Malware Analysis Report

2025-05-05 21:25

Sample ID 240521-wwzb7adh29
Target cracked-premium-spotify.rar
SHA256 d6a3c410b9c13da9d82ceeb2a1471afcfc9d9679599c3dce795027e38e63e59e
Tags
pyinstaller execution spyware stealer upx
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

d6a3c410b9c13da9d82ceeb2a1471afcfc9d9679599c3dce795027e38e63e59e

Threat Level: Likely malicious

The file cracked-premium-spotify.rar was found to be: Likely malicious.

Malicious Activity Summary

pyinstaller execution spyware stealer upx

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

UPX packed file

Drops startup file

Loads dropped DLL

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Detects Pyinstaller

Unsigned PE

Enumerates system info in registry

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Detects videocard installed

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-21 18:17

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-21 18:16

Reported

2024-05-21 18:19

Platform

win11-20240419-en

Max time kernel

90s

Max time network

93s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.pyc

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.pyc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-21 18:16

Reported

2024-05-21 18:19

Platform

win11-20240508-en

Max time kernel

145s

Max time network

151s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\cracked-premium-spotify.rar

Signatures

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\Winword.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\Winword.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\Winword.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\Winword.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\Winword.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\Winword.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\root\Office16\Winword.exe N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\Winword.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4760 wrote to memory of 3020 N/A C:\Windows\system32\OpenWith.exe C:\Program Files\Microsoft Office\root\Office16\Winword.exe
PID 4760 wrote to memory of 3020 N/A C:\Windows\system32\OpenWith.exe C:\Program Files\Microsoft Office\root\Office16\Winword.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\cracked-premium-spotify.rar

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\Winword.exe

"C:\Program Files\Microsoft Office\root\Office16\Winword.exe" /n "C:\Users\Admin\AppData\Local\Temp\cracked-premium-spotify.rar"

Network

Country Destination Domain Proto
US 8.8.8.8:53 219.183.117.104.in-addr.arpa udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/3020-2-0x00007FFD6E130000-0x00007FFD6E140000-memory.dmp

memory/3020-1-0x00007FFD6E130000-0x00007FFD6E140000-memory.dmp

memory/3020-0-0x00007FFD6E130000-0x00007FFD6E140000-memory.dmp

memory/3020-3-0x00007FFD6E130000-0x00007FFD6E140000-memory.dmp

memory/3020-4-0x00007FFD6E130000-0x00007FFD6E140000-memory.dmp

memory/3020-5-0x00007FFD6B890000-0x00007FFD6B8A0000-memory.dmp

memory/3020-6-0x00007FFD6B890000-0x00007FFD6B8A0000-memory.dmp

memory/3020-36-0x00007FFD6E130000-0x00007FFD6E140000-memory.dmp

memory/3020-37-0x00007FFD6E130000-0x00007FFD6E140000-memory.dmp

memory/3020-39-0x00007FFD6E130000-0x00007FFD6E140000-memory.dmp

memory/3020-38-0x00007FFD6E130000-0x00007FFD6E140000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-21 18:16

Reported

2024-05-21 18:19

Platform

win11-20240508-en

Max time kernel

146s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spotify-Mod.exe C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A discord.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4124 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe
PID 4124 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe
PID 5092 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 5092 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 3784 wrote to memory of 3996 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 3784 wrote to memory of 3996 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 5092 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 5092 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 4580 wrote to memory of 712 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4580 wrote to memory of 712 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5092 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 5092 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 2596 wrote to memory of 3240 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 3240 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5092 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 5092 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 1448 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 1448 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 564 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 564 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 4936 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 4936 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 5108 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 5108 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5092 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 5092 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 4948 wrote to memory of 3716 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4948 wrote to memory of 3716 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5092 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\System32\Wbem\wmic.exe
PID 5092 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\System32\Wbem\wmic.exe
PID 5092 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 5092 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 3060 wrote to memory of 4984 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3060 wrote to memory of 4984 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5092 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 5092 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 1668 wrote to memory of 3480 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1668 wrote to memory of 3480 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5092 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 5092 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 2080 wrote to memory of 2700 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2080 wrote to memory of 2700 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 5092 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 5092 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe C:\Windows\system32\cmd.exe
PID 3592 wrote to memory of 4816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 3592 wrote to memory of 4816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 3592 wrote to memory of 2108 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 3592 wrote to memory of 2108 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe

"C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe"

C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe

"C:\Users\Admin\AppData\Local\Temp\Spotify-Mod.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"

C:\Windows\System32\wbem\WMIC.exe

C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\System32\Wbem\wmic.exe

wmic cpu get Name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"

C:\Windows\System32\wbem\WMIC.exe

C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\self_delete.bat"

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 2

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 2

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 172.67.74.152:443 api.ipify.org tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 162.159.137.232:443 discord.com tcp
US 172.67.74.152:443 api.ipify.org tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
GB 184.25.204.17:443 tcp
US 52.182.143.211:443 browser.pipe.aria.microsoft.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI41242\python312.dll

MD5 644db8b3ab5827dc676d92de705a652a
SHA1 7b02cb0de1b4563f730a9c220c415ed601d14a3f
SHA256 145f6c26b7b1431ffb26f8b067de3ba619b656de5840fcc968ab0b3e61b7ee7a
SHA512 c8d33c00d04f56650f45be6e29114b135445203ab8db5caaf6ee9ab17d593413cc8804f97346257c618ce5f4da652ed6ed2faa9bb0b816a49017333c42937ef6

C:\Users\Admin\AppData\Local\Temp\_MEI41242\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

memory/5092-95-0x00007FFD982E0000-0x00007FFD989B9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_ctypes.pyd

MD5 1edf8e4b75c253f3f6b0b1f9a93f9b71
SHA1 34d03023f8e382c407740a15127530686f60bf96
SHA256 f5b36ebf25552e9e1f54627be56f78f5b14f46725f840d2e6faaf47b16ddb3dc
SHA512 b2002a3a3964baa002315fd47604b212956bdd20a0b9c482d4876fd7a923f0a839e5f8c8839c5e8a54d23098bab6eb416323a013daae0a6cebcf916b9ceaa12d

C:\Users\Admin\AppData\Local\Temp\_MEI41242\base_library.zip

MD5 630153ac2b37b16b8c5b0dbb69a3b9d6
SHA1 f901cd701fe081489b45d18157b4a15c83943d9d
SHA256 ec4e6b8e9f6f1f4b525af72d3a6827807c7a81978cb03db5767028ebea283be2
SHA512 7e3a434c8df80d32e66036d831cbd6661641c0898bd0838a07038b460261bf25b72a626def06d0faa692caf64412ca699b1fa7a848fe9d969756e097cba39e41

C:\Users\Admin\AppData\Local\Temp\_MEI41242\python3.dll

MD5 6271a2fe61978ca93e60588b6b63deb2
SHA1 be26455750789083865fe91e2b7a1ba1b457efb8
SHA256 a59487ea2c8723277f4579067248836b216a801c2152efb19afee4ac9785d6fb
SHA512 8c32bcb500a94ff47f5ef476ae65d3b677938ebee26e80350f28604aaee20b044a5d55442e94a11ccd9962f34d22610b932ac9d328197cf4d2ffbc7df640efba

C:\Users\Admin\AppData\Local\Temp\_MEI41242\libffi-8.dll

MD5 ae513b7cdc4ee04687002577ffbf1ff4
SHA1 7d9a5eb0ac504bc255e80055d72e42ccb7ab7b4d
SHA256 ed18fc7eee1bf09d994d8eba144e4e7d1e6a030ba87888001eea550d7afffada
SHA512 9fcb24debfaf035a3604a2a9abece0655424f981ebb0afef14b9674e57030dea8c5c230ca8cc13c10de8422777b4c549002350f62b9259c486cca841d9c81634

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_bz2.pyd

MD5 162e073421e8a6e47f4d11f0de63df28
SHA1 d044e3df6952e63a1680b760edc4dc0831398fdc
SHA256 f64433f9ac0681e0e26d141c846f7aad938ff6bea7c497da87f68144c5dec67a
SHA512 82fe9bcf0c51baed30687ac3f5a48b92a1cc7a53311e6ff8078b625d5b48a270ba8b6e92ad4ae419e9199407f2c7fcf511bde9188d5f06c56a1d4f144b584ea4

memory/5092-106-0x00007FFDB3830000-0x00007FFDB383F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_lzma.pyd

MD5 173a4e19c3ca16db5ee95bc2fe01016b
SHA1 64d3259beeb5ac3a59c53796651c0f44ce2c317e
SHA256 f8c1c6e0bdcce10df607630255c6908b6870b2c12231f9000073c6728818e2c0
SHA512 78da5d71386514e82b27b8ce6a98ba798d6a31a09ea09a3e491aa20e69b198a1110f32c27a9c4ff6ab8ba88f7b0ab2a5ffb6fe724dc7bb277ee794ad486b8d4f

memory/5092-111-0x00007FFDA9F00000-0x00007FFDA9F2D000-memory.dmp

memory/5092-110-0x00007FFDB3450000-0x00007FFDB3469000-memory.dmp

memory/5092-105-0x00007FFDA9F30000-0x00007FFDA9F55000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI41242\libcrypto-3.dll

MD5 ee4ebac30781c90c6fb6fdffa6bdd19a
SHA1 154eada82a520af85c1248b792edb716a72a19e0
SHA256 d9c01ab4545d4681ab057b572eb8590defd33bc44527bb4ef26a5f23cadbfd03
SHA512 fc9457046f262595024971047f06df5b5865e53536e8fc5d35a6e5c9da494e99cd2dbeb9d6d17e37b51169b88ed6cb6e5931474dbbab7350e1b4da8e7ee0576c

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_wmi.pyd

MD5 8679733f0b32381d459d7bbeb3d8c160
SHA1 605c0429b9afb74afc2c2d39ba4060cb3a492b59
SHA256 968d8a16c27b744a275098ee9461ec4ff99c7760ab46be028e590a55041f7e9a
SHA512 af497cb6a4f5501e93e7874e028047d10fb76d72bcc81a0db1bcfbea0c3641e86d6df4142121ee37a51c98c41e870758fee63baf3cc0d20c2a22a1a17d973546

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_uuid.pyd

MD5 7a00ff38d376abaaa1394a4080a6305b
SHA1 d43a9e3aa3114e7fc85c851c9791e839b3a0ee13
SHA256 720e9b68c41c8d9157865e4dd243fb1731f627f3af29c43250804a5995a82016
SHA512 ce39452df539eeeff390f260c062a0c902557fda25a7be9a58274675b82b30bddb7737b242e525f7d501db286f4873b901d94e1cd09aa8864f052594f4b34789

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_ssl.pyd

MD5 55494fb40eb424482c31cb515cdd3032
SHA1 6bdd5092554305cd4a1dd006b304ddf4efd86de3
SHA256 036bba9f78a7b8c72112a6119f179cde7038263dd19ad5ad2592e191642e5887
SHA512 54e6145920c600cc6410d251102d6d6081de61191cb38c1f7d7f4d269aaaa7a032ff04bc08566d44bfc5e7831780694cd2856e10438ccbeddac28d62c8f90e6c

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_sqlite3.pyd

MD5 baae0d07fde6d5d23e0a00f95df04079
SHA1 14c391c78b7361a25f2e75ff8e726de794e9e9f4
SHA256 02d7217fa00d03b5a603b1f8a9282f1ab5512225ab65c673403b51fed0b9fe1e
SHA512 74de82b0c6293792df1f4b77d9447a85804f22addb0b3d69723d76be25b49b1e6cf5c86af20e1b03b3af29ff28f7dd68ab84198dd800aa544a9f3e8147bbcf65

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_socket.pyd

MD5 2e33f3f73ce1e81244afdd0f67ea21d9
SHA1 f33f884ad3897b3170c211d5b6896e0bd7e0dc1c
SHA256 3583a376a44af5621888cd232ecc7fe3a19f4731268f2f340346fad9931c6393
SHA512 fc6bd819573f800c09ac40fea66b3c7fcc42d7b08494d04c51b2be898a6c94780df3e3b98c3e8cf55d2869bf74c26dbd2f72ad08b36bb91c82f47878999ba4fb

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_queue.pyd

MD5 e882fa7aa3f06040190941ef4681aa63
SHA1 1ed79a4181272b831716e631c136553645bb40a5
SHA256 42dcac31444b071881da3a4d120ae60f3f8c5ad8f4280871ddca5f4a8fb35204
SHA512 90c3a832bd35c02d25b7afd10b2bbb48f2a3720a3c77e981fd9de687e6fea443ef07b6398616a6ec33a3e08864da500f73fa4cb980d5d13cf3544d678ad1d5f1

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_overlapped.pyd

MD5 1cd935b38fc92de07887ca152bce9f61
SHA1 b5cb5bdac60dcf5380e278fca3d3912728091ff7
SHA256 19da0a2ba36bdd88aa28cbcb94a9358f116f3a929f3be6edf61e5b59ce27cb48
SHA512 50ffc97c563809651019e0ede59c524c97241fe4d365d7e19bb3cb86ba6a3ba07a966653ad5f3444ab5f240335c57540a5f50ca8832508949ffbe9504209812a

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_multiprocessing.pyd

MD5 16ce3efeaa51699f96c3e62aeddfb283
SHA1 61ae5f4e30bdcc8e9a26671e268d5b94d7e0fbc5
SHA256 ae97e6981d72da14c81a48f6a049268fb3ec46ee4631c3dbe719998abe1e0b89
SHA512 d8b5dd87b2477ece5b4ffaf882d6a21b43927b26cbc5af4e4052a626195a072a933cba65a2f530b82b4203aab222bc6d885b2e56c9f2622273a69544647bfe24

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_hashlib.pyd

MD5 43ac0eca4b4d7272e7d3eff2e7a49c7a
SHA1 5974e82997b8344cbab9be644578147d9f8375d9
SHA256 ad327af8c1d8d05b03f21b8729640720d77093799ce229149d16db310d978f41
SHA512 b6d1f881448de6119c3ccdd3de354dd1d69e5e38584ec599188d66c741ff179989af2c5aed9c98440faccedd98a214d3bb14241f9ac5cd63a67ee7fc2df1ee53

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_decimal.pyd

MD5 5c24aef1e8ea173d8232f872fd238439
SHA1 f91e6c75b21764af4e285f75818799a1886f3c66
SHA256 062cd94a10c527932ccb450039f85dd1e4b4ede0213a9701d02f6792c03bc163
SHA512 8bd68b70e7af1bbf10eca668544c5f48375c42cb42552a726d642b1449c416c708423227ef708b0cbfbd5bdf5a2adc58bfd9593524e977f97e72a9d0a199b511

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_cffi_backend.cp312-win_amd64.pyd

MD5 5ecaaa900fdabc7207cf938e23f5d956
SHA1 40d4d67e8ba1737caa5e0ab69cb08d7f7f4215ae
SHA256 b2ee6d811dc1d94a761ffe691006e23ad00adeb9b710c4f8e7d59f177401aaba
SHA512 ff03c361adaf5e14101083e9374e8b85f0b74bda2b6c05a0739237b397fa02dbfa8b6b8cadc4ded1d9b64e8ae63d040e1b6ed2cc3947451b6c3f58ed7bfc1cd0

C:\Users\Admin\AppData\Local\Temp\_MEI41242\_asyncio.pyd

MD5 81b90d80b9e847b2ff4293bf64a2ba72
SHA1 ae628535fc54694d2dd453bd2fd53329a4abd464
SHA256 18edc6a184a803164769dbf56910a2fe8d6bc9bdc9ea0b7ae20b353ed7990942
SHA512 747abdda85dc5d3eb0b31cfaed3cd6b751e66c1c64bcde899558f458ab916ddb06e9f4e3571c2f2fa492adcbffd6c9cd6b043191b6006712a3e2e63e760efd17

C:\Users\Admin\AppData\Local\Temp\_MEI41242\VCRUNTIME140_1.dll

MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

C:\Users\Admin\AppData\Local\Temp\_MEI41242\unicodedata.pyd

MD5 375462e5ca8918a0f2ddcd926f506035
SHA1 c386df4ce481ba4818ca4852e923f2a5fab49236
SHA256 31ba62f0d236498164f1d6d16b7b36761243eae5200f735e9308804fc0b6cf8e
SHA512 60371f18b1e8395737e5e588fefefe792bf146f24cfd08a9dc23c92bf6e96e5beb3fa3f14e0ff211203f668926a39bf4a160124aadab2f66067f3c360d3bf20d

C:\Users\Admin\AppData\Local\Temp\_MEI41242\sqlite3.dll

MD5 3a8edd3d1ab081b356cf2ea65b3e9d72
SHA1 41dcbfa611b520819fb0bd16c48d9fd8fe68cff1
SHA256 3da04d83c88298e46cbb781594198fbc3cda4f4d622f9f7fece3e485fb7b95ca
SHA512 6ba93c43d9d3464e690d4c58e19786395ea0c73c07539f6a2c6bbff2c1167a49bb7bdb59301210e481663f9f3f820578b4963fe52bbfef0103fb4166c4a229bf

C:\Users\Admin\AppData\Local\Temp\_MEI41242\select.pyd

MD5 721f686d1dd14ca7bfeb52f5a2e79265
SHA1 0785b7beb258bb0a64c8d0937b9955494038f563
SHA256 a4528fb53204adbaeaab1d6971d7c5f265bd4288fc9e7143973d33537bc3f93d
SHA512 d8770da43047ac6d03ca837e729147bd9b89603981d55ad15f51b2ba57dce4d30f9428ccaa384417e1ce21bf97f106bbe365aec437ac00b7ab9c900e013c888c

C:\Users\Admin\AppData\Local\Temp\_MEI41242\pyexpat.pyd

MD5 f546eeb7c940274c5ef9966647005744
SHA1 007d86b1872794d1a66ad71dafb037e6c17e5b11
SHA256 1096d50f972481e38230df88b19acb9aa28f82802753e2427ddc45859d8c47bf
SHA512 a65b6cd10beceebe22d8f936e6763e90513b66582b6106cc17f7b6ec87bc3ed9f20e744ffeb18535c4ea1c8aa9a6cd8d008cee6e0c158da24605195b4ca7f828

C:\Users\Admin\AppData\Local\Temp\_MEI41242\libssl-3.dll

MD5 a160ff459e97bf9514ef28281dbc6c81
SHA1 730510497c9a4d28444e5243bc5f44a91643d725
SHA256 2674c58e05448f8b60d7b2182bbcd2efe386d4b7b1104dd1f753112638cb8e00
SHA512 04651ca40a806f0596434e0bbe30c7458daf316174ecdbf142cbddc21dbac5f0db58dc284bce5b7c6949545720021b2bd1f768ebf8c2e379a17dc6dc2fb2b46d

memory/5092-132-0x00007FFDAF670000-0x00007FFDAF67D000-memory.dmp

memory/5092-136-0x00007FFDAF660000-0x00007FFDAF66D000-memory.dmp

memory/5092-135-0x00007FFDACE90000-0x00007FFDACEA9000-memory.dmp

memory/5092-138-0x00007FFDAD120000-0x00007FFDAD12D000-memory.dmp

memory/5092-142-0x00007FFD97DB0000-0x00007FFD982D9000-memory.dmp

memory/5092-141-0x00007FFDAA250000-0x00007FFDAA264000-memory.dmp

memory/5092-146-0x00007FFDA9FA0000-0x00007FFDAA06D000-memory.dmp

memory/5092-145-0x00007FFDAA070000-0x00007FFDAA0A3000-memory.dmp

memory/5092-148-0x00007FFDA9F80000-0x00007FFDA9F96000-memory.dmp

memory/5092-151-0x00007FFDA9F60000-0x00007FFDA9F72000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI41242\psutil\_psutil_windows.pyd

MD5 4732b2f1e51342fe289bc316897d8d62
SHA1 acb5ac5fc83121e8caec091191bd66d519f29787
SHA256 9ba42d887ff1655a9a7fd20b33c6bf80b6429a60dcd9f0409281a25e3d73f329
SHA512 7435c0da033dbc07bbd2e6bebfc48041701dbc7bcb58276fbf51ba6db7507a16ad8a7a12dbdbdbdd4074772094c3bd969e27a2c4946c050bcff049a9c4666d18

memory/5092-160-0x00007FFDA9580000-0x00007FFDA9598000-memory.dmp

memory/5092-157-0x00007FFDA9800000-0x00007FFDA9824000-memory.dmp

memory/5092-156-0x00007FFDA9EC0000-0x00007FFDA9EF5000-memory.dmp

memory/5092-155-0x00007FFDA5630000-0x00007FFDA57A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI41242\zstandard\backend_c.cp312-win_amd64.pyd

MD5 7175acb973e8831e604bccfa53c1ed3a
SHA1 28a4b9064edc115889e13337fd962c63d83a9da6
SHA256 195f61ce28b3582a00f5d30c92a957e732b2ec13ba7be20f457f3a10215fad25
SHA512 4e8eb9e9beba43fa58798a58e7a3923f3e1cffd4ecd98adca9b136219b27886ca05bbf2a3e456c85c2dee182050a750a9138abc88fda111bd404c9679fd85cc3

memory/5092-163-0x00007FFDA94A0000-0x00007FFDA9527000-memory.dmp

memory/5092-154-0x00007FFD982E0000-0x00007FFD989B9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI41242\charset_normalizer\md.cp312-win_amd64.pyd

MD5 b2352e4f9d5c69c86ec16f013865c5b1
SHA1 707931e554172f23d56f65815f55da049568bddf
SHA256 696a3a317aa717dcfd565a9853adfb7df125aec7a366204c0ecbf07c1ed0624d
SHA512 b899e6be4c00c35610c1cfef2fc48201f6296bdf0e52347d83f5fae2a2b4f22cfc2871668a7ec1ad18de8ccd129b0348f27a6034fda75997fb9eb13982367c89

memory/5092-170-0x00007FFDA9400000-0x00007FFDA9427000-memory.dmp

memory/5092-172-0x00007FFD97AC0000-0x00007FFD97BDB000-memory.dmp

memory/5092-169-0x00007FFDAA240000-0x00007FFDAA24B000-memory.dmp

memory/5092-168-0x00007FFDAF670000-0x00007FFDAF67D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI41242\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

MD5 4440fd868cf337f42c500985f199bed5
SHA1 769370b36f3af4e99a930364d1b5b81219dbee98
SHA256 69f6357b5cf96cb302113e858276e2da924cc71e374da6f406cc5323e4b83c1e
SHA512 0e9a902b282edffb4be0a127028edc35973382016df20f14029fd37c6a411bcc8591be2ffc40d3d8ebe6a157bdccc66b1d2e6d1764f8bbd4daa4c0f5aa897847

C:\Users\Admin\AppData\Local\Temp\_MEI41242\Cryptodome\Cipher\_raw_ecb.pyd

MD5 988bc44217fde3aaef9b400519a87acd
SHA1 40d8e43753bd4712e1dd53419fe19ef59044555f
SHA256 a4cf8ec5227cd73909defaca13988cc0e8ecea234986fc28d0cdc4b4c239ac84
SHA512 45ab5fdda31056e64011655a8e1d6bc37bbc1454614f2c748c84c65400d28820313605636118dca59701418f03f87833780ea4419a57ccf1bae983c5cb03d983

memory/5092-175-0x00007FFDAA100000-0x00007FFDAA10B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI41242\Cryptodome\Cipher\_raw_cbc.pyd

MD5 ecb6bcbafea70b91e63bc4d6eac80690
SHA1 83522cbccc21acd51718fe913b7fe1d9777de134
SHA256 a3f98cbaefc4ebf7ad9f6e8eb067b44220a8fa72efa4a6a4b015cdb5aa64c58c
SHA512 dbe980884cb88f77d0570dd1306e5a2e625aefbf61cea84b73650ae936cfa720805f02fe6232d3345ef950fc4cd675091b81fce6849f1583e44966ca064dcbb8

C:\Users\Admin\AppData\Local\Temp\_MEI41242\Cryptodome\Cipher\_raw_cfb.pyd

MD5 18e0a95c5cfed7c054e36f3508c3ca78
SHA1 ae480e982f272f1370f60fa08d7f4772dc003920
SHA256 b9941f43c52eed26ffabc190c7b5fff804f1a8dbbdfadd35fc3ab673e7bf2e05
SHA512 f817a656529f58732c78cb3bce3db25c8859c176cdbe28056b3f6a13d733f4672bd35166e25ab678d7b8e3239b498e23cfd90ec4be5e906d7b0a093bf83ea1e5

memory/5092-191-0x00007FFDA9260000-0x00007FFDA926C000-memory.dmp

memory/5092-190-0x00007FFDA9FA0000-0x00007FFDAA06D000-memory.dmp

memory/5092-189-0x00007FFDAA070000-0x00007FFDAA0A3000-memory.dmp

memory/5092-188-0x00007FFDA9290000-0x00007FFDA929C000-memory.dmp

memory/5092-187-0x00007FFDA9270000-0x00007FFDA927C000-memory.dmp

memory/5092-186-0x00007FFDA9280000-0x00007FFDA928B000-memory.dmp

memory/5092-200-0x00007FFDA8F00000-0x00007FFDA8F0C000-memory.dmp

memory/5092-202-0x00007FFDA9230000-0x00007FFDA923B000-memory.dmp

memory/5092-201-0x00007FFD97870000-0x00007FFD97AB5000-memory.dmp

memory/5092-199-0x00007FFDA91D0000-0x00007FFDA91E2000-memory.dmp

memory/5092-198-0x00007FFDA91F0000-0x00007FFDA91FD000-memory.dmp

memory/5092-197-0x00007FFDA9200000-0x00007FFDA920C000-memory.dmp

memory/5092-196-0x00007FFDA9210000-0x00007FFDA921C000-memory.dmp

memory/5092-195-0x00007FFDA9220000-0x00007FFDA922B000-memory.dmp

memory/5092-194-0x00007FFDA5630000-0x00007FFDA57A6000-memory.dmp

memory/5092-193-0x00007FFDA9240000-0x00007FFDA924C000-memory.dmp

memory/5092-192-0x00007FFDA9250000-0x00007FFDA925E000-memory.dmp

memory/5092-185-0x00007FFDA92A0000-0x00007FFDA92AB000-memory.dmp

memory/5092-184-0x00007FFDA92D0000-0x00007FFDA92DC000-memory.dmp

memory/5092-183-0x00007FFDA9490000-0x00007FFDA949B000-memory.dmp

memory/5092-182-0x00007FFD97DB0000-0x00007FFD982D9000-memory.dmp

memory/5092-181-0x00007FFDAA250000-0x00007FFDAA264000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI41242\Cryptodome\Cipher\_raw_ofb.pyd

MD5 19a5dcc0f2f46c3bce75a708978dd810
SHA1 f6432aa2e0823021322b9a4615bd4b37648361e6
SHA256 85fe310f47e417bff3def8ff13ed2c59318e3843efca718414ed4c140c8e7b19
SHA512 65cdd4c7b87d187f40bbe433619b0bfa0e49603a8f72b423f548ac551c2f7d2b1686a2f35284813124f6682ed5b712c5d05fd2067a6df815857f9fe9988176d1

memory/5092-206-0x00007FFD9F580000-0x00007FFD9F5AE000-memory.dmp

memory/5092-205-0x00007FFDA9580000-0x00007FFDA9598000-memory.dmp

memory/5092-204-0x00007FFD9F5B0000-0x00007FFD9F5D9000-memory.dmp

memory/5092-203-0x00007FFDA9800000-0x00007FFDA9824000-memory.dmp

memory/3240-228-0x00000199F9AA0000-0x00000199F9AC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vbugah5r.qm3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\XEYvuAuV6K\Browser\cc's.txt

MD5 5aa796b6950a92a226cc5c98ed1c47e8
SHA1 6706a4082fc2c141272122f1ca424a446506c44d
SHA256 c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c
SHA512 976f403257671e8f652bf988f4047202e1a0fd368fdb2bab2e79ece1c20c7eb775c4b3a8853c223d4f750f4192cd09455ff024918276dc1dd1442fa3b36623ad

C:\Users\Admin\AppData\Local\Temp\XEYvuAuV6K\Browser\history.txt

MD5 5638715e9aaa8d3f45999ec395e18e77
SHA1 4e3dc4a1123edddf06d92575a033b42a662fe4ad
SHA256 4db7f6559c454d34d9c2d557524603c3f52649c2d69b26b6e8384a3d179aeae6
SHA512 78c96efab1d941e34d3137eae32cef041e2db5b0ebbf883e6a2effa79a323f66e00cfb7c45eb3398b3cbd0469a2be513c3ff63e5622261857eefc1685f77f76b

memory/5092-281-0x00007FFDA9400000-0x00007FFDA9427000-memory.dmp

memory/5092-284-0x00007FFDA9710000-0x00007FFDA971F000-memory.dmp

memory/5092-283-0x00007FFD97AC0000-0x00007FFD97BDB000-memory.dmp

memory/5092-289-0x00007FFD982E0000-0x00007FFD989B9000-memory.dmp

memory/5092-338-0x00007FFDA9260000-0x00007FFDA926C000-memory.dmp

memory/5092-349-0x00007FFDA9270000-0x00007FFDA927C000-memory.dmp

memory/5092-359-0x00007FFDA9710000-0x00007FFDA971F000-memory.dmp

memory/5092-358-0x00007FFD97870000-0x00007FFD97AB5000-memory.dmp

memory/5092-357-0x00007FFD9F5B0000-0x00007FFD9F5D9000-memory.dmp

memory/5092-356-0x00007FFD9F580000-0x00007FFD9F5AE000-memory.dmp

memory/5092-355-0x00007FFDA8F00000-0x00007FFDA8F0C000-memory.dmp

memory/5092-354-0x00007FFDA91D0000-0x00007FFDA91E2000-memory.dmp

memory/5092-353-0x00007FFDA91F0000-0x00007FFDA91FD000-memory.dmp

memory/5092-352-0x00007FFDA9200000-0x00007FFDA920C000-memory.dmp

memory/5092-351-0x00007FFDA9210000-0x00007FFDA921C000-memory.dmp

memory/5092-350-0x00007FFDA9220000-0x00007FFDA922B000-memory.dmp

memory/5092-348-0x00007FFDA9280000-0x00007FFDA928B000-memory.dmp

memory/5092-347-0x00007FFDA92A0000-0x00007FFDA92AB000-memory.dmp

memory/5092-346-0x00007FFDA92D0000-0x00007FFDA92DC000-memory.dmp

memory/5092-345-0x00007FFDA9490000-0x00007FFDA949B000-memory.dmp

memory/5092-344-0x00007FFDAA100000-0x00007FFDAA10B000-memory.dmp

memory/5092-343-0x00007FFD97AC0000-0x00007FFD97BDB000-memory.dmp

memory/5092-342-0x00007FFDA9400000-0x00007FFDA9427000-memory.dmp

memory/5092-341-0x00007FFDAA240000-0x00007FFDAA24B000-memory.dmp

memory/5092-340-0x00007FFDA94A0000-0x00007FFDA9527000-memory.dmp

memory/5092-339-0x00007FFDA9580000-0x00007FFDA9598000-memory.dmp

memory/5092-337-0x00007FFDA9800000-0x00007FFDA9824000-memory.dmp

memory/5092-336-0x00007FFDA9240000-0x00007FFDA924C000-memory.dmp

memory/5092-335-0x00007FFDA9F80000-0x00007FFDA9F96000-memory.dmp

memory/5092-334-0x00007FFDA9FA0000-0x00007FFDAA06D000-memory.dmp

memory/5092-333-0x00007FFDAA070000-0x00007FFDAA0A3000-memory.dmp

memory/5092-332-0x00007FFDA9230000-0x00007FFDA923B000-memory.dmp

memory/5092-331-0x00007FFDAA250000-0x00007FFDAA264000-memory.dmp

memory/5092-330-0x00007FFDAD120000-0x00007FFDAD12D000-memory.dmp

memory/5092-329-0x00007FFDAF660000-0x00007FFDAF66D000-memory.dmp

memory/5092-328-0x00007FFDACE90000-0x00007FFDACEA9000-memory.dmp

memory/5092-327-0x00007FFDAF670000-0x00007FFDAF67D000-memory.dmp

memory/5092-326-0x00007FFDA9F00000-0x00007FFDA9F2D000-memory.dmp

memory/5092-325-0x00007FFDB3450000-0x00007FFDB3469000-memory.dmp

memory/5092-324-0x00007FFDB3830000-0x00007FFDB383F000-memory.dmp

memory/5092-323-0x00007FFDA9F30000-0x00007FFDA9F55000-memory.dmp

memory/5092-322-0x00007FFDA9EC0000-0x00007FFDA9EF5000-memory.dmp

memory/5092-320-0x00007FFDA9250000-0x00007FFDA925E000-memory.dmp

memory/5092-316-0x00007FFDA9290000-0x00007FFDA929C000-memory.dmp

memory/5092-306-0x00007FFDA5630000-0x00007FFDA57A6000-memory.dmp

memory/5092-303-0x00007FFDA9F60000-0x00007FFDA9F72000-memory.dmp

memory/5092-299-0x00007FFD97DB0000-0x00007FFD982D9000-memory.dmp