Malware Analysis Report

2024-09-11 09:18

Sample ID 240618-w6cwyaycjl
Target Desktop.exe
SHA256 6f72152cb1615a64f0e8c49ba8f49dea012dbad0badd521eeda3290c6959fd84
Tags
discordrat exelastealer defense_evasion evasion persistence privilege_escalation pyinstaller rat rootkit spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6f72152cb1615a64f0e8c49ba8f49dea012dbad0badd521eeda3290c6959fd84

Threat Level: Known bad

The file Desktop.exe was found to be: Known bad.

Malicious Activity Summary

discordrat exelastealer defense_evasion evasion persistence privilege_escalation pyinstaller rat rootkit spyware stealer upx

Discord RAT

Exela Stealer

Grants admin privileges

Modifies Windows Firewall

UPX packed file

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Hide Artifacts: Hidden Files and Directories

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Detects Pyinstaller

Event Triggered Execution: Netsh Helper DLL

Views/modifies file attributes

Gathers system information

Gathers network information

Collects information from the system

Enumerates processes with tasklist

Suspicious use of AdjustPrivilegeToken

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Detects videocard installed

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Account Manipulation
T1098
Create or Modify System Process
T1543
Windows Service
T1543.003
Event Triggered Execution
T1546
Netsh Helper DLL
T1546.007
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Event Triggered Execution
T1546
Netsh Helper DLL
T1546.007
Defense Evasion
TA0005
Impair Defenses
T1562
Disable or Modify System Firewall
T1562.004
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Process Discovery
T1057
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-18 18:31

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 18:31

Reported

2024-06-18 18:32

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

53s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Desktop.exe"

Signatures

Discord RAT

stealer rootkit rat persistence discordrat

Exela Stealer

stealer exelastealer

Grants admin privileges

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Desktop.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Collects information from the system

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1608 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\Desktop.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe
PID 1608 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\Desktop.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe
PID 4388 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe
PID 4388 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe
PID 4120 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 424 wrote to memory of 4796 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 424 wrote to memory of 4796 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4408 wrote to memory of 1256 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4408 wrote to memory of 1256 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4076 wrote to memory of 4300 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4076 wrote to memory of 4300 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4120 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4012 wrote to memory of 1612 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4012 wrote to memory of 1612 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4120 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4580 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4580 wrote to memory of 2196 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4956 wrote to memory of 3204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4956 wrote to memory of 3204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4120 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 2680 wrote to memory of 4336 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2680 wrote to memory of 4336 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4120 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 776 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4620 wrote to memory of 776 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4120 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 2280 wrote to memory of 3800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2280 wrote to memory of 3800 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4868 wrote to memory of 1640 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4868 wrote to memory of 1640 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3220 wrote to memory of 4692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3220 wrote to memory of 4692 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4692 wrote to memory of 1356 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4692 wrote to memory of 1356 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4492 wrote to memory of 1036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4492 wrote to memory of 1036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1036 wrote to memory of 4084 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 1036 wrote to memory of 4084 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4120 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe
PID 4120 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe C:\Windows\system32\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Desktop.exe

"C:\Users\Admin\AppData\Local\Temp\Desktop.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "gdb --version"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get Manufacturer

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"

C:\Windows\System32\Wbem\WMIC.exe

wmic path Win32_ComputerSystem get Manufacturer

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Get-Clipboard

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\HOSTNAME.EXE

hostname

C:\Windows\System32\Wbem\WMIC.exe

wmic logicaldisk get caption,description,providername

C:\Windows\system32\net.exe

net user

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user

C:\Windows\system32\query.exe

query user

C:\Windows\system32\quser.exe

"C:\Windows\system32\quser.exe"

C:\Windows\system32\net.exe

net localgroup

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup

C:\Windows\system32\net.exe

net localgroup administrators

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup administrators

C:\Windows\system32\net.exe

net user guest

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user guest

C:\Windows\system32\net.exe

net user administrator

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user administrator

C:\Windows\System32\Wbem\WMIC.exe

wmic startup get caption,command

C:\Windows\system32\tasklist.exe

tasklist /svc

C:\Windows\system32\ipconfig.exe

ipconfig /all

C:\Windows\system32\ROUTE.EXE

route print

C:\Windows\system32\ARP.EXE

arp -a

C:\Windows\system32\NETSTAT.EXE

netstat -ano

C:\Windows\system32\sc.exe

sc query type= service state= all

C:\Windows\system32\netsh.exe

netsh firewall show state

C:\Windows\system32\netsh.exe

netsh firewall show config

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"

Network

Country Destination Domain Proto
N/A 127.0.0.1:51821 tcp
US 8.8.8.8:53 ip-api.com udp
N/A 127.0.0.1:51830 tcp
N/A 127.0.0.1:51835 tcp
N/A 127.0.0.1:51838 tcp
N/A 127.0.0.1:51840 tcp
US 8.8.8.8:53 discord.com udp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe

MD5 a32eb4180ec6957a17eea6fcdc81cbb7
SHA1 d0fd7e6268ba3042f13d5bf1ad0ae633f804cf57
SHA256 044dca6bd58750a5e419054c894494034c71d8d510558d6e1de427c9ff9dc316
SHA512 a4ed51aacd3a1c84257325e65691401e6a86cffb9d91892ab1af02729f6202bd702522a32c9141648c73b120f4bad5fbdda0a1789db31fa1828fb8bd7314d685

C:\Users\Admin\AppData\Local\Temp\_MEI43882\python310.dll

MD5 fc7bd515b12e537a39dc93a09b3eaad6
SHA1 96f5d4b0967372553cb106539c5566bc184f6167
SHA256 461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164
SHA512 a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

C:\Users\Admin\AppData\Local\Temp\_MEI43882\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

memory/4120-65-0x00007FFBF8410000-0x00007FFBF887E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43882\python3.dll

MD5 c17b7a4b853827f538576f4c3521c653
SHA1 6115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256 d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA512 8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

C:\Users\Admin\AppData\Local\Temp\_MEI43882\_ctypes.pyd

MD5 4b90108fabdd64577a84313c765a2946
SHA1 245f4628683a3e18bb6f0d1c88aa26fb959ed258
SHA256 e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1
SHA512 91fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc

C:\Users\Admin\AppData\Local\Temp\_MEI43882\base_library.zip

MD5 22fee1506d933abb3335ffb4a1e1d230
SHA1 18331cba91f33fb6b11c6fdefa031706ae6d43a0
SHA256 03f6a37fc2e166e99ce0ad8916dfb8a70945e089f9fc09b88e60a1649441ab6e
SHA512 3f764337a3fd4f8271cba9602aef0663d6b7c37a021389395a00d39bd305d2b927a150c2627b1c629fdbd41c044af0f7bc9897f84c348c2bccc085df911eee02

C:\Users\Admin\AppData\Local\Temp\_MEI43882\_sqlite3.pyd

MD5 e7d68df8f65fbb0298a45519e2336f32
SHA1 ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d
SHA256 2473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79
SHA512 626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e

C:\Users\Admin\AppData\Local\Temp\_MEI43882\sqlite3.dll

MD5 6a3a34c9c67efd6c17d44292e8db8fad
SHA1 339b1e514d60d8370eaec1e2f2b71cead999f970
SHA256 7b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9
SHA512 6f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5

C:\Users\Admin\AppData\Local\Temp\_MEI43882\libcrypto-1_1.dll

MD5 86cfc84f8407ab1be6cc64a9702882ef
SHA1 86f3c502ed64df2a5e10b085103c2ffc9e3a4130
SHA256 11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307
SHA512 b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

memory/4120-105-0x00007FFC07780000-0x00007FFC0779F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43882\libssl-1_1.dll

MD5 6cd33578bc5629930329ca3303f0fae1
SHA1 f2f8e3248a72f98d27f0cfa0010e32175a18487f
SHA256 4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0
SHA512 c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

memory/4120-108-0x00007FFC07750000-0x00007FFC0777E000-memory.dmp

memory/4120-107-0x00007FFBF80D0000-0x00007FFBF8241000-memory.dmp

memory/4120-114-0x000001EB55890000-0x000001EB55C05000-memory.dmp

memory/4120-113-0x00007FFBF7D50000-0x00007FFBF80C5000-memory.dmp

memory/4120-112-0x00007FFC06F60000-0x00007FFC07018000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43882\_ssl.pyd

MD5 7e9d95ac47a2284706318656b4f711d3
SHA1 f085104709201c6e64635aeacf1da51599054e55
SHA256 38dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9
SHA512 294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118

memory/4120-104-0x00007FFC077A0000-0x00007FFC077CD000-memory.dmp

memory/4120-103-0x00007FFC07C20000-0x00007FFC07C39000-memory.dmp

memory/4120-102-0x00007FFC0B550000-0x00007FFC0B55D000-memory.dmp

memory/4120-101-0x00007FFC07C40000-0x00007FFC07C59000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43882\_lzma.pyd

MD5 8edbeeccb6f3dbb09389d99d45db5542
SHA1 f7e7af2851a5bf22de79a24fe594b5c0435fca8a
SHA256 90701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f
SHA512 2a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501

C:\Users\Admin\AppData\Local\Temp\_MEI43882\_bz2.pyd

MD5 6250a28b9d0bfefc1254bd78ece7ae9f
SHA1 4b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd
SHA256 7d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b
SHA512 6d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7

C:\Users\Admin\AppData\Local\Temp\_MEI43882\select.pyd

MD5 3797a47a60b606e25348c67043874fe8
SHA1 63a33fedffd52190236a6acd0fc5d9d491e3ac45
SHA256 312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac
SHA512 3eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2

C:\Users\Admin\AppData\Local\Temp\_MEI43882\_socket.pyd

MD5 53e72716073038c1dd1db65bfdb1254c
SHA1 7bf220a02a3b51aa51300b3a9ea7fa48358ca161
SHA256 e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d
SHA512 c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941

memory/4120-94-0x00007FFC0D610000-0x00007FFC0D61F000-memory.dmp

memory/4120-93-0x00007FFC09620000-0x00007FFC09644000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43882\_uuid.pyd

MD5 59cfd9669367517b384922b2485cb6a7
SHA1 1bd44298543204d61d4efd2cd3980ad01071360d
SHA256 e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f
SHA512 d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665

C:\Users\Admin\AppData\Local\Temp\_MEI43882\_queue.pyd

MD5 5c4c43763fb1a796134aa5734905c891
SHA1 44a5e1ae4806406a239129d77888bd87d291a410
SHA256 4edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c
SHA512 07bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e

C:\Users\Admin\AppData\Local\Temp\_MEI43882\_overlapped.pyd

MD5 5c1441f6ee11632183a83dac2d22853b
SHA1 eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2
SHA256 104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf
SHA512 e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595

C:\Users\Admin\AppData\Local\Temp\_MEI43882\_multiprocessing.pyd

MD5 4fbc5fd5da9da74c04fe0374387b34d3
SHA1 1e9c98db0486f98fb7d8eb9fa57a949494b649b5
SHA256 b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950
SHA512 ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a

C:\Users\Admin\AppData\Local\Temp\_MEI43882\_hashlib.pyd

MD5 3b5530f497ff7c127383d0029e680c35
SHA1 fb5dc554bb9ff49622184cc16883a7567115c7ca
SHA256 5971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573
SHA512 12ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a

C:\Users\Admin\AppData\Local\Temp\_MEI43882\_decimal.pyd

MD5 20985dc78dbd1992382354af5ca28988
SHA1 385a3e7a7654e5e4c686399f3a72b235e941e311
SHA256 f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43
SHA512 61b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8

C:\Users\Admin\AppData\Local\Temp\_MEI43882\_cffi_backend.cp310-win_amd64.pyd

MD5 641e49ce0c4fa963d347fbf915aabdbe
SHA1 1351f6c4ac5dcda7e3ffbf3d5e355b4bb864eb10
SHA256 1c795df278c7f64be8e6973f8dbf1a625997cb39ae2dcb5bee0ca4c1b90c8906
SHA512 766b9adb5143e89d663177c2fb0e951afb84c0a43ec690ae2c477ee0bbe036df6f4161a6012430d42e4913fd5fbe7e49af6d13ac7c62d042a484861fc5a04616

C:\Users\Admin\AppData\Local\Temp\_MEI43882\_asyncio.pyd

MD5 7d4f9a2b793e021f7e37b8448751ed4e
SHA1 0ea07b5024501aad5008655cfeae6d96b5da957a
SHA256 2293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4
SHA512 af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26

C:\Users\Admin\AppData\Local\Temp\_MEI43882\unicodedata.pyd

MD5 fed35db31377d515d198e5e446498be2
SHA1 62e388d17e17208ea0e881ccd96c75b7b1fbc5f7
SHA256 af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b
SHA512 0985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a

C:\Users\Admin\AppData\Local\Temp\_MEI43882\pyexpat.pyd

MD5 46331749084f98bcfe8631d74c5e038f
SHA1 5e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347
SHA256 21cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df
SHA512 edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589

C:\Users\Admin\AppData\Local\Temp\_MEI43882\libffi-7.dll

MD5 d50ebf567149ead9d88933561cb87d09
SHA1 171df40e4187ebbfdf9aa1d76a33f769fb8a35ed
SHA256 6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af
SHA512 7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de

C:\Users\Admin\AppData\Local\Temp\_MEI43882\multidict\_multidict.cp310-win_amd64.pyd

MD5 58a0ff76a0d7d3cd86ceb599d247c612
SHA1 af52bdb9556ef4b9d38cf0f0b9283494daa556a6
SHA256 2079d8be068f67fb2ece4fb3f5927c91c1c25edecb9d1c480829eb1cd21d7cc5
SHA512 e2d4f80cdeba2f5749a4d3de542e09866055d8aee1d308b96cb61bc53f4495c781e9b2559cc6a5f160be96b307539a8b6e06cabeffcc0ddb9ad4107dcacd8a76

memory/4120-118-0x00007FFC0B4E0000-0x00007FFC0B4F0000-memory.dmp

memory/4120-117-0x00007FFC07730000-0x00007FFC07745000-memory.dmp

memory/4120-122-0x00007FFC07710000-0x00007FFC07724000-memory.dmp

memory/4120-123-0x00007FFC07690000-0x00007FFC076A4000-memory.dmp

memory/4120-125-0x00007FFBF7C30000-0x00007FFBF7D48000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43882\yarl\_quoting_c.cp310-win_amd64.pyd

MD5 c14493cd3cc9b9b5f850b5fadcbe936e
SHA1 eddb260ff89bfa132a479fdf783c67098011fb85
SHA256 1782f3c12b3eb01716fcd59b0cd69c02c2fb888db4377f4d5fe00f07986be8e3
SHA512 0a7b85322b8fa566fb3d24b8e4021fb64433be06c3c4dbeb06d9633e4af0a5b76252fb2228de0abd818be5f4a18fffc712c727816632dd8c8585c9a9a7bf0fb6

memory/4120-128-0x00007FFC07660000-0x00007FFC07682000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43882\aiohttp\_helpers.cp310-win_amd64.pyd

MD5 9957581b89a8a0c1fa8f10ed03faf862
SHA1 8a38fede27a2990d5ce9aa1e3664aa5617da1f32
SHA256 fbb576e7c8b4a96fa41dc629a336650a4362e61092423e977596c266dc23983f
SHA512 195566707019c8efdd8a11ebf3dfe30cf67f6d62cb2ca103d98a4ffca8574cc5df6d83b78ad891f369ea4318d1e7fc9466b1c17fb9cfea61a16960e9a2b26dcd

C:\Users\Admin\AppData\Local\Temp\_MEI43882\aiohttp\_http_writer.cp310-win_amd64.pyd

MD5 29e8136c3e5f76cad4920b6af598a750
SHA1 04150e81d15700592654999e18a9ab956c5694fb
SHA256 efbac999cb548957e7fe424b15a4edc98a8544689b87cd8159f26dc25224d83c
SHA512 e7fe7ba7e457321bcdb226202fcaffe0cb95582354a592240d3b776b9f5663a94e38f9cf4f450102a5423fb0d238a0cb02e44c49dcddad45dbcbb9b714541827

memory/4120-135-0x00007FFBF8410000-0x00007FFBF887E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43882\aiohttp\_websocket.cp310-win_amd64.pyd

MD5 af4bb56d74abb4de5f9fb4b91e16a017
SHA1 f83fa1b0c60afd5f6ab5be9e456cc6670b99361c
SHA256 5ecc8c1abf0dd9bb2449001ada615661923cf33e61dec1afbbc25bb1a353b3a4
SHA512 e3d9b4f61486e1aa0da84cdc7d3f065ee247d67e08da2392cbbbce4fbafb3e026f65c9a2a024423ea853d9f6a22b7c8ee64e4c433a1633ea7250c88fcb4b0603

C:\Users\Admin\AppData\Local\Temp\_MEI43882\frozenlist\_frozenlist.cp310-win_amd64.pyd

MD5 6106b4d1eec11d2a71def28d2a2afa46
SHA1 e10039eff42f88a2cd8dfe11d428c35f6178c6ce
SHA256 19b144f1bfeb38f5a88da4471d0e9eeefcee979e0d574ecf13a28d06bdf7f1da
SHA512 d08ba0cf57d533ce2df7027158329da66518fb1bf10220d836ce39bdf8bc0436dfc3a649cf937b3b3e2bb9ff0d3c9e964416e9ac965cff4b24bd203067f53d43

memory/4120-144-0x00007FFC09610000-0x00007FFC0961A000-memory.dmp

memory/4120-143-0x00007FFC06F10000-0x00007FFC06F59000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43882\cryptography\hazmat\bindings\_rust.pyd

MD5 001536e476bf36e77c61e5e60d96ea76
SHA1 79f4768cf796262febd62f7d9d3d510f6c9d816f
SHA256 364c6887349315afe5343bb2613002cd2b860af427a76aeceab591272b6f50a5
SHA512 948141c8eee69e20f3497520fcdd2836aab6d01a16a9639aef0869795ca454b684bec79a77bf1c16da2a339ee4adaf56ac6c839c15b5e4ef912d5d94edb83a90

memory/4120-141-0x00007FFC07640000-0x00007FFC07657000-memory.dmp

memory/4120-148-0x00007FFC07090000-0x00007FFC070AE000-memory.dmp

memory/4120-149-0x00007FFBF7530000-0x00007FFBF7C24000-memory.dmp

memory/4120-147-0x00007FFC07560000-0x00007FFC07571000-memory.dmp

memory/4120-146-0x00007FFC07C40000-0x00007FFC07C59000-memory.dmp

memory/4120-145-0x00007FFC07620000-0x00007FFC07639000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43882\aiohttp\_http_parser.cp310-win_amd64.pyd

MD5 4c47cc586ff34eb1e8ff5304de05cbfa
SHA1 dea8568ac69a6d75a2ed0cb96228f113ed55f364
SHA256 5a1f5f3b5c813c03821377b5ba3c5b3139de8a69415736fb2d8a022ef7160b30
SHA512 41a90bec5258047e10ced50195abae182f560fd118742e86a340eda54ae3ff4f031805763366a7c4e7e0944669691271432b9b3edc0cdb3f2851d27bee5608c4

memory/4120-150-0x00007FFC07750000-0x00007FFC0777E000-memory.dmp

memory/4120-151-0x00007FFC06DF0000-0x00007FFC06E28000-memory.dmp

memory/4120-199-0x00007FFC06F60000-0x00007FFC07018000-memory.dmp

memory/4120-202-0x00007FFC07E40000-0x00007FFC07E4D000-memory.dmp

memory/4120-201-0x000001EB55890000-0x000001EB55C05000-memory.dmp

memory/4120-200-0x00007FFBF7D50000-0x00007FFBF80C5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0dxhtps5.22b.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1640-212-0x0000016365C30000-0x0000016365C52000-memory.dmp

memory/4120-219-0x00007FFC07730000-0x00007FFC07745000-memory.dmp

memory/4120-220-0x00007FFC0B4E0000-0x00007FFC0B4F0000-memory.dmp

memory/4120-249-0x00007FFBF7C30000-0x00007FFBF7D48000-memory.dmp

memory/4120-246-0x00007FFBF7530000-0x00007FFBF7C24000-memory.dmp

memory/4120-239-0x00007FFC07660000-0x00007FFC07682000-memory.dmp

memory/4120-234-0x00007FFC07730000-0x00007FFC07745000-memory.dmp

memory/4120-230-0x00007FFBF80D0000-0x00007FFBF8241000-memory.dmp

memory/4120-229-0x00007FFC07780000-0x00007FFC0779F000-memory.dmp

memory/4120-223-0x00007FFC09620000-0x00007FFC09644000-memory.dmp

memory/4120-247-0x00007FFC06DF0000-0x00007FFC06E28000-memory.dmp

memory/4120-222-0x00007FFBF8410000-0x00007FFBF887E000-memory.dmp

memory/4120-270-0x00007FFC07730000-0x00007FFC07745000-memory.dmp

memory/4120-268-0x00007FFC06F60000-0x00007FFC07018000-memory.dmp

memory/4120-275-0x00007FFC07660000-0x00007FFC07682000-memory.dmp

memory/4120-269-0x00007FFBF7D50000-0x00007FFBF80C5000-memory.dmp

memory/4120-267-0x00007FFC07750000-0x00007FFC0777E000-memory.dmp

memory/4120-258-0x00007FFBF8410000-0x00007FFBF887E000-memory.dmp

memory/4120-372-0x00007FFC077A0000-0x00007FFC077CD000-memory.dmp

memory/4120-371-0x00007FFC07C20000-0x00007FFC07C39000-memory.dmp

memory/4120-370-0x00007FFC0B550000-0x00007FFC0B55D000-memory.dmp

memory/4120-369-0x00007FFC0B4E0000-0x00007FFC0B4F0000-memory.dmp

memory/4120-368-0x00007FFC0D610000-0x00007FFC0D61F000-memory.dmp

memory/4120-367-0x00007FFC09620000-0x00007FFC09644000-memory.dmp

memory/4120-377-0x00007FFBF7D50000-0x00007FFBF80C5000-memory.dmp

memory/4120-382-0x00007FFC07090000-0x00007FFC070AE000-memory.dmp

memory/4120-385-0x00007FFC06F10000-0x00007FFC06F59000-memory.dmp

memory/4120-392-0x00007FFC07E40000-0x00007FFC07E4D000-memory.dmp

memory/4120-391-0x00007FFC06DF0000-0x00007FFC06E28000-memory.dmp

memory/4120-390-0x00007FFC07620000-0x00007FFC07639000-memory.dmp

memory/4120-389-0x00007FFBF7C30000-0x00007FFBF7D48000-memory.dmp

memory/4120-388-0x00007FFC07710000-0x00007FFC07724000-memory.dmp

memory/4120-387-0x00007FFC09610000-0x00007FFC0961A000-memory.dmp

memory/4120-386-0x00007FFBF8410000-0x00007FFBF887E000-memory.dmp

memory/4120-384-0x00007FFC07640000-0x00007FFC07657000-memory.dmp

memory/4120-383-0x00007FFC07660000-0x00007FFC07682000-memory.dmp

memory/4120-381-0x00007FFC07690000-0x00007FFC076A4000-memory.dmp

memory/4120-380-0x00007FFC07560000-0x00007FFC07571000-memory.dmp

memory/4120-379-0x00007FFC07C40000-0x00007FFC07C59000-memory.dmp

memory/4120-378-0x00007FFC07730000-0x00007FFC07745000-memory.dmp

memory/4120-376-0x00007FFC06F60000-0x00007FFC07018000-memory.dmp

memory/4120-375-0x00007FFBF80D0000-0x00007FFBF8241000-memory.dmp

memory/4120-374-0x00007FFC07750000-0x00007FFC0777E000-memory.dmp

memory/4120-373-0x00007FFC07780000-0x00007FFC0779F000-memory.dmp

memory/4120-366-0x00007FFBF7530000-0x00007FFBF7C24000-memory.dmp

memory/4952-393-0x000001D606460000-0x000001D606478000-memory.dmp

memory/4952-394-0x000001D620A40000-0x000001D620C02000-memory.dmp