Overview

overview

10

Static

static

3

0b28556b7f...c7.exe

windows7-x64

10

0b28556b7f...c7.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-08-2024 20:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0b28556b7f1d6627f4943e6f09dc5af5674975e657dcde51f7907fbefe72efc7.exe

  • Size

    1.7MB

  • MD5

    38f86bb61ab58b0dc009fec84341cbbd

  • SHA1

    1649d9657dee781fd123baa8bd933314934c05b0

  • SHA256

    0b28556b7f1d6627f4943e6f09dc5af5674975e657dcde51f7907fbefe72efc7

  • SHA512

    c63f441b1035670aff8f880390629b0c5663f149e1642844e44499af835127d59488d188435d7207490515db17abc646daa5662b579cfc6346b681e541397102

  • SSDEEP

    49152:pcQzbKVxK+fUQTqE+3cDUbgjXFeXpBIy:pcQ/KVxyg+3MUmFJy

Score
10/10
amadeylummamonsterxwormfed3aadiscoveryevasionexecutionpersistenceratstealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

xworm

C2

127.0.0.1:7000

beshomandotestbesnd.run.place:7000
Attributes
  • Install_directory

    %Userprofile%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Extracted

Family

lumma

C2

https://deicedosmzj.shop/api

https://potentioallykeos.shop/api

https://interactiedovspm.shop/api

https://charecteristicdxp.shop/api

https://cagedwifedsozm.shop/api

https://southedhiscuso.shop/api

https://consciousourwi.shop/api

https://tenntysjuxmz.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect Xworm Payload 2 IoCs
  • Detects Monster Stealer. 2 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Monster

    Monster is a Golang stealer that was discovered in 2024.

    stealermonster
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 11 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 32 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b28556b7f1d6627f4943e6f09dc5af5674975e657dcde51f7907fbefe72efc7.exe
    "C:\Users\Admin\AppData\Local\Temp\0b28556b7f1d6627f4943e6f09dc5af5674975e657dcde51f7907fbefe72efc7.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3784
      • C:\Users\Admin\AppData\Local\Temp\1000169001\explorer.exe
        "C:\Users\Admin\AppData\Local\Temp\1000169001\explorer.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4616
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1000169001\explorer.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2316
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:552
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\explorer'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2732
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3980
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\explorer"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4608
      • C:\Users\Admin\AppData\Local\Temp\1000170001\LummaC22222.exe
        "C:\Users\Admin\AppData\Local\Temp\1000170001\LummaC22222.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2356
      • C:\Users\Admin\AppData\Local\Temp\1000174001\5PHCENYBS068Y01.exe
        "C:\Users\Admin\AppData\Local\Temp\1000174001\5PHCENYBS068Y01.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1380
        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\stub.exe
          C:\Users\Admin\AppData\Local\Temp\1000174001\5PHCENYBS068Y01.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:5072
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            5⤵
              PID:2224
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1348
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic path win32_VideoController get name
                6⤵
                • Detects videocard installed
                • Suspicious use of AdjustPrivilegeToken
                PID:552
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2916
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic computersystem get Manufacturer
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3700
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "gdb --version"
              5⤵
                PID:1628
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tasklist"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4528
                • C:\Windows\system32\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1660
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4944
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic path Win32_ComputerSystem get Manufacturer
                  6⤵
                    PID:3248
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:4040
        • C:\Users\Admin\explorer
          C:\Users\Admin\explorer
          1⤵
          • Executes dropped EXE
          PID:2648
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:2260
        • C:\Users\Admin\explorer
          C:\Users\Admin\explorer
          1⤵
          • Executes dropped EXE
          PID:1920
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:2204
        • C:\Users\Admin\explorer
          C:\Users\Admin\explorer
          1⤵
          • Executes dropped EXE
          PID:3976

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Modify Registry

        1
        T1112

        Virtualization/Sandbox Evasion

        2
        T1497

        Credential Access

        Discovery

        Process Discovery

        1
        T1057

        Query Registry

        5
        T1012

        System Information Discovery

        4
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Virtualization/Sandbox Evasion

        2
        T1497

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          86af0a00125e10ec253344dc9ead6619

          SHA1

          d7b65ec171be373231016992dba5ef3ca3da25c1

          SHA256

          0f020b2fda4763a44f8e5a1a4badfe21c080b99bb56dc46bb2354522eeb90ee6

          SHA512

          5a061205131a18870c0508b72cd6fd9bf9ddad9ab54305e6740d7f6d7f4e2a29d953f3494899f718a9fd3e2a51446ca55a91ad46e041c12b25a1aa6855fa5843

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          cadef9abd087803c630df65264a6c81c

          SHA1

          babbf3636c347c8727c35f3eef2ee643dbcc4bd2

          SHA256

          cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

          SHA512

          7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          fd98baf5a9c30d41317663898985593b

          SHA1

          ea300b99f723d2429d75a6c40e0838bf60f17aad

          SHA256

          9d97a5bbc88fdcceac25f293383f7e5ce242675460ffbfb2ee9090870c034e96

          SHA512

          bf4dbbd671b5d7afb326622a7c781f150860294d3dba7160330046c258c84a15981c70e50d84dc7faaa7cc8b8c90bf8df818b3f2d3806a8a3671dfe5e38fe7b0

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1000169001\explorer.exe
          Filesize

          87KB

          MD5

          7bc9e427746a95ed037db5e0b3230780

          SHA1

          e5fb0551239eb8edf5b117b04a86742c7780355c

          SHA256

          3d8b1b6802f265ff8eb229c38ff81824f3652f271eb97b7bfef86db369902a08

          SHA512

          ae6e823d72a1a976401726ba3dfb61919bf529719fc555c680a99b3a58c15c982b9a8024d4ca2dab933acd1cc22c1f66bc0d46e7d0e7422825dad9c77852808b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1000170001\LummaC22222.exe
          Filesize

          258KB

          MD5

          40e9f5e6b35423ed5af9a791fc6b8740

          SHA1

          75d24d3d05a855bb347f4e3a94eae4c38981aca9

          SHA256

          7fdd7da7975da141ab5a48b856d24fba2ff35f52ad071119f6a83548494ba816

          SHA512

          c2150dfb166653a2627aba466a6d98c0f426232542afc6a3c6fb5ebb04b114901233f51d57ea59dbef988d038d4103a637d9a51015104213b0be0fe09c96aea8

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1000174001\5PHCENYBS068Y01.exe
          Filesize

          10.5MB

          MD5

          7fffe8702479239234bce6013bcad409

          SHA1

          ee7aaecaeff869350ead69c907b77d5b0afd3f09

          SHA256

          7870eda6f78bde1ea7c083ddf32a9aabd118b30f6b8617f4b9e6625edba0ff95

          SHA512

          8d5932d1fa8006c73e8576383425151439b4bf4637017f104a6c4e5cf202ce1c4a1dbec6d61adb794fd8a30c1300d6635d162df8630f9193c96239ec8b2a6869

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          Filesize

          1.7MB

          MD5

          38f86bb61ab58b0dc009fec84341cbbd

          SHA1

          1649d9657dee781fd123baa8bd933314934c05b0

          SHA256

          0b28556b7f1d6627f4943e6f09dc5af5674975e657dcde51f7907fbefe72efc7

          SHA512

          c63f441b1035670aff8f880390629b0c5663f149e1642844e44499af835127d59488d188435d7207490515db17abc646daa5662b579cfc6346b681e541397102

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_overlapped.pyd
          Filesize

          47KB

          MD5

          7e6bd435c918e7c34336c7434404eedf

          SHA1

          f3a749ad1d7513ec41066ab143f97fa4d07559e1

          SHA256

          0606a0c5c4ab46c4a25ded5a2772e672016cac574503681841800f9059af21c4

          SHA512

          c8bf4b1ec6c8fa09c299a8418ee38cdccb04afa3a3c2e6d92625dbc2de41f81dd0df200fd37fcc41909c2851ac5ca936af632307115b9ac31ec020d9ed63f157

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
          Filesize

          155KB

          MD5

          35f66ad429cd636bcad858238c596828

          SHA1

          ad4534a266f77a9cdce7b97818531ce20364cb65

          SHA256

          58b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc

          SHA512

          1cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_http_parser.pyd
          Filesize

          217KB

          MD5

          9642c0a5fb72dfe2921df28e31faa219

          SHA1

          67a963157ee7fc0c30d3807e8635a57750ca0862

          SHA256

          580a004e93bed99820b1584dffaf0c4caa9fbbf4852ccded3b2b99975299367b

          SHA512

          f84b7cde87186665a700c3017efcbcc6c19f5dc2c7b426d427dddbcbdec38b6189dd60ce03153fb14b6ea938d65aab99da33bda63b48e3e9ce9e5d3555b50a04

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\cryptography\hazmat\bindings\_rust.pyd
          Filesize

          7.6MB

          MD5

          b98d491ead30f30e61bc3e865ab72f18

          SHA1

          db165369b7f2ae513b51c4f3def9ea2668268221

          SHA256

          35d5aeb890b99e6bae3e6b863313fbc8a1a554acbcd416fe901b1e1ae2993c98

          SHA512

          044c9c39bddb13020ed865d3aa30926460ae6ded5fdea59eca2b1cf6a4ded55728d883f19ee0749f95a4d93f66e04fcc62bc3be67119c4ccabd17b003cf5f3c4

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-1_1.dll
          Filesize

          3.3MB

          MD5

          ab01c808bed8164133e5279595437d3d

          SHA1

          0f512756a8db22576ec2e20cf0cafec7786fb12b

          SHA256

          9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55

          SHA512

          4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll
          Filesize

          682KB

          MD5

          de72697933d7673279fb85fd48d1a4dd

          SHA1

          085fd4c6fb6d89ffcc9b2741947b74f0766fc383

          SHA256

          ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f

          SHA512

          0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
          Filesize

          1.1MB

          MD5

          102bbbb1f33ce7c007aac08fe0a1a97e

          SHA1

          9a8601bea3e7d4c2fa6394611611cda4fc76e219

          SHA256

          2cf6c5dea30bb0584991b2065c052c22d258b6e15384447dcea193fdcac5f758

          SHA512

          a07731f314e73f7a9ea73576a89ccb8a0e55e53f9b5b82f53121b97b1814d905b17a2da9bd2eda9f9354fc3f15e3dea7a613d7c9bc98c36bba653743b24dfc32

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jbnevrqb.kga.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\VCRUNTIME140.dll
          Filesize

          96KB

          MD5

          f12681a472b9dd04a812e16096514974

          SHA1

          6fd102eb3e0b0e6eef08118d71f28702d1a9067c

          SHA256

          d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

          SHA512

          7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\_asyncio.pyd
          Filesize

          62KB

          MD5

          6eb3c9fc8c216cea8981b12fd41fbdcd

          SHA1

          5f3787051f20514bb9e34f9d537d78c06e7a43e6

          SHA256

          3b0661ef2264d6566368b677c732ba062ac4688ef40c22476992a0f9536b0010

          SHA512

          2027707824d0948673443dd54b4f45bc44680c05c3c4a193c7c1803a1030124ad6c8fbe685cc7aaf15668d90c4cd9bfb93de51ea8db4af5abe742c1ef2dcd08b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\_bz2.pyd
          Filesize

          81KB

          MD5

          a4b636201605067b676cc43784ae5570

          SHA1

          e9f49d0fc75f25743d04ce23c496eb5f89e72a9a

          SHA256

          f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c

          SHA512

          02096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\_cffi_backend.pyd
          Filesize

          177KB

          MD5

          ebb660902937073ec9695ce08900b13d

          SHA1

          881537acead160e63fe6ba8f2316a2fbbb5cb311

          SHA256

          52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd

          SHA512

          19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\_ctypes.pyd
          Filesize

          119KB

          MD5

          87596db63925dbfe4d5f0f36394d7ab0

          SHA1

          ad1dd48bbc078fe0a2354c28cb33f92a7e64907e

          SHA256

          92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4

          SHA512

          e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\_hashlib.pyd
          Filesize

          60KB

          MD5

          49ce7a28e1c0eb65a9a583a6ba44fa3b

          SHA1

          dcfbee380e7d6c88128a807f381a831b6a752f10

          SHA256

          1be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430

          SHA512

          cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\_lzma.pyd
          Filesize

          154KB

          MD5

          b5fbc034ad7c70a2ad1eb34d08b36cf8

          SHA1

          4efe3f21be36095673d949cceac928e11522b29c

          SHA256

          80a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6

          SHA512

          e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\_socket.pyd
          Filesize

          75KB

          MD5

          e137df498c120d6ac64ea1281bcab600

          SHA1

          b515e09868e9023d43991a05c113b2b662183cfe

          SHA256

          8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a

          SHA512

          cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\_sqlite3.pyd
          Filesize

          95KB

          MD5

          7f61eacbbba2ecf6bf4acf498fa52ce1

          SHA1

          3174913f971d031929c310b5e51872597d613606

          SHA256

          85de6d0b08b5cc1f2c3225c07338c76e1cab43b4de66619824f7b06cb2284c9e

          SHA512

          a5f6f830c7a5fadc3349b42db0f3da1fddb160d7e488ea175bf9be4732a18e277d2978720c0e294107526561a7011fadab992c555d93e77d4411528e7c4e695a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\aiohttp\_helpers.pyd
          Filesize

          38KB

          MD5

          d2bf6ca0df56379f1401efe347229dd2

          SHA1

          95c6a524a9b64ec112c32475f06a0821ff7e79c9

          SHA256

          04d56d6aa727665802283b8adf9b873c1dd76dfc7265a12c0f627528ba706040

          SHA512

          b4a2b9f71b156731aa071d13bf8dcffec4091d8d2fab47aea1ff47cd7abff13e28acf1d9456a97eb7a5723dbfa166fc63de11c63dc5cb63b13b4df9930390377

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\aiohttp\_http_writer.pyd
          Filesize

          34KB

          MD5

          e16a71fc322a3a718aeaeaef0eeeab76

          SHA1

          78872d54d016590df87208518e3e6515afce5f41

          SHA256

          51490359d8079232565187223517eca99e1ce55bc97b93cf966d2a5c1f2e5435

          SHA512

          a9a7877aa77d000ba2dd7d96cf88a0e9afb6f6decb9530c1d4e840c270dd1805e73401266b1c8e17c1418effb823c1bd91b13f82dbfc6dba455940e3e644de54

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\libffi-7.dll
          Filesize

          32KB

          MD5

          eef7981412be8ea459064d3090f4b3aa

          SHA1

          c60da4830ce27afc234b3c3014c583f7f0a5a925

          SHA256

          f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

          SHA512

          dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\multidict\_multidict.pyd
          Filesize

          45KB

          MD5

          ddd4c0ae1e0d166c22449e9dcdca20d7

          SHA1

          ff0e3d889b4e8bc43b0f13aa1154776b0df95700

          SHA256

          74ec52418c5d38a63add94228c6f68cf49519666ae8bcb7ac199f7d539d8612c

          SHA512

          c8464a77ba8b504ba9c7873f76499174095393c42dc85a9c1be2875c3661cda928851e37013e4ac95ba539eed984bf71c0fcc2cb599f3f0c4c1588d4a692bdfd

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\python3.dll
          Filesize

          63KB

          MD5

          07bd9f1e651ad2409fd0b7d706be6071

          SHA1

          dfeb2221527474a681d6d8b16a5c378847c59d33

          SHA256

          5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5

          SHA512

          def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\python310.dll
          Filesize

          4.3MB

          MD5

          c80b5cb43e5fe7948c3562c1fff1254e

          SHA1

          f73cb1fb9445c96ecd56b984a1822e502e71ab9d

          SHA256

          058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

          SHA512

          faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\select.pyd
          Filesize

          28KB

          MD5

          adc412384b7e1254d11e62e451def8e9

          SHA1

          04e6dff4a65234406b9bc9d9f2dcfe8e30481829

          SHA256

          68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1

          SHA512

          f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\sqlite3.dll
          Filesize

          1.4MB

          MD5

          926dc90bd9faf4efe1700564aa2a1700

          SHA1

          763e5af4be07444395c2ab11550c70ee59284e6d

          SHA256

          50825ea8b431d86ec228d9fa6b643e2c70044c709f5d9471d779be63ff18bcd0

          SHA512

          a8703ff97243aa3bc877f71c0514b47677b48834a0f2fee54e203c0889a79ce37c648243dbfe2ee9e1573b3ca4d49c334e9bfe62541653125861a5398e2fe556

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\stub.exe
          Filesize

          15.9MB

          MD5

          1f4bbcf45463611b2321a428424e71ff

          SHA1

          102b8883177489e69964822db3adc4bb3ddba2b5

          SHA256

          1f0ad6f7003fbd3e3e8ebeb0e179ffd8b9ce43f0914b1041136c6603eaa6ebb2

          SHA512

          3613d74999fd7eedbe73ddb63f65529475a432b9203fd86b0f88b45ebff0d2e9192b27ce1c24f4e42eaee0c331bfea34a90764482990b5f2424c0f980c50a44a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\onefile_1380_133687451376532365\yarl\_quoting_c.pyd
          Filesize

          93KB

          MD5

          8b4cd87707f15f838b5db8ed5b5021d2

          SHA1

          bbc05580a181e1c03e0a53760c1559dc99b746fe

          SHA256

          eefb46501ef97baf29a93304f58674e70f5ccecafb183f230e5ce7872a852f56

          SHA512

          6768cff12fa22fe8540a3f6bdb350a5fcec0b2a0f01531458eb23f77b24460620cd400078fd1ec63738884c2b78920e428126833953c26b8dc8ad8b7c069415d

          Download Submit

        • memory/1380-234-0x00007FF690E20000-0x00007FF6918C7000-memory.dmp

          Filesize

          10.7MB

          Download

        • memory/2204-253-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/2204-251-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/2260-244-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/2260-243-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/2316-72-0x0000021373550000-0x0000021373572000-memory.dmp

          Filesize

          136KB

          Download

        • memory/3784-110-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-239-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-250-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-114-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-249-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-20-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-97-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-19-0x00000000002A1000-0x00000000002CF000-memory.dmp

          Filesize

          184KB

          Download

        • memory/3784-199-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-21-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-245-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-248-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-16-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-247-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-242-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-241-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-236-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-237-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-238-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/3784-246-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/4040-233-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/4040-225-0x00000000002A0000-0x0000000000732000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/4616-41-0x0000000000DF0000-0x0000000000E0C000-memory.dmp

          Filesize

          112KB

          Download

        • memory/4616-115-0x00007FF98B033000-0x00007FF98B035000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4616-40-0x00007FF98B033000-0x00007FF98B035000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4836-1-0x0000000077A94000-0x0000000077A96000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4836-18-0x0000000000B80000-0x0000000001012000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/4836-4-0x0000000000B80000-0x0000000001012000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/4836-2-0x0000000000B81000-0x0000000000BAF000-memory.dmp

          Filesize

          184KB

          Download

        • memory/4836-3-0x0000000000B80000-0x0000000001012000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/4836-0-0x0000000000B80000-0x0000000001012000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/5072-228-0x00007FF67AEC0000-0x00007FF67BEE6000-memory.dmp

          Filesize

          16.1MB

          Download