Malware Analysis Report

2024-12-07 03:06

Sample ID 241113-svw9navcnq
Target BBGYP_CheatFn.exe
SHA256 eff9a43651bd1d423d107cfd0130776c3e463eef3eff735cc7c05a2ce749b763
Tags
pyinstaller upx spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

eff9a43651bd1d423d107cfd0130776c3e463eef3eff735cc7c05a2ce749b763

Threat Level: Shows suspicious behavior

The file BBGYP_CheatFn.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

pyinstaller upx spyware stealer

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Maps connected drives based on registry

UPX packed file

Detects Pyinstaller

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-13 15:27

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-13 15:27

Reported

2024-11-13 15:29

Platform

win7-20240708-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe

"C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe"

C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe

"C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI7842\python311.dll

MD5 600083f0167eb7d76a00d176dc798bec
SHA1 abca1beef2382dda441ca92d70ad342d0ece567b
SHA256 07b0227bb835d760153aab17ed5dfeb4837b771a387e9e5b25b1d6a0e9a4b315
SHA512 185fee16a619681e53ac5b3f77f4e5bc150c6f2467f4659f40540e4cd5a8b43f0e4e1bafc4a26c116bf1c43b7f884fcb7deed62196189b7567ea1bd598ce8f2c

memory/2000-128-0x000007FEF54B0000-0x000007FEF5A9A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-13 15:27

Reported

2024-11-13 15:30

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe"

Signatures

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBGYP_CheatFn.exe C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBGYP_CheatFn.exe C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3948 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe
PID 3948 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe
PID 4336 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\system32\cmd.exe
PID 4336 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\system32\cmd.exe
PID 4336 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\System32\Wbem\wmic.exe
PID 4336 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\System32\Wbem\wmic.exe
PID 4336 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\system32\cmd.exe
PID 4336 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\system32\cmd.exe
PID 4336 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\system32\cmd.exe
PID 4336 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\system32\cmd.exe
PID 1336 wrote to memory of 2916 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1336 wrote to memory of 2916 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4336 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\system32\cmd.exe
PID 4336 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\system32\cmd.exe
PID 3060 wrote to memory of 4464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3060 wrote to memory of 4464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4336 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\System32\Wbem\wmic.exe
PID 4336 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\System32\Wbem\wmic.exe
PID 4336 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe

"C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe"

C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe

"C:\Users\Admin\AppData\Local\Temp\BBGYP_CheatFn.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\System32\Wbem\wmic.exe

wmic csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "<Response [403]>"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nul

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nul

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName

C:\Windows\System32\Wbem\wmic.exe

wmic csproduct get uuid

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 rentry.co udp
US 172.67.75.40:443 rentry.co tcp
US 172.67.75.40:443 rentry.co tcp
US 172.67.75.40:443 rentry.co tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 40.75.67.172.in-addr.arpa udp
US 172.67.75.40:443 rentry.co tcp
US 172.67.75.40:443 rentry.co tcp
US 172.67.75.40:443 rentry.co tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.109.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:443 ipinfo.io tcp
US 172.67.75.40:443 rentry.co tcp
US 8.8.8.8:53 81.59.117.34.in-addr.arpa udp
US 34.117.59.81:443 ipinfo.io tcp
N/A 127.0.0.1:59757 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 232.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 24.73.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI39482\python311.dll

MD5 600083f0167eb7d76a00d176dc798bec
SHA1 abca1beef2382dda441ca92d70ad342d0ece567b
SHA256 07b0227bb835d760153aab17ed5dfeb4837b771a387e9e5b25b1d6a0e9a4b315
SHA512 185fee16a619681e53ac5b3f77f4e5bc150c6f2467f4659f40540e4cd5a8b43f0e4e1bafc4a26c116bf1c43b7f884fcb7deed62196189b7567ea1bd598ce8f2c

C:\Users\Admin\AppData\Local\Temp\_MEI39482\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

memory/4336-130-0x00007FF91D2D0000-0x00007FF91D8BA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\python3.dll

MD5 2ad3039bd03669f99e948f449d9f778b
SHA1 dae8f661990c57adb171667b9206c8d84c50ecad
SHA256 852b901e17022c437f8fc3039a5af2ee80c5d509c9ef5f512041af17c48fcd61
SHA512 8ffeaa6cd491d7068f9176fd628002c84256802bd47a17742909f561ca1da6a2e7c600e17cd983063e8a93c2bbe9b981bd43e55443d28e32dfb504d7f1e120c0

C:\Users\Admin\AppData\Local\Temp\_MEI39482\base_library.zip

MD5 66bcb4a60e261851aec16c46614c1107
SHA1 96e6f563f469c379914a77751e45f10c47528e21
SHA256 07e8ee46164946ca470112f89d4f18c47ede76701fc1a7816315bdcce5b538ff
SHA512 e369aaf12e70502b973a77a493f280d06c0e446e041d86f1e392fc8d608e0452ff074faafa5d318dfcd1bd4adbeb99002dac8e44c81dc0e87a4ed595c9820da3

C:\Users\Admin\AppData\Local\Temp\_MEI39482\pyexpat.pyd

MD5 07512b1bdbf8409e9e82364525275c99
SHA1 f5a80ce3b04cc5377df3bd0452e21e4181fa55c8
SHA256 d4bc9aed13f5577675d48d036df852e88a42d69e1138b4b2ff02f17df4b5c02e
SHA512 ad77c0d21fb07f21a54aced592167477d7aba455646a4621ddf106f2a11ad02fc58a48b032750476bb16931fc7cd4221843b0e4a6ccdc2b1b03eb1e9f5b70d67

memory/4336-186-0x00007FF92C790000-0x00007FF92C7A5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_overlapped.pyd

MD5 aad03482b928d4152089152efe483f8b
SHA1 c22981f52e976ab7457278f46ad39ee00739fdb7
SHA256 9c4ee52720e097cfc627c1629e3afebbfb2e9182e7a1f0db44a15207ac2e8831
SHA512 34545064ebf696a33ee7cc9096e75f7dbd0d8a907b04eaf1cc470232252afc66a03a269aa324469e5f7755d58c7d67838ee6b85da987f85354ac92a9f197c18e

memory/4336-188-0x00007FF92C400000-0x00007FF92C412000-memory.dmp

memory/4336-185-0x00007FF92C420000-0x00007FF92C455000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\sqlite3.dll

MD5 fee21b277967bf94f1140275f1e6148e
SHA1 7b2722c0ca0cd72fc78b35a33f42ae7d9755965e
SHA256 eb801bf47ed8538e9230d92d47da92e1d3875b95f852f1c38d7786293be98331
SHA512 2a68a3a8a165b3a6b5233d5442285a3db53518a8a241a7ad4b0ae63610589630100b1d719bf4632c3c95cfd680f6bef958557c3b9e41a2559d13ce9492fd7798

memory/4336-193-0x00007FF91C9C0000-0x00007FF91CB2F000-memory.dmp

memory/4336-191-0x00007FF92C3D0000-0x00007FF92C3F3000-memory.dmp

memory/4336-190-0x00007FF930550000-0x00007FF930569000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_sqlite3.pyd

MD5 c3e3d43a5f3c47e137a383b20cd0290e
SHA1 237e2f9eb3b7465d9eff1efab2f7757230dd1a56
SHA256 cde7050edc1e0adb7e125b3425787c877a5be8dd718acd61e55774eaa83d312d
SHA512 1e3bdd090366660739d9312ee4ae05edf1d388462d64d17e85d2997e8e1a09eabd58a83ff9c808a5d4a2de5e7effbbe194ac8590c713fe0a9bed170c74b7e5af

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_asyncio.pyd

MD5 92746d6e2028bd38d9745f9c4045d0f8
SHA1 fbdc40ab6efb9c298595aa5df48ff80120ec2573
SHA256 fc61e713b023e17b0630ff688d0bf932e3c4c9b4d4429fe2a25832352af2036f
SHA512 bd3046d04f9326abc0b1511b4b829ece44409b643db6c30f1b25567d89b0caa92fb8f13b259227020e3c2f53e50289ef2aaf4f99837b783ee48424a16ff4fe8d

C:\Users\Admin\AppData\Local\Temp\_MEI39482\jaraco\text\Lorem ipsum.txt

MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24

memory/4336-181-0x00007FF92CF90000-0x00007FF92CFB3000-memory.dmp

memory/4336-180-0x00007FF92C170000-0x00007FF92C228000-memory.dmp

memory/4336-179-0x00007FF92C7B0000-0x00007FF92C7DE000-memory.dmp

memory/4336-178-0x00007FF91D2D0000-0x00007FF91D8BA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\libssl-1_1.dll

MD5 6e53647fe8e3a58b0da311a6d1b6b682
SHA1 f75631d29f9d869b38c36b6854da7ca0199e03ac
SHA256 9ec69488f5d80b96a349552caae9a362c1938b89f6584a0f36060de9decd7f82
SHA512 4c01494f27588cd9840ae4b83f14185b846ace4a97cd2d6c054fd34194963d19213ead934c43a19fb9b40166bedea656b5492f440fc7921071bf2f6c79a0708f

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_ssl.pyd

MD5 d9524d0eb4215e5c77b039d5f8a23ace
SHA1 3e81c5c8256fd9e346f74b943480c160a5ac7ed1
SHA256 57b2203b4664c41a38c82088c43b2e9212b34bff45662600ef15939a53e43d34
SHA512 c18ff3c704986148d41053c11dc9eaf91a59486de19b2bfd8164eef8713994675a11af15bc359791e53af75754c4cbdb80edcd486751c73b037290e9e83ff648

memory/4336-175-0x00007FF91CB30000-0x00007FF91CEA5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\libcrypto-1_1.dll

MD5 46edee4fdfb9b727f4382e3483082253
SHA1 08b89604e013e90057f2aad73527d564f745695e
SHA256 574e07c1a0587b8edc5d91a91f6050fd11f28f6f70e6b589451b0657d189e67b
SHA512 63bed16feea3a4ad980ff4c1f84cfb4dbd98a43e9d212f57c6dfd73e12af9ff317935a4e59ab4de5749ce5360fedff79d22c14df71b0ae85735fb1b715c435a4

memory/4336-173-0x00007FF92C880000-0x00007FF92C894000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_hashlib.pyd

MD5 2dbf8c391a7c28ae23f30a0261cca828
SHA1 9aea0cf3f0f67166201bec9131c703db4aa730c3
SHA256 2ea2ae22c7acbcc6fb3318505ffa4d6e88593915ba5ae7e9bb48990110a6c47f
SHA512 c7695db0bb18fd149862f002b53244de3c30cb92aecf854485e01bbdd33058037f9ded5d75349cc31b1867e21b14868dfcbe771af64b29706711c9f7485d2295

memory/4336-171-0x00007FF92C8A0000-0x00007FF92C8AD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_brotli.cp311-win_amd64.pyd

MD5 f7fa546c602ec2c0f1b9fcaf51237b45
SHA1 2756cdb4b454577b198831697af1bb7ef9652f3d
SHA256 88901438672fc2b46a8b3541ef3a443d1fa587a34a4fa1b4147d625c7aa86b0b
SHA512 b2606dfa20a61a34be84000da1342e6daa5fe2e0fda3fd51c150fcb7afac4fac1af7f109d7808f5dec2c30cf3972d2b8df16e797647e9a26e3a3ed2f08aa271f

memory/4336-200-0x00007FF91C430000-0x00007FF91C4B7000-memory.dmp

memory/4336-202-0x00007FF91C310000-0x00007FF91C42C000-memory.dmp

memory/4336-204-0x00007FF924E00000-0x00007FF924E37000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_cffi_backend.cp311-win_amd64.pyd

MD5 f5a0e3f73ad4002839a85ec9b5285cc0
SHA1 2657e49964491d8b0784ab6ae157c767cf809673
SHA256 34dff4546abf4cd9d1e605f215339e6816c3aa4ef3c6028afcf00cb6241dbccf
SHA512 81d683f45b6ea1b48d0e377779c9b87ddff5b8549f00ae375ebe617fbd00d0149639a2b5c1b42ea536bde786aea50025646311b3de243c48ed192014dcc9974b

memory/4336-201-0x00007FF91CB30000-0x00007FF91CEA5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\unicodedata.pyd

MD5 9a67dba02c85895307464d058c3934a8
SHA1 b8be6e8a98c894f4849212c52e244f8153f71023
SHA256 fd61dfc97d72fa70ac767fe92f43e49a165017a80fad8c9e75c8eca569fc9186
SHA512 4b918af58a346f9f9014e0138c2838e17d182329df5b5f7caf28cde7f29b76d0763ac9b727a8bf757220d3fb0be66915bd8ee3d8414f416cd7ff56f99a2be14f

memory/4336-198-0x00007FF92C880000-0x00007FF92C894000-memory.dmp

memory/4336-197-0x00007FF91C4C0000-0x00007FF91C58F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\zstandard\backend_c.cp311-win_amd64.pyd

MD5 1604e9442e25b58376e370c33518cc80
SHA1 0bb8ff1cf47d5db3e413965a8964a391a7a19f9c
SHA256 cb400ea4c1949215aee3be519daca9d82c41e8f2ebfc7441d866326cf196fbe6
SHA512 2122b5db09351715a5b06f39d3870e3298905a2f6826a4a0f960268d116add200389b2add83f6c3d492c1cc792a895d813f2ca8eb8441e69c7a394cbffddfc72

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_queue.pyd

MD5 0201b12dbd9cfd06560b9be14d3adf18
SHA1 80ad435fa1cddfc7f084d030890b35127a2196bf
SHA256 11b46d4e0a8a73d641348929b0e161226863263f198976894da876ba6e0f3ecc
SHA512 3ffed526232d8a6ee8082b4246441e9e83fadacf7a0cd19fe08a1c7b2cf7f05f94f06bc0694c31cd58e4aaaa5e9568250ee4a1e1cfbe6e34d112a672d8dda268

memory/4336-169-0x00007FF9307B0000-0x00007FF9307BD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\select.pyd

MD5 c182227a4502e0f4cfab6eeb9df58fdf
SHA1 b24463ddbc1ffcf0ae6c9987d3b8942bb0ad3d0a
SHA256 7383bb342323af6a6ed6f6aa61c1cbcd0e7c0cef91210591fb31ced4151af35c
SHA512 f7cda367fe92401c8390e7c65242d5b74734c702e61baa5015c7748433808b2f752d38c4850334254fba2ff3f7dcd18af84b165c9bd5c2adb718db02e6feee9c

memory/4336-167-0x00007FF930550000-0x00007FF930569000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_socket.pyd

MD5 c632c5341ccaacf3313e74cf52b90a7a
SHA1 f9cd533e0d3c7483580618ff8686f20f6706955f
SHA256 9ed980bc8a81268f00d22ad030c794fda834bad3e27934c6a3ccaa1c20276943
SHA512 488c02872d171dc8dd7a53f8b2f42b71ca1e67bf51c622a2bf04f1b5d184d3cca6ba058e26d5b1514673e33499b2cb1c1cc5ab7e089985e02116c5d88653855c

memory/4336-165-0x00007FF92C8B0000-0x00007FF92C8DD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_multiprocessing.pyd

MD5 33aebc39ef5520e386672dc37b4a985b
SHA1 29d78f90a8f6852e68c18d6b5404db94d5ce7d5b
SHA256 c105bb87ae2edd6054cfc24e6e2400f42c779dacb7be34ebd889371a93994fb8
SHA512 de430c8aaba4f50d21304a30058472d4df6077ea534abb48d85e537bffdb504b6131a24b67e127eaabc240049bf9c02a4bcb2e7cfdfb2cde9c1a182fc745dd57

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_elementtree.pyd

MD5 c21ec592d58223692c335eb83beb559d
SHA1 ca2499b7a5b4e413404cee3cc78399094f568b0a
SHA256 62407380d44966e30734adef8e9d970a05a2bc3d4291cd88842a9b9d1c508342
SHA512 aacadb770d9e9d47ccb921738ef237e22a1207085b445d8338e664dab62e38b985907bc53e3b79aa41e3e10c3a4c4d52ac93aa383fd42c23358c97a891841c91

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_decimal.pyd

MD5 80a4662f7b4160fd8f3111a6aa05d862
SHA1 b2d556caff2a33c9ddc2f3107cb349d5109ea22d
SHA256 d9713f8ac34534670d07ee27f87ee66761e1d9c7592dc060b68d553749673b39
SHA512 b07ed0315da64ac9bd4dbfada8b7e288b5c0b6e0201e9dd1f4f42fae26e76b5fade0850086d2bc87100bff406e6a65dce77a60de65a35a97a81a246e86e967b3

C:\Users\Admin\AppData\Local\Temp\_MEI39482\VCRUNTIME140_1.dll

MD5 bba9680bc310d8d25e97b12463196c92
SHA1 9a480c0cf9d377a4caedd4ea60e90fa79001f03a
SHA256 e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
SHA512 1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_lzma.pyd

MD5 53adc32731b50f6c11a6c79a7c8af086
SHA1 f3fe58d4a45dea74026c8928cbf0ae9bdbb74401
SHA256 66bf64cddb47b932c4568b8f358408f11c060c6c716be691fbdf7cb06490056b
SHA512 104b472b6a35e5e5a0fef85fec11273811c79784d69d2f669ae8ac696b42960e265b085c892cdaac394ca25147abab70b90062046d3c0844c6082fb7ca07abd6

memory/4336-144-0x00007FF930950000-0x00007FF930969000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_bz2.pyd

MD5 7e8f4caaedb136ee6415e791359e47f9
SHA1 68078b9a3ab2cc9bc1337860bb272179c5d5b403
SHA256 b5d4829624da541501530b0e4da9d78c147f52584ebfeda99950e923610dd1a1
SHA512 1b7ca2cdda19059fe01243949d107049d3e27dfe62657f1e5cb9c47882cf39b82e94cf571985e6bb2839ba6c729501b9cf25ead5edcc9ba6118f43eb980fd6b7

memory/4336-140-0x00007FF935D60000-0x00007FF935D6F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\libffi-8.dll

MD5 1d1134ecdff503c92f4a6e6a92de5eea
SHA1 9c0ed5efc502f199c84c8d8abccac0527e772fa0
SHA256 c583735e55dbf41f5be9d9e1045ab7a2736779f1222a75ba09997acfaf2f57b9
SHA512 1ed08592327f81d7ba428ae3291775334b20b2afab9ee4725e7998854919f2afd544353d19b578658d3e8728ecb9795a49e3543cca9c428af9046c4092012353

memory/4336-138-0x00007FF92CF90000-0x00007FF92CFB3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\_ctypes.pyd

MD5 4683b3ff9fb8b7eed8441058a5ba31bd
SHA1 9c83c422d1f6bd7942962fc1cc8ff3e13a2e52b5
SHA256 f96c3f11fe6807cc74dfd6d46e3777b37d3bf7359d53838e0890fad379b11b91
SHA512 42b1ec74a748a406e85b89769143e20f5a366315ad95e9bcdca5057d61f5e3fafa9698e941efdcf294d89982274c7e96c8cc59489ea42553bd8887a5a1547bad

C:\Users\Admin\AppData\Local\Temp\_MEI39482\psutil\_psutil_windows.pyd

MD5 7c3b605ada78bec472664bbbc95fba7c
SHA1 f8168b5042d916222d8e9e78ff7868ba9608bb84
SHA256 9f08a32b403b7649287f237fc5f6a09bf442ae35b015f9a0b4100bd6e2e2626b
SHA512 8579fd179cd91c39a81c06aba99c48a8e4e0392e9d649bc648e84ec397233dad42d4cd5ea7247f466843d0d6c1393df6225615f554506f24c47b558c44daf315

memory/4336-207-0x00007FF92C5A0000-0x00007FF92C5B8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\certifi\cacert.pem

MD5 ea4ee2af66c4c57b8a275867e9dc07cd
SHA1 d904976736e6db3c69c304e96172234078242331
SHA256 fa883829ebb8cd2a602f9b21c1f85de24cf47949d520bceb1828b4cd1cb6906c
SHA512 4114105f63e72b54e506d06168b102a9130263576200fb21532140c0e9936149259879ac30a8b78f15ae7cb0b59b043db5154091312da731ac16e67e6314c412

C:\Users\Admin\AppData\Local\Temp\_MEI39482\win32\win32gui.pyd

MD5 26750b3304aa9b0e5dd279b7d883da3b
SHA1 ca990c6220054e979fad8e61ccddba0003b412ed
SHA256 ef33493e97a3da3a9f63dd31fb4e7a5eb78c8ffd04b515444d9f9ec9be374509
SHA512 ad9afe119e1d68a8a0e0a9c11a668a05e61abfa5a382eb5e5b275cbd683364c648ced45cb9894d2ca1372796ddb2b6215fa77819e58bba0c123b959e6316c766

memory/4336-212-0x00007FF92C790000-0x00007FF92C7A5000-memory.dmp

memory/4336-217-0x00007FF91C990000-0x00007FF91C9BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\pywin32_system32\pywintypes311.dll

MD5 a3591e9c249a49030ee7a6784c2e27c1
SHA1 43268517bd27a8030bce9bc39108a5ccc86b9414
SHA256 e65985c1109890acb598b7bbdd5d7a1efc3580b681143d9030710493e5ea2334
SHA512 40bc55f6bcb8c54874cd86b93c15e328bf65651dcfbaf494fc7b506e200bafd00d0915d9dcf54786aadd901c6f99e11fdfd2274a3c6388e38a398f21a1900131

memory/4336-213-0x00007FF924E50000-0x00007FF924E8F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI39482\win32\win32api.pyd

MD5 f9e700ba7b288f8bbb27dd13ae8531bd
SHA1 2acad8b8621f3bc8a7607f5dfdefefd53456e6ec
SHA256 159e8b4f95468dd4ba6bb1766bdca866913f6f2255cd8aa403a74b990691a793
SHA512 49f15ec2c6744235d13393fbc569a8d97ce31ca7e2752bb4eac708aaed603c4135fe0da2883c084fe0200e7e9dddebaaf8fe8cc930515b7477e200d2cdedc51b

memory/4336-220-0x00007FF91C960000-0x00007FF91C98B000-memory.dmp

memory/4336-222-0x00007FF91C940000-0x00007FF91C956000-memory.dmp

memory/4336-221-0x00007FF92C3D0000-0x00007FF92C3F3000-memory.dmp

memory/4336-223-0x00007FF91C9C0000-0x00007FF91CB2F000-memory.dmp

memory/4336-226-0x00007FF91C930000-0x00007FF91C93C000-memory.dmp

memory/4336-229-0x00007FF924E40000-0x00007FF924E4B000-memory.dmp

memory/4336-232-0x00007FF91C770000-0x00007FF91C77E000-memory.dmp

memory/4336-231-0x00007FF91C900000-0x00007FF91C90D000-memory.dmp

memory/4336-235-0x00007FF924E00000-0x00007FF924E37000-memory.dmp

memory/4336-234-0x00007FF91C750000-0x00007FF91C75B000-memory.dmp

memory/4336-233-0x00007FF91C760000-0x00007FF91C76C000-memory.dmp

memory/4336-236-0x00007FF91C740000-0x00007FF91C74B000-memory.dmp

memory/4336-230-0x00007FF924DF0000-0x00007FF924DFC000-memory.dmp

memory/4336-238-0x00007FF91C730000-0x00007FF91C73C000-memory.dmp

memory/4336-237-0x00007FF924E50000-0x00007FF924E8F000-memory.dmp

memory/4336-228-0x00007FF91C910000-0x00007FF91C91C000-memory.dmp

memory/4336-227-0x00007FF91C920000-0x00007FF91C92B000-memory.dmp

memory/4336-225-0x00007FF9234B0000-0x00007FF9234BB000-memory.dmp

memory/4336-224-0x00007FF925BE0000-0x00007FF925BEB000-memory.dmp

memory/4336-241-0x00007FF91C710000-0x00007FF91C71D000-memory.dmp

memory/4336-240-0x00007FF91C720000-0x00007FF91C72B000-memory.dmp

memory/4336-239-0x00007FF91C990000-0x00007FF91C9BE000-memory.dmp

memory/4336-242-0x00007FF91C6F0000-0x00007FF91C702000-memory.dmp

memory/4336-243-0x00007FF91C6E0000-0x00007FF91C6EC000-memory.dmp

memory/4336-244-0x00007FF91BC60000-0x00007FF91BEA9000-memory.dmp

memory/4336-245-0x00007FF91C6B0000-0x00007FF91C6D9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e1srm0or.s10.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3616-257-0x00000152FF580000-0x00000152FF5A2000-memory.dmp

memory/4336-258-0x00007FF91C750000-0x00007FF91C75B000-memory.dmp

memory/4336-294-0x00007FF91D2D0000-0x00007FF91D8BA000-memory.dmp

memory/4336-311-0x00007FF91C4C0000-0x00007FF91C58F000-memory.dmp

memory/4336-308-0x00007FF92C400000-0x00007FF92C412000-memory.dmp

memory/4336-307-0x00007FF92C790000-0x00007FF92C7A5000-memory.dmp

memory/4336-305-0x00007FF92C170000-0x00007FF92C228000-memory.dmp

memory/4336-304-0x00007FF92C7B0000-0x00007FF92C7DE000-memory.dmp

memory/4336-303-0x00007FF91CB30000-0x00007FF91CEA5000-memory.dmp

memory/4336-299-0x00007FF930550000-0x00007FF930569000-memory.dmp

memory/4336-295-0x00007FF92CF90000-0x00007FF92CFB3000-memory.dmp

memory/4336-323-0x00007FF91BC60000-0x00007FF91BEA9000-memory.dmp

memory/4336-324-0x00007FF91C6B0000-0x00007FF91C6D9000-memory.dmp

memory/4336-326-0x00007FF92CF90000-0x00007FF92CFB3000-memory.dmp

memory/4336-327-0x00007FF935D60000-0x00007FF935D6F000-memory.dmp

memory/4336-329-0x00007FF92C8B0000-0x00007FF92C8DD000-memory.dmp

memory/4336-334-0x00007FF91CB30000-0x00007FF91CEA5000-memory.dmp

memory/4336-325-0x00007FF91D2D0000-0x00007FF91D8BA000-memory.dmp

memory/4336-336-0x00007FF92C170000-0x00007FF92C228000-memory.dmp

memory/4336-341-0x00007FF91C9C0000-0x00007FF91CB2F000-memory.dmp

memory/4336-348-0x00007FF91C990000-0x00007FF91C9BE000-memory.dmp

memory/4336-350-0x00007FF91C940000-0x00007FF91C956000-memory.dmp

memory/4336-349-0x00007FF91C960000-0x00007FF91C98B000-memory.dmp

memory/4336-352-0x00007FF91C6B0000-0x00007FF91C6D9000-memory.dmp

memory/4336-351-0x00007FF91BC60000-0x00007FF91BEA9000-memory.dmp

memory/4336-347-0x00007FF924E50000-0x00007FF924E8F000-memory.dmp

memory/4336-346-0x00007FF92C5A0000-0x00007FF92C5B8000-memory.dmp

memory/4336-345-0x00007FF924E00000-0x00007FF924E37000-memory.dmp

memory/4336-344-0x00007FF91C310000-0x00007FF91C42C000-memory.dmp

memory/4336-343-0x00007FF91C430000-0x00007FF91C4B7000-memory.dmp

memory/4336-342-0x00007FF91C4C0000-0x00007FF91C58F000-memory.dmp

memory/4336-340-0x00007FF92C3D0000-0x00007FF92C3F3000-memory.dmp

memory/4336-339-0x00007FF92C400000-0x00007FF92C412000-memory.dmp

memory/4336-338-0x00007FF92C790000-0x00007FF92C7A5000-memory.dmp

memory/4336-337-0x00007FF92C420000-0x00007FF92C455000-memory.dmp

memory/4336-335-0x00007FF92C7B0000-0x00007FF92C7DE000-memory.dmp

memory/4336-333-0x00007FF92C880000-0x00007FF92C894000-memory.dmp

memory/4336-332-0x00007FF92C8A0000-0x00007FF92C8AD000-memory.dmp

memory/4336-331-0x00007FF9307B0000-0x00007FF9307BD000-memory.dmp

memory/4336-330-0x00007FF930550000-0x00007FF930569000-memory.dmp

memory/4336-328-0x00007FF930950000-0x00007FF930969000-memory.dmp