Malware Analysis Report

2025-08-06 02:47

Sample ID 241031-dg9khaycrp
Target 815566cfa896c06cff241371523c4acd_JaffaCakes118
SHA256 67cc8e079c9f46aaa2c174288ca62ff8c2b790fd4168f816be736ef972a45816
Tags
discovery pyinstaller defense_evasion spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

67cc8e079c9f46aaa2c174288ca62ff8c2b790fd4168f816be736ef972a45816

Threat Level: Shows suspicious behavior

The file 815566cfa896c06cff241371523c4acd_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery pyinstaller defense_evasion spyware stealer

Checks computer location settings

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Indicator Removal: File Deletion

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Detects Pyinstaller

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-31 03:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-31 02:59

Reported

2024-10-31 03:23

Platform

win7-20240903-en

Max time kernel

117s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jinn_is.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A N/A N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2812 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Discord_server.exe
PID 2812 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Discord_server.exe
PID 2812 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Discord_server.exe
PID 2812 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Discord_server.exe
PID 2812 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\jinn_is.exe
PID 2812 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\jinn_is.exe
PID 2812 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\jinn_is.exe
PID 2812 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\jinn_is.exe
PID 2848 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe C:\Users\Admin\AppData\Local\Temp\Discord_server.exe
PID 2848 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe C:\Users\Admin\AppData\Local\Temp\Discord_server.exe
PID 2848 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe C:\Users\Admin\AppData\Local\Temp\Discord_server.exe

Processes

C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\Discord_server.exe

"C:\Users\Admin\AppData\Local\Temp\Discord_server.exe"

C:\Users\Admin\AppData\Local\Temp\jinn_is.exe

"C:\Users\Admin\AppData\Local\Temp\jinn_is.exe"

C:\Users\Admin\AppData\Local\Temp\Discord_server.exe

"C:\Users\Admin\AppData\Local\Temp\Discord_server.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\Discord_server.exe

MD5 5b7338c1936cbc02c96853782903990c
SHA1 42923983bd7d1f1cbce712839b1591d29496df62
SHA256 40bf4ccd73037c1b67201a9a4c521f3c5d3fc5a472a92985eb0082deaa22c7b8
SHA512 fc12c23744c1c514a9916a303cfd80c162028e8079c59f9625f64640b595607605c8a49395698c9bf32fbd5891dbaafd4c0d7b26af026a13ede58f205fcd0eb9

C:\Users\Admin\AppData\Local\Temp\jinn_is.exe

MD5 0d4a53b05396e1e186439b2f22f3d684
SHA1 949f34684f891e98a709c06b4ec69a810a5ca5a9
SHA256 643518f0a7e0140b40c012836a4f505833773c56126dd40ea25c58ccde92b31f
SHA512 d2a18e51e70846f16c415b884304305a78b1ec878d040cd5afcee40af743dd19a526cfd77e5a5c73c78915a65979372209dccee1c97b702aeebdf83ef141bb4d

memory/2852-15-0x000000013FBC0000-0x000000013FBFC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI28482\python39.dll

MD5 1d5e4c20a20740f38f061bdf48aaca4f
SHA1 de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0
SHA256 f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366
SHA512 9df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397

memory/2852-66-0x000000013FBC0000-0x000000013FBFC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-31 02:59

Reported

2024-10-31 03:22

Platform

win10v2004-20241007-en

Max time kernel

136s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord_server.exe N/A

Reads user/profile data of web browsers

spyware stealer

Indicator Removal: File Deletion

defense_evasion

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\815566cfa896c06cff241371523c4acd_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\Discord_server.exe

"C:\Users\Admin\AppData\Local\Temp\Discord_server.exe"

C:\Users\Admin\AppData\Local\Temp\jinn_is.exe

"C:\Users\Admin\AppData\Local\Temp\jinn_is.exe"

C:\Users\Admin\AppData\Local\Temp\Discord_server.exe

"C:\Users\Admin\AppData\Local\Temp\Discord_server.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c del Loginvault.db

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.136.232:443 discord.com tcp
US 162.159.136.232:443 discord.com tcp
US 8.8.8.8:53 232.136.159.162.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 72.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Discord_server.exe

MD5 5b7338c1936cbc02c96853782903990c
SHA1 42923983bd7d1f1cbce712839b1591d29496df62
SHA256 40bf4ccd73037c1b67201a9a4c521f3c5d3fc5a472a92985eb0082deaa22c7b8
SHA512 fc12c23744c1c514a9916a303cfd80c162028e8079c59f9625f64640b595607605c8a49395698c9bf32fbd5891dbaafd4c0d7b26af026a13ede58f205fcd0eb9

C:\Users\Admin\AppData\Local\Temp\jinn_is.exe

MD5 0d4a53b05396e1e186439b2f22f3d684
SHA1 949f34684f891e98a709c06b4ec69a810a5ca5a9
SHA256 643518f0a7e0140b40c012836a4f505833773c56126dd40ea25c58ccde92b31f
SHA512 d2a18e51e70846f16c415b884304305a78b1ec878d040cd5afcee40af743dd19a526cfd77e5a5c73c78915a65979372209dccee1c97b702aeebdf83ef141bb4d

memory/2336-21-0x00007FF6531F0000-0x00007FF65322C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI29762\python39.dll

MD5 1d5e4c20a20740f38f061bdf48aaca4f
SHA1 de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0
SHA256 f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366
SHA512 9df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397

C:\Users\Admin\AppData\Local\Temp\_MEI29762\base_library.zip

MD5 c6b38adf85add9f9a7ea0b67eea508b4
SHA1 23a398ffdae6047d9777919f7b6200dd2a132887
SHA256 77479f65578cf9710981255a3ad5495d45f8367b2f43c2f0680fce0fed0e90fb
SHA512 d6abc793a7b6cc6138b50305a8c1cad10fa1628ca01a2284d82222db9bd1569959b05bdf4581d433ff227438131e43eec98bf265e746b17e76b1c9e9e21d447d

C:\Users\Admin\AppData\Local\Temp\_MEI29762\VCRUNTIME140.dll

MD5 18049f6811fc0f94547189a9e104f5d2
SHA1 dc127fa1ff0aab71abd76b89fc4b849ad3cf43a6
SHA256 c865c3366a98431ec3a5959cb5ac3966081a43b82dfcd8bfefafe0146b1508db
SHA512 38fa01debdb8c5369b3be45b1384434acb09a6afe75a50a31b3f0babb7bc0550261a5376dd7e5beac74234ec1722967a33fc55335b1809c0b64db42f7e56cdf7

C:\Users\Admin\AppData\Local\Temp\_MEI29762\_ctypes.pyd

MD5 7322f8245b5c8551d67c337c0dc247c9
SHA1 5f4cb918133daa86631211ae7fa65f26c23fcc98
SHA256 4fcf4c9c98b75a07a7779c52e1f7dff715ae8a2f8a34574e9dac66243fb86763
SHA512 52748b59ce5d488d2a4438548963eb0f2808447c563916e2917d08e5f4aab275e4769c02b63012b3d2606fdb5a8baa9eb5942ba5c5e11b7678f5f4187b82b0c2

C:\Users\Admin\AppData\Local\Temp\_MEI29762\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI29762\_socket.pyd

MD5 478abd499eefeba3e50cfc4ff50ec49d
SHA1 fe1aae16b411a9c349b0ac1e490236d4d55b95b2
SHA256 fdb14859efee35e105f21a64f7afdf50c399ffa0fa8b7fcc76dae4b345d946cb
SHA512 475b8d533599991b4b8bfd27464b379d78e51c41f497e81698b4e7e871f82b5f6b2bfec70ec2c0a1a8842611c8c2591133eaef3f7fc4bc7625e18fc4189c914e

C:\Users\Admin\AppData\Local\Temp\_MEI29762\select.pyd

MD5 fed3dae56f7c9ea35d2e896fede29581
SHA1 ae5b2ef114138c4d8a6479d6441967c170c5aa23
SHA256 d56542143775d02c70ad713ac36f295d473329ef3ad7a2999811d12151512931
SHA512 3128c57724b0609cfcaca430568d79b0e6abd13e5bba25295493191532dba24af062d4e0340d0ed68a885c24fbbf36b7a3d650add2f47f7c2364eab6a0b5faff

C:\Users\Admin\AppData\Local\Temp\_MEI29762\libcrypto-1_1.dll

MD5 89511df61678befa2f62f5025c8c8448
SHA1 df3961f833b4964f70fcf1c002d9fd7309f53ef8
SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
SHA512 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668

C:\Users\Admin\AppData\Local\Temp\_MEI29762\libssl-1_1.dll

MD5 50bcfb04328fec1a22c31c0e39286470
SHA1 3a1b78faf34125c7b8d684419fa715c367db3daa
SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
SHA512 370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685

C:\Users\Admin\AppData\Local\Temp\_MEI29762\_ssl.pyd

MD5 cf7886b3ac590d2ea1a6efe4ee47dc20
SHA1 8157a0c614360162588f698a2b0a4efe321ea427
SHA256 3d183c1b3a24d634387cce3835f58b8e1322bf96ab03f9fe9f02658fb17d1f8c
SHA512 b171f7d683621fdab5989bfed20c3f6479037035f334ea9a19feb1184f46976095a7666170a06f1258c6ddf2c1f8bdb4e31cbfd33d3b8fa4b330f097d1c09d81

C:\Users\Admin\AppData\Local\Temp\_MEI29762\_bz2.pyd

MD5 a991152fd5b8f2a0eb6c34582adf7111
SHA1 3589342abea22438e28aa0a0a86e2e96e08421a1
SHA256 7301fc2447e7e6d599472d2c52116fbe318a9ff9259b8a85981c419bfd20e3ef
SHA512 f039ac9473201d27882c0c11e5628a10bdbe5b4c9b78ead246fd53f09d25e74c984e9891fccbc27c63edc8846d5e70f765ca7b77847a45416675d2e7c04964fc

C:\Users\Admin\AppData\Local\Temp\_MEI29762\_lzma.pyd

MD5 cdd13b537dad6a910cb9cbb932770dc9
SHA1 b37706590d5b6f18c042119d616df6ff8ce3ad46
SHA256 638cd8c336f90629a6260e67827833143939497d542838846f4fc94b2475bb3e
SHA512 c375fb6914cda3ae7829d016d3084f3b5b9f78f200a62f076ec1646576f87694eec7fa6f1c99cbe30824f2fe6e2d61ecdeb50061383b12143cd2678004703199

C:\Users\Admin\AppData\Local\Temp\_MEI29762\sqlite3.dll

MD5 7b523ec0e5eaf72ba72a8601d82fb97d
SHA1 6ea37960e7b915deaffb42f942271627cc4e06e6
SHA256 3c206503837ce6c4a9fbec94678eba80114ee6506aa94b93c5dccc5911c48a73
SHA512 b48a5627afedffb0ad913b728b5cfa0f64ccede395b99504892846b41b7aac4dced46d9b1f5230d95b0e48784db522d300071e6bbb912f77893ae2eceb020712

C:\Users\Admin\AppData\Local\Temp\_MEI29762\_sqlite3.pyd

MD5 46d80e7c337787fa37c7b413b70c6c44
SHA1 7e714ddf236dc80b54200e7bd4b92573ffdc66e5
SHA256 638c284d9e4bf328971086e90a4c61483323fa4b2cae6100e4a22e4cdff65e2a
SHA512 b6dec4be48574c8b6928af00a94debfae20a18d61f7220c7e759432b9f4933b7cae787416e1f520547a35f2661fd8d770f627b337e8274a3aeaa4ac5fee338fb

C:\Users\Admin\AppData\Local\Temp\_MEI29762\python3.dll

MD5 ea3cd6ac4992ce465ee33dd168a9aad1
SHA1 158d9f8935c2bd20c90175164e6ca861a1dfeedb
SHA256 201f32a2492b18956969dc0417e2ef0ff14fdbf57fb07d77864ed36286170710
SHA512 ebae7c4d134a2db79938c219fa0156b32ec2b9a57a92877e9283ce19d36b40bf7048ca4d9743e1a1d811f6cb1c7339a6dd53c48df81838e5c962be39bf6d5d3b

C:\Users\Admin\AppData\Local\Temp\_MEI29762\_hashlib.pyd

MD5 88e2bf0a590791891fb5125ffcf5a318
SHA1 39f96abbabf3fdd46844ba5190d2043fb8388696
SHA256 e7aecb61a54dcc77b6d9cafe9a51fd1f8d78b2194cc3baf6304bbd1edfd0aee6
SHA512 7d91d2fa95bb0ffe92730679b9a82e13a3a6b9906b2c7f69bc9065f636a20be65e1d6e7a557bfd6e4b80edd0f00db92eb7fea06345c2c9b98176c65d18c4bdbf

C:\Users\Admin\AppData\Local\Temp\_MEI29762\cryptography\hazmat\bindings\_openssl.pyd

MD5 3f55712682ac3cc3c01131d946fe1f8d
SHA1 1339e820fb7765d57be51a7020d2bce54feefa7a
SHA256 40f5647c2f6183520adea109b6b5e17795065c5b9601e379f7b8259bcaa35767
SHA512 d2533207376d153c7f861d1e9b62f00cbd193ddfc51bbda182c20726ad116b8c6cb31c2b85efc13c41a581c1e6a5f803bbcb6814031ee77f64b2f41cd99fcf89

C:\Users\Admin\AppData\Local\Temp\_MEI29762\_cffi_backend.cp39-win_amd64.pyd

MD5 51740b093592af2fbeb5d675af5edc73
SHA1 5918e99a8c64c5abb915e7a998136ab514b828f3
SHA256 83ed202214d28d14125fdb760b7c6439f79c59c02bb3a39e7812f8d622c97ada
SHA512 877028a87653e4f46434f874018b400439456c9255da7d5e8919579a0bd2dcdc11974710089a671b9d7aa651ddf670ccaacab7612ce23876b44f13c73e4866f7

C:\Users\Admin\AppData\Local\Temp\_MEI29762\multidict\_multidict.cp39-win_amd64.pyd

MD5 d70507ffb5d2f6d527e32546fd138d0e
SHA1 3c43e86ac5afa6c4064b17fcaff45be5a2bbb9d3
SHA256 9fb82e21ee4f4d37d019b7053e6be4d9eed8c92cd12a3f7211125032c6e8cb22
SHA512 15933d164c1df23bfe8960a465b6ceedb34b765861ce8cc53bb87fe37745c59f8ee132891b5dc408278b8ad78d7c098f450291350c2e577436ebf2d49ac53faf

C:\Users\Admin\AppData\Local\Temp\_MEI29762\_asyncio.pyd

MD5 c89b5ec34a76d00543d55748a7275cb1
SHA1 341a61e181fc7957d326080354135e20d3d16fab
SHA256 3e521e119cfad53c8fcf67bbf26de2ecffe24cb13079f36a22339f0f8ad297a6
SHA512 b21514674bdb7ca392e35bfe1ecb3dbbe16bd8daf38fbeafb6182253551f3cdd37833df523ab6181555a6547f764224626fcb6403429decca1ed58dade2b01ef

C:\Users\Admin\AppData\Local\Temp\_MEI29762\_overlapped.pyd

MD5 071461aa318f97345f1f59a28cd4c110
SHA1 f4630cf01f27cd20d27a41a48708d27f03a61e37
SHA256 cd475a094ddbdc315c2a2072002b442d2e9fbd7aa0db3a037653acba74899ecd
SHA512 7cfbc92cb726c7f4b34e315303d9d983360d470ba1793529792122bdf2cc133c75e1c960a1b8602407743b3dfd7639153c226bc80f08afb5bd467f98194e722a

C:\Users\Admin\AppData\Local\Temp\_MEI29762\_uuid.pyd

MD5 054e24e81058045be333f2437e38f75a
SHA1 e4d958f57cb5269158975c0c94c4d70107748d0e
SHA256 36e15e9c7953c5fef0e83dafa86bf0d9fac2032d07c66e4a339deae8b1dca049
SHA512 09b55b016b291dbcb4bf6a36f3438e538b29f57306eb2048e994c3ec7bad8a44e06ff653d4cd6b9a637bb3e4d4eb5fdff8aabe1d45b74ef8bf089d643ea32278

C:\Users\Admin\AppData\Local\Temp\_MEI29762\unicodedata.pyd

MD5 cd12c15c6eef60d9ea058cd4092e5d1b
SHA1 57a7c0b0468f0be8e824561b45f86e0aa0db28dd
SHA256 e3ab6e5749a64e04ee8547f71748303ba159dd68dfc402cb69356f35e645badd
SHA512 514e76174f977cc73300bc40ff170007a444e743a39947d5e2f76e60b2a149c16d57b42b6a82a7fea8dd4e9addb3e876d8ab50ea1898ee896c1907667277cf00

C:\Users\Admin\AppData\Local\Temp\_MEI29762\yarl\_quoting_c.cp39-win_amd64.pyd

MD5 b9dbd65dd477f78e292494852ed9cfb8
SHA1 d0c78884460fc4fd9810a00c9cd728629db40da4
SHA256 e7af21ec47fa1aea28ecc7516b389102514e9e5720b4af89e7aa48b489d4a500
SHA512 ef139107342dbb251079a800f275dce170891b5ea829395b256adebee60cae4e14fc852a58b0f476b4b7d3d87cc180046e691a855e4edc62c1baace6b53ab96b

C:\Users\Admin\AppData\Local\Temp\_MEI29762\aiohttp\_helpers.cp39-win_amd64.pyd

MD5 6815a1c38a30d6ae70027184c09adccf
SHA1 ce5afe856c4445d173c0d524f139d1aed3cc4e65
SHA256 399dfeee9a2f8c6a132c2d4d28931f4c6c0f1d1394de54b182a6457d9143a418
SHA512 efd4fa17a9611ca4337cc667b164e83745bbc4043c226e684957146c9bc2ba37c892940845ec2ff0142d3fe604654a12bf05022782d0c0c3194e4d109b5ebf4f

C:\Users\Admin\AppData\Local\Temp\_MEI29762\aiohttp\_http_writer.cp39-win_amd64.pyd

MD5 1a518361de37d98224ff98bf47618ecf
SHA1 f81def8f71d203aaf68774f6e1158ccceb5806bc
SHA256 84e8b37d6fd0162610deb3c1d4887f70e6447850321eea846f860efc2862704b
SHA512 7ffef935ba56e2bbad0c569e63f5d33d83dfc72e10252ee259c6fff9859c4e302405a8c017012a9efa6da40ecc1de1ad3248a89404d8532b78b177a6d2ce305f

C:\Users\Admin\AppData\Local\Temp\_MEI29762\aiohttp\_http_parser.cp39-win_amd64.pyd

MD5 67946fe0102b3555988a8edd321946c0
SHA1 a93b16df8e9ccbfe2892e4676f58a695cde9604a
SHA256 636a925eb31c3a7de39cb9495613b13570606a0672d3e699cb6983287e0c01e3
SHA512 786a4e6c49f77bf6cffce5c98cbc66d518075309dacc4c3df286d3c3bc21f7c0cf7986bf85e374827ec7951c13acdd031e76c336bd1fb4fd265aa03a8a28dfd1

C:\Users\Admin\AppData\Local\Temp\_MEI29762\aiohttp\_websocket.cp39-win_amd64.pyd

MD5 5fdb53cff23dc82384c70db00ada94c0
SHA1 c52391eadeafe9933682c7dbee182200b0640688
SHA256 d1c463b5c7a878ef5358a63bb0ea9e87311fe1f416f762bd18b4888c170c647f
SHA512 2d81e2eed6b4f37c4178141a24cf4475d27378a5bad3b6f8af022b185050ee9832de5db31271e5ca6e5e397f2e8a2a36edf9ca7eb6e0a9b918e3e8618c22e60b

C:\Users\Admin\AppData\Local\Temp\_MEI29762\aiohttp\_frozenlist.cp39-win_amd64.pyd

MD5 f2454e08f168a9af3b6aabf41c5488e3
SHA1 3ba72153103db0292c555eba4f43f37bddd43a51
SHA256 6a563a4ddc233ed5f01f8635d590366b5a078ac73a28a82d837f24bec23dd14f
SHA512 3b2008e5ff3009664d7eeafffc3c8bfe420e337177a3f6926314773d65b6622a09b192e893ec50f0b366f356c9b4768358e352cba96127f85f529ce255eb8c93

C:\Users\Admin\AppData\Local\Temp\_MEI29762\_queue.pyd

MD5 f19d9a56df14aea465e7ead84751ea5f
SHA1 f170ccbeb8fb4a1e0fe56f9a7c20ae4c1a48e4a9
SHA256 17ccd37dfba38bba706189d12ed28ca32c7330cc60db7bf203bf7198287073e4
SHA512 2b69a11026bf4fe3792082d57eaf3b24713e7bd44dfd61ccaa6e5adb6771e49b6c81c1b542fbb159c9055db9739b9c4473a856914c72683a2a4cf658d6d7a469