9da04fe8b604e0d0112562da0744c416461b43c32526200e2e857fedc7bc76bc

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rootcrypt.exe
Size 39.1MB
Sample261024-1wltbaxtbz
SHA256 9da04fe8b604e0d0112562da0744c416461b43c32526200e2e857fedc7bc76bc
MD5 cdce341f53d164c7df0d30da4ba7d9ad
SHA1 5973dfdb0e886568bc9063dbbc45215072f71d4d
SHA512 49a89da2136560f0aaecd262832cb52170617a27a11ff186cd5ef3dce642be7ed76283b912fcd8daf99a749624e213f2b81453b77a428538709e4c20d9132c0a
SSDEEP 786432:x+gX4BMdhwzTQXR5FbPp6FcSS5U/LT2KzVyPVLBdbl60GMz:zXGMK4XR3bLSCU/+6yPl3BGM
TLSH
T181973310E5E804E6E8762634E4F16386DA2274AD8BB1C6DB40E002535977FE06B7F7ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 24 IoCs

pid	Process
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe
5540	rootcrypt.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5540	rootcrypt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5540	rootcrypt.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5540	rootcrypt.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 5540	3556	rootcrypt.exe	89

C:\Users\Admin\AppData\Local\Temp\rootcrypt.exe
"C:\Users\Admin\AppData\Local\Temp\rootcrypt.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Users\Admin\AppData\Local\Temp\rootcrypt.exe
  "C:\Users\Admin\AppData\Local\Temp\rootcrypt.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\Qt5\bin\MSVCP140.dll
Size 576KB
SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
MD5 01b946a2edc5cc166de018dbb754b69c
SHA1 dbe09b7b9ab2d1a61ef63395111d2eb9b04f0a46
SHA512 65dc3f32faf30e62dfdecb72775df870af4c3a32a0bf576ed1aaae4b16ac6897b62b19e01dc2bf46f46fbe3f475c061f79cbe987eda583fee1817070779860e5
SSDEEP 12288:xI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRkdQEKZm+jWodEEVh51:xD89rxZfQEKZm+jWodEEP5
TLSH
T1DBC40923A74901A0E196E3B891C78306D7F17C468312E3C792FAD66D2F5B7D5AB3B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\Qt5\bin\MSVCP140_1.dll
Size 30KB
SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
MD5 0fe6d52eb94c848fe258dc0ec9ff4c11
SHA1 95cc74c64ab80785f3893d61a73b8a958d24da29
SHA512 c39a134210e314627b0f2072f4ffc9b2ce060d44d3365d11d8c1fe908b3b9403ebdd6f33e67d556bd052338d0ed3d5f16b54d628e8290fd3a155f55d36019a86
SSDEEP 384:rOY/H1SbuIqnX8ndnWc95gW3C8c+pBj0HRN7bULkcyHRN7rxTO6iuQl9xiv:yYIBqnMdxxWd4urv
TLSH
T1F9E24C8AEB688883E963587085B9DD47FC3DF7D15B60529F1259E7680CD33C2AB3461C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\Qt5\bin\Qt5Core.dll
Size 5.7MB
SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
MD5 817520432a42efa345b2d97f5c24510e
SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
SSDEEP 98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
TLSH
T1BA569C47B6A70160D0B6C27CC9A7821BE6B3781287228ADF425CA70A5F777F1293F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\Qt5\bin\Qt5Gui.dll
Size 6.7MB
SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
MD5 47307a1e2e9987ab422f09771d590ff1
SHA1 0dfc3a947e56c749a75f921f4a850a3dcbf04248
SHA512 21b1c133334c7ca7bbbe4f00a689c580ff80005749da1aa453cceb293f1ad99f459ca954f54e93b249d406aea038ad3d44d667899b73014f884afdbd9c461c14
SSDEEP 49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
TLSH
T13966178672596262C977E27D8B4F052EE1F3B85283428BC744558B880F737EA1B7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\Qt5\bin\Qt5Widgets.dll
Size 5.2MB
SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
MD5 4cd1f8fdcd617932db131c3688845ea8
SHA1 b090ed884b07d2d98747141aefd25590b8b254f9
SHA512 7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
SSDEEP 49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
TLSH
T179466B87B3A50185C16BD23CCA8B8613D6B2B04447639BCF256A8F592F737E12E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\Qt5\bin\VCRUNTIME140_1.dll
Size 43KB
SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
MD5 6bc084255a5e9eb8df2bcd75b4cd0777
SHA1 cf071ad4e512cd934028f005cabe06384a3954b6
SHA512 b822538494d13bda947655af791fed4daa811f20c4b63a45246c8f3befa3ec37ff1aa79246c89174fe35d76ffb636fa228afa4bda0bd6d2c41d01228b151fd89
SSDEEP 384:Aim/NRETi8kykt25HwviU5fJUiP2551xWmbTqOA7SXf+Ny85xM8ATJWr3KWoC8cS:0Ie8kySL2iPQxdvjAevcMESW5lxJG
TLSH
T156136C4597BC8086E46789B0C0A6DF17FE38F6926760928F0B65D25D2F537C0AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qminimal.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\Qt5\plugins\platforms\qminimal.dll
Size 824KB
SHA256 05d1e7364dd2a672df3ca44dd6fd85bed3d3dc239dcfe29bfb464f10b4daa628
MD5 2f6d88f8ec3047deaf174002228219ab
SHA1 eb7242bb0fe74ea78a17d39c76310a7cdd1603a8
SHA512 0a895ba11c81af14b5bd1a04a450d6dcca531063307c9ef076e9c47bd15f4438837c5d425caee2150f3259691f971d6ee61154748d06d29e4e77da3110053b54
SSDEEP 12288:y6MhioHKQ1ra8HT+bkMY8zKI4kwU7dFOTTYfEWmTxbwTlWc:BMhioHKQp+bkjAjwGdFSZtbwBd
TLSH
T19F057E87F3A905A8C567C239C257961BE7B274091321ABDF15A08F697F13FE12B3A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoffscreen.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\Qt5\plugins\platforms\qoffscreen.dll
Size 736KB
SHA256 54097626faae718a4bc8e436c85b4ded8f8fb7051b2b9563a29aee4ed5c32b7b
MD5 6407499918557594916c6ab1ffef1e99
SHA1 5a57c6b3ffd51fc5688d5a28436ad2c2e70d3976
SHA512 8e8abb563a508e7e75241b9720a0e7ae9c1a59dd23788c74e4ed32a028721f56546792d6cca326f3d6aa0a62fdedc63bf41b8b74187215cd3b26439f40233f4d
SSDEEP 12288:/HpBmyVIRZ3Tck83vEgex5aebusGMIlhLfEWmpCJkl:/HpB63TckUcLaHMITAZmW
TLSH
T17EF48E87E7B506A8C567C238825B862BF37574051310EBDF16A44B7A7F13FE16A3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwebgl.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\Qt5\plugins\platforms\qwebgl.dll
Size 470KB
SHA256 9c3b2fa2383eeed92bb5810bdcf893ae30fa654a30b453ab2e49a95e1ccf1631
MD5 1edcb08c16d30516483a4cbb7d81e062
SHA1 4760915f1b90194760100304b8469a3b2e97e2bc
SHA512 0a923495210b2dc6eb1acedaf76d57b07d72d56108fd718bd0368d2c2e78ae7ac848b90d90c8393320a3d800a38e87796965afd84da8c1df6c6b244d533f0f39
SSDEEP 6144:WO/vyK+DtyaHlIMDhg5WEOvAwKB2VaaHeqRw/yVfYu4UnCA6DEjeYchcD+1Zy2:bKtHOWg5OvAwK0NYu4AShcD+1U2
TLSH
T1FFA41736FAD00685D52AD2358A7BC946E632399C0BD1A6CF2328CE1D5F366D2353CB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\Qt5\plugins\platforms\qwindows.dll
Size 1.4MB
SHA256 3333ba244c97264e3bd19db5953efa80a6e47aaced9d337ac3287ec718162b85
MD5 4931fcd0e86c4d4f83128dc74e01eaad
SHA1 ac1d0242d36896d4dda53b95812f11692e87d8df
SHA512 0396bccda43856950afe4e7b16e0f95d4d48b87473dc90cf029e6ddfd0777e1192c307cfe424eae6fb61c1b479f0ba1ef1e4269a69c843311a37252cf817d84d
SSDEEP 24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
TLSH
T1D4658C57A3B54299C26BC23DC64B8B17D6B1701503219BCF01A98E597F23BE3277EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qxdgdesktopportal.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll
Size 66KB
SHA256 e23fbc1bec6ceedfa9fd305606a460d9cac5d43a66d19c0de36e27632fddd952
MD5 f66f6e9eda956f72e3bb113407035e61
SHA1 97328524da8e82f5f92878f1c0421b38ecec1e6c
SHA512 7ff76e83c8d82016ab6bd349f10405f30deebe97e8347c6762eb71a40009f9a2978a0d8d0c054cf7a3d2d377563f6a21b97ddefd50a9ac932d43cc124d7c4918
SSDEEP 1536:Nt4B1RLj3S6TtH2sweUH+Hz6/4+D6VFsfvUfO:AB1RHFdoeUs6/4O6VFSZ
TLSH
T142633A5763A405D6C0B6C338D9E24A16D2B7B8100B62CEEF926D8A1A1F333D3797D794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindowsvistastyle.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll
Size 140KB
SHA256 d9b21182952682fe7ba63af1df24e23ace592c35b3f31eceef9f0eabeb5881b9
MD5 53a85f51054b7d58d8ad7c36975acb96
SHA1 893a757ca01472a96fb913d436aa9f8cfb2a297f
SHA512 35957964213b41f1f21b860b03458404fbf11daf03d102fbea8c2b2f249050cefbb348edc3f22d8ecc3cb8abfdc44215c2dc9da029b4f93a7f40197bd0c16960
SSDEEP 3072:rrjwZ43rCOtrBk7wcR0l7wBlaL6BtIEt51T0Nhkqg8FoQY:7hZu9R0l7wFBtIEt51T0Nuqg8JY
TLSH
T149E33B1372A502DAC077D278C15F0517F7B3B05853128BDF426BCEA92F532A2BE39A56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\QtCore.pyd
Size 2.4MB
SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
MD5 678fa1496ffdea3a530fa146dedcdbcc
SHA1 c80d8f1de8ae06ecf5750c83d879d2dcc2d6a4f8
SHA512 8d9e3fa49fb42f844d8df241786ea9c0f55e546d373ff07e8c89aac4f3027c62ec1bd0c9c639afeabc034cc39e424b21da55a1609c9f95397a66d5f0d834e88e
SSDEEP 49152:ZYS8YHrNj4/7RsRLvYpiW3pCBU+Z7bJWvCSBYgbxGJ5M2GM/fXR1fUdihfSbCo6e:9bpj4/7RsRLvYpiW3pCBU+Z7bJWvCSBv
TLSH
T1C8B51957631965D4C4FAD638C90F860AF6F370111346A3CF24248BA92F637EA6BBDB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtGui.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\QtGui.pyd
Size 2.4MB
SHA256 a9408e3b15ff3030f0e9acb3429000d253d3bb7206f750091a7130325f6d0d72
MD5 ae182c36f5839baddc9dcb71192cfa7a
SHA1 c9fa448981ba61343c7d7decacae300cad416957
SHA512 8950244d828c5ede5c3934cfe2ee229be19cc00fbf0c4a7ccebec19e8641345ef5fd028511c5428e1e21ce5491a3f74fb0175b03da17588daef918e3f66b206a
SSDEEP 24576:SUjOoTFrwI8nc6EmRAQ9RzgpP2bXYUKuXeLQp5PjYq0zb:SUqCgnZXRAQ9RzggbozJLQp5Mq
TLSH
T12FB53A1B531934D4C5EADB3C890F8606BAF37016134693DF14258F692FA37DA6ABCB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtWidgets.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\QtWidgets.pyd
Size 4.9MB
SHA256 a1e97a2ab434c6ae5e56491c60172e59cdcce42960734e8bdf5d851b79361071
MD5 e8c3bfbc19378e541f5f569e2023b7aa
SHA1 aca007030c1cee45cbc692adcb8bcb29665792ba
SHA512 9134c2ead00c2d19dec499e60f91e978858766744965ead655d2349ff92834ab267ac8026038e576a7e207d3bbd4a87cd5f2e2846a703c7f481a406130530eb0
SSDEEP 49152:Qi+reIG7QwktsFPKoe2yicbbqgkcY9abW7KnTYK2bjMkTDGM7y:uqT7Q1kyTvoWW7EYvM9M
TLSH
T1C436F803665A71E8C4FAD13D8A4F4602F9E37099035B93CF1C264B5A6F637E1AA3D748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sip.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\PyQt5\sip.cp311-win_amd64.pyd
Size 120KB
SHA256 319414d886bbd0baffbe41e28b455ed463d57701568d531dc85f233ae8f597aa
MD5 dff0104bdd4b38d015ff0d41ca9e11f9
SHA1 676dea0648db65eed34bcc586fc832ae547bd4f7
SHA512 ffcd13b3dc6fa7027b2826867013f8b4096a936446ff7996acd1a68fff0c80e83aecba3dd95fa1b330e73ae763d91c645f3c55516483f40d8a997cefa90ec9ef
SSDEEP 1536:X1RQ/wGSVWcro1B5cOPVq/bArWFmtDfbDWRAU5FvQtY3v0CiUblu:X7swXtoZcaq/88mt3jU5FvQtY/0Wbl
TLSH
T14EC3295B33D800C6E6A6917C8C639503D3B3B061271167CF02A0DA5A2F67EE67EBE751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\VCRUNTIME140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\VCRUNTIME140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\_bz2.pyd
Size 71KB
SHA256 c46b2979e25b66827d0361a559e12879b8a250cf5c8771a54db94e4808e00685
MD5 8d28cd65e4ce6ca79c326f9daf2e0a67
SHA1 286b4fab4996a2d90e85664bd4dca3230dfd3ea6
SHA512 8f5cd8c289be8ef87a94ed8314796f4e2be9d3f08c89dbca81452784723a4912142a58bb4d7565744c1a5691403b9d1084050f58bafe48b8ea3f902b800d3fd2
SSDEEP 1536:AENENz793YK4ZnPnomCNsD+Zr/E/8dDCIaR0IKIECV:NENzxoKiomjKpEkdWIa2fIECV
TLSH
T11D634B56B7B666F4F46F90BD8A410323E330BA55036063AFF148829A3F13BD1AD78356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\_cffi_backend.cp311-win_amd64.pyd
Size 175KB
SHA256 0b5c05bf3e9da14c33566d2c546fb7618ac7fc2b89365a66cfb1082ffe3d898d
MD5 87c57ea3f34d4226c596eb64f72763e7
SHA1 4226786006bc8c924790bd770d07ab3634a6452d
SHA512 2058e5c248cc7deca4d0cbab8ad3ae22ee7baaa2ebdf8289dd03ca7c1c888c8a1580b86cf3b1c017c46c660e0c2cddd4c4b40786bb176d0e043245751ec5f2d1
SSDEEP 3072:kWkpON4k4KPLiOVX+ARhbUvyT2z243Zy5FthZQ2P7RFSTL7Ko3i3gA2Q:krKPLTVRhbUvyCz24sDFFSTLO8Sg
TLSH
T187046C5A328C11B2D6A6513886579B53F3B3B460174197CF01A0C7B52F1BBEA7A7FB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\_decimal.pyd
Size 237KB
SHA256 5566518542e3ee6dd8cbecbae76e40a30015e82cc04ee4ea768a3cc9fb53f4ce
MD5 a80ed1383173049f9b26ea01b27fa058
SHA1 0e0c9361f18c4df41a8d13cea3c34c66367989ad
SHA512 a8f60aff4123565e5aa2a4977e71e6de386deddf267f9cc3d1d8caa170d66fdf8b5518f54a1c9aee18fe8108cd99bb687ace83c524e05738c31a6621f4dc5856
SSDEEP 6144:HXOksyljLGY7iCIH1VA2Bk9qWM53pLW1At/Idtz:HeTEjiY4H1VA6ln/IHz
TLSH
T1E6345B5AA2490DA4EE778074D8579F47E7B278940360C3CF43A48AA73F576A323BE744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\_hashlib.pyd
Size 52KB
SHA256 5f17438d0e3091e6006048c873ce43e7e33d842a2a736500815a56aa8be4bf01
MD5 1a99593df5483910489b9c16cce25b18
SHA1 ef4f8488301577e7a53c2ae354acef37f24ea649
SHA512 3033b22ff61ce6d7ebcaee1ebebd68811e07c5ad5c25a9def226e6982b04fa5ddfce55e6213a2db5c5e1f8a271aca26797c4fcf8b1a8d20fe7b560512bf566e5
SSDEEP 768:lKyUPw0PnfpXx+TSRN24ENp+nfEZWKM0IyIEOIv:lKTY0Pnfph+2YzNafEZtM0IyIEOI
TLSH
T19F33490AF29100E8D56781B9C9A31E87E6F2F15417107BDF4368C28D2F237E396B6B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\_lzma.pyd
Size 149KB
SHA256 0369454200d4b8deb3959415aae9bb9926e681b14bcb4427e432381fe57ecb27
MD5 38315a763b4266ad431762f51960bfc4
SHA1 f0770073b92879bbd3dd4bcfc254cb233e30ec79
SHA512 bfc3d1144078925d2a5f37c555d6deec3a85ce150e6a357cd2c146e19360f630b08bb504e1b77a30b6fa035c6e157fcb904be021e771ae813e3172e545ba3187
SSDEEP 3072:ohyN1RbBHQrnoe6r5NJuAJKlo/CznfD9mNoKFz2QhskfIEZ1:eQvbBwcVN0FR7YOKFlsk
TLSH
T10FE31891B254F4D6F2228C34C9274F27E7F978495310A29E01DC837D6B2FBB56A6A313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\_socket.pyd
Size 66KB
SHA256 9bc8b64506c21e94457da274573e85777a06b67d4d6b98dddeab4b97172fcef1
MD5 3a13308b8f79efd613fd25f8a092e84f
SHA1 a8a09c96de0e37c117b7ace8adc3150cef1b4e23
SHA512 5c300391a5155a50ca1f81cb1667072cd139f4a4a0ad926446040fbb20603151ece5c7bee3f5d49afdc231fa744742180937cb9d6a4c0fee9d669d963202141f
SSDEEP 1536:3/mbt022h0Y9/s+S+pzMEnrIDOMQLF/0I+IELw:PytbxY9/sT+pzMEEDOtLqrIELw
TLSH
T150633A10A3A051B9D2B3D17AC6335F62F774F4811399A38F4564CA6E5F23782DE3AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\base_library.zip
Size 1.4MB
SHA256 410aec59222b84e1a165cb546003ac819437137fae5bac3e166936499d418650
MD5 4911c8b4016b9be8cb377aca98902c27
SHA1 b32d0447c09738a19f4ee513f2e4bd3502d077dd
SHA512 909df8106e94d6b36cc0abc42113606bfa5e9bbc2041add837b32cbe5c33cedea73b049d2279ea985ed42e37fb755c2a5da7a21486fd2100a258f54aba66dab1
SSDEEP 24576:M3ALHHJ3cnz/bucEvUFi8TfRHa5PydmzrQR5pCTzQjwh4:MVTfRIQR5p/Z
TLSH
T1916509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\cryptography\hazmat\bindings\_rust.pyd
Size 9.5MB
SHA256 6a42262974f0e086c1f2defaff4ccd9fb25046cf193422135e2dda5b4b29b2a2
MD5 8b80c64e2853a8b5516531148dfeb4bc
SHA1 069ed7c2b7e5852798c36c11bfd23ceb07672684
SHA512 4eac69e27cc0efe93e25f1f07d639dfa3ce64f3b28503c8bf8f90b306c5f540066fea64bf7da8ff5a748d394312f9b77c42a4387945a83ef2f8e9123f719db07
SSDEEP 98304:TAjr9vPjhGgKqrMlBXaP3TTo8Ur2O4Y5P1d4W/DhkmgFTkjZhQHgD+zopeV:C2td4W/qmgFT67QHqo
TLSH
T122A67C25B6A950A8D86AC4B8C34756339B7174DA1B347AFF49D486B92F36BF01B3D300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\libcrypto-3-x64.dll
Size 7.6MB
SHA256 4ef4f59ddc79f232a76e7eee7a7fd91792974ba885011b00acada8debfc14173
MD5 ea124141d5b123353e0141568c373c18
SHA1 db302d86966ca87a30859654a86801cd12ca3519
SHA512 b1befe38003b82c35da945f68f116af9a1f9be447618db88b36b89e2e87a70b8706bfce143fbd6f7c7e9efdf840f65ef0cab1062a727cfa22b8f7b62ad7fa5e4
SSDEEP 98304:I1fp/3ffd/Mjy36hTn4pE7Qvy+b1CPwDvt3uF90CZW:SfpuHEaC1CPwDvt3uF90C
TLSH
T182862857F6BA10D5D8FAC1398293323BB970B86543B457D3A60095AA0F33BF8A93D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\python3.dll
Size 54KB
SHA256 8fda4948f6fc2bed1c7d1ece9596a3450c772775e48046c0bf701517d78ae9e3
MD5 026590b165fd202775cb0927a3c958e7
SHA1 2dd40f29c54113c9380e37d28d4dfa8cf828b187
SHA512 36e5c98cfd93c9721b7f8f2ff483b59cf9d375feb73b75f8ba9f155a487ed9b96326dd2d25b9518c331545f718bb52223eb741b5d48646b3874d4f91dbbcc77a
SSDEEP 768:Iw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJSh:v/5k8cnzeJe0I+IEL0
TLSH
T1B6431B52AB58F8A6D6F625FC38D29DCD143B12CC83ED88DCA57993D30E5A320A52734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\python311.dll
Size 5.6MB
SHA256 06cb189016f6d5a593aba0e4c53ae972f2b7a257373c502e7da80f35f37dc1c0
MD5 0101e392844bad69ff3d24fecd3df2b9
SHA1 1094e6a4a91bbce91d29a0e00fe1ada22fa43be2
SHA512 a27d35bae06d16e35b8e92812ef731274ded6c464634d91382b916a8ef774b4ace936ce3e0294f891db5f67a1375aa24b97b404d796e980eb3617fd1023937e5
SSDEEP 98304:M1T5+PMGxsz72Jbor8fhZUFHnMPHVjrK:M1T0xxS2JbowZPZ
TLSH
T17E466C21B26489A4C8BB8536EE6B435AC7717C106B11DB4B5164B3EE2F337530AEF349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\select.pyd
Size 18KB
SHA256 ab91970ff8458849e59711e323dc49f09bafe7a650ddcf797fd7242343ebc49d
MD5 c381e282961528e818c15688ee643dea
SHA1 46e782d807af3b725c96be2acf51c09c2e929e6b
SHA512 eded4e4554d9e29f49e0d94b2a6f88240f9ac0bb98520ad4f0e9adadf1adb24846d20641dce78477b720f58adba5018610ed0bc362f9116eee5742a5d11ba00b
SSDEEP 384:Uar1fP1/pqOLlxHqP0smv7AzN57Elna0sj+IEQG:vh1Y4xHqiWOla0I+IEQG
TLSH
T107824C46BBB090E9E1A2C1B3C9770F11D936B631472543CF23A4866D2F27BC2A736B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000de42\unicodedata.pyd
Size 1.1MB
SHA256 aa489115a8139de6aa0db51e2c8771c78df430fd7c3c65b714f385833ccc91fe
MD5 6b6a5ea52f84c51f18279d668e620ee4
SHA1 0d474d67a95fa0aef37671a8bc8d96c19b820c36
SHA512 a1e2de1dc529b5b36ee69eef29c3378dfccc396cff53ae8933a1460ffb05414c31a83796fb55fb564cd07b146862bb86352dcf0fbc67b3872715405d2c52adb5
SSDEEP 12288:VdlYbfjwR6nbeonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eDH3:1YbMT0IDJcjEwPgPOG6Xyd46H3
TLSH
T1DA354AC9BB828D66D87B317944D2212F1361C272476B233BB65513285C8B3B74EE6DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5540-180-0x00007FF830980000-0x00007FF830EC1000-memory.dmp

Download

memory/5540-193-0x0000025BA85D0000-0x0000025BA85E0000-memory.dmp

Download

memory/5540-162-0x00007FF83A630000-0x00007FF83A893000-memory.dmp

Download

memory/5540-182-0x00007FF830ED0000-0x00007FF8313BC000-memory.dmp

Download

memory/5540-185-0x00007FF833DC0000-0x00007FF834025000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads