Analysis Overview
SHA256
fdb9f742ec550af9a8ca330f0a1d3aa012b1df6348e8182a52b6aac0f74a781b
Threat Level: Known bad
The file ElectronV3.exe was found to be: Known bad.
Malicious Activity Summary
Exela Stealer
Exelastealer family
Grants admin privileges
Modifies Windows Firewall
Loads dropped DLL
Reads user/profile data of web browsers
Clipboard Data
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Network Service Discovery
UPX packed file
Enumerates processes with tasklist
Hide Artifacts: Hidden Files and Directories
Launches sc.exe
System Network Connections Discovery
Permission Groups Discovery: Local Groups
Detects Pyinstaller
System Network Configuration Discovery: Wi-Fi Discovery
Unsigned PE
Browser Information Discovery
Event Triggered Execution: Netsh Helper DLL
Runs net.exe
Gathers network information
Collects information from the system
Suspicious behavior: EnumeratesProcesses
Detects videocard installed
Gathers system information
Scheduled Task/Job: Scheduled Task
Views/modifies file attributes
Uses Task Scheduler COM API
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-11-24 00:18
Signatures
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-24 00:18
Reported
2024-11-24 00:19
Platform
win10ltsc2021-20241023-en
Max time kernel
21s
Max time network
30s
Command Line
Signatures
Exela Stealer
Exelastealer family
Grants admin privileges
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Clipboard Data
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Network Service Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\ARP.EXE | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
Hide Artifacts: Hidden Files and Directories
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
Browser Information Discovery
Event Triggered Execution: Netsh Helper DLL
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
| Key value enumerated | \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh | C:\Windows\system32\netsh.exe | N/A |
Permission Groups Discovery: Local Groups
System Network Configuration Discovery: Wi-Fi Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
System Network Connections Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NETSTAT.EXE | N/A |
Collects information from the system
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Gathers network information
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NETSTAT.EXE | N/A |
| N/A | N/A | C:\Windows\system32\ipconfig.exe | N/A |
Gathers system information
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\systeminfo.exe | N/A |
Runs net.exe
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"
C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "gdb --version"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get Manufacturer
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
C:\Windows\System32\Wbem\WMIC.exe
wmic path Win32_ComputerSystem get Manufacturer
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
C:\Windows\system32\attrib.exe
attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "schtasks /query /TN "ExelaUpdateService""
C:\Windows\system32\schtasks.exe
schtasks /query /TN "ExelaUpdateService"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
C:\Windows\system32\schtasks.exe
schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\system32\mshta.exe
mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
C:\Windows\system32\cmd.exe
cmd.exe /c chcp
C:\Windows\system32\chcp.com
chcp
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe Get-Clipboard
C:\Windows\system32\cmd.exe
cmd.exe /c chcp
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\chcp.com
chcp
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
C:\Windows\system32\netsh.exe
netsh wlan show profiles
C:\Windows\system32\systeminfo.exe
systeminfo
C:\Windows\system32\HOSTNAME.EXE
hostname
C:\Windows\System32\Wbem\WMIC.exe
wmic logicaldisk get caption,description,providername
C:\Windows\system32\net.exe
net user
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user
C:\Windows\system32\query.exe
query user
C:\Windows\system32\quser.exe
"C:\Windows\system32\quser.exe"
C:\Windows\system32\net.exe
net localgroup
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup
C:\Windows\system32\net.exe
net localgroup administrators
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup administrators
C:\Windows\system32\net.exe
net user guest
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user guest
C:\Windows\system32\net.exe
net user administrator
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user administrator
C:\Windows\System32\Wbem\WMIC.exe
wmic startup get caption,command
C:\Windows\system32\tasklist.exe
tasklist /svc
C:\Windows\system32\ipconfig.exe
ipconfig /all
C:\Windows\system32\ROUTE.EXE
route print
C:\Windows\system32\ARP.EXE
arp -a
C:\Windows\system32\NETSTAT.EXE
netstat -ano
C:\Windows\system32\sc.exe
sc query type= service state= all
C:\Windows\system32\netsh.exe
netsh firewall show state
C:\Windows\system32\netsh.exe
netsh firewall show config
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.32.126.40.in-addr.arpa | udp |
| N/A | 127.0.0.1:49927 | tcp | |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| N/A | 127.0.0.1:49938 | tcp | |
| N/A | 127.0.0.1:49943 | tcp | |
| N/A | 127.0.0.1:49950 | tcp | |
| N/A | 127.0.0.1:49952 | tcp | |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.138.232:443 | discord.com | tcp |
| US | 162.159.138.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | api.gofile.io | udp |
| FR | 45.112.123.126:443 | api.gofile.io | tcp |
| US | 8.8.8.8:53 | 232.138.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | store1.gofile.io | udp |
| FR | 45.112.123.227:443 | store1.gofile.io | tcp |
| US | 8.8.8.8:53 | 126.123.112.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.123.112.45.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI34162\python310.dll
| MD5 | fc7bd515b12e537a39dc93a09b3eaad6 |
| SHA1 | 96f5d4b0967372553cb106539c5566bc184f6167 |
| SHA256 | 461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164 |
| SHA512 | a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122 |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\VCRUNTIME140.dll
| MD5 | 870fea4e961e2fbd00110d3783e529be |
| SHA1 | a948e65c6f73d7da4ffde4e8533c098a00cc7311 |
| SHA256 | 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644 |
| SHA512 | 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88 |
memory/884-51-0x00007FF90FDE0000-0x00007FF91024E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI34162\base_library.zip
| MD5 | 5c712503cdf703ab569b2397371c9723 |
| SHA1 | 07d5109714feee34f7386072ac87f3f70289cab6 |
| SHA256 | a995fcaada1fc114583e23d14dd0f5deeb03edda005c9d57934346fc66837841 |
| SHA512 | c6a51c9e4e9aadde6bebb564181fb72928ec42ff3aed1833bb4676871eaf398b497bc03a0f1cdfbbd7545585d438763d19a5411ea5bcf021383fad1124307596 |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_ctypes.pyd
| MD5 | 4b90108fabdd64577a84313c765a2946 |
| SHA1 | 245f4628683a3e18bb6f0d1c88aa26fb959ed258 |
| SHA256 | e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1 |
| SHA512 | 91fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\python3.DLL
| MD5 | c17b7a4b853827f538576f4c3521c653 |
| SHA1 | 6115047d02fbbad4ff32afb4ebd439f5d529485a |
| SHA256 | d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68 |
| SHA512 | 8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7 |
memory/884-81-0x00007FF928A20000-0x00007FF928A2F000-memory.dmp
memory/884-80-0x00007FF923A80000-0x00007FF923AA4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_uuid.pyd
| MD5 | 59cfd9669367517b384922b2485cb6a7 |
| SHA1 | 1bd44298543204d61d4efd2cd3980ad01071360d |
| SHA256 | e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f |
| SHA512 | d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665 |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_ssl.pyd
| MD5 | 7e9d95ac47a2284706318656b4f711d3 |
| SHA1 | f085104709201c6e64635aeacf1da51599054e55 |
| SHA256 | 38dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9 |
| SHA512 | 294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118 |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_sqlite3.pyd
| MD5 | e7d68df8f65fbb0298a45519e2336f32 |
| SHA1 | ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d |
| SHA256 | 2473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79 |
| SHA512 | 626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_socket.pyd
| MD5 | 53e72716073038c1dd1db65bfdb1254c |
| SHA1 | 7bf220a02a3b51aa51300b3a9ea7fa48358ca161 |
| SHA256 | e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d |
| SHA512 | c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941 |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_queue.pyd
| MD5 | 5c4c43763fb1a796134aa5734905c891 |
| SHA1 | 44a5e1ae4806406a239129d77888bd87d291a410 |
| SHA256 | 4edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c |
| SHA512 | 07bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_overlapped.pyd
| MD5 | 5c1441f6ee11632183a83dac2d22853b |
| SHA1 | eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2 |
| SHA256 | 104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf |
| SHA512 | e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595 |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_multiprocessing.pyd
| MD5 | 4fbc5fd5da9da74c04fe0374387b34d3 |
| SHA1 | 1e9c98db0486f98fb7d8eb9fa57a949494b649b5 |
| SHA256 | b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950 |
| SHA512 | ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_lzma.pyd
| MD5 | 8edbeeccb6f3dbb09389d99d45db5542 |
| SHA1 | f7e7af2851a5bf22de79a24fe594b5c0435fca8a |
| SHA256 | 90701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f |
| SHA512 | 2a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501 |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_hashlib.pyd
| MD5 | 3b5530f497ff7c127383d0029e680c35 |
| SHA1 | fb5dc554bb9ff49622184cc16883a7567115c7ca |
| SHA256 | 5971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573 |
| SHA512 | 12ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_decimal.pyd
| MD5 | 20985dc78dbd1992382354af5ca28988 |
| SHA1 | 385a3e7a7654e5e4c686399f3a72b235e941e311 |
| SHA256 | f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43 |
| SHA512 | 61b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8 |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_cffi_backend.cp310-win_amd64.pyd
| MD5 | 7727212e7bdbf63b1a39fb7faad24265 |
| SHA1 | a8fdec19d6690081b2bf55247e8e17657a68ac97 |
| SHA256 | b0116303e1e903d6eb02a69d05879f38af1640813f4b110cb733ffff6e4e985c |
| SHA512 | 2b1a27642118dd228791d0d8ba307aa39ab2d9c7d3799cff9f3c0744fe270eeaefe5545a4fda6e74e86fee747e45bf5f6c9ac799950c2b483a16eb3ce85d816a |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_bz2.pyd
| MD5 | 6250a28b9d0bfefc1254bd78ece7ae9f |
| SHA1 | 4b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd |
| SHA256 | 7d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b |
| SHA512 | 6d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7 |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_brotli.cp310-win_amd64.pyd
| MD5 | 94c13e0636646019a4c7d405c2d919df |
| SHA1 | 8ed8519e9b310f59e5b40f3c8fb675791cae09f9 |
| SHA256 | 10517c02bb69dafd60053152e65d00c02e24952f63ca230af807ec6b2053f2a6 |
| SHA512 | 82fba52c4db4206f7a1ebb1a3ebf12fc60f3deff4763fd5a059b00f46aa7513279da994a815a0883ce3301c3cdd1d20923db21b926c43b2ee732c28852979945 |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\_asyncio.pyd
| MD5 | 7d4f9a2b793e021f7e37b8448751ed4e |
| SHA1 | 0ea07b5024501aad5008655cfeae6d96b5da957a |
| SHA256 | 2293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4 |
| SHA512 | af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26 |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\unicodedata.pyd
| MD5 | fed35db31377d515d198e5e446498be2 |
| SHA1 | 62e388d17e17208ea0e881ccd96c75b7b1fbc5f7 |
| SHA256 | af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b |
| SHA512 | 0985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\sqlite3.dll
| MD5 | 6a3a34c9c67efd6c17d44292e8db8fad |
| SHA1 | 339b1e514d60d8370eaec1e2f2b71cead999f970 |
| SHA256 | 7b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9 |
| SHA512 | 6f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5 |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\select.pyd
| MD5 | 3797a47a60b606e25348c67043874fe8 |
| SHA1 | 63a33fedffd52190236a6acd0fc5d9d491e3ac45 |
| SHA256 | 312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac |
| SHA512 | 3eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2 |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\pyexpat.pyd
| MD5 | 46331749084f98bcfe8631d74c5e038f |
| SHA1 | 5e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347 |
| SHA256 | 21cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df |
| SHA512 | edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589 |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\libssl-1_1.dll
| MD5 | 6cd33578bc5629930329ca3303f0fae1 |
| SHA1 | f2f8e3248a72f98d27f0cfa0010e32175a18487f |
| SHA256 | 4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0 |
| SHA512 | c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\libcrypto-1_1.dll
| MD5 | 86cfc84f8407ab1be6cc64a9702882ef |
| SHA1 | 86f3c502ed64df2a5e10b085103c2ffc9e3a4130 |
| SHA256 | 11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307 |
| SHA512 | b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\libffi-7.dll
| MD5 | d50ebf567149ead9d88933561cb87d09 |
| SHA1 | 171df40e4187ebbfdf9aa1d76a33f769fb8a35ed |
| SHA256 | 6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af |
| SHA512 | 7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de |
memory/884-85-0x00007FF9285F0000-0x00007FF9285FD000-memory.dmp
memory/884-83-0x00007FF928530000-0x00007FF928549000-memory.dmp
memory/884-87-0x00007FF926570000-0x00007FF926589000-memory.dmp
memory/884-89-0x00007FF921840000-0x00007FF92186D000-memory.dmp
memory/884-91-0x00007FF923B80000-0x00007FF923B9F000-memory.dmp
memory/884-93-0x00007FF91E3E0000-0x00007FF91E551000-memory.dmp
memory/884-95-0x00007FF91F470000-0x00007FF91F49E000-memory.dmp
memory/884-101-0x00007FF91ED70000-0x00007FF91EE28000-memory.dmp
memory/884-102-0x000002B92D2B0000-0x000002B92D625000-memory.dmp
memory/884-103-0x00007FF90FA60000-0x00007FF90FDD5000-memory.dmp
memory/884-100-0x00007FF923A80000-0x00007FF923AA4000-memory.dmp
memory/884-99-0x00007FF90FDE0000-0x00007FF91024E000-memory.dmp
memory/884-105-0x00007FF91F3F0000-0x00007FF91F405000-memory.dmp
memory/884-108-0x00007FF9264B0000-0x00007FF9264C0000-memory.dmp
memory/884-107-0x00007FF928530000-0x00007FF928549000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI34162\multidict\_multidict.cp310-win_amd64.pyd
| MD5 | 7f691747ce66d3ed05a7c2c53220c8b5 |
| SHA1 | 1d3f247042030cf8cf7c859002941beba5d15776 |
| SHA256 | 7d6472a0d7f1a0740c7fc0d0d0ea6f7c6e7cb2b11b8c623c46a6fae1adb4e228 |
| SHA512 | b01f0e91039fc5b2782caaa0b3d56d5d1fe9e94424cc536cde9eca73a76747736060042e345af9edc5ef5bf5c154705d2c2dddf35536f305306be25a955a9f06 |
memory/884-111-0x00007FF91ED50000-0x00007FF91ED64000-memory.dmp
memory/884-113-0x00007FF91ED30000-0x00007FF91ED44000-memory.dmp
memory/884-116-0x00007FF90F850000-0x00007FF90F968000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI34162\yarl\_helpers_c.cp310-win_amd64.pyd
| MD5 | 15591df44ee64cb8772f1a5583465094 |
| SHA1 | 7c75d1f1e234e00d0023d803642d4fedce3b7b80 |
| SHA256 | 1de4a743bf1182dcfd04942696201ad1a3babd9455adafa2283709a1f3dcbaf1 |
| SHA512 | 6f65bfcfdb155841ebc58494f947218a17e06b370c39b289cb86aba6d8f0ce9aab71bb8fe74b3c37f4049f99b9097718c718a337a2da2a98d6445fa24c143a6e |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\yarl\_quoting_c.cp310-win_amd64.pyd
| MD5 | e73b7c4ab697651094b83841e21370a0 |
| SHA1 | 3093c418051c4d4e32ddb041ebcd7920cd77a191 |
| SHA256 | 4ed26f8531dfb4a33d88ccb591a36fbbb25f28ce4720a92e840897316b01ac5d |
| SHA512 | 4846a981773c89bbdb5999e4472ec7f25d359e8bb16528a059b925078e0896d476e125b6cfede022a4ecce53cce30e001e2d1bcc90d03a0b2de29e6c6c8eba49 |
memory/884-123-0x00007FF91CEE0000-0x00007FF91CF02000-memory.dmp
memory/884-122-0x00007FF91E3E0000-0x00007FF91E551000-memory.dmp
memory/884-120-0x00007FF91E060000-0x00007FF91E077000-memory.dmp
memory/884-119-0x00007FF923B80000-0x00007FF923B9F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI34162\aiohttp\_helpers.cp310-win_amd64.pyd
| MD5 | 543e83e6396cae6570f30eb0b07dbd85 |
| SHA1 | 330c63d832b06cd94de04cdb9c3777b5fc0daf9c |
| SHA256 | 37f70d7409d0ff362ba1fdfc7717ed220f6b03cdbf04665b9a29a164cadc6384 |
| SHA512 | b5a7549d92c93861ba68b72f3d9e02de4c09b7ae41fba204604910c4e05bc88b8e32c40ae999cf3ccaabb3c6aee4618d285dc060c9f08a9a70d0ee31f1ff4d51 |
memory/884-127-0x00007FF91A8F0000-0x00007FF91A907000-memory.dmp
memory/884-126-0x00007FF91F470000-0x00007FF91F49E000-memory.dmp
memory/884-132-0x00007FF90F560000-0x00007FF90F62F000-memory.dmp
memory/884-130-0x000002B92D2B0000-0x000002B92D625000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI34162\aiohttp\_http_writer.cp310-win_amd64.pyd
| MD5 | d77dcee3f14c440a8759afa058a12f89 |
| SHA1 | e106cb383a0116079e64d881efd172f2c1e53da4 |
| SHA256 | dcb467aad3b7281c04489c2fcb499a8f63b081d1388a8fde482a3392667e6391 |
| SHA512 | 5327cc895467061159891e85da61dc6c0287a6961d820878d88b23514a81fdb7e01103e025e8e0cb74d3918725d128427c06c4749e7d33ad883ac0ed99335a6d |
C:\Users\Admin\AppData\Local\Temp\_MEI34162\aiohttp\_http_parser.cp310-win_amd64.pyd
| MD5 | 899af4aa2d81d3ef292518511b1dcec5 |
| SHA1 | a24d25f12b0e6cd68d4385f6227dcb686f223170 |
| SHA256 | 533b97f4363ddd5a7d43cadd835404ff23b2ad9fe9a79fbed4b1ce9c12f0cebd |
| SHA512 | cfec8c07c23a2a4ff29e366216494d48061be6c28ab0cde0fdaae04c648292170855491bee678116e9e76ccf3821781f776f03cf09896e5f0530c753999b0342 |
memory/884-139-0x00007FF91F3F0000-0x00007FF91F405000-memory.dmp
memory/884-138-0x00007FF9161D0000-0x00007FF91621D000-memory.dmp
memory/884-137-0x00007FF91A5C0000-0x00007FF91A5D9000-memory.dmp
memory/884-136-0x00007FF90FA60000-0x00007FF90FDD5000-memory.dmp
memory/884-129-0x00007FF91ED70000-0x00007FF91EE28000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI34162\aiohttp\_websocket.cp310-win_amd64.pyd
| MD5 | 6d0b455fc452f5ab428cca27ba603e46 |
| SHA1 | d3ff9006c48217306808c2bf3ab1cc5ba0505369 |
| SHA256 | e8129a7262e537ce6377d6e58f047ec5c69216e4a7bee588d4c69578bb01be8b |
| SHA512 | 48873a1ee4871f0ad0d28aa0f58ed027cd11484caa232de8534260a2fd231a58bec939d851a5ee6bba788d939b696485136c3ee24e8b9f94db9803dcab6b169e |
memory/884-142-0x00007FF91F450000-0x00007FF91F461000-memory.dmp
memory/884-145-0x00007FF921D30000-0x00007FF921D3A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI34162\frozenlist\_frozenlist.cp310-win_amd64.pyd
| MD5 | 6106b4d1eec11d2a71def28d2a2afa46 |
| SHA1 | e10039eff42f88a2cd8dfe11d428c35f6178c6ce |
| SHA256 | 19b144f1bfeb38f5a88da4471d0e9eeefcee979e0d574ecf13a28d06bdf7f1da |
| SHA512 | d08ba0cf57d533ce2df7027158329da66518fb1bf10220d836ce39bdf8bc0436dfc3a649cf937b3b3e2bb9ff0d3c9e964416e9ac965cff4b24bd203067f53d43 |
memory/884-147-0x00007FF91E260000-0x00007FF91E27E000-memory.dmp
memory/884-148-0x00007FF90E720000-0x00007FF90EEBA000-memory.dmp
memory/884-150-0x00007FF91E220000-0x00007FF91E257000-memory.dmp
memory/884-149-0x00007FF91E060000-0x00007FF91E077000-memory.dmp
memory/884-157-0x00007FF91CEE0000-0x00007FF91CF02000-memory.dmp
memory/884-163-0x00007FF91A8F0000-0x00007FF91A907000-memory.dmp
memory/884-202-0x00007FF91EEE0000-0x00007FF91EEED000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xo5cx50w.lzw.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/404-213-0x0000022BEC920000-0x0000022BEC942000-memory.dmp
memory/884-219-0x00007FF9161D0000-0x00007FF91621D000-memory.dmp
memory/884-220-0x00007FF90FDE0000-0x00007FF91024E000-memory.dmp
memory/884-246-0x00007FF90E720000-0x00007FF90EEBA000-memory.dmp
memory/884-242-0x00007FF9161D0000-0x00007FF91621D000-memory.dmp
memory/884-241-0x00007FF91A5C0000-0x00007FF91A5D9000-memory.dmp
memory/884-239-0x00007FF91A8F0000-0x00007FF91A907000-memory.dmp
memory/884-228-0x00007FF91E3E0000-0x00007FF91E551000-memory.dmp
memory/884-227-0x00007FF923B80000-0x00007FF923B9F000-memory.dmp
memory/884-221-0x00007FF923A80000-0x00007FF923AA4000-memory.dmp
memory/884-247-0x00007FF91E220000-0x00007FF91E257000-memory.dmp
memory/884-238-0x00007FF91CEE0000-0x00007FF91CF02000-memory.dmp
memory/884-233-0x00007FF9264B0000-0x00007FF9264C0000-memory.dmp
memory/884-232-0x00007FF91F3F0000-0x00007FF91F405000-memory.dmp
memory/884-259-0x00007FF90FDE0000-0x00007FF91024E000-memory.dmp
memory/884-280-0x00007FF91A5C0000-0x00007FF91A5D9000-memory.dmp
memory/884-277-0x00007FF91CEE0000-0x00007FF91CF02000-memory.dmp
memory/884-271-0x00007FF91F3F0000-0x00007FF91F405000-memory.dmp
memory/884-270-0x00007FF90FA60000-0x00007FF90FDD5000-memory.dmp
memory/884-269-0x00007FF91ED70000-0x00007FF91EE28000-memory.dmp
memory/884-268-0x00007FF91F470000-0x00007FF91F49E000-memory.dmp