedb47ecf21016e32247c3f6c553c8e293efbe85c4a8e2b25ff0c8c95e09c23d8ca985ea3ef9bc749328a1ab221cab6fe38972376ba429005ac972d314b41
TLSH
T16C41623072443A63F634F3F91C76532EE25C4058EF48BAA3C466ACCD1A66684DC1C5E6
MD5 SHA1 SHA512 TLSH

Submit Download

_compiler.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\re\__pycache__\_compiler.cpython-311.pyc
Size 31KB
SHA256 2a95f6c2053f7e36dcb64c98d812159fa7925f884234c6899b1edee723bdb753
MD5 ae9fcf02b28268869926a1a7e203d07f
SHA1 ca91abfe1bdc9624872707e7bc903ac61d710108
SHA512 8e150f183b1f1c0631c8fed1ffdfe52831c99a5a90a573406dd42ac1ccda46b29fe901682dbafdec630ac3e9c722c69a80d4a908d1852128226db47e404703c6
SSDEEP 384:ue4485c98jLBL6j6619vQMIN/K65smExSeAa23H5CPjKd9EbMAwW099EKmZ8pve2:L85G4ALfC5uxSeAa2X5fOrwWScipe2
TLSH
T15CE27F947761C9BAF921F3B5C412091FF329CAF13361CA437595D12B9E662B9BE008EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_constants.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\re\__pycache__\_constants.cpython-311.pyc
Size 5KB
SHA256 cc7d683e4946823f22be39fd214ed4b00b7b81865ab86c259be90229b97e87b3
MD5 a8a4441a83133b75a87362e6764859ff
SHA1 894b906ae46d7c2f9bbf2c67708d95ea631eb82c
SHA512 478b06046a0c7432d751c7b0f93f73fdb7e898f42cbc22fd81577d9f87ecfb2a682df597522afe928078699e4423622cc8b1d3c13eb258770c4db81e461927cd
SSDEEP 96:335OsKuskiL+zuQSUNFMCZpFKK7EPcMkSLecbpP84PA2Upn:3VK7kiyaOHM0QK7EJoG584o2qn
TLSH
T1DDC1F7C546A25FEEFC8BF1764837059426A7CAA7A610C30723B5410A9E0F3E5F9398F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_parser.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\re\__pycache__\_parser.cpython-311.pyc
Size 49KB
SHA256 c3551948d0853a4f1b6987f807700a470ab5154a43ab279dc3e558a988543029
MD5 ac8508ecb69e3efe07563fde440fb48b
SHA1 7fba97c99619a203bf66afd69fc67f4999832077
SHA512 b70016b7c55dcc2ac190a572d9e036e57cc45654b9b8ba335914ccd4579a8cbc92a67f0f8bd65415c9f73e5407a0018c46f99988d83b6a77852fa0ba6c1017ea
SSDEEP 768:nnt3viH/ns8bPsPpvEy5Avr9xPvZG4cv0pMVWi/rXbKNZknX06ZU1ND+:nnpvifCf5A7O0pO4kX0nND+
TLSH
T13C33B2557681C97BF856F7B2C417090AF378C9F0E702CB27660A82269E8B7787D114ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_casefix.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\re\_casefix.py
Size 5KB
SHA256 41572ac50cf96b04496e676d8a6708898bb8e752e06dad34ed4c50c5d8f1fe40
MD5 726e833de423703cfd15917369710470
SHA1 fc01f1731a6ab3d509c28b0e091bc777939bae52
SHA512 0f8b1a1b592b418c2571e0693224cf96ad9ea4ceb5d4c2d7d80b70c4a5911d7971efe1ac35f3b71dff0ca53716ad306dd15e5369b593d8c99101d737aeadefa8
SSDEEP 96:P1qykKUmgFHYXYgtySZ8ho6lAE5q9imt20ASkG3eAFN1C:fUmgp8MhrlAsmt2NSXeUjC
TLSH
T136B1E1F1A88211442379DF792A6B68C870D119D269E4DE29300FD2C70BF24B9BC5EDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_compiler.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\re\_compiler.py
Size 25KB
SHA256 c05067f8bfa4c13cbbf1eedc4d5cafc9b621bcb6ebc5771ba0518a18095af15a
MD5 ec945c83391a184b87cc0c597934d80c
SHA1 225dfb4e13772cadaf9a450dee799b5b310be717
SHA512 8999f1f57e6813daaca58c8e6bee6076d7870e5478f25049b964729697d1f90cfc87e74c0e263baa6092d94aec6497d9391437060f491d2fff205e911d01b79c
SSDEEP 384:IT6n/PHiedoD8LFbOfC+9/1CNhWcBTxMMG37/IsOASQBDL:IT6n/PHiUICGC7WcBlMMy7/IsuQBDL
TLSH
T199C240302EA32939C303C9594CE78014536EBC27BA652938795C63486F1E678D3F5EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_constants.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\re\_constants.py
Size 5KB
SHA256 3e4463dc8ba87c4a3563be46d2d593e82ca9a0fb91768cfe5a07554ed3de82c5
MD5 00d71e482552ee6cdc970708193a2e69
SHA1 bb706b32ea7c0eb86532410a6e37436af5e942c3
SHA512 b4e91582bfd7c4edc61d5a9990778d48fb19d35a476dc591041d2f2826e8c38c1327f1d962df193006cbefed567aae513656fce8ff0343a9828ffe26764e9a3a
SSDEEP 96:xBUvOo743esUz6r1k6hdVbxcbxbabB0vpTDtY3tYDtYGIz4dDVAhTouyj1T2DOA4:J1126pbxcbxbabqxntY3tYDtYGIzoRQY
TLSH
T1DBC130734ABA1FA88083C0571C7F618825AB522B5D547566B7ED40049F4E6F8F2798F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_parser.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\re\_parser.py
Size 41KB
SHA256 4748e39c77d6dc14f81af80e68a62ad99031a8182d5e0b219a6666d0cfb1626f
MD5 44aa6702665a3cab9429a79261fcd26d
SHA1 854360dc2b7f931890d7ca32be458a62e9861e3e
SHA512 3d89103c61941d8c574fdfc71b31c847d9223df946f2f515daf54fc96e875a5d55e1973df95be1c42557250464564e4620058ad11cd9becb09f86f03f0f9ef64
SSDEEP 768:XISeYq8grljq98Hyw80TuAXviHw/xVnhEpuTydZzxEgzifeAw0K3gE:XISeYq8Slj1Hx80TuAXv3C
TLSH
T1C4132F275A624839D317846D0CA3C0024B1E6827DB196E7CB8AC52583F729B787F9FF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reprlib.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\reprlib.py
Size 5KB
SHA256 264433cc232332db871666b3bb6e4c2cb97b092cb8d5056a45ec2e53daea2b1c
MD5 012e97e2b040814aa62714cc15b20f8a
SHA1 8647e5e90f30388ea9e9b880c3c516069441ce16
SHA512 c826f502c0d89fc454f2c1b480479d6fd596968e7de8a9a80b2e5c313db43650304277f30800f632aa10120618f7ec408a23af09cadaf7183250d8aa18bd201b
SSDEEP 96:SHyWDXMoembvEqZInvbHXHJeDEYD+jpOBgj8ogJonoq7p9eJgr:htoemCX6eqGwonnl9Jr
TLSH
T1A7B19EA92497B911D347E46D08DAF90BA92A3867500C34B5F8FC36B8AF5A41482F5FF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\site-packages\_distutils_hack\__init__.py
Size 6KB
SHA256 ced72e54431ecf2d8d7dbd8a1e27724f1b171af3ca1503c304bf11c59a7fe861
MD5 e912fe96df779359bf6746580f019644
SHA1 8bcd1183f1544fff8a04485304c434f0300acdb6
SHA512 ea0495c3b02874b58806758425351b40723931ec7fad50dda15b5eed3e377ff77a4add2eaaf012b7e0339f6db9ceff8ac1b8736cb160e8507ef73d8ac49aa148
SSDEEP 96:cnuPveem/bGmdx9pJHPrGXwiE2fXsfnCUy01LOq6LIrqCWPANPuqlTl7Frw:cuPGJ/ymdnppKEk0CNsrqoWel7lw
TLSH
T1A6E15233C8635C8247C7C1F45A87E471FBE558930AB06938BDED42A82F995E0C9FB5A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.cpython-311.pyc

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\site-packages\_distutils_hack\__pycache__\__init__.cpython-311.pyc
Size 11KB
SHA256 e7976b0078a0a8199b491a48bd69375826050d8a38a0cc24c84ca2c27d38f0ef
MD5 dcd6fbdc41660d585336b6580022fdc9
SHA1 18fc13c1b90e6d6491633e9fa92cd61bf547f923
SHA512 87142d2266eed61c8976bd06f5fffd687c2ccf81bb12ad5d4d084ff93927e2ff49bdee0505e0cf2bc8a640b378989957f335ff4ea36323356703534f46a00b85
SSDEEP 192:FPE5v0Hgpf0+r2GKN8VqTTxbH/w/RY8eAfuhE8HqUbKUBlbIqK6Zr5vpOrVrgYz:FyvsgBfKoqTTxbo/RY3jhEoqUbKmlbIf
TLSH
T1F132849259429CB6FAB4F2F866121535F7F384F6A3205713716EC06A4F2F6C4AC662CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

distutils-precedence.pth

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\site-packages\distutils-precedence.pth
Size 151B
SHA256 2638ce9e2500e572a5e0de7faed6661eb569d1b696fcba07b0dd223da5f5d224
MD5 18d27e199b0d26ef9b718ce7ff5a8927
SHA1 ea9c9bfc82ad47e828f508742d7296e69d2226e4
SHA512 b8504949f3ddf0089164b0296e8371d7dcdd4c3761fb17478994f5e6943966528a45a226eba2d5286b9c799f0eb8c99bd20cbd8603a362532b3a65dd058fa42e
TLSH
T1B1C08CF28A022D104091A565CD19261BEDB88F203A567310C66046FE636261C2AD24B0
MD5 SHA1 SHA512 TLSH

Submit Download

struct.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\struct.py
Size 257B
SHA256 9c231f9497caf513a22dee8f790b07f969b0e45854a0bdd6dd84b492e08c2856
MD5 9a042099d6ad2dceb1c9ba37c7030369
SHA1 dd29986d2204dbac1767dcf35002ea42ed224002
SHA512 b2f5c6a0d5e1390c27d73f16ddd1ff7097337211c8309d4d928d6056e4f1cbe0e1394f12121e90ff2d75da212c942110cf418eeaf42f455db0410b3067684964
TLSH
T146D0A722B03BA09E68E6C4D2C1CE1C15637F5207DEAA36DF345AAB340FC21050C90135
MD5 SHA1 SHA512 TLSH

Submit Download

sysconfig.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\sysconfig.py
Size 29KB
SHA256 c16887bf792dc21f27fe5d2ca4ee271f131b7f6a88593def43be52cfbc846759
MD5 28cfe9940e708212b2bf5b2dc60fc25d
SHA1 121f9b72ddc9e7c14c4114f37f3475b07a3e482f
SHA512 254aef9f11b091aa248948af448c51f1f2dc09bc14bc544c3788c841fa3fd18be1ab81fd0a0f0d56e81891a45aebeba6646fdc893f153687cb85a359e64917a1
SSDEEP 768:kp3B6PljhDaGV22n1K7YgUvn3roaf6dgvOK/:k/69hDaQAUDfb3
TLSH
T1C2D2E8A69A6F98B54283176F4D9DD004E755B9B32A50703CFD9C910C2FC4A1C83B7AF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

types.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\types.py
Size 9KB
SHA256 0c08fbb650c37535a7d8361fc12029e3f4c72a418cf564e8779dae14b979e5ba
MD5 c386621521e57a91462ab1f168bf380f
SHA1 57cf18e68b6fdf80e97285fafbd3e5667f65e252
SHA512 37a56b402cbeb7de2fe801d18489656ade4cbd6328e53207af57ab9d64cd1fee22bf1ca1eac739805e056cec20122e81b8f69a2543fbf754a608c28ab660b16e
SSDEEP 192:Qq0LiW+etVKyueg/quvgUpYUuxVV3wflRWSTO4j30XafpY:QqhHenKyb+lvhpYfxI1TO4b0XaS
TLSH
T129229627BAA5EA75C747D579C893E082A3199C27C308052478FC82B86F12561D3F6FED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

warnings.py

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\Lib\warnings.py
Size 20KB
SHA256 47328418f0365f0897a2d3789f684dbaba1d5b9c492871f1b72a35b8e2e92021
MD5 0cc2088a084a5c4e4c6322cd641deda7
SHA1 cec9eef5b075286ebf63c358d31af106a3b258ac
SHA512 88628602a5786605c1fbc25b4ed49887ff42ae8e196962cee8198396b659fd579636d1b44bc45541ca4b13351738cf7094fe9c0f91a3ac7c341394e52becb44f
SSDEEP 384:F5zPjSMXz6pYaN1nuVWeqBJKVvI7aU/MZSiFUmV:F5HSMXz60QOIMXFUmV
TLSH
T1D992643A69696DB7CB0745AAB983A00E07E9A85715052AB4BCDCC24C3F84574C3F97FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\VCRUNTIME140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python.exe

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\python.exe
Size 89KB
SHA256 4d33159de276fb921e2e987f63af88b75d88c4de0b1848373b7b85b570cd726a
MD5 3e91d50d4634976cf2d83eff39378962
SHA1 b2cedfb61ba75eecfaa1130796dd19ee724b83f0
SHA512 36aa60603191d5426638428f7acd99ef839f6a0daa6bdfe80d8e1e93eb67ee1c90e7cd947321e2607c6cdfaf141d643b1acca47b9f1cf59a531782eb419f45a8
SSDEEP 1536:IV0IzbuEYE+9z2wp+FavGmhMn+IhzZtzw/wZR:Iq4buAs0FNmhMn+IhNK/wZR
TLSH
T1D3937E4A6A5E81A0D4749071037B43F61B2D2E21ABC2C6CEA7C13F1AE97D1C1F529B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Roaming\uv\python\cpython-3.11.16-windows-x86_64-none\python311.dll
Size 5.6MB
SHA256 40a427366808674fb8ddba610e1ed9200709a4f166a135794f90205c94d69548
MD5 358e04ce7a2498a8bdb0726b022fd37d
SHA1 60fe7ed12d5e76fa89169c3beeeae2d232102ed3
SHA512 12e44c052035248fa3e88c45602db80d65b3a8da1eecf51c3cdce3e04ea488dce2e4e88327560e8bd211c0ce35ccbdd826e5e3ac1596aa2ece9aa87c4525a1a5
SSDEEP 49152:58SVKc4tveZVPzQcRFu7WBs39zjy0EUPNxf1TO1qyxPcQY6SvzRzz4YnUuCjLow6:5ohpeEWB+Jjy+CkiujnfTfSHyMW/tD
TLSH
T128466C21B26499A0C8B78536EE2B435AC7717C506B11DB4B51A4B3EE2F337530AEF349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads