Malware Analysis Report

2025-06-15 20:56

Sample ID 240525-ykke1agb2v
Target Base-Sniping-Bot-Opensource-main.zip
SHA256 5f58a2c6cd761ab224ee1065dfa8025bd197dde1b6e286e05de15cb7aa4fdb78
Tags
pyinstaller
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

5f58a2c6cd761ab224ee1065dfa8025bd197dde1b6e286e05de15cb7aa4fdb78

Threat Level: Shows suspicious behavior

The file Base-Sniping-Bot-Opensource-main.zip was found to be: Shows suspicious behavior.

Malicious Activity Summary

pyinstaller

Loads dropped DLL

Enumerates connected drives

Detects Pyinstaller

Unsigned PE

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-25 19:50

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-25 19:50

Reported

2024-05-25 19:59

Platform

win11-20240419-en

Max time kernel

313s

Max time network

311s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Base-Sniping-Bot-Opensource-main.zip

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A
N/A N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\e: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\g: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\i: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\l: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\D: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\k: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\z: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\j: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\m: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\w: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\y: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\a: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\n: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\o: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\r: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\v: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\x: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\b: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\h: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\p: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\q: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\t: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\s: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\u: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\SearchIndexer.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdc32582ddaeda01 C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bbcfc082ddaeda01 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4272882ddaeda01 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e167a781ddaeda01 C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001496b982ddaeda01 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" C:\Windows\System32\SearchProtocolHost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4784 wrote to memory of 1964 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\System32\SearchProtocolHost.exe
PID 4784 wrote to memory of 1964 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\System32\SearchProtocolHost.exe
PID 4784 wrote to memory of 3960 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4784 wrote to memory of 3960 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4784 wrote to memory of 1816 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4784 wrote to memory of 1816 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4784 wrote to memory of 2784 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\System32\SearchProtocolHost.exe
PID 4784 wrote to memory of 2784 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\System32\SearchProtocolHost.exe
PID 4784 wrote to memory of 1464 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4784 wrote to memory of 1464 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4784 wrote to memory of 2524 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4784 wrote to memory of 2524 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2932 wrote to memory of 1408 N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe
PID 2932 wrote to memory of 1408 N/A C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Base-Sniping-Bot-Opensource-main.zip

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\System32\SearchProtocolHost.exe

"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 828 2700 2716 812 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 828 2756 2752 812 {85EE815A-7738-4808-A14A-3AD87E32A3BF}

C:\Windows\System32\SearchProtocolHost.exe

"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 828 2700 2716 812 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}

C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe

"C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 828 2756 2752 812 {85EE815A-7738-4808-A14A-3AD87E32A3BF}

C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe

"C:\Users\Admin\Desktop\Base-Sniping-Bot-Opensource-main\base_sniper.exe"

Network

Country Destination Domain Proto
GB 184.28.176.106:443 tcp
US 8.8.8.8:53 browser.pipe.aria.microsoft.com udp
IE 20.50.73.11:443 browser.pipe.aria.microsoft.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
NL 23.62.61.194:443 r.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp

Files

memory/4784-0-0x000001770F140000-0x000001770F150000-memory.dmp

memory/4784-16-0x000001770F240000-0x000001770F250000-memory.dmp

memory/4784-32-0x0000017713930000-0x0000017713938000-memory.dmp

memory/3960-36-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-37-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-38-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-41-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-40-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-39-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-42-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-43-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-51-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-50-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-49-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-48-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-47-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-46-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-45-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-44-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-52-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-53-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-54-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-57-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-56-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-55-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-66-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-65-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-64-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-63-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-62-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-61-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-60-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-59-0x0000023307450000-0x0000023307460000-memory.dmp

memory/3960-58-0x0000023307450000-0x0000023307460000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\_MEI29322\eth_hash-0.6.0.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

C:\Users\Admin\AppData\Local\Temp\_MEI29322\eth_keys-0.5.0.dist-info\WHEEL

MD5 a227bf38fb17005b3bdb56ccc428b1bb
SHA1 502f95da3089549e19c451737aa262e45c5bc3bc
SHA256 a2241587fe4f9d033413780f762cf4f5608d9b08870cc6867abfde96a0777283
SHA512 a0ba37a0b2f3d4ae1ee2b09bb13ed20912db4e6a009fe9ba9414830ad4fdbf58571e195abbe0d19f5582e2cf958cfb49ffdacd7c5182008699f92a0f5eec6c41

C:\Users\Admin\AppData\Local\Temp\_MEI29322\python312.dll

MD5 550288a078dffc3430c08da888e70810
SHA1 01b1d31f37fb3fd81d893cc5e4a258e976f5884f
SHA256 789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d
SHA512 7244432fc3716f7ef27630d4e8fbc8180a2542aa97a01d44dca260ab43966dd8ac98b6023400b0478a4809aace1a128f1f4d6e544f2e591a5b436fd4c8a9d723

C:\Users\Admin\AppData\Local\Temp\_MEI29322\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

C:\Users\Admin\AppData\Local\Temp\_MEI29322\base_library.zip

MD5 630153ac2b37b16b8c5b0dbb69a3b9d6
SHA1 f901cd701fe081489b45d18157b4a15c83943d9d
SHA256 ec4e6b8e9f6f1f4b525af72d3a6827807c7a81978cb03db5767028ebea283be2
SHA512 7e3a434c8df80d32e66036d831cbd6661641c0898bd0838a07038b460261bf25b72a626def06d0faa692caf64412ca699b1fa7a848fe9d969756e097cba39e41

C:\Users\Admin\AppData\Local\Temp\_MEI29322\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_ctypes.pyd

MD5 2a834c3738742d45c0a06d40221cc588
SHA1 606705a593631d6767467fb38f9300d7cd04ab3e
SHA256 f20dfa748b878751ea1c4fe77a230d65212720652b99c4e5577bce461bbd9089
SHA512 924235a506ce4d635fa7c2b34e5d8e77eff73f963e58e29c6ef89db157bf7bab587678bb2120d09da70594926d82d87dbaa5d247e861e331cf591d45ea19a117

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_bz2.pyd

MD5 59d60a559c23202beb622021af29e8a9
SHA1 a405f23916833f1b882f37bdbba2dd799f93ea32
SHA256 706d4a0c26dd454538926cbb2ff6c64257c3d9bd48c956f7cabd6def36ffd13e
SHA512 2f60e79603cf456b2a14b8254cec75ce8be0a28d55a874d4fb23d92d63bbe781ed823ab0f4d13a23dc60c4df505cbf1dbe1a0a2049b02e4bdec8d374898002b1

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_wmi.pyd

MD5 c1654ebebfeeda425eade8b77ca96de5
SHA1 a4a150f1c810077b6e762f689c657227cc4fd257
SHA256 aa1443a715fbf84a84f39bd89707271fc11a77b597d7324ce86fc5cfa56a63a9
SHA512 21705b991e75efd5e59b8431a3b19ae5fcc38a3e7f137a9d52acd24e7f67d61758e48abc1c9c0d4314fa02010a1886c15ead5bca8dca1b1d4ccbfc3c589d342e

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_socket.pyd

MD5 9c6283cc17f9d86106b706ec4ea77356
SHA1 af4f2f52ce6122f340e5ea1f021f98b1ffd6d5b6
SHA256 5cc62aac52edf87916deb4ebbad9abb58a6a3565b32e7544f672aca305c38027
SHA512 11fd6f570dd78f8ff00be645e47472a96daffa3253e8bd29183bccde3f0746f7e436a106e9a68c57cc05b80a112365441d06cc719d51c906703b428a32c93124

C:\Users\Admin\AppData\Local\Temp\_MEI29322\select.pyd

MD5 8a273f518973801f3c63d92ad726ec03
SHA1 069fc26b9bd0f6ea3f9b3821ad7c812fd94b021f
SHA256 af358285a7450de6e2e5e7ff074f964d6a257fb41d9eb750146e03c7dda503ca
SHA512 7fedae0573ecb3946ede7d0b809a98acad3d4c95d6c531a40e51a31bdb035badc9f416d8aaa26463784ff2c5e7a0cc2c793d62b5fdb2b8e9fad357f93d3a65f8

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_queue.pyd

MD5 f3eca4f0b2c6c17ace348e06042981a4
SHA1 eb694dda8ff2fe4ccae876dc0515a8efec40e20e
SHA256 fb57ee6adf6e7b11451b6920ddd2fb943dcd9561c9eae64fdda27c7ed0bc1b04
SHA512 604593460666045ca48f63d4b14fa250f9c4b9e5c7e228cc9202e7692c125aacb0018b89faa562a4197692a9bc3d2382f9e085b305272ee0a39264a2a0f53b75

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_uuid.pyd

MD5 7a00ff38d376abaaa1394a4080a6305b
SHA1 d43a9e3aa3114e7fc85c851c9791e839b3a0ee13
SHA256 720e9b68c41c8d9157865e4dd243fb1731f627f3af29c43250804a5995a82016
SHA512 ce39452df539eeeff390f260c062a0c902557fda25a7be9a58274675b82b30bddb7737b242e525f7d501db286f4873b901d94e1cd09aa8864f052594f4b34789

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_tkinter.pyd

MD5 a7929fd434e8803dde0951e6aa306d6a
SHA1 b0cb108be0616678d68eb8328c065aa1fd38e563
SHA256 5c400b4bc0367e1eff93955973efb3f85ce5970080bb1953f4e80bdf6f23c5c7
SHA512 b8a83fd831ae393ae7bc23d86af79d224142af41837002883296d62b3fdc059a3794f1bb2ecd7714ca75003bd07cb3fc0617d99ffa3867068bfb3a44bf5cf215

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_ssl.pyd

MD5 ddb21bd1acde4264754c49842de7ebc9
SHA1 80252d0e35568e68ded68242d76f2a5d7e00001e
SHA256 72bb15cd8c14ba008a52d23cdcfc851a9a4bde13deee302a5667c8ad60f94a57
SHA512 464520ecd1587f5cede6219faac2c903ee41d0e920bf3c9c270a544b040169dcd17a4e27f6826f480d4021077ab39a6cbbd35ebb3d71672ebb412023bc9e182a

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_overlapped.pyd

MD5 61193e813a61a545e2d366439c1ee22a
SHA1 f404447b0d9bff49a7431c41653633c501986d60
SHA256 c21b50a7bf9dbe1a0768f5030cac378d58705a9fe1f08d953129332beb0fbefc
SHA512 747e4d5ea1bdf8c1e808579498834e1c24641d434546bffdfcf326e0de8d5814504623a3d3729168b0098824c2b8929afc339674b0d923388b9dac66f5d9d996

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_multiprocessing.pyd

MD5 4ccbd87d76af221f24221530f5f035d1
SHA1 d02b989aaac7657e8b3a70a6ee7758a0b258851b
SHA256 c7bbcfe2511fd1b71b916a22ad6537d60948ffa7bde207fefabee84ef53cafb5
SHA512 34d808adac96a66ca434d209f2f151a9640b359b8419dc51ba24477e485685af10c4596a398a85269e8f03f0fc533645907d7d854733750a35bf6c691de37799

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_hashlib.pyd

MD5 b0262bd89a59a3699bfa75c4dcc3ee06
SHA1 eb658849c646a26572dea7f6bfc042cb62fb49dc
SHA256 4adfbbd6366d9b55d902fc54d2b42e7c8c989a83016ed707bd7a302fc3fc7b67
SHA512 2e4b214de3b306e3a16124af434ff8f5ab832aa3eeb1aa0aa9b49b0ada0928dcbb05c57909292fbe3b01126f4cd3fe0dac9cc15eaea5f3844d6e267865b9f7b1

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_decimal.pyd

MD5 f930b7550574446a015bc602d59b0948
SHA1 4ee6ff8019c6c540525bdd2790fc76385cdd6186
SHA256 3b9ad1d2bc9ec03d37da86135853dac73b3fe851b164fe52265564a81eb8c544
SHA512 10b864975945d6504433554f9ff11b47218caa00f809c6bce00f9e4089b862190a4219f659697a4ba5e5c21edbe1d8d325950921e09371acc4410469bd9189ee

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_cffi_backend.cp312-win_amd64.pyd

MD5 0572b13646141d0b1a5718e35549577c
SHA1 eeb40363c1f456c1c612d3c7e4923210eae4cdf7
SHA256 d8a76d1e31bbd62a482dea9115fc1a109cb39af4cf6d1323409175f3c93113a7
SHA512 67c28432ca8b389acc26e47eb8c4977fddd4af9214819f89df07fecbc8ed750d5f35807a1b195508dd1d77e2a7a9d7265049dcfbfe7665a7fd1ba45da1e4e842

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_asyncio.pyd

MD5 209cbcb4e1a16aa39466a6119322343c
SHA1 cdcce6b64ebf11fecff739cbc57e7a98d6620801
SHA256 f7069734d5174f54e89b88d717133bff6a41b01e57f79957ab3f02daa583f9e2
SHA512 5bbc4ede01729e628260cf39df5809624eae795fd7d51a1ed770ed54663955674593a97b78f66dbf6ae268186273840806ed06d6f7877444d32fdca031a9f0da

C:\Users\Admin\AppData\Local\Temp\_MEI29322\zlib1.dll

MD5 b4a0b3d5abc631e95c074eee44e73f96
SHA1 c22c8baa23d731a0e08757d0449ca3dd662fd9e6
SHA256 c89c8a2fcf11d8191c7690027055431906aae827fc7f443f0908ad062e7e653e
SHA512 56bafd1c6c77343f724a8430a1f496b4a3160faa9a19ea40796438ae67d6c45f8a13224dcf3d1defb97140a2e47a248dd837801a8cb4674e7890b495aeec538e

C:\Users\Admin\AppData\Local\Temp\_MEI29322\VCRUNTIME140_1.dll

MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

C:\Users\Admin\AppData\Local\Temp\_MEI29322\unicodedata.pyd

MD5 04f35d7eec1f6b72bab9daf330fd0d6b
SHA1 ecf0c25ba7adf7624109e2720f2b5930cd2dba65
SHA256 be942308d99cc954931fe6f48ed8cc7a57891ccbe99aae728121bcda1fd929ab
SHA512 3da405e4c1371f4b265e744229dcc149491a112a2b7ea8e518d5945f8c259cad15583f25592b35ec8a344e43007ae00da9673822635ee734d32664f65c9c8d9b

C:\Users\Admin\AppData\Local\Temp\_MEI29322\tk86t.dll

MD5 ef0d7469a88afb64944e2b2d91eb3e7f
SHA1 a26fd3de8da3e4aec417cebfa2de78f9ba7cf05b
SHA256 23a195e1e3922215148e1e09a249b4fe017a73b3564af90b0f6fd4d9e5dda4da
SHA512 909f0b73b64bad84b896a973b58735747d87b5133207cb3d9fa9ce0c026ee59255b7660c43bb86b1ddeef9fbb80b2250719fd379cff7afd9dbec6f6a007ed093

C:\Users\Admin\AppData\Local\Temp\_MEI29322\tcl86t.dll

MD5 b0261de5ef4879a442abdcd03dedfa3c
SHA1 7f13684ff91fcd60b4712f6cf9e46eb08e57c145
SHA256 28b61545d3a53460f41c20dacf0e0df2ba687a5c85f9ed5c34dbfc7ed2f23e3e
SHA512 e39a242e321e92761256b2b4bdde7f9d880b5c64d4778b87fa98bf4ac93a0248e408a332ae214b7ffd76fb9d219555dc10ab8327806d8d63309bf6d147ebbd59

C:\Users\Admin\AppData\Local\Temp\_MEI29322\pyexpat.pyd

MD5 f179c9bdd86a2a218a5bf9f0f1cf6cd9
SHA1 4544fb23d56cc76338e7f71f12f58c5fe89d0d76
SHA256 c42874e2cf034fb5034f0be35f7592b8a96e8903218da42e6650c504a85b37cc
SHA512 3464ece5c6a0e95ef6136897b70a96c69e552d28bfedd266f13eec840e36ec2286a1fb8973b212317de6fe3e93d7d7cc782eb6fc3d6a2a8f006b34f6443498de

C:\Users\Admin\AppData\Local\Temp\_MEI29322\lru.cp312-win_amd64.pyd

MD5 f8a9a318c19e05731691da3be73e1390
SHA1 e5e2a2493ac6a4231aa6ad75a1a7ff7d908767e3
SHA256 a7bff5ada7ad241873b58c353428cc091a80d6bef39fbe2f784a21259b615224
SHA512 86396989ce9e7aed6927a69e0eaf864fdbf77173acd6443460d060ae0595e57c55eacbdcd53ac1c0eec48c18393b96ccf7f875f29a4a4a40e238736250b74716

C:\Users\Admin\AppData\Local\Temp\_MEI29322\libssl-3.dll

MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

C:\Users\Admin\AppData\Local\Temp\_MEI29322\libcrypto-3.dll

MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

C:\Users\Admin\AppData\Local\Temp\_MEI29322\_lzma.pyd

MD5 b71dbe0f137ffbda6c3a89d5bcbf1017
SHA1 a2e2bdc40fdb83cc625c5b5e8a336ca3f0c29c5f
SHA256 6216173194b29875e84963cd4dc4752f7ca9493f5b1fd7e4130ca0e411c8ac6a
SHA512 9a5c7b1e25d8e1b5738f01aedfd468c1837f1ac8dd4a5b1d24ce86dcae0db1c5b20f2ff4280960bc523aee70b71db54fd515047cdaf10d21a8bec3ebd6663358

C:\Users\Admin\AppData\Local\Temp\_MEI29322\python3.dll

MD5 6271a2fe61978ca93e60588b6b63deb2
SHA1 be26455750789083865fe91e2b7a1ba1b457efb8
SHA256 a59487ea2c8723277f4579067248836b216a801c2152efb19afee4ac9785d6fb
SHA512 8c32bcb500a94ff47f5ef476ae65d3b677938ebee26e80350f28604aaee20b044a5d55442e94a11ccd9962f34d22610b932ac9d328197cf4d2ffbc7df640efba

C:\Users\Admin\AppData\Local\Temp\_MEI29322\cytoolz\functoolz.cp312-win_amd64.pyd

MD5 eee2ff12b42f70b0253223cf1b11cc06
SHA1 5e3ca9600455a68934cdac437d02f87603694570
SHA256 cacedcb9d32d1f447ccaf2d116497840e6e8a75d041a1b068739b3a627baf547
SHA512 a3cd63f4b173b6d0cc7fa59337af4c06e095a58ace0b338c86cb23a28fa38cb1d10451143fda4e872ced906093c7302b6543f5b2b8900eebd5b5fc3117b1d591

C:\Users\Admin\AppData\Local\Temp\_MEI29322\cytoolz\utils.cp312-win_amd64.pyd

MD5 c122e19db7d1aea5b4e4ef3c61266d6f
SHA1 436602b30dda3a3f0d8ef15267e22a408ba400bd
SHA256 b529b6b9899cec10384fc85bf13d919607be8bcb058e77089524894d2b00399f
SHA512 f23a2f8081441c10c33a2530986fb45317f8efbca0b19f3b7b16f39c4c67596b69325c7d82fbbd4db596863f76b655e8dd4e9ffe69676c5703874f868194848b

C:\Users\Admin\AppData\Local\Temp\_MEI29322\cytoolz\itertoolz.cp312-win_amd64.pyd

MD5 54ac87e2e0bdf41da1a8909d2de4c4fd
SHA1 204e7b2152958727200f9f4fd6c39b05f2a97517
SHA256 e80d0e6ca25df92336bf3c1a175ce948ae1c9066a804e2f1f4df3af4c7f5e037
SHA512 3584ca43ab7e8b9ea23beaa1cf525744ab4818d628b88392f2b7a8d410be8915d62a018d4e3801727b3b7bd49d16bfd96cdd62a7df99a5b9b0689ef3420b2a8b

C:\Users\Admin\AppData\Local\Temp\_MEI29322\tcl\encoding\cp1252.enc

MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52

C:\Users\Admin\AppData\Local\Temp\_MEI29322\cytoolz\recipes.cp312-win_amd64.pyd

MD5 1ef9b46344c97f2ea149e185c529c81e
SHA1 59df25e7c803d4a15428fe851eef917f0d505890
SHA256 a5ad55fc5154399662f60ccd1669dd5971a94ec65ea7fc3115e539b237c55cda
SHA512 67c608abc9eeab5c91687cb88eaee99c23fed33b8d284227ef32f6d0aba0eca5649091ed97778b6f9284a86628cd735ac973b4b5fae24b8c82b31801835b8b8b

C:\Users\Admin\AppData\Local\Temp\_MEI29322\cytoolz\dicttoolz.cp312-win_amd64.pyd

MD5 5c62ad5c5da81f490b0b954ff8616c78
SHA1 ca2fb16cf840f579dd3db3d72540caa5b0eacb26
SHA256 bb1b3a4f30adc135bacaa51ba378b40333c70763bc8f1958cf125260453d95e2
SHA512 1bae404fed8451512df22ceee314c5844df6a62e3d4ab9b2b230ec90f6259ffb15a9b6d9e0c9b1e0048e9cbe34753beb7cac9f4e912c67282b9324ddfe421955