Malware Analysis Report

2025-08-05 21:09

Sample ID 241021-q3dfeaxgnp
Target perfo.mod.exe
SHA256 ef88d23016e06fa5d44806bc7762a0ae927972a7a22890b22af675271f2ff526
Tags
discovery spyware stealer pyinstaller
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

ef88d23016e06fa5d44806bc7762a0ae927972a7a22890b22af675271f2ff526

Threat Level: Shows suspicious behavior

The file perfo.mod.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery spyware stealer pyinstaller

Drops startup file

Reads user/profile data of web browsers

Loads dropped DLL

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Unsigned PE

Detects Pyinstaller

Browser Information Discovery

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-21 13:47

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-21 13:46

Reported

2024-10-21 13:47

Platform

win10-20240404-en

Max time kernel

17s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe"

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ㅤ.exe C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ㅤ.exe C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rescache\_merged\4183903823\2290032291.pri C:\Windows\system32\taskmgr.exe N/A
File created C:\Windows\rescache\_merged\1601268389\715946058.pri C:\Windows\system32\taskmgr.exe N/A

Browser Information Discovery

discovery

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe

"C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe"

C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe

"C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe csproduct get uuid

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 172.67.74.152:443 api.ipify.org tcp
US 8.8.8.8:53 redtiger.shop udp
FR 213.130.145.42:443 redtiger.shop tcp
US 8.8.8.8:53 discord.com udp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 152.74.67.172.in-addr.arpa udp
US 8.8.8.8:53 42.145.130.213.in-addr.arpa udp
US 8.8.8.8:53 232.137.159.162.in-addr.arpa udp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI43402\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

C:\Users\Admin\AppData\Local\Temp\_MEI43402\setuptools\_vendor\jaraco.text-3.12.1.dist-info\LICENSE

MD5 141643e11c48898150daa83802dbc65f
SHA1 0445ed0f69910eeaee036f09a39a13c6e1f37e12
SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
SHA512 ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f

C:\Users\Admin\AppData\Local\Temp\_MEI43402\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL

MD5 43136dde7dd276932f6197bb6d676ef4
SHA1 6b13c105452c519ea0b65ac1a975bd5e19c50122
SHA256 189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
SHA512 e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1

C:\Users\Admin\AppData\Local\Temp\_MEI43402\python312.dll

MD5 cae8fa4e7cb32da83acf655c2c39d9e1
SHA1 7a0055588a2d232be8c56791642cb0f5abbc71f8
SHA256 8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
SHA512 db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

C:\Users\Admin\AppData\Local\Temp\_MEI43402\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

C:\Users\Admin\AppData\Local\Temp\_MEI43402\base_library.zip

MD5 763d1a751c5d47212fbf0caea63f46f5
SHA1 845eaa1046a47b5cf376b3dbefcf7497af25f180
SHA256 378a4b40f4fa4a8229c93e0afee819085251af03402ccefa3b469651e50e60b7
SHA512 bb356dd610e6035f4002671440ce96624addf9a89fd952a6419647a528a551a6ccd0eca0ee2eeb080d9aad683b5afc9415c721fa62c3bcddcb7f1923f59d9c45

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_bz2.pyd

MD5 dd26ed92888de9c57660a7ad631bb916
SHA1 77d479d44d9e04f0a1355569332233459b69a154
SHA256 324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697
SHA512 d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_lzma.pyd

MD5 8cfbafe65d6e38dde8e2e8006b66bb3e
SHA1 cb63addd102e47c777d55753c00c29c547e2243c
SHA256 6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff
SHA512 fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_wmi.pyd

MD5 bed7b0ced98fa065a9b8fe62e328713f
SHA1 e329ebca2df8889b78ce666e3fb909b4690d2daa
SHA256 5818679010bb536a3d463eeee8ce203e880a8cd1c06bf1cb6c416ab0dc024d94
SHA512 c95f7bb6ca9afba50bf0727e971dff7326ce0e23a4bfa44d62f2ed67ed5fede1b018519dbfa0ed3091d485ed0ace68b52dd0bb2921c9c1e3bc1fa875cd3d2366

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_uuid.pyd

MD5 8f5402bb6aac9c4ff9b4ce5ac3f0f147
SHA1 87207e916d0b01047b311d78649763d6e001c773
SHA256 793e44c75e7d746af2bb5176e46c454225f07cb27b1747f1b83d1748d81ad9ac
SHA512 65fdef32aeba850aa818a8c8bf794100725a9831b5242350e6c04d0bca075762e1b650f19c437a17b150e9fca6ad344ec4141a041fa12b5a91652361053c7e81

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_tkinter.pyd

MD5 e38a6b96f5cc200f21da22d49e321da3
SHA1 4ea69d2b021277ab0b473cfd44e4bfd17e3bac3b
SHA256 f0ebdf2ca7b33c26b8938efa59678068d3840957ee79d2b3c576437f8f913f20
SHA512 3df55cdd44ea4789fb2de9672f421b7ff9ad798917417dcb5b1d8575804306fb7636d436965598085d2e87256ecb476ed69df7af05986f05b9f4a18eed9629e2

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_ssl.pyd

MD5 6a2b0f8f50b47d05f96deff7883c1270
SHA1 2b1aeb6fe9a12e0d527b042512fc8890eedb10d8
SHA256 68dad60ff6fb36c88ef1c47d1855517bfe8de0f5ddea0f630b65b622a645d53a
SHA512 a080190d4e7e1abb186776ae6e83dab4b21a77093a88fca59ce1f63c683f549a28d094818a0ee44186ddea2095111f1879008c0d631fc4a8d69dd596ef76ca37

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_sqlite3.pyd

MD5 f8869058c1f6f6352309d774c0fefde9
SHA1 4a9fd6c93785c6b6c53f33946e9b1ca5db52a4e9
SHA256 fb00951d39084e88871c813d6c4043ce8afb60ab6d012e699ddd607baa10f6e1
SHA512 37205b755985cdbb16f806cda8e7637164d1d62f410ea07501739215b9e410e91997110600ead999d726cb15ec4aef3abf673e7ad47d3ca076457c89ea2b401c

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_socket.pyd

MD5 e43aed7d6a8bcd9ddfc59c2d1a2c4b02
SHA1 36f367f68fb9868412246725b604b27b5019d747
SHA256 2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a
SHA512 d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_queue.pyd

MD5 7d91dd8e5f1dbc3058ea399f5f31c1e6
SHA1 b983653b9f2df66e721ece95f086c2f933d303fc
SHA256 76bba42b1392dc57a867aef385b990fa302a4f1dcf453705ac119c9c98a36e8d
SHA512 b8e7369da79255a4bb2ed91ba0c313b4578ee45c94e6bc74582fc14f8b2984ed8fcda0434a5bd3b72ea704e6e8fd8cbf1901f325e774475e4f28961483d6c7cf

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_overlapped.pyd

MD5 df92ea698a3d0729b70a4306bbe3029f
SHA1 b82f3a43568148c64a46e2774aec39bf1f2d3c1e
SHA256 46dec978ec8cb2146854739bfeddea93335dcc92a25d719352b94f9517855032
SHA512 bdebafe1b40244a0cb6c97e75424f79cfe395774a9d03cdb02f82083110c1f4bdcac2819ba1845ad1c56e2d2e6506dcc1833e4eb269bb0f620f0eb73b4d47817

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_multiprocessing.pyd

MD5 eb859fc7f54cba118a321440ad088096
SHA1 9d3c410240f4c5269e07ffbde43d6f5e7cc30b44
SHA256 14bdd15d60b9d6141009aeedc606007c42b46c779a523d21758e57cf126dc2a4
SHA512 694a9c1cc3dc78b47faedf66248ff078e5090cfab22e95c123fb99b10192a5748748a5f0937ffd9fd8e1873ad48f290be723fe194b7eb2a731add7f5fb776c4a

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_hashlib.pyd

MD5 d19cb5ca144ae1fd29b6395b0225cf40
SHA1 5b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4
SHA256 f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa
SHA512 9ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_decimal.pyd

MD5 cea3b419c7ca87140a157629c6dbd299
SHA1 7dbff775235b1937b150ae70302b3208833dc9be
SHA256 95b9850e6fb335b235589dd1348e007507c6b28e332c9abb111f2a0035c358e5
SHA512 6e3a6781c0f05bb5182073cca1e69b6df55f05ff7cdcea394bacf50f88605e2241b7387f1d8ba9f40a96832d04f55edb80003f0cf1e537a26f99408ee9312f5b

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_cffi_backend.cp312-win_amd64.pyd

MD5 fcb71ce882f99ec085d5875e1228bdc1
SHA1 763d9afa909c15fea8e016d321f32856ec722094
SHA256 86f136553ba301c70e7bada8416b77eb4a07f76ccb02f7d73c2999a38fa5fa5b
SHA512 4a0e98ab450453fd930edc04f0f30976abb9214b693db4b6742d784247fb062c57fafafb51eb04b7b4230039ab3b07d2ffd3454d6e261811f34749f2e35f04d6

C:\Users\Admin\AppData\Local\Temp\_MEI43402\_asyncio.pyd

MD5 cc0f232f2a8a359dee29a573667e6d77
SHA1 d3ffbf5606d9c77a0de0b7456f7a5314f420b1f7
SHA256 7a5c88ce496bafdf31a94ae6d70b017070703bc0a7da1dfae7c12b21bb61030d
SHA512 48484177bf55179607d66f5a5837a35cd586e8a9fb185de8b10865aab650b056a61d1dc96370c5efc6955ccb4e34b31810f8e1c8f5f02d268f565a73b4ff5657

C:\Users\Admin\AppData\Local\Temp\_MEI43402\zlib1.dll

MD5 4fadeda3c1da95337b67d15c282d49d8
SHA1 f49ee3256f8f5746515194114f7ef73d6b6141c0
SHA256 28484bcea1e387c4a41564af8f62c040fe203fe2491e415ce90f3d7f5c7ab013
SHA512 45634caf9d9214f0e45e11a1539d8663b45527e1ae9282558b5fdb8465d90b0fabcf4c0e508504427a597ba390c029bc12068ac17d842fd0fcbb1886d252c6b1

C:\Users\Admin\AppData\Local\Temp\_MEI43402\VCRUNTIME140_1.dll

MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

C:\Users\Admin\AppData\Local\Temp\_MEI43402\unicodedata.pyd

MD5 b848e259fabaf32b4b3c980a0a12488d
SHA1 da2e864e18521c86c7d8968db74bb2b28e4c23e2
SHA256 c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c
SHA512 4c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27

C:\Users\Admin\AppData\Local\Temp\_MEI43402\tk86t.dll

MD5 966580716c0d6b7eec217071a6df6796
SHA1 e3d2d4a7ec61d920130d7a745586ceb7aad4184d
SHA256 afc13fce0690c0a4b449ec7ed4fb0233a8359911c1c0ba26a285f32895dbb3d2
SHA512 cf0675ea888a6d1547842bcfb27d45815b164337b4a285253716917eb157c6df3cc97cba8ad2ab7096e8f5131889957e0555bae9b5a8b64745ac3d2f174e3224

C:\Users\Admin\AppData\Local\Temp\_MEI43402\tcl86t.dll

MD5 3ae729942d15f4f48b1ea8c91880f1f4
SHA1 d27596d14af5adeb02edab74859b763bf6ac2853
SHA256 fe62ca2b01b0ec8a609b48f165ca9c6a91653d3966239243ad352dd4c8961760
SHA512 355800e9152daad675428421b867b6d48e2c8f8be9ca0284f221f27fae198c8f07d90980e04d807b50a88f92ffb946dc53b7564e080e2e0684f7f6ccc84ff245

C:\Users\Admin\AppData\Local\Temp\_MEI43402\sqlite3.dll

MD5 956ef70f60fb099d31a79fa7334359ad
SHA1 336a78492c0e10fab4baa0add7552e52f61dd110
SHA256 809c7b48b73c95b361d13c753e7a6e3c83124a27e18aac81df7c876f32e98e00
SHA512 7fd74b92e32a385b193264d0f08a390eec672e508ef85bf0439bdb713a9c8909688f845bcacd4adb3dd91b08a3eb40ae32532a08fc9378ed4530646fb871fd50

C:\Users\Admin\AppData\Local\Temp\_MEI43402\select.pyd

MD5 79ce1ae3a23dff6ed5fc66e6416600cd
SHA1 6204374d99144b0a26fd1d61940ff4f0d17c2212
SHA256 678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0
SHA512 a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa

C:\Users\Admin\AppData\Local\Temp\_MEI43402\pyexpat.pyd

MD5 815f1bdabb79c6a12b38d84aa343196d
SHA1 916483149875a5e20c6046ceffef62dd6089ddd5
SHA256 31712ae276e2ced05ecda3e1c08fbbcc2cff8474a972626aba55f7797f0ed8c9
SHA512 1078e7e48b6f6ed160ae2bccf80a43a5f1cca769b8a690326e112bf20d7f3d018f855f6aa3b56d315dc0853472e0affcfe8e910b5ce69ce952983cfaa496c21d

C:\Users\Admin\AppData\Local\Temp\_MEI43402\libssl-3.dll

MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

C:\Users\Admin\AppData\Local\Temp\_MEI43402\libcrypto-3.dll

MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

\Users\Admin\AppData\Local\Temp\_MEI43402\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

\Users\Admin\AppData\Local\Temp\_MEI43402\_ctypes.pyd

MD5 c8afa1ebb28828e1115c110313d2a810
SHA1 1d0d28799a5dbe313b6f4ddfdb7986d2902fa97a
SHA256 8978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0
SHA512 4d9f41bd23b62600d1eb097d1578ba656b5e13fd2f31ef74202aa511111969bb8cfc2a8e903de73bd6e63fadaa59b078714885b8c5b8ecc5c4128ff9d06c1e56

\Users\Admin\AppData\Local\Temp\_MEI43402\python3.dll

MD5 8dbe9bbf7118f4862e02cd2aaf43f1ab
SHA1 935bc8c5cea4502d0facf0c49c5f2b9c138608ed
SHA256 29f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db
SHA512 938f8387dcc356012ac4a952d371664700b110f7111fcc24f5df7d79791ae95bad0dbaf77d2d6c86c820bfd48a6bdbe8858b7e7ae1a77df88e596556c7135ed4

\Users\Admin\AppData\Local\Temp\_MEI43402\PyQt5\QtCore.pyd

MD5 678fa1496ffdea3a530fa146dedcdbcc
SHA1 c80d8f1de8ae06ecf5750c83d879d2dcc2d6a4f8
SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
SHA512 8d9e3fa49fb42f844d8df241786ea9c0f55e546d373ff07e8c89aac4f3027c62ec1bd0c9c639afeabc034cc39e424b21da55a1609c9f95397a66d5f0d834e88e

C:\Users\Admin\AppData\Local\Temp\_MEI43402\PyQt5\Qt5\bin\MSVCP140_1.dll

MD5 0fe6d52eb94c848fe258dc0ec9ff4c11
SHA1 95cc74c64ab80785f3893d61a73b8a958d24da29
SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
SHA512 c39a134210e314627b0f2072f4ffc9b2ce060d44d3365d11d8c1fe908b3b9403ebdd6f33e67d556bd052338d0ed3d5f16b54d628e8290fd3a155f55d36019a86

C:\Users\Admin\AppData\Local\Temp\_MEI43402\PyQt5\sip.cp312-win_amd64.pyd

MD5 f57134d35976c48ffb955df1739af5d4
SHA1 c1b3a81352e462d4ecc33ee5119b882d657bed2f
SHA256 9e91b237e2aa69c0c7e268f072999bb0319b04513c9fc97ab7c4371e642375d2
SHA512 db385592876f489460023f2d02fc80635fe4f9746ecd99c8c7622399a34ea43ef631d3668429ad4e8f69552a5c386bbf12f3805a9101f7eb70337ce23e65c80b

\Users\Admin\AppData\Local\Temp\_MEI43402\win32\win32api.pyd

MD5 3a80fea23a007b42cef8e375fc73ad40
SHA1 04319f7552ea968e2421c3936c3a9ee6f9cf30b2
SHA256 b70d69d25204381f19378e1bb35cc2b8c8430aa80a983f8d0e8e837050bb06ef
SHA512 a63bed03f05396b967858902e922b2fbfb4cf517712f91cfaa096ff0539cf300d6b9c659ffee6bf11c28e79e23115fd6b9c0b1aa95db1cbd4843487f060ccf40

\Users\Admin\AppData\Local\Temp\_MEI43402\pywin32_system32\pywintypes312.dll

MD5 26d752c8896b324ffd12827a5e4b2808
SHA1 447979fa03f78cb7210a4e4ba365085ab2f42c22
SHA256 bd33548dbdbb178873be92901b282bad9c6817e3eac154ca50a666d5753fd7ec
SHA512 99c87ab9920e79a03169b29a2f838d568ca4d4056b54a67bc51caf5c0ff5a4897ed02533ba504f884c6f983ebc400743e6ad52ac451821385b1e25c3b1ebcee0

memory/784-1336-0x00007FF803730000-0x00007FF803993000-memory.dmp

\Users\Admin\AppData\Local\Temp\_MEI43402\PyQt5\Qt5\bin\MSVCP140.dll

MD5 01b946a2edc5cc166de018dbb754b69c
SHA1 dbe09b7b9ab2d1a61ef63395111d2eb9b04f0a46
SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
SHA512 65dc3f32faf30e62dfdecb72775df870af4c3a32a0bf576ed1aaae4b16ac6897b62b19e01dc2bf46f46fbe3f475c061f79cbe987eda583fee1817070779860e5

\Users\Admin\AppData\Local\Temp\_MEI43402\PyQt5\Qt5\bin\Qt5Core.dll

MD5 817520432a42efa345b2d97f5c24510e
SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441

C:\Users\Admin\AppData\Local\Temp\_MEI43402\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24

C:\Users\Admin\AppData\Local\Temp\password_db

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\downloads_db

MD5 90a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1 aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA256 7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512 ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

C:\Users\Admin\AppData\Local\Temp\Browser_Admin\Cards_Admin.txt

MD5 952fee97ed9bdf0fd9f5ec8d7da1f15a
SHA1 f31b06403d8d6c60704792184a6bee64d85e31ca
SHA256 cd90cecb3cc61129c34cd979d9a7db78caa4cff69ccf23c89287ea6b66a3f7e6
SHA512 247df800e44290311d86957a3eabd4a5150e7341d63e8987bbdf9fbed4e8da1e4f5a1e0cf84cadcc8509c2d0bf25bdeaccac332b4feab181881d12dd3448a109

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-21 13:46

Reported

2024-10-21 13:49

Platform

win11-20241007-en

Max time kernel

88s

Max time network

93s

Command Line

"C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe"

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ㅤ.exe C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ㅤ.exe C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Browser Information Discovery

discovery

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe

"C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe"

C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe

"C:\Users\Admin\AppData\Local\Temp\perfo.mod.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe csproduct get uuid

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 172.67.74.152:443 api.ipify.org tcp
FR 213.130.145.42:443 redtiger.shop tcp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 152.74.67.172.in-addr.arpa udp
US 8.8.8.8:53 42.145.130.213.in-addr.arpa udp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 162.159.138.232:443 discord.com tcp
US 162.159.138.232:443 discord.com tcp
US 162.159.138.232:443 discord.com tcp
US 162.159.138.232:443 discord.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI27442\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

C:\Users\Admin\AppData\Local\Temp\_MEI27442\setuptools\_vendor\jaraco.text-3.12.1.dist-info\LICENSE

MD5 141643e11c48898150daa83802dbc65f
SHA1 0445ed0f69910eeaee036f09a39a13c6e1f37e12
SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
SHA512 ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f

C:\Users\Admin\AppData\Local\Temp\_MEI27442\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL

MD5 43136dde7dd276932f6197bb6d676ef4
SHA1 6b13c105452c519ea0b65ac1a975bd5e19c50122
SHA256 189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
SHA512 e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1

C:\Users\Admin\AppData\Local\Temp\_MEI27442\python312.dll

MD5 cae8fa4e7cb32da83acf655c2c39d9e1
SHA1 7a0055588a2d232be8c56791642cb0f5abbc71f8
SHA256 8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
SHA512 db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

C:\Users\Admin\AppData\Local\Temp\_MEI27442\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

C:\Users\Admin\AppData\Local\Temp\_MEI27442\base_library.zip

MD5 763d1a751c5d47212fbf0caea63f46f5
SHA1 845eaa1046a47b5cf376b3dbefcf7497af25f180
SHA256 378a4b40f4fa4a8229c93e0afee819085251af03402ccefa3b469651e50e60b7
SHA512 bb356dd610e6035f4002671440ce96624addf9a89fd952a6419647a528a551a6ccd0eca0ee2eeb080d9aad683b5afc9415c721fa62c3bcddcb7f1923f59d9c45

C:\Users\Admin\AppData\Local\Temp\_MEI27442\python3.DLL

MD5 8dbe9bbf7118f4862e02cd2aaf43f1ab
SHA1 935bc8c5cea4502d0facf0c49c5f2b9c138608ed
SHA256 29f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db
SHA512 938f8387dcc356012ac4a952d371664700b110f7111fcc24f5df7d79791ae95bad0dbaf77d2d6c86c820bfd48a6bdbe8858b7e7ae1a77df88e596556c7135ed4

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_ctypes.pyd

MD5 c8afa1ebb28828e1115c110313d2a810
SHA1 1d0d28799a5dbe313b6f4ddfdb7986d2902fa97a
SHA256 8978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0
SHA512 4d9f41bd23b62600d1eb097d1578ba656b5e13fd2f31ef74202aa511111969bb8cfc2a8e903de73bd6e63fadaa59b078714885b8c5b8ecc5c4128ff9d06c1e56

C:\Users\Admin\AppData\Local\Temp\_MEI27442\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_lzma.pyd

MD5 8cfbafe65d6e38dde8e2e8006b66bb3e
SHA1 cb63addd102e47c777d55753c00c29c547e2243c
SHA256 6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff
SHA512 fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_bz2.pyd

MD5 dd26ed92888de9c57660a7ad631bb916
SHA1 77d479d44d9e04f0a1355569332233459b69a154
SHA256 324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697
SHA512 d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897

C:\Users\Admin\AppData\Local\Temp\_MEI27442\select.pyd

MD5 79ce1ae3a23dff6ed5fc66e6416600cd
SHA1 6204374d99144b0a26fd1d61940ff4f0d17c2212
SHA256 678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0
SHA512 a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_socket.pyd

MD5 e43aed7d6a8bcd9ddfc59c2d1a2c4b02
SHA1 36f367f68fb9868412246725b604b27b5019d747
SHA256 2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a
SHA512 d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_wmi.pyd

MD5 bed7b0ced98fa065a9b8fe62e328713f
SHA1 e329ebca2df8889b78ce666e3fb909b4690d2daa
SHA256 5818679010bb536a3d463eeee8ce203e880a8cd1c06bf1cb6c416ab0dc024d94
SHA512 c95f7bb6ca9afba50bf0727e971dff7326ce0e23a4bfa44d62f2ed67ed5fede1b018519dbfa0ed3091d485ed0ace68b52dd0bb2921c9c1e3bc1fa875cd3d2366

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_uuid.pyd

MD5 8f5402bb6aac9c4ff9b4ce5ac3f0f147
SHA1 87207e916d0b01047b311d78649763d6e001c773
SHA256 793e44c75e7d746af2bb5176e46c454225f07cb27b1747f1b83d1748d81ad9ac
SHA512 65fdef32aeba850aa818a8c8bf794100725a9831b5242350e6c04d0bca075762e1b650f19c437a17b150e9fca6ad344ec4141a041fa12b5a91652361053c7e81

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_tkinter.pyd

MD5 e38a6b96f5cc200f21da22d49e321da3
SHA1 4ea69d2b021277ab0b473cfd44e4bfd17e3bac3b
SHA256 f0ebdf2ca7b33c26b8938efa59678068d3840957ee79d2b3c576437f8f913f20
SHA512 3df55cdd44ea4789fb2de9672f421b7ff9ad798917417dcb5b1d8575804306fb7636d436965598085d2e87256ecb476ed69df7af05986f05b9f4a18eed9629e2

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_ssl.pyd

MD5 6a2b0f8f50b47d05f96deff7883c1270
SHA1 2b1aeb6fe9a12e0d527b042512fc8890eedb10d8
SHA256 68dad60ff6fb36c88ef1c47d1855517bfe8de0f5ddea0f630b65b622a645d53a
SHA512 a080190d4e7e1abb186776ae6e83dab4b21a77093a88fca59ce1f63c683f549a28d094818a0ee44186ddea2095111f1879008c0d631fc4a8d69dd596ef76ca37

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_sqlite3.pyd

MD5 f8869058c1f6f6352309d774c0fefde9
SHA1 4a9fd6c93785c6b6c53f33946e9b1ca5db52a4e9
SHA256 fb00951d39084e88871c813d6c4043ce8afb60ab6d012e699ddd607baa10f6e1
SHA512 37205b755985cdbb16f806cda8e7637164d1d62f410ea07501739215b9e410e91997110600ead999d726cb15ec4aef3abf673e7ad47d3ca076457c89ea2b401c

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_queue.pyd

MD5 7d91dd8e5f1dbc3058ea399f5f31c1e6
SHA1 b983653b9f2df66e721ece95f086c2f933d303fc
SHA256 76bba42b1392dc57a867aef385b990fa302a4f1dcf453705ac119c9c98a36e8d
SHA512 b8e7369da79255a4bb2ed91ba0c313b4578ee45c94e6bc74582fc14f8b2984ed8fcda0434a5bd3b72ea704e6e8fd8cbf1901f325e774475e4f28961483d6c7cf

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_overlapped.pyd

MD5 df92ea698a3d0729b70a4306bbe3029f
SHA1 b82f3a43568148c64a46e2774aec39bf1f2d3c1e
SHA256 46dec978ec8cb2146854739bfeddea93335dcc92a25d719352b94f9517855032
SHA512 bdebafe1b40244a0cb6c97e75424f79cfe395774a9d03cdb02f82083110c1f4bdcac2819ba1845ad1c56e2d2e6506dcc1833e4eb269bb0f620f0eb73b4d47817

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_multiprocessing.pyd

MD5 eb859fc7f54cba118a321440ad088096
SHA1 9d3c410240f4c5269e07ffbde43d6f5e7cc30b44
SHA256 14bdd15d60b9d6141009aeedc606007c42b46c779a523d21758e57cf126dc2a4
SHA512 694a9c1cc3dc78b47faedf66248ff078e5090cfab22e95c123fb99b10192a5748748a5f0937ffd9fd8e1873ad48f290be723fe194b7eb2a731add7f5fb776c4a

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_hashlib.pyd

MD5 d19cb5ca144ae1fd29b6395b0225cf40
SHA1 5b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4
SHA256 f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa
SHA512 9ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_decimal.pyd

MD5 cea3b419c7ca87140a157629c6dbd299
SHA1 7dbff775235b1937b150ae70302b3208833dc9be
SHA256 95b9850e6fb335b235589dd1348e007507c6b28e332c9abb111f2a0035c358e5
SHA512 6e3a6781c0f05bb5182073cca1e69b6df55f05ff7cdcea394bacf50f88605e2241b7387f1d8ba9f40a96832d04f55edb80003f0cf1e537a26f99408ee9312f5b

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_cffi_backend.cp312-win_amd64.pyd

MD5 fcb71ce882f99ec085d5875e1228bdc1
SHA1 763d9afa909c15fea8e016d321f32856ec722094
SHA256 86f136553ba301c70e7bada8416b77eb4a07f76ccb02f7d73c2999a38fa5fa5b
SHA512 4a0e98ab450453fd930edc04f0f30976abb9214b693db4b6742d784247fb062c57fafafb51eb04b7b4230039ab3b07d2ffd3454d6e261811f34749f2e35f04d6

C:\Users\Admin\AppData\Local\Temp\_MEI27442\_asyncio.pyd

MD5 cc0f232f2a8a359dee29a573667e6d77
SHA1 d3ffbf5606d9c77a0de0b7456f7a5314f420b1f7
SHA256 7a5c88ce496bafdf31a94ae6d70b017070703bc0a7da1dfae7c12b21bb61030d
SHA512 48484177bf55179607d66f5a5837a35cd586e8a9fb185de8b10865aab650b056a61d1dc96370c5efc6955ccb4e34b31810f8e1c8f5f02d268f565a73b4ff5657

C:\Users\Admin\AppData\Local\Temp\_MEI27442\zlib1.dll

MD5 4fadeda3c1da95337b67d15c282d49d8
SHA1 f49ee3256f8f5746515194114f7ef73d6b6141c0
SHA256 28484bcea1e387c4a41564af8f62c040fe203fe2491e415ce90f3d7f5c7ab013
SHA512 45634caf9d9214f0e45e11a1539d8663b45527e1ae9282558b5fdb8465d90b0fabcf4c0e508504427a597ba390c029bc12068ac17d842fd0fcbb1886d252c6b1

C:\Users\Admin\AppData\Local\Temp\_MEI27442\VCRUNTIME140_1.dll

MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

C:\Users\Admin\AppData\Local\Temp\_MEI27442\unicodedata.pyd

MD5 b848e259fabaf32b4b3c980a0a12488d
SHA1 da2e864e18521c86c7d8968db74bb2b28e4c23e2
SHA256 c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c
SHA512 4c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27

C:\Users\Admin\AppData\Local\Temp\_MEI27442\tk86t.dll

MD5 966580716c0d6b7eec217071a6df6796
SHA1 e3d2d4a7ec61d920130d7a745586ceb7aad4184d
SHA256 afc13fce0690c0a4b449ec7ed4fb0233a8359911c1c0ba26a285f32895dbb3d2
SHA512 cf0675ea888a6d1547842bcfb27d45815b164337b4a285253716917eb157c6df3cc97cba8ad2ab7096e8f5131889957e0555bae9b5a8b64745ac3d2f174e3224

C:\Users\Admin\AppData\Local\Temp\_MEI27442\tcl86t.dll

MD5 3ae729942d15f4f48b1ea8c91880f1f4
SHA1 d27596d14af5adeb02edab74859b763bf6ac2853
SHA256 fe62ca2b01b0ec8a609b48f165ca9c6a91653d3966239243ad352dd4c8961760
SHA512 355800e9152daad675428421b867b6d48e2c8f8be9ca0284f221f27fae198c8f07d90980e04d807b50a88f92ffb946dc53b7564e080e2e0684f7f6ccc84ff245

C:\Users\Admin\AppData\Local\Temp\_MEI27442\sqlite3.dll

MD5 956ef70f60fb099d31a79fa7334359ad
SHA1 336a78492c0e10fab4baa0add7552e52f61dd110
SHA256 809c7b48b73c95b361d13c753e7a6e3c83124a27e18aac81df7c876f32e98e00
SHA512 7fd74b92e32a385b193264d0f08a390eec672e508ef85bf0439bdb713a9c8909688f845bcacd4adb3dd91b08a3eb40ae32532a08fc9378ed4530646fb871fd50

C:\Users\Admin\AppData\Local\Temp\_MEI27442\pyexpat.pyd

MD5 815f1bdabb79c6a12b38d84aa343196d
SHA1 916483149875a5e20c6046ceffef62dd6089ddd5
SHA256 31712ae276e2ced05ecda3e1c08fbbcc2cff8474a972626aba55f7797f0ed8c9
SHA512 1078e7e48b6f6ed160ae2bccf80a43a5f1cca769b8a690326e112bf20d7f3d018f855f6aa3b56d315dc0853472e0affcfe8e910b5ce69ce952983cfaa496c21d

C:\Users\Admin\AppData\Local\Temp\_MEI27442\libssl-3.dll

MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

C:\Users\Admin\AppData\Local\Temp\_MEI27442\libcrypto-3.dll

MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

C:\Users\Admin\AppData\Local\Temp\_MEI27442\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24

C:\Users\Admin\AppData\Local\Temp\_MEI27442\PyQt5\QtCore.pyd

MD5 678fa1496ffdea3a530fa146dedcdbcc
SHA1 c80d8f1de8ae06ecf5750c83d879d2dcc2d6a4f8
SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
SHA512 8d9e3fa49fb42f844d8df241786ea9c0f55e546d373ff07e8c89aac4f3027c62ec1bd0c9c639afeabc034cc39e424b21da55a1609c9f95397a66d5f0d834e88e

C:\Users\Admin\AppData\Local\Temp\_MEI27442\PyQt5\Qt5\bin\Qt5Core.dll

MD5 817520432a42efa345b2d97f5c24510e
SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441

C:\Users\Admin\AppData\Local\Temp\_MEI27442\PyQt5\sip.cp312-win_amd64.pyd

MD5 f57134d35976c48ffb955df1739af5d4
SHA1 c1b3a81352e462d4ecc33ee5119b882d657bed2f
SHA256 9e91b237e2aa69c0c7e268f072999bb0319b04513c9fc97ab7c4371e642375d2
SHA512 db385592876f489460023f2d02fc80635fe4f9746ecd99c8c7622399a34ea43ef631d3668429ad4e8f69552a5c386bbf12f3805a9101f7eb70337ce23e65c80b

C:\Users\Admin\AppData\Local\Temp\_MEI27442\win32\win32api.pyd

MD5 3a80fea23a007b42cef8e375fc73ad40
SHA1 04319f7552ea968e2421c3936c3a9ee6f9cf30b2
SHA256 b70d69d25204381f19378e1bb35cc2b8c8430aa80a983f8d0e8e837050bb06ef
SHA512 a63bed03f05396b967858902e922b2fbfb4cf517712f91cfaa096ff0539cf300d6b9c659ffee6bf11c28e79e23115fd6b9c0b1aa95db1cbd4843487f060ccf40

C:\Users\Admin\AppData\Local\Temp\_MEI27442\pywin32_system32\pywintypes312.dll

MD5 26d752c8896b324ffd12827a5e4b2808
SHA1 447979fa03f78cb7210a4e4ba365085ab2f42c22
SHA256 bd33548dbdbb178873be92901b282bad9c6817e3eac154ca50a666d5753fd7ec
SHA512 99c87ab9920e79a03169b29a2f838d568ca4d4056b54a67bc51caf5c0ff5a4897ed02533ba504f884c6f983ebc400743e6ad52ac451821385b1e25c3b1ebcee0

C:\Users\Admin\AppData\Local\Temp\_MEI27442\PyQt5\Qt5\bin\MSVCP140_1.dll

MD5 0fe6d52eb94c848fe258dc0ec9ff4c11
SHA1 95cc74c64ab80785f3893d61a73b8a958d24da29
SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
SHA512 c39a134210e314627b0f2072f4ffc9b2ce060d44d3365d11d8c1fe908b3b9403ebdd6f33e67d556bd052338d0ed3d5f16b54d628e8290fd3a155f55d36019a86

C:\Users\Admin\AppData\Local\Temp\_MEI27442\PyQt5\Qt5\bin\MSVCP140.dll

MD5 01b946a2edc5cc166de018dbb754b69c
SHA1 dbe09b7b9ab2d1a61ef63395111d2eb9b04f0a46
SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
SHA512 65dc3f32faf30e62dfdecb72775df870af4c3a32a0bf576ed1aaae4b16ac6897b62b19e01dc2bf46f46fbe3f475c061f79cbe987eda583fee1817070779860e5

memory/4600-1336-0x00007FFF5DE10000-0x00007FFF5E073000-memory.dmp

memory/4600-1351-0x000002C37CD50000-0x000002C37CD51000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\password_db

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Temp\downloads_db

MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

C:\Users\Admin\AppData\Local\Temp\password_db

MD5 14ccc9293153deacbb9a20ee8f6ff1b7
SHA1 46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3
SHA256 3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
SHA512 916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

C:\Users\Admin\AppData\Local\Temp\Browser_Admin\Cards_Admin.txt

MD5 a7a1f4f644a683d90617c1a9f6ca9322
SHA1 855f6f20969993ae7aad210eea07ba2c3c199896
SHA256 053190fb92c05eb92b1eb35ae1f662055b5f5fd9652580e6e08058401c871e7d
SHA512 f945d675c22f8b099306d5b68ec04046af919d2a47201d021cbd95d40d5a4f8b042de5c83e85d1b93b302a2c8ac55695f55fb62a64e6cb1a7371efa26effb65e

C:\Users\Admin\AppData\Local\Temp\downloads_db

MD5 4e2922249bf476fb3067795f2fa5e794
SHA1 d2db6b2759d9e650ae031eb62247d457ccaa57d2
SHA256 c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1
SHA512 8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

C:\Users\Admin\AppData\Local\Temp\Browser_Admin\Cookies_Admin.txt

MD5 9360c1fc799ed711de28d5033ae329f7
SHA1 f2238a3e316c4ab84873b1ce690abdcaaf2a2939
SHA256 3736cee6f6b2d391f496a7b172e567d9ed6647a9937cb453003cc34129899c59
SHA512 32ddaf381211f4dd773a7e78473e02b3fb20b19325ad5ec5f284d1e09362e7e8e1ffa32f64db6c1a1cb350512ef16cfe9b9bf900e5123a2db96f70366de51b25