Malware Analysis Report

2025-01-02 11:47

Sample ID 230104-rq5vkabg6s
Target floss-v2.2.0-windows.zip
SHA256 edc206110a62bba4c27ff245d93e66d237c74c27f98ae05b9478151fbaed8aee
Tags
pyinstaller bazarbackdoor
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

edc206110a62bba4c27ff245d93e66d237c74c27f98ae05b9478151fbaed8aee

Threat Level: Known bad

The file floss-v2.2.0-windows.zip was found to be: Known bad.

Malicious Activity Summary

pyinstaller bazarbackdoor

Bazar/Team9 Backdoor payload

Bazarbackdoor family

Loads dropped DLL

Detects Pyinstaller

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-01-04 14:24

Signatures

Bazar/Team9 Backdoor payload

Description Indicator Process Target
N/A N/A N/A N/A

Bazarbackdoor family

bazarbackdoor

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-01-04 14:24

Reported

2023-01-04 14:29

Platform

win10v2004-20220901-en

Max time kernel

91s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\floss.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\floss.exe

"C:\Users\Admin\AppData\Local\Temp\floss.exe"

C:\Users\Admin\AppData\Local\Temp\floss.exe

"C:\Users\Admin\AppData\Local\Temp\floss.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

Network

Country Destination Domain Proto
N/A 20.42.65.84:443 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 93.184.221.240:80 tcp
N/A 104.80.229.204:443 tcp

Files

memory/3948-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI3722\ucrtbase.dll

MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

C:\Users\Admin\AppData\Local\Temp\_MEI3722\python38.dll

MD5 26ba25d468a778d37f1a24f4514d9814
SHA1 b64fe169690557656ede3ae50d3c5a197fea6013
SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
SHA512 80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080

C:\Users\Admin\AppData\Local\Temp\_MEI3722\ucrtbase.dll

MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

C:\Users\Admin\AppData\Local\Temp\_MEI3722\VCRUNTIME140.dll

MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

C:\Users\Admin\AppData\Local\Temp\_MEI3722\VCRUNTIME140.dll

MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

C:\Users\Admin\AppData\Local\Temp\_MEI3722\base_library.zip

MD5 52b8a88916733f0e5f15a10e5868a96c
SHA1 67d9052431565d3644dcbbf398094bb1a54f7087
SHA256 fa828ea0e83ef34cd4486343a33719241036d0fd97d9e9b52be882f73d8f2c19
SHA512 a3fb9bcb8ffedf45881820afa676f200feade7484770add4a681485549f705494f55ec10308eb57b075ccae6f3705bcde05153b58fcc3bfe9fbfdcce76b01565

C:\Users\Admin\AppData\Local\Temp\_MEI3722\python38.dll

MD5 26ba25d468a778d37f1a24f4514d9814
SHA1 b64fe169690557656ede3ae50d3c5a197fea6013
SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
SHA512 80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080

C:\Users\Admin\AppData\Local\Temp\_MEI3722\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI3722\_bz2.pyd

MD5 a49c5f406456b79254eb65d015b81088
SHA1 cfc2a2a89c63df52947af3610e4d9b8999399c91
SHA256 ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
SHA512 bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae

C:\Users\Admin\AppData\Local\Temp\_MEI3722\_lzma.pyd

MD5 cf9fd17b1706f3044a8f74f6d398d5f1
SHA1 c5cd0debbde042445b9722a676ff36a0ac3959ad
SHA256 9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
SHA512 5fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a

C:\Users\Admin\AppData\Local\Temp\_MEI3722\_lzma.pyd

MD5 cf9fd17b1706f3044a8f74f6d398d5f1
SHA1 c5cd0debbde042445b9722a676ff36a0ac3959ad
SHA256 9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
SHA512 5fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a

C:\Users\Admin\AppData\Local\Temp\_MEI3722\_socket.pyd

MD5 4827652de133c83fa1cae839b361856c
SHA1 182f9a04bdc42766cfd5fb352f2cb22e5c26665e
SHA256 87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba
SHA512 8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a

C:\Users\Admin\AppData\Local\Temp\_MEI3722\select.pyd

MD5 e21cff76db11c1066fd96af86332b640
SHA1 e78ef7075c479b1d218132d89bf4bec13d54c06a
SHA256 fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
SHA512 e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f

C:\Users\Admin\AppData\Local\Temp\_MEI3722\select.pyd

MD5 e21cff76db11c1066fd96af86332b640
SHA1 e78ef7075c479b1d218132d89bf4bec13d54c06a
SHA256 fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
SHA512 e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f

C:\Users\Admin\AppData\Local\Temp\_MEI3722\_socket.pyd

MD5 4827652de133c83fa1cae839b361856c
SHA1 182f9a04bdc42766cfd5fb352f2cb22e5c26665e
SHA256 87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba
SHA512 8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a

C:\Users\Admin\AppData\Local\Temp\_MEI3722\_bz2.pyd

MD5 a49c5f406456b79254eb65d015b81088
SHA1 cfc2a2a89c63df52947af3610e4d9b8999399c91
SHA256 ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
SHA512 bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae

C:\Users\Admin\AppData\Local\Temp\_MEI3722\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI3722\_ctypes.pyd

MD5 291a0a9b63bae00a4222a6df71a22023
SHA1 7a6a2aad634ec30e8edb2d2d8d0895c708d84551
SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
SHA512 d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09

C:\Users\Admin\AppData\Local\Temp\_MEI3722\_ctypes.pyd

MD5 291a0a9b63bae00a4222a6df71a22023
SHA1 7a6a2aad634ec30e8edb2d2d8d0895c708d84551
SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
SHA512 d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pyexpat.pyd

MD5 2ae23047648257afa90d0ca96811979f
SHA1 0833cf7ccae477faa4656c74d593d0f59844cadd
SHA256 5caf51f12406bdb980db1361fab79c51be8cac0a2a0071a083adf4d84f423e95
SHA512 13052eb183bb7eb8bb2740ff39f63805b69e920f2e21b482657a9995aa002579a88296b81ec415942511d2ed146689d1868b446f7e698e72da22f5c182706030

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pyexpat.pyd

MD5 2ae23047648257afa90d0ca96811979f
SHA1 0833cf7ccae477faa4656c74d593d0f59844cadd
SHA256 5caf51f12406bdb980db1361fab79c51be8cac0a2a0071a083adf4d84f423e95
SHA512 13052eb183bb7eb8bb2740ff39f63805b69e920f2e21b482657a9995aa002579a88296b81ec415942511d2ed146689d1868b446f7e698e72da22f5c182706030

memory/4356-154-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI3722\_hashlib.pyd

MD5 5e5af52f42eaf007e3ac73fd2211f048
SHA1 1a981e66ab5b03f4a74a6bac6227cd45df78010b
SHA256 a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
SHA512 bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd

C:\Users\Admin\AppData\Local\Temp\_MEI3722\libcrypto-1_1.dll

MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

C:\Users\Admin\AppData\Local\Temp\_MEI3722\_hashlib.pyd

MD5 5e5af52f42eaf007e3ac73fd2211f048
SHA1 1a981e66ab5b03f4a74a6bac6227cd45df78010b
SHA256 a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
SHA512 bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd

C:\Users\Admin\AppData\Local\Temp\_MEI3722\libcrypto-1_1.dll

MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

C:\Users\Admin\AppData\Local\Temp\_MEI3722\_queue.pyd

MD5 dd146e2fa08302496b15118bf47703cf
SHA1 d06813e2fcb30cbb00bb3893f30c2661686cf4b7
SHA256 67e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
SHA512 5b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c

C:\Users\Admin\AppData\Local\Temp\_MEI3722\_queue.pyd

MD5 dd146e2fa08302496b15118bf47703cf
SHA1 d06813e2fcb30cbb00bb3893f30c2661686cf4b7
SHA256 67e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
SHA512 5b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c

C:\Users\Admin\AppData\Local\Temp\_MEI3722\msgpack\_cmsgpack.cp38-win_amd64.pyd

MD5 e8c67ce91fc4c3c47e1e367f408ff2ac
SHA1 8a8d33c81062dd3b41b3f5caf3f8c8e27b84e791
SHA256 9c4ff2e631a3455b7d8cbe0c0162b134bb413880a7912084d641e0583169724e
SHA512 15971749bb9a33019cfce7defba56964033c96dd0eeff269c9c72b70c4647a13eeb9d04f73fc63ad1c935a752c2ee1a8f845293657ce20b0433f68169ba3820f

C:\Users\Admin\AppData\Local\Temp\_MEI3722\msgpack\_cmsgpack.cp38-win_amd64.pyd

MD5 e8c67ce91fc4c3c47e1e367f408ff2ac
SHA1 8a8d33c81062dd3b41b3f5caf3f8c8e27b84e791
SHA256 9c4ff2e631a3455b7d8cbe0c0162b134bb413880a7912084d641e0583169724e
SHA512 15971749bb9a33019cfce7defba56964033c96dd0eeff269c9c72b70c4647a13eeb9d04f73fc63ad1c935a752c2ee1a8f845293657ce20b0433f68169ba3820f

C:\Users\Admin\AppData\Local\Temp\_MEI3722\flirt\flirt.cp38-win_amd64.pyd

MD5 727667a5eb9c5206bee3ba55cf9495d9
SHA1 a9e2f13bfc78715f6286c345ed23e4f327394245
SHA256 1c9be9248f9f00d8898f2e909850a55a82027c6ee7d24b59f835bb2ed5d665ca
SHA512 275345eaae8ddaeef30a5697c81b31880ccca5bd136fdebb7eb60024d96ddd8e7dc35b0078852e2926d7a3c4734870a563dd5faf471f8671c419fb9229726913

C:\Users\Admin\AppData\Local\Temp\_MEI3722\flirt\flirt.cp38-win_amd64.pyd

MD5 727667a5eb9c5206bee3ba55cf9495d9
SHA1 a9e2f13bfc78715f6286c345ed23e4f327394245
SHA256 1c9be9248f9f00d8898f2e909850a55a82027c6ee7d24b59f835bb2ed5d665ca
SHA512 275345eaae8ddaeef30a5697c81b31880ccca5bd136fdebb7eb60024d96ddd8e7dc35b0078852e2926d7a3c4734870a563dd5faf471f8671c419fb9229726913

C:\Users\Admin\AppData\Local\Temp\_MEI3722\unicodedata.pyd

MD5 601aee84e12b87ca66826dfc7ca57231
SHA1 3a7812433ca7d443d4494446a9ced24b6774ceca
SHA256 d8091e62c74e1b2b648086f778c3c41ce01f09661a75ea207d3fea2cf26a8762
SHA512 7c2d64623c6cfd66d6729f59909c90aa944e810ff6514c58b2b3142ee90e8660b7ddf7fa187389dd333e47efe8b19e935dd4e9119c15375b69b4880d043877d7

C:\Users\Admin\AppData\Local\Temp\_MEI3722\unicodedata.pyd

MD5 601aee84e12b87ca66826dfc7ca57231
SHA1 3a7812433ca7d443d4494446a9ced24b6774ceca
SHA256 d8091e62c74e1b2b648086f778c3c41ce01f09661a75ea207d3fea2cf26a8762
SHA512 7c2d64623c6cfd66d6729f59909c90aa944e810ff6514c58b2b3142ee90e8660b7ddf7fa187389dd333e47efe8b19e935dd4e9119c15375b69b4880d043877d7

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\__init__.cp38-win_amd64.pyd

MD5 3cbea0200fbc72d6e8003ee037a8e52e
SHA1 195f17e126c0b5c6afe934a17e177a1c96dccc2d
SHA256 0a6ebb1f309c803cbb6e40fd2a740f0621c5faf83a46e42296ce78a02e54d89b
SHA512 e1f13724bda845d7073b793833d0d4667ff0de8acf045d21fd9a46cc725f0558f21ff33c74659b9ed53253ecc87c266d71327db853d921de48e41fc706d5bcce

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\__init__.cp38-win_amd64.pyd

MD5 3cbea0200fbc72d6e8003ee037a8e52e
SHA1 195f17e126c0b5c6afe934a17e177a1c96dccc2d
SHA256 0a6ebb1f309c803cbb6e40fd2a740f0621c5faf83a46e42296ce78a02e54d89b
SHA512 e1f13724bda845d7073b793833d0d4667ff0de8acf045d21fd9a46cc725f0558f21ff33c74659b9ed53253ecc87c266d71327db853d921de48e41fc706d5bcce

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\dataclasses.cp38-win_amd64.pyd

MD5 4fab1558f6cd14149fd39aeaba9d6bce
SHA1 cd6f1cc85015d1eb32527f0dea32e2ee16e35cf4
SHA256 9593e1b5a08e18170e2331d7faec0d105d6d8bc55c7ba18cde8d641a2ccfbc8d
SHA512 fb903f964d0850e317dd2612c3042b0496809370006f7bd3514efe2bd0f3d1245f664cfd23ea702be7d9fa987e5519178450711332f561a9cf988c11ed754f73

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\dataclasses.cp38-win_amd64.pyd

MD5 4fab1558f6cd14149fd39aeaba9d6bce
SHA1 cd6f1cc85015d1eb32527f0dea32e2ee16e35cf4
SHA256 9593e1b5a08e18170e2331d7faec0d105d6d8bc55c7ba18cde8d641a2ccfbc8d
SHA512 fb903f964d0850e317dd2612c3042b0496809370006f7bd3514efe2bd0f3d1245f664cfd23ea702be7d9fa987e5519178450711332f561a9cf988c11ed754f73

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\class_validators.cp38-win_amd64.pyd

MD5 1833c1b72e4f5285ef60156f5398273c
SHA1 b9d1191f3d1d500586943848e37decc3b9f304c3
SHA256 36cf9046a107fb9ec71253b281e8be8dca34d1ea50329347dd13f1fee4a90fb4
SHA512 52dda14c5411367b158459991d4bec80adab7f1ea5ead827758b3cbc12462c438f6d7976b2ee2c4633dc0f812c9b76209454032352f2e1d9c68232d1caf44cd5

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\class_validators.cp38-win_amd64.pyd

MD5 1833c1b72e4f5285ef60156f5398273c
SHA1 b9d1191f3d1d500586943848e37decc3b9f304c3
SHA256 36cf9046a107fb9ec71253b281e8be8dca34d1ea50329347dd13f1fee4a90fb4
SHA512 52dda14c5411367b158459991d4bec80adab7f1ea5ead827758b3cbc12462c438f6d7976b2ee2c4633dc0f812c9b76209454032352f2e1d9c68232d1caf44cd5

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\errors.cp38-win_amd64.pyd

MD5 8e2bc62a58c0d638e091943274f111b5
SHA1 884bcabe84192a127c705a2c38acec66e758b228
SHA256 f0d91595449c54fd945976b9a5bab4f5cb56860bfa321529012454635d62a82b
SHA512 6c9b4dd6ee385552648e0324f78b0b11131831b49c3951f5f1b44da78e41e1063233d14dc9514ef6f43c372442daf2a92692dfb0ff9cddad34cc7bad31266348

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\errors.cp38-win_amd64.pyd

MD5 8e2bc62a58c0d638e091943274f111b5
SHA1 884bcabe84192a127c705a2c38acec66e758b228
SHA256 f0d91595449c54fd945976b9a5bab4f5cb56860bfa321529012454635d62a82b
SHA512 6c9b4dd6ee385552648e0324f78b0b11131831b49c3951f5f1b44da78e41e1063233d14dc9514ef6f43c372442daf2a92692dfb0ff9cddad34cc7bad31266348

C:\Users\Admin\AppData\Local\Temp\_MEI3722\_decimal.pyd

MD5 a2b554d61e6cf63c6e5bbafb20ae3359
SHA1 26e043efdaaa52e9034602cebeb564d4f9714a7f
SHA256 30eea56a4d1dd78f9d65fcb6168ab189cfa8098c38aad47ee770756a056749ca
SHA512 5ea99fa23e7657e9f01dc155741d5f93945a2e6c90f1494873aa7c35a8da0001815b31b387b239ef7de1695b8f416028166dd94db259d246d8dc10a37e20da97

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\typing.cp38-win_amd64.pyd

MD5 3aac1766407943feb00d87b4a8f2fba2
SHA1 49d76d89edbdd060f0928d988828dae049bd13f5
SHA256 e26425d73ce3cb15cadd7791cfdcccd78990bd1c01558c76e3b31746005f60d2
SHA512 85608fc011d1dbef13482c06a33b2bab09284c3b869f3ab5a5bf8b2c02d1e0679972c64ba75357eaf3731170b1fa919f3647f578f4a38f106b62ae2ca5ea83bd

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\typing.cp38-win_amd64.pyd

MD5 3aac1766407943feb00d87b4a8f2fba2
SHA1 49d76d89edbdd060f0928d988828dae049bd13f5
SHA256 e26425d73ce3cb15cadd7791cfdcccd78990bd1c01558c76e3b31746005f60d2
SHA512 85608fc011d1dbef13482c06a33b2bab09284c3b869f3ab5a5bf8b2c02d1e0679972c64ba75357eaf3731170b1fa919f3647f578f4a38f106b62ae2ca5ea83bd

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\utils.cp38-win_amd64.pyd

MD5 f1ab3daf23aa7b5a6c862b795fd74a63
SHA1 e63053d0ec6626bc1e2b7971daae7f0e9d8f3b60
SHA256 435886ef4fea597e941601fe0c59e8b2f4974d4a1706d96f6d78f91a8b9802b3
SHA512 40107f9a16f8f16732786bfacf8de172aba81c8c620b7d47034a493b8b1b3a92ed577470d56f239f0a9a30c8ad19e2560422593b6b85ad038089320dbb4a20ce

C:\Users\Admin\AppData\Local\Temp\_MEI3722\_decimal.pyd

MD5 a2b554d61e6cf63c6e5bbafb20ae3359
SHA1 26e043efdaaa52e9034602cebeb564d4f9714a7f
SHA256 30eea56a4d1dd78f9d65fcb6168ab189cfa8098c38aad47ee770756a056749ca
SHA512 5ea99fa23e7657e9f01dc155741d5f93945a2e6c90f1494873aa7c35a8da0001815b31b387b239ef7de1695b8f416028166dd94db259d246d8dc10a37e20da97

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\config.cp38-win_amd64.pyd

MD5 5e3382ef2b4c8f71741fa7cd66145e89
SHA1 04cdd6b24f2ca064a127b605d05f1bed87385cc3
SHA256 c087369842f8012acd6c087d6da627bf50dca6830e961597b45644981b6cec53
SHA512 d71d2807f1dfeca9cc9f2b09e006a6f0fdab46760eb759047549244e427efbf84caf1ef226cffd9a010a4a43336224870e216aaa82ae9afee6e953ed0c48756a

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\error_wrappers.cp38-win_amd64.pyd

MD5 2b5ca5f5d019f8a674c795a8ad6c1726
SHA1 59aae11a66485d795e1b5d830edd523be7310a36
SHA256 b47845a8e4c36daaae70bc790029dd3a312f526f4587db1c536f9a2160bdfc8b
SHA512 74c116038e785e9394a542144e77957d680175c68b4ee42a4b56686a78402d023ba673a0ac3ee5c468aa57696670112a97bda9952d422e44fe55999f4302f550

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\error_wrappers.cp38-win_amd64.pyd

MD5 2b5ca5f5d019f8a674c795a8ad6c1726
SHA1 59aae11a66485d795e1b5d830edd523be7310a36
SHA256 b47845a8e4c36daaae70bc790029dd3a312f526f4587db1c536f9a2160bdfc8b
SHA512 74c116038e785e9394a542144e77957d680175c68b4ee42a4b56686a78402d023ba673a0ac3ee5c468aa57696670112a97bda9952d422e44fe55999f4302f550

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\json.cp38-win_amd64.pyd

MD5 d00f4e3f4e0240aac1039c6b20a9d284
SHA1 e93b4aecff471009f09dd34c1adcd584df6be8b5
SHA256 d6142ac6ba4f9837b51040f6b60c56b53cacb588c6c381ebae2e7953f1d75caa
SHA512 aa38e7aec8e29ff00eaabeb427d2754b02f6db42e049810fdd11f77f8740960ef0b49baea30845a91cd5b43c7fd6b9aecb26648261e793238927258fe11b2785

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\networks.cp38-win_amd64.pyd

MD5 c96897650810d1336402fdbece84c197
SHA1 adb4d4ce51c7262d913946acbc1e18cb0f4efa59
SHA256 0e742187c52d9e60d6be467bb0fba83c452e44d932efcaaefbade8165f7b5462
SHA512 58e9c84221735371d829ba386197f660de46f588d6384fce81f1f5c389edaa5c4a03772aa829c188aa7aac4a8292b5ae644149c6005dea0f1492190ad33a160c

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\validators.cp38-win_amd64.pyd

MD5 510284c4bb297dcbcc2c091026259cfe
SHA1 569a5f2cdbe946395a076045ba773734a860c609
SHA256 eca985c166261cc4dbf26890ecf8ab6b664aa99011bd48f2dd383e32d3b16f8f
SHA512 20ba5cc72c950ca59d5c4fad37706ef266e195e7bd2eb01f97f222e747ec3420c9633e6c250f155127c4746aefe8a69ea56fdb13f77b9bd20983b504be6b28c3

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\datetime_parse.cp38-win_amd64.pyd

MD5 5d2da8e1f37e3652bcf6e60c194c4fb5
SHA1 9375e35ef184857c9ef851fd762bd26a00bfb7b9
SHA256 d1eb200907b1b35238cb238b0d921c75464b597e438317b8e9f3cd573d2ecd35
SHA512 177fb99245801eb5dbdd7a391bf99fff905733cb8bf8bb167e6c5d7643028122e339e7006550313b473a968fc1b90c010751f6a581862b9c02b0bcbcf044a313

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\datetime_parse.cp38-win_amd64.pyd

MD5 5d2da8e1f37e3652bcf6e60c194c4fb5
SHA1 9375e35ef184857c9ef851fd762bd26a00bfb7b9
SHA256 d1eb200907b1b35238cb238b0d921c75464b597e438317b8e9f3cd573d2ecd35
SHA512 177fb99245801eb5dbdd7a391bf99fff905733cb8bf8bb167e6c5d7643028122e339e7006550313b473a968fc1b90c010751f6a581862b9c02b0bcbcf044a313

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\types.cp38-win_amd64.pyd

MD5 fc5484ebb67bb0eb0e1649fd49ec7c0d
SHA1 82b5d92c6d860439d0287c7208490a0ab8bc8b6b
SHA256 5fd28957742d343a62fed5cf1917f1b0bc820715538a3d94a050d0432ca21307
SHA512 b4dc333ab07bffe80c5d0691a07aefa006dca901d3b03d545339badf284b3fa40edc48b5593d66481a11c88dd01ac6cb23def91fd4a85cb5aef7c2e7d907fb7e

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\validators.cp38-win_amd64.pyd

MD5 510284c4bb297dcbcc2c091026259cfe
SHA1 569a5f2cdbe946395a076045ba773734a860c609
SHA256 eca985c166261cc4dbf26890ecf8ab6b664aa99011bd48f2dd383e32d3b16f8f
SHA512 20ba5cc72c950ca59d5c4fad37706ef266e195e7bd2eb01f97f222e747ec3420c9633e6c250f155127c4746aefe8a69ea56fdb13f77b9bd20983b504be6b28c3

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\networks.cp38-win_amd64.pyd

MD5 c96897650810d1336402fdbece84c197
SHA1 adb4d4ce51c7262d913946acbc1e18cb0f4efa59
SHA256 0e742187c52d9e60d6be467bb0fba83c452e44d932efcaaefbade8165f7b5462
SHA512 58e9c84221735371d829ba386197f660de46f588d6384fce81f1f5c389edaa5c4a03772aa829c188aa7aac4a8292b5ae644149c6005dea0f1492190ad33a160c

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\color.cp38-win_amd64.pyd

MD5 61d3aa46614a2ee7777f17d042f57fb3
SHA1 02daf1b923477e76379724703c4352de8d4fcaec
SHA256 4388ae16a33ad496238413844277d6f6eaa8b01fef2d366cfa50ff8812878778
SHA512 f5c5ddc8a0280b23a24050a68c6609bc9fde407d24aacb2c78fead28cca4a05a1b211d85f1a9aa8d88c761ad2ca4f435506f173a37e1776e0bcac9cd6adb9d66

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\color.cp38-win_amd64.pyd

MD5 61d3aa46614a2ee7777f17d042f57fb3
SHA1 02daf1b923477e76379724703c4352de8d4fcaec
SHA256 4388ae16a33ad496238413844277d6f6eaa8b01fef2d366cfa50ff8812878778
SHA512 f5c5ddc8a0280b23a24050a68c6609bc9fde407d24aacb2c78fead28cca4a05a1b211d85f1a9aa8d88c761ad2ca4f435506f173a37e1776e0bcac9cd6adb9d66

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\json.cp38-win_amd64.pyd

MD5 d00f4e3f4e0240aac1039c6b20a9d284
SHA1 e93b4aecff471009f09dd34c1adcd584df6be8b5
SHA256 d6142ac6ba4f9837b51040f6b60c56b53cacb588c6c381ebae2e7953f1d75caa
SHA512 aa38e7aec8e29ff00eaabeb427d2754b02f6db42e049810fdd11f77f8740960ef0b49baea30845a91cd5b43c7fd6b9aecb26648261e793238927258fe11b2785

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\config.cp38-win_amd64.pyd

MD5 5e3382ef2b4c8f71741fa7cd66145e89
SHA1 04cdd6b24f2ca064a127b605d05f1bed87385cc3
SHA256 c087369842f8012acd6c087d6da627bf50dca6830e961597b45644981b6cec53
SHA512 d71d2807f1dfeca9cc9f2b09e006a6f0fdab46760eb759047549244e427efbf84caf1ef226cffd9a010a4a43336224870e216aaa82ae9afee6e953ed0c48756a

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\version.cp38-win_amd64.pyd

MD5 bae482ade69691b28efd5ec1eca4e6e1
SHA1 b4a25b3d1ba61669ab90981a7318753447f7bdc1
SHA256 1805cd6191202c29113ce7bd0980a7081a1e5845bdb589bd0c3c3027ca505948
SHA512 ea88d3f6a7a0cecdc1ce20e1ad994bf949d8a0238da2df9062c5d95708bd7380e0fc02960e6cdb07373e473633673b4d8940a8535b6c2f71f09200db95551c1b

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\version.cp38-win_amd64.pyd

MD5 bae482ade69691b28efd5ec1eca4e6e1
SHA1 b4a25b3d1ba61669ab90981a7318753447f7bdc1
SHA256 1805cd6191202c29113ce7bd0980a7081a1e5845bdb589bd0c3c3027ca505948
SHA512 ea88d3f6a7a0cecdc1ce20e1ad994bf949d8a0238da2df9062c5d95708bd7380e0fc02960e6cdb07373e473633673b4d8940a8535b6c2f71f09200db95551c1b

C:\Users\Admin\AppData\Local\Temp\_MEI3722\pydantic\utils.cp38-win_amd64.pyd

MD5 f1ab3daf23aa7b5a6c862b795fd74a63
SHA1 e63053d0ec6626bc1e2b7971daae7f0e9d8f3b60
SHA256 435886ef4fea597e941601fe0c59e8b2f4974d4a1706d96f6d78f91a8b9802b3
SHA512 40107f9a16f8f16732786bfacf8de172aba81c8c620b7d47034a493b8b1b3a92ed577470d56f239f0a9a30c8ad19e2560422593b6b85ad038089320dbb4a20ce

Analysis: behavioral1

Detonation Overview

Submitted

2023-01-04 14:24

Reported

2023-01-04 14:29

Platform

win7-20221111-en

Max time kernel

29s

Max time network

32s

Command Line

"C:\Users\Admin\AppData\Local\Temp\floss.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\floss.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\floss.exe

"C:\Users\Admin\AppData\Local\Temp\floss.exe"

C:\Users\Admin\AppData\Local\Temp\floss.exe

"C:\Users\Admin\AppData\Local\Temp\floss.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

Network

N/A

Files

memory/1372-54-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI17482\ucrtbase.dll

MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

\Users\Admin\AppData\Local\Temp\_MEI17482\ucrtbase.dll

MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-core-localization-l1-2-0.dll

MD5 de5695f26a0bcb54f59a8bc3f9a4ecef
SHA1 99c32595f3edc2c58bdb138c3384194831e901d6
SHA256 e9539fce90ad8be582b25ab2d5645772c2a5fb195e602ecdbf12b980656e436a
SHA512 df635d5d51cdea24885ae9f0406f317ddcf04ecb6bfa26579bb2e256c457057607844ded4b52ff1f5ca25abe29d1eb2b20f1709cf19035d3829f36bbe31f550f

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-core-processthreads-l1-1-1.dll

MD5 74c264cffc09d183fcb1555b16ea7e4b
SHA1 0b5b08cdf6e749b48254ac811ca09ba95473d47c
SHA256 a8e2fc077d9a7d2faa85e1e6833047c90b22c6086487b98fc0e6a86b7bf8bf09
SHA512 285afbcc39717510ced2ed096d9f77fc438268ecaa59cff3cf167fcc538e90c73c67652046b0ee379e0507d6e346af79d43c51a571c6dd66034f9385a73d00d1

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-core-processthreads-l1-1-1.dll

MD5 74c264cffc09d183fcb1555b16ea7e4b
SHA1 0b5b08cdf6e749b48254ac811ca09ba95473d47c
SHA256 a8e2fc077d9a7d2faa85e1e6833047c90b22c6086487b98fc0e6a86b7bf8bf09
SHA512 285afbcc39717510ced2ed096d9f77fc438268ecaa59cff3cf167fcc538e90c73c67652046b0ee379e0507d6e346af79d43c51a571c6dd66034f9385a73d00d1

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-core-file-l1-2-0.dll

MD5 d92e6a007fc22a1e218552ebfb65da93
SHA1 3c9909332e94f7b7386664a90f52730f4027a75a
SHA256 03bd3217eae0ef68521b39556e7491292db540f615da873dd8da538693b81862
SHA512 b8b0e6052e68c08e558e72c168e4ff318b1907c4dc5fc1cd1104f5cae7cc418293013dabbb30c835a5c35a456e1cb22cc352b7ae40f82b9b7311bb7419d854c7

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-core-file-l1-2-0.dll

MD5 d92e6a007fc22a1e218552ebfb65da93
SHA1 3c9909332e94f7b7386664a90f52730f4027a75a
SHA256 03bd3217eae0ef68521b39556e7491292db540f615da873dd8da538693b81862
SHA512 b8b0e6052e68c08e558e72c168e4ff318b1907c4dc5fc1cd1104f5cae7cc418293013dabbb30c835a5c35a456e1cb22cc352b7ae40f82b9b7311bb7419d854c7

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-core-localization-l1-2-0.dll

MD5 de5695f26a0bcb54f59a8bc3f9a4ecef
SHA1 99c32595f3edc2c58bdb138c3384194831e901d6
SHA256 e9539fce90ad8be582b25ab2d5645772c2a5fb195e602ecdbf12b980656e436a
SHA512 df635d5d51cdea24885ae9f0406f317ddcf04ecb6bfa26579bb2e256c457057607844ded4b52ff1f5ca25abe29d1eb2b20f1709cf19035d3829f36bbe31f550f

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-core-timezone-l1-1-0.dll

MD5 cb39eea2ef9ed3674c597d5f0667b5b4
SHA1 c133dc6416b3346fa5b0f449d7cc6f7dbf580432
SHA256 1627b921934053f1f7d2a19948aee06fac5db8ee8d4182e6f071718d0681f235
SHA512 2c65014dc045a2c1e5f52f3fea4967d2169e4a78d41fe56617ce9a4d5b30ebf25043112917ff3d7d152744ddef70475937ae0a7f96785f97dcefafe8e6f14d9c

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-core-timezone-l1-1-0.dll

MD5 cb39eea2ef9ed3674c597d5f0667b5b4
SHA1 c133dc6416b3346fa5b0f449d7cc6f7dbf580432
SHA256 1627b921934053f1f7d2a19948aee06fac5db8ee8d4182e6f071718d0681f235
SHA512 2c65014dc045a2c1e5f52f3fea4967d2169e4a78d41fe56617ce9a4d5b30ebf25043112917ff3d7d152744ddef70475937ae0a7f96785f97dcefafe8e6f14d9c

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-core-file-l2-1-0.dll

MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-core-file-l2-1-0.dll

MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

C:\Users\Admin\AppData\Local\Temp\_MEI17482\python38.dll

MD5 26ba25d468a778d37f1a24f4514d9814
SHA1 b64fe169690557656ede3ae50d3c5a197fea6013
SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
SHA512 80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080

\Users\Admin\AppData\Local\Temp\_MEI17482\python38.dll

MD5 26ba25d468a778d37f1a24f4514d9814
SHA1 b64fe169690557656ede3ae50d3c5a197fea6013
SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
SHA512 80471bfeeab279ce4adfb9ee1962597fb8e1886b861e31bdff1e3aa0df06d93afeb3a3398e9519bab7152d4bd7d88fa9b328a2d7eb50a91eb60fead268912080

C:\Users\Admin\AppData\Local\Temp\_MEI17482\VCRUNTIME140.dll

MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

\Users\Admin\AppData\Local\Temp\_MEI17482\VCRUNTIME140.dll

MD5 4a365ffdbde27954e768358f4a4ce82e
SHA1 a1b31102eee1d2a4ed1290da2038b7b9f6a104a3
SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
SHA512 54e4b6287c4d5a165509047262873085f50953af63ca0dcb7649c22aba5b439ab117a7e0d6e7f0a3e51a23e28a255ffd1ca1ddce4b2ea7f87bca1c9b0dbe2722

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-runtime-l1-1-0.dll

MD5 27c4a3bcc0f1dba2de4c2242cd489f3b
SHA1 a704fd91e3c67108b1f02fd5e9f1223c7154a9cc
SHA256 315ded39d9e157cec05d83711c09858c23602857c9d8c88beef121c24c43be84
SHA512 793e74dfb1052c06ab4c29e7b622c795cc3122a722382b103940b94e9dac1e6ca8039df48c558efcc5d952a0660393ae2b11ced5ade4dc8d5dd31a9f5bb9f807

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-runtime-l1-1-0.dll

MD5 27c4a3bcc0f1dba2de4c2242cd489f3b
SHA1 a704fd91e3c67108b1f02fd5e9f1223c7154a9cc
SHA256 315ded39d9e157cec05d83711c09858c23602857c9d8c88beef121c24c43be84
SHA512 793e74dfb1052c06ab4c29e7b622c795cc3122a722382b103940b94e9dac1e6ca8039df48c558efcc5d952a0660393ae2b11ced5ade4dc8d5dd31a9f5bb9f807

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-heap-l1-1-0.dll

MD5 9151e83b4fdfa88353b7a97ae7792678
SHA1 b46152e70d5d3d75d61d4ccdb50403bd08bb9354
SHA256 6c0e0d22b65329f4948fcf36c8048a54ccccbf6c05b330b2c1a686f3e686eed0
SHA512 4d4210474957e656d821e1dc5934a4bfbf7e73dd61d696a1ab39914f887810c8fbe500dbb1e23782b40807f25820f35c9665e04dcdc2fd0f6c83046a4aecb86b

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-heap-l1-1-0.dll

MD5 9151e83b4fdfa88353b7a97ae7792678
SHA1 b46152e70d5d3d75d61d4ccdb50403bd08bb9354
SHA256 6c0e0d22b65329f4948fcf36c8048a54ccccbf6c05b330b2c1a686f3e686eed0
SHA512 4d4210474957e656d821e1dc5934a4bfbf7e73dd61d696a1ab39914f887810c8fbe500dbb1e23782b40807f25820f35c9665e04dcdc2fd0f6c83046a4aecb86b

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-string-l1-1-0.dll

MD5 ec1381c9fda84228441459151e7badea
SHA1 db2d37f3c04a2c2d4b6f9b3fd82c1be091e85d2c
SHA256 44ddab31c182235ac5405d31c1cba048316cc230698e392a732ac941ec683bad
SHA512 ee9ebbdc23e7c945f2b291fde5eb68a42c11988182e6c78c0ab8fa9cb003b24910974a3291bcdaa0c8d1f9dfa8df40293848fb9a16c4be1425253bed0511a712

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-string-l1-1-0.dll

MD5 ec1381c9fda84228441459151e7badea
SHA1 db2d37f3c04a2c2d4b6f9b3fd82c1be091e85d2c
SHA256 44ddab31c182235ac5405d31c1cba048316cc230698e392a732ac941ec683bad
SHA512 ee9ebbdc23e7c945f2b291fde5eb68a42c11988182e6c78c0ab8fa9cb003b24910974a3291bcdaa0c8d1f9dfa8df40293848fb9a16c4be1425253bed0511a712

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-stdio-l1-1-0.dll

MD5 306608a878089cb38602af693ba0485b
SHA1 59753556f471c5bf1dfef46806cb02cf87590c5c
SHA256 3b59a50457f6b6eaa6d35e42722d4562e88bcd716bae113be1271ead0feb7af3
SHA512 21b626e619aaf4eda861a9c5edf02133c63adc9e893f38fede72d90a6e8be0e566c117a8a24ca4bab77928083ae4a859034417b035e8553cc7ccfb88cb4cbd9c

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-stdio-l1-1-0.dll

MD5 306608a878089cb38602af693ba0485b
SHA1 59753556f471c5bf1dfef46806cb02cf87590c5c
SHA256 3b59a50457f6b6eaa6d35e42722d4562e88bcd716bae113be1271ead0feb7af3
SHA512 21b626e619aaf4eda861a9c5edf02133c63adc9e893f38fede72d90a6e8be0e566c117a8a24ca4bab77928083ae4a859034417b035e8553cc7ccfb88cb4cbd9c

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-convert-l1-1-0.dll

MD5 0e35e369165875d3a593d68324e2b162
SHA1 6a1ff3405277250a892b79faed01dcdc9dbf864a
SHA256 14694879f9c3c52fbd7dde96bf5d67b9768b067c80d5567be55b37262e9dbd54
SHA512 d496f0c38300d0eed62b26a59c57463a1444a0c77a75c463014c5791371deca93d1d5dd0090e8e324c6a09bd9cff328f94947272ca49018c191c12732e805ee8

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-convert-l1-1-0.dll

MD5 0e35e369165875d3a593d68324e2b162
SHA1 6a1ff3405277250a892b79faed01dcdc9dbf864a
SHA256 14694879f9c3c52fbd7dde96bf5d67b9768b067c80d5567be55b37262e9dbd54
SHA512 d496f0c38300d0eed62b26a59c57463a1444a0c77a75c463014c5791371deca93d1d5dd0090e8e324c6a09bd9cff328f94947272ca49018c191c12732e805ee8

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-math-l1-1-0.dll

MD5 7a235962dbab1e807c6ec7609fc76077
SHA1 148ddd11a0d366313f75871007057b3f0485ab33
SHA256 f7c5d7394643c95fe14c07773a8a206e74a28db125f9b3976f9e1c8c599f2af1
SHA512 25b21ee7bb333e5e34d2b4a32d631a50b8ffaf1f1320d47c97c2a4dff59fa2a2703cdf30638b46c800d3150efaa4a2518c55e7b2a3b2e4273f43dd5ca83ae940

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-math-l1-1-0.dll

MD5 7a235962dbab1e807c6ec7609fc76077
SHA1 148ddd11a0d366313f75871007057b3f0485ab33
SHA256 f7c5d7394643c95fe14c07773a8a206e74a28db125f9b3976f9e1c8c599f2af1
SHA512 25b21ee7bb333e5e34d2b4a32d631a50b8ffaf1f1320d47c97c2a4dff59fa2a2703cdf30638b46c800d3150efaa4a2518c55e7b2a3b2e4273f43dd5ca83ae940

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-locale-l1-1-0.dll

MD5 ebc168d7d3ea7c6192935359b6327627
SHA1 aeceb7c071cf1bb000758b6ceebefeec91ad22bd
SHA256 c048a3d7ab951dce1d6d3f5f497b50353f640a1787c6c65677a13c55c8e99983
SHA512 891d252ecd50bded4614547758d5e301bdf8e71fbb1023ff89f8de2f81927cc7cc84b98985d99e8fa8dcbf361e5117d9c625dc0d36983afc3f2aa48a54ce3d48

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-locale-l1-1-0.dll

MD5 ebc168d7d3ea7c6192935359b6327627
SHA1 aeceb7c071cf1bb000758b6ceebefeec91ad22bd
SHA256 c048a3d7ab951dce1d6d3f5f497b50353f640a1787c6c65677a13c55c8e99983
SHA512 891d252ecd50bded4614547758d5e301bdf8e71fbb1023ff89f8de2f81927cc7cc84b98985d99e8fa8dcbf361e5117d9c625dc0d36983afc3f2aa48a54ce3d48

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-time-l1-1-0.dll

MD5 4cf70855444f38e1eb71f9c3cd1c6e86
SHA1 d06aec4008d397756ee841f0e7a435d1c05b5f07
SHA256 a409e25a9d3c252cc0a5af9df85d3733e946087b06cd1fb2cf1bf640eb0d49ba
SHA512 a13a80645e679343ac5638e8aa6a03012f16200cb3a4637be52a01aa3bef854324a8ed1882ca91b304b9c47b6351b1fc1671f4dede5be77bc208a71fe6029064

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-time-l1-1-0.dll

MD5 4cf70855444f38e1eb71f9c3cd1c6e86
SHA1 d06aec4008d397756ee841f0e7a435d1c05b5f07
SHA256 a409e25a9d3c252cc0a5af9df85d3733e946087b06cd1fb2cf1bf640eb0d49ba
SHA512 a13a80645e679343ac5638e8aa6a03012f16200cb3a4637be52a01aa3bef854324a8ed1882ca91b304b9c47b6351b1fc1671f4dede5be77bc208a71fe6029064

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-environment-l1-1-0.dll

MD5 dacf383a06480ca5ab70d7156aecab43
SHA1 9e48d096c2e81a7d979f3c6b94315671157206a1
SHA256 00f84c438aab40500a2f2df22c7a4ec147a50509c8d0cdac6a83e4269e387478
SHA512 5d4146a669ddb963cf677257ec7865e2cfcb7960e41a38bbd60f9a7017474ed2f3291505fa407e25881cbf9e5e6b8055ff3bd891043284a0a04e3fe9cfad9817

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-environment-l1-1-0.dll

MD5 dacf383a06480ca5ab70d7156aecab43
SHA1 9e48d096c2e81a7d979f3c6b94315671157206a1
SHA256 00f84c438aab40500a2f2df22c7a4ec147a50509c8d0cdac6a83e4269e387478
SHA512 5d4146a669ddb963cf677257ec7865e2cfcb7960e41a38bbd60f9a7017474ed2f3291505fa407e25881cbf9e5e6b8055ff3bd891043284a0a04e3fe9cfad9817

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-process-l1-1-0.dll

MD5 55463244172161b76546dc2de37f42bd
SHA1 c10a5360ad5e340d59c814e159ea1efcbf5bf3ee
SHA256 4166a32551989f960dac7c0e296ffb28092f45f6539e7c450fa04bf17612be73
SHA512 eacec78ff95f60def6f7f27bda4a84f1dd2dfa386efc4f6da770c37268df83c5b402693ea5c29f54d48026579f3843db26add4d6448ea10cbf7f14d4d14a72fd

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-conio-l1-1-0.dll

MD5 a68d15cab300774d2a20a986ee57f9f4
SHA1 bb69665b3c8714d935ee63791181491b819795cb
SHA256 966ddbf59e1d6c2a80b8abbf4a30d37475de097bf13fb72ba78684d65975cd97
SHA512 ac040f92560631ca5162c7559173bdfe858e282225967ab1adc0a038d34943b00db140d44319cd2cdc2864295a098ab0ba634dfaa443e1d1782fa143ae4c217d

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-conio-l1-1-0.dll

MD5 a68d15cab300774d2a20a986ee57f9f4
SHA1 bb69665b3c8714d935ee63791181491b819795cb
SHA256 966ddbf59e1d6c2a80b8abbf4a30d37475de097bf13fb72ba78684d65975cd97
SHA512 ac040f92560631ca5162c7559173bdfe858e282225967ab1adc0a038d34943b00db140d44319cd2cdc2864295a098ab0ba634dfaa443e1d1782fa143ae4c217d

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 d725d87a331e3073bf289d4ec85bd04d
SHA1 c9d36103be794a802957d0a8243b066fa22f2e43
SHA256 30bcf934cbcc9ed72ff364b6e352a70a9e2afa46eceadea5c47183cb46cfd16e
SHA512 6713ff954221c5dd835c15556e5fa6b8684fa7e19ce4f527a5892e77f322b3dae7199a232040b89ad4a9575c8d9788d771892d2294f3c18da45e643eb25fdb08

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-process-l1-1-0.dll

MD5 55463244172161b76546dc2de37f42bd
SHA1 c10a5360ad5e340d59c814e159ea1efcbf5bf3ee
SHA256 4166a32551989f960dac7c0e296ffb28092f45f6539e7c450fa04bf17612be73
SHA512 eacec78ff95f60def6f7f27bda4a84f1dd2dfa386efc4f6da770c37268df83c5b402693ea5c29f54d48026579f3843db26add4d6448ea10cbf7f14d4d14a72fd

C:\Users\Admin\AppData\Local\Temp\_MEI17482\base_library.zip

MD5 52b8a88916733f0e5f15a10e5868a96c
SHA1 67d9052431565d3644dcbbf398094bb1a54f7087
SHA256 fa828ea0e83ef34cd4486343a33719241036d0fd97d9e9b52be882f73d8f2c19
SHA512 a3fb9bcb8ffedf45881820afa676f200feade7484770add4a681485549f705494f55ec10308eb57b075ccae6f3705bcde05153b58fcc3bfe9fbfdcce76b01565

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 d725d87a331e3073bf289d4ec85bd04d
SHA1 c9d36103be794a802957d0a8243b066fa22f2e43
SHA256 30bcf934cbcc9ed72ff364b6e352a70a9e2afa46eceadea5c47183cb46cfd16e
SHA512 6713ff954221c5dd835c15556e5fa6b8684fa7e19ce4f527a5892e77f322b3dae7199a232040b89ad4a9575c8d9788d771892d2294f3c18da45e643eb25fdb08

C:\Users\Admin\AppData\Local\Temp\_MEI17482\_ctypes.pyd

MD5 291a0a9b63bae00a4222a6df71a22023
SHA1 7a6a2aad634ec30e8edb2d2d8d0895c708d84551
SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
SHA512 d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09

\Users\Admin\AppData\Local\Temp\_MEI17482\_ctypes.pyd

MD5 291a0a9b63bae00a4222a6df71a22023
SHA1 7a6a2aad634ec30e8edb2d2d8d0895c708d84551
SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
SHA512 d43ef6fc2595936b17b0a689a00be04968f11d7c28945af4c3a74589bd05f415bf4cb3b4e22ac496490daff533755999a69d5962ccffd12e09c16130ed57fd09

C:\Users\Admin\AppData\Local\Temp\_MEI17482\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

\Users\Admin\AppData\Local\Temp\_MEI17482\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI17482\_bz2.pyd

MD5 a49c5f406456b79254eb65d015b81088
SHA1 cfc2a2a89c63df52947af3610e4d9b8999399c91
SHA256 ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
SHA512 bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae

\Users\Admin\AppData\Local\Temp\_MEI17482\_bz2.pyd

MD5 a49c5f406456b79254eb65d015b81088
SHA1 cfc2a2a89c63df52947af3610e4d9b8999399c91
SHA256 ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
SHA512 bbafeff8c101c7425dc9b8789117fe4c5e516d217181d3574d9d81b8fec4b0bd34f1e1fe6e406ae95584dc671f788cd7b05c8d700baf59fbf21de9c902edf7ae

C:\Users\Admin\AppData\Local\Temp\_MEI17482\_lzma.pyd

MD5 cf9fd17b1706f3044a8f74f6d398d5f1
SHA1 c5cd0debbde042445b9722a676ff36a0ac3959ad
SHA256 9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
SHA512 5fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a

\Users\Admin\AppData\Local\Temp\_MEI17482\_lzma.pyd

MD5 cf9fd17b1706f3044a8f74f6d398d5f1
SHA1 c5cd0debbde042445b9722a676ff36a0ac3959ad
SHA256 9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
SHA512 5fe922c00c6f7fd3cd9bc56fc51de1f44adffbdb0afc0583f1bb08008be628b9ac16f8560b0c3ba16138e1cdcaf1c525ef24241bed804804cdeb5961aed6385a

C:\Users\Admin\AppData\Local\Temp\_MEI17482\_socket.pyd

MD5 4827652de133c83fa1cae839b361856c
SHA1 182f9a04bdc42766cfd5fb352f2cb22e5c26665e
SHA256 87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba
SHA512 8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a

\Users\Admin\AppData\Local\Temp\_MEI17482\_socket.pyd

MD5 4827652de133c83fa1cae839b361856c
SHA1 182f9a04bdc42766cfd5fb352f2cb22e5c26665e
SHA256 87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba
SHA512 8d66d68613fdba0820257550de3c39b308b1dce659dca953d10a95ff2cf89c31afe512d30ed44422b31117058dc9fa15279e5ac84694da89b47f99b0ad7e338a

C:\Users\Admin\AppData\Local\Temp\_MEI17482\select.pyd

MD5 e21cff76db11c1066fd96af86332b640
SHA1 e78ef7075c479b1d218132d89bf4bec13d54c06a
SHA256 fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
SHA512 e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f

\Users\Admin\AppData\Local\Temp\_MEI17482\select.pyd

MD5 e21cff76db11c1066fd96af86332b640
SHA1 e78ef7075c479b1d218132d89bf4bec13d54c06a
SHA256 fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
SHA512 e86dba2326ca5ea3f5ef3af2abd3c23d5b29b6211acc865b6be5a51d5c8850b7cda8c069e6f631ac62f2047224c4b675bbe6ac97c7ba781de5b8016ebaffd46f

C:\Users\Admin\AppData\Local\Temp\_MEI17482\pyexpat.pyd

MD5 2ae23047648257afa90d0ca96811979f
SHA1 0833cf7ccae477faa4656c74d593d0f59844cadd
SHA256 5caf51f12406bdb980db1361fab79c51be8cac0a2a0071a083adf4d84f423e95
SHA512 13052eb183bb7eb8bb2740ff39f63805b69e920f2e21b482657a9995aa002579a88296b81ec415942511d2ed146689d1868b446f7e698e72da22f5c182706030

\Users\Admin\AppData\Local\Temp\_MEI17482\pyexpat.pyd

MD5 2ae23047648257afa90d0ca96811979f
SHA1 0833cf7ccae477faa4656c74d593d0f59844cadd
SHA256 5caf51f12406bdb980db1361fab79c51be8cac0a2a0071a083adf4d84f423e95
SHA512 13052eb183bb7eb8bb2740ff39f63805b69e920f2e21b482657a9995aa002579a88296b81ec415942511d2ed146689d1868b446f7e698e72da22f5c182706030

C:\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-utility-l1-1-0.dll

MD5 fcd6b29932d6fb307964b2d3f94e6b48
SHA1 be560f8a63c8e36a7b3fa48ff384f99f69a5d4f7
SHA256 cfb2ee4e426bb00b76163c1a66cf8cfef8d7450cbf9bbce3bc9eb2053f51e0e5
SHA512 3edfcf559f1e21870277358e6d266a1a0cea68b163b11c73108f3b6a56006d20b51410a3b4ea39bf80906bf6c9d573e1072697cfcd6a3d37e3679ea54757c69f

\Users\Admin\AppData\Local\Temp\_MEI17482\api-ms-win-crt-utility-l1-1-0.dll

MD5 fcd6b29932d6fb307964b2d3f94e6b48
SHA1 be560f8a63c8e36a7b3fa48ff384f99f69a5d4f7
SHA256 cfb2ee4e426bb00b76163c1a66cf8cfef8d7450cbf9bbce3bc9eb2053f51e0e5
SHA512 3edfcf559f1e21870277358e6d266a1a0cea68b163b11c73108f3b6a56006d20b51410a3b4ea39bf80906bf6c9d573e1072697cfcd6a3d37e3679ea54757c69f

memory/900-112-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI17482\_hashlib.pyd

MD5 5e5af52f42eaf007e3ac73fd2211f048
SHA1 1a981e66ab5b03f4a74a6bac6227cd45df78010b
SHA256 a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
SHA512 bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd

\Users\Admin\AppData\Local\Temp\_MEI17482\_hashlib.pyd

MD5 5e5af52f42eaf007e3ac73fd2211f048
SHA1 1a981e66ab5b03f4a74a6bac6227cd45df78010b
SHA256 a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
SHA512 bc37625005c3dad1129b158a2f1e91628d5c973961e0efd61513bb6c7b97d77922809afca8039d08c11903734450bc098c6e7b63655ff1e9881323e5cfd739fd

C:\Users\Admin\AppData\Local\Temp\_MEI17482\libcrypto-1_1.dll

MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

\Users\Admin\AppData\Local\Temp\_MEI17482\libcrypto-1_1.dll

MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

C:\Users\Admin\AppData\Local\Temp\_MEI17482\_queue.pyd

MD5 dd146e2fa08302496b15118bf47703cf
SHA1 d06813e2fcb30cbb00bb3893f30c2661686cf4b7
SHA256 67e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
SHA512 5b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c

\Users\Admin\AppData\Local\Temp\_MEI17482\_queue.pyd

MD5 dd146e2fa08302496b15118bf47703cf
SHA1 d06813e2fcb30cbb00bb3893f30c2661686cf4b7
SHA256 67e4e888559ea2c62ff267b58d7a7e95c2ec361703b5aa232aa8b2a1f96a2051
SHA512 5b93a782c9562370fc5b3f289ca422b4d1a1c532e81bd6c95a0063f2e3889ecf828003e42b674439fc7cd0fa72f64ad607bab6910abe9d959a4fb9fb08df263c

C:\Users\Admin\AppData\Local\Temp\_MEI17482\msgpack\_cmsgpack.cp38-win_amd64.pyd

MD5 e8c67ce91fc4c3c47e1e367f408ff2ac
SHA1 8a8d33c81062dd3b41b3f5caf3f8c8e27b84e791
SHA256 9c4ff2e631a3455b7d8cbe0c0162b134bb413880a7912084d641e0583169724e
SHA512 15971749bb9a33019cfce7defba56964033c96dd0eeff269c9c72b70c4647a13eeb9d04f73fc63ad1c935a752c2ee1a8f845293657ce20b0433f68169ba3820f