Analysis Overview
SHA256
9236a756a4f1d70338c934f0a0f0be119d6cc7319ee73a44a416cd2f17064987
Threat Level: Known bad
The file ZLogger4.7.exe was found to be: Known bad.
Malicious Activity Summary
Detect Pysilon
Pysilon family
Enumerates VirtualBox DLL files
Sets file to hidden
Reads user/profile data of web browsers
UPX packed file
Executes dropped EXE
Checks computer location settings
Loads dropped DLL
Adds Run key to start application
Looks up external IP address via web service
Legitimate hosting services abused for malware hosting/C2
Unsigned PE
Enumerates physical storage devices
Detects Pyinstaller
Uses Volume Shadow Copy WMI provider
Modifies registry class
Checks processor information in registry
Suspicious use of SetWindowsHookEx
Gathers system information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: AddClipboardFormatListener
Views/modifies file attributes
Suspicious use of SendNotifyMessage
Kills process with taskkill
Uses Task Scheduler COM API
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-11-25 14:21
Signatures
Detect Pysilon
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Pysilon family
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral10
Detonation Overview
Submitted
2023-11-25 14:21
Reported
2023-11-25 14:26
Platform
win10v2004-20231025-en
Max time kernel
142s
Max time network
150s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 254.111.26.67.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 218.240.110.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.112.168.52.in-addr.arpa | udp |
Files
Analysis: behavioral1
Detonation Overview
Submitted
2023-11-25 14:21
Reported
2023-11-25 14:27
Platform
win7-20231023-en
Max time kernel
122s
Max time network
131s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2000 wrote to memory of 2640 | N/A | C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe | C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe |
| PID 2000 wrote to memory of 2640 | N/A | C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe | C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe |
| PID 2000 wrote to memory of 2640 | N/A | C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe | C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe
"C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe"
C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe
"C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\_MEI20002\python311.dll
| MD5 | 5f6fd64ec2d7d73ae49c34dd12cedb23 |
| SHA1 | c6e0385a868f3153a6e8879527749db52dce4125 |
| SHA256 | ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967 |
| SHA512 | c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab |
\Users\Admin\AppData\Local\Temp\_MEI20002\python311.dll
| MD5 | 5f6fd64ec2d7d73ae49c34dd12cedb23 |
| SHA1 | c6e0385a868f3153a6e8879527749db52dce4125 |
| SHA256 | ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967 |
| SHA512 | c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab |
memory/2640-1260-0x000007FEF62B0000-0x000007FEF6899000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-11-25 14:21
Reported
2023-11-25 14:26
Platform
win10v2004-20231023-en
Max time kernel
138s
Max time network
152s
Command Line
Signatures
Enumerates VirtualBox DLL files
| Description | Indicator | Process | Target |
| File opened (read-only) | C:\windows\system32\vboxhook.dll | C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe | N/A |
| File opened (read-only) | C:\windows\system32\vboxmrxnp.dll | C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe | N/A |
| File opened (read-only) | C:\windows\system32\vboxhook.dll | C:\Users\Admin\AMSIIntegrity\ZLoggerV4.7.exe | N/A |
| File opened (read-only) | C:\windows\system32\vboxmrxnp.dll | C:\Users\Admin\AMSIIntegrity\ZLoggerV4.7.exe | N/A |
Sets file to hidden
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AMSIIntegrity\ZLoggerV4.7.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AMSIIntegrity\ZLoggerV4.7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AMSIIntegrity\ZLoggerV4.7.exe | N/A |
Loads dropped DLL
Reads user/profile data of web browsers
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BoolCheck = "C:\\Users\\Admin\\AMSIIntegrity\\ZLoggerV4.7.exe" | C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ident.me | N/A | N/A |
| N/A | ident.me | N/A | N/A |
Enumerates physical storage devices
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
Gathers system information
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\systeminfo.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings | C:\Users\Admin\AMSIIntegrity\ZLoggerV4.7.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Users\Admin\AMSIIntegrity\ZLoggerV4.7.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AMSIIntegrity\ZLoggerV4.7.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\system32\AUDIODG.EXE | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\system32\AUDIODG.EXE | N/A |
| Token: 33 | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe
"C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe"
C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe
"C:\Users\Admin\AppData\Local\Temp\ZLogger4.7.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a8 0x2ec
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AMSIIntegrity\""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AMSIIntegrity\activate.bat
C:\Windows\system32\attrib.exe
attrib +s +h .
C:\Users\Admin\AMSIIntegrity\ZLoggerV4.7.exe
"ZLoggerV4.7.exe"
C:\Windows\system32\taskkill.exe
taskkill /f /im "ZLogger4.7.exe"
C:\Users\Admin\AMSIIntegrity\ZLoggerV4.7.exe
"ZLoggerV4.7.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AMSIIntegrity\""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
C:\Windows\system32\systeminfo.exe
systeminfo
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "del C:\Users\Admin\AMSIIntegrity\ss.png"
C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\jumpscare.mp4"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "del C:\Users\Admin\AMSIIntegrity\ss.png"
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\DenySelect.odt"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.135.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.135.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | gateway.discord.gg | udp |
| US | 162.159.135.234:443 | gateway.discord.gg | tcp |
| US | 8.8.8.8:53 | 234.135.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 218.240.110.104.in-addr.arpa | udp |
| N/A | 127.0.0.1:56476 | tcp | |
| US | 8.8.8.8:53 | ident.me | udp |
| DE | 49.12.234.183:443 | ident.me | tcp |
| US | 8.8.8.8:53 | 183.234.12.49.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ipv4.lafibre.info | udp |
| NL | 51.158.154.169:443 | ipv4.lafibre.info | tcp |
| US | 8.8.8.8:53 | 169.154.158.51.in-addr.arpa | udp |
| US | 162.159.135.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | github.com | udp |
| DE | 140.82.121.4:443 | github.com | tcp |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.108.133:443 | raw.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 4.121.82.140.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.89.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI45162\python311.dll
| MD5 | 5f6fd64ec2d7d73ae49c34dd12cedb23 |
| SHA1 | c6e0385a868f3153a6e8879527749db52dce4125 |
| SHA256 | ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967 |
| SHA512 | c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\python311.dll
| MD5 | 5f6fd64ec2d7d73ae49c34dd12cedb23 |
| SHA1 | c6e0385a868f3153a6e8879527749db52dce4125 |
| SHA256 | ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967 |
| SHA512 | c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\VCRUNTIME140.dll
| MD5 | 49c96cecda5c6c660a107d378fdfc3d4 |
| SHA1 | 00149b7a66723e3f0310f139489fe172f818ca8e |
| SHA256 | 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc |
| SHA512 | e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\VCRUNTIME140.dll
| MD5 | 49c96cecda5c6c660a107d378fdfc3d4 |
| SHA1 | 00149b7a66723e3f0310f139489fe172f818ca8e |
| SHA256 | 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc |
| SHA512 | e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d |
memory/740-1262-0x00007FFCC4F60000-0x00007FFCC5549000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45162\base_library.zip
| MD5 | 32ede00817b1d74ce945dcd1e8505ad0 |
| SHA1 | 51b5390db339feeed89bffca925896aff49c63fb |
| SHA256 | 4a73d461851b484d213684f0aadf59d537cba6fe7e75497e609d54c9f2ba5d4a |
| SHA512 | a0e070b2ee1347e85f37e9fd589bc8484f206fa9c8f4020de147b815d2041293551e3a14a09a6eb4050cfa1f74843525377e1a99bbdcfb867b61ebddb89f21f7 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_ctypes.pyd
| MD5 | 00f75daaa7f8a897f2a330e00fad78ac |
| SHA1 | 44aec43e5f8f1282989b14c4e3bd238c45d6e334 |
| SHA256 | 9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f |
| SHA512 | f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\python3.DLL
| MD5 | 0e105f62fdd1ff4157560fe38512220b |
| SHA1 | 99bd69a94b3dc99fe2c0f7bbbcd05aa0bc8cd45c |
| SHA256 | 803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423 |
| SHA512 | 59c0f749ed9c59efdbcd04265b4985b1175fdd825e5a307745531ed2537397e739bc9290fdc3936cfd04f566e28bb76b878f124248b8344cf74f641c6b1101de |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libffi-8.dll
| MD5 | 08b000c3d990bc018fcb91a1e175e06e |
| SHA1 | bd0ce09bb3414d11c91316113c2becfff0862d0d |
| SHA256 | 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece |
| SHA512 | 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_bz2.pyd
| MD5 | c413931b63def8c71374d7826fbf3ab4 |
| SHA1 | 8b93087be080734db3399dc415cc5c875de857e2 |
| SHA256 | 17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293 |
| SHA512 | 7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_lzma.pyd
| MD5 | 542eab18252d569c8abef7c58d303547 |
| SHA1 | 05eff580466553f4687ae43acba8db3757c08151 |
| SHA256 | d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9 |
| SHA512 | b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_hashlib.pyd
| MD5 | b227bf5d9fec25e2b36d416ccd943ca3 |
| SHA1 | 4fae06f24a1b61e6594747ec934cbf06e7ec3773 |
| SHA256 | d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7 |
| SHA512 | c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libcrypto-3.dll
| MD5 | 78ebd9cb6709d939e4e0f2a6bbb80da9 |
| SHA1 | ea5d7307e781bc1fa0a2d098472e6ea639d87b73 |
| SHA256 | 6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e |
| SHA512 | b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122 |
memory/740-1319-0x00007FFCD5290000-0x00007FFCD52A9000-memory.dmp
memory/740-1318-0x00007FFCC4A40000-0x00007FFCC4F60000-memory.dmp
memory/740-1320-0x00007FFCD4910000-0x00007FFCD4924000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_socket.pyd
| MD5 | 1a34253aa7c77f9534561dc66ac5cf49 |
| SHA1 | fcd5e952f8038a16da6c3092183188d997e32fb9 |
| SHA256 | dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f |
| SHA512 | ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_ssl.pyd
| MD5 | f9cc7385b4617df1ddf030f594f37323 |
| SHA1 | ebceec12e43bee669f586919a928a1fd93e23a97 |
| SHA256 | b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6 |
| SHA512 | 3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libssl-3.dll
| MD5 | bf4a722ae2eae985bacc9d2117d90a6f |
| SHA1 | 3e29de32176d695d49c6b227ffd19b54abb521ef |
| SHA256 | 827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147 |
| SHA512 | dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_queue.pyd
| MD5 | 347d6a8c2d48003301032546c140c145 |
| SHA1 | 1a3eb60ad4f3da882a3fd1e4248662f21bd34193 |
| SHA256 | e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192 |
| SHA512 | b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06 |
memory/740-1329-0x00007FFCD48F0000-0x00007FFCD4909000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45162\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
| MD5 | 1c52efd6568c7d95b83b885632ec7798 |
| SHA1 | cae9e800292cb7f328105495dd53fc20749741f8 |
| SHA256 | 2b2cad68bec8979fd577d692013a7981fdbc80a5a6e8f517c2467fdcee5d8939 |
| SHA512 | 35e619f996e823f59455b531f1872d7658b299c41e14d91cd13dcef20072971a437884fde4424fd9a10b67a39ea40f48df416ed8b0633aea00022b31709541f2 |
memory/740-1331-0x00007FFCD0C00000-0x00007FFCD0C33000-memory.dmp
memory/740-1332-0x00007FFCCB4B0000-0x00007FFCCB57D000-memory.dmp
memory/740-1333-0x00007FFCD6280000-0x00007FFCD628D000-memory.dmp
memory/740-1334-0x00007FFCD5F60000-0x00007FFCD5F6B000-memory.dmp
memory/740-1335-0x00007FFCCB9E0000-0x00007FFCCBA06000-memory.dmp
memory/740-1336-0x00007FFCCB9A0000-0x00007FFCCB9D8000-memory.dmp
memory/740-1337-0x00007FFCD5280000-0x00007FFCD528B000-memory.dmp
memory/740-1338-0x00007FFCD5230000-0x00007FFCD523C000-memory.dmp
memory/740-1330-0x00007FFCD6350000-0x00007FFCD635D000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45162\charset_normalizer\md.cp311-win_amd64.pyd
| MD5 | 32062fd1796553acac7aa3d62ce4c4a5 |
| SHA1 | 0c5e7deb9c11eeaf4799f1a677880fbaf930079c |
| SHA256 | 4910c386c02ae6b2848d5728e7376c5881c56962d29067005e1e2ad518bc07ae |
| SHA512 | 18c3b894af9102df8ed15f78e1d3a51db1f07465d814380a0220f0c0571b52292b065aed819004f13aeb343f677ac5bfd5a5a35d6f74e48381228724241f7758 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\charset_normalizer\md.cp311-win_amd64.pyd
| MD5 | 32062fd1796553acac7aa3d62ce4c4a5 |
| SHA1 | 0c5e7deb9c11eeaf4799f1a677880fbaf930079c |
| SHA256 | 4910c386c02ae6b2848d5728e7376c5881c56962d29067005e1e2ad518bc07ae |
| SHA512 | 18c3b894af9102df8ed15f78e1d3a51db1f07465d814380a0220f0c0571b52292b065aed819004f13aeb343f677ac5bfd5a5a35d6f74e48381228724241f7758 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\select.pyd
| MD5 | 45d5a749e3cd3c2de26a855b582373f6 |
| SHA1 | 90bb8ac4495f239c07ec2090b935628a320b31fc |
| SHA256 | 2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876 |
| SHA512 | c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea |
memory/740-1315-0x00007FFCD4CA0000-0x00007FFCD4CCD000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_bz2.pyd
| MD5 | c413931b63def8c71374d7826fbf3ab4 |
| SHA1 | 8b93087be080734db3399dc415cc5c875de857e2 |
| SHA256 | 17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293 |
| SHA512 | 7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_uuid.pyd
| MD5 | 4faa479423c54d5be2a103b46ecb4d04 |
| SHA1 | 011f6cdbd3badaa5c969595985a9ad18547dd7ec |
| SHA256 | c2ad3c1b4333bc388b6a22049c89008505c434b1b85bff0823b19ef0cf48065a |
| SHA512 | 92d35824c30667af606bba883bf6e275f2a8b5cbfea2e84a77e256d122b91b3ee7e84d9f4e2a4946e903a11293af9648a45e8cfbe247cbdc3bcdea92eb5349c6 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_tkinter.pyd
| MD5 | 21e05294dd230deee50e5036efad282a |
| SHA1 | 689747aaac5e2ecb8852507805bc4ae1df63fe10 |
| SHA256 | 1ae9a8d0d41abb9d793ef74c2d78079c12122c779a5403109e6599331d282377 |
| SHA512 | 877be83ad0caa7f9f8b0efeea047c76efec86ed388ba63792d2ef40e257bc86504c84215ff8bd7d1500c5e3b6430b7d5d8d8b1ddd6abb3f50020101cf75bba83 |
memory/740-1339-0x00007FFCD5160000-0x00007FFCD516B000-memory.dmp
memory/740-1340-0x00007FFCD48B0000-0x00007FFCD48BC000-memory.dmp
memory/740-1341-0x00007FFCD4720000-0x00007FFCD472B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_ssl.pyd
| MD5 | f9cc7385b4617df1ddf030f594f37323 |
| SHA1 | ebceec12e43bee669f586919a928a1fd93e23a97 |
| SHA256 | b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6 |
| SHA512 | 3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_sqlite3.pyd
| MD5 | 1a8fdc36f7138edcc84ee506c5ec9b92 |
| SHA1 | e5e2da357fe50a0927300e05c26a75267429db28 |
| SHA256 | 8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882 |
| SHA512 | 462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_socket.pyd
| MD5 | 1a34253aa7c77f9534561dc66ac5cf49 |
| SHA1 | fcd5e952f8038a16da6c3092183188d997e32fb9 |
| SHA256 | dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f |
| SHA512 | ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a |
memory/740-1343-0x00007FFCD18F0000-0x00007FFCD18FD000-memory.dmp
memory/740-1344-0x00007FFCD1140000-0x00007FFCD114E000-memory.dmp
memory/740-1342-0x00007FFCD4710000-0x00007FFCD471C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_queue.pyd
| MD5 | 347d6a8c2d48003301032546c140c145 |
| SHA1 | 1a3eb60ad4f3da882a3fd1e4248662f21bd34193 |
| SHA256 | e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192 |
| SHA512 | b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_overlapped.pyd
| MD5 | ce4626159bf66ab04f0279bb2a9f4fad |
| SHA1 | 18d93c34132aee2bed9ad5928010d3f4f33bb477 |
| SHA256 | 7b92710eaf825571d3f3b0443b7c5d0e7231df8f3cbb3ba69d90eedbc151edf0 |
| SHA512 | 365ba4250eb58498c8c7f3398461c777f91e6ae9408213b373a0306d7c29b10515460160f15a37d6d311378e433cb4733d5107dfc0d4ecef5c5ed34da26bcd5b |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_multiprocessing.pyd
| MD5 | e3e3f86cc4c41edbaa5d30769d743d09 |
| SHA1 | c8df3eaf3e30b6cfb9891a5fbd595a03f831cfc7 |
| SHA256 | 0d8203dba58573e4bf1ff3c3e89c331085ce25df11f2860d8d59203dd8b3faf8 |
| SHA512 | eedff332f82e1635d4d1f091061389612476612daf4cd9c1dcdbcb76a4cde45c84879bfa6b3b505b6bb4ce6030102999d6830573095fa1dc637fbdb8b02e37a4 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_hashlib.pyd
| MD5 | b227bf5d9fec25e2b36d416ccd943ca3 |
| SHA1 | 4fae06f24a1b61e6594747ec934cbf06e7ec3773 |
| SHA256 | d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7 |
| SHA512 | c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_elementtree.pyd
| MD5 | f7f00d7a8c8f9532b58360deb55f7fa0 |
| SHA1 | be5ba44bac538d892579b27f4cb8a5af054720d7 |
| SHA256 | f752a6e47532582a6469d65d774c358f575bba0ecffb2c268dca04f99f1548cd |
| SHA512 | 3cf9d2ae0dc5034add460efe1e687a75d31d4d46d37b13c1d800781f280a8f2b7be17416a102efff4e562e2877fa0aa728f3ef8b55124b43a6029fe92c24d02d |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_decimal.pyd
| MD5 | e3fb8bf23d857b1eb860923ccc47baa5 |
| SHA1 | 46e9d5f746c047e1b2fefaaf8d3ec0f2c56c42f0 |
| SHA256 | 7da13df1f416d3ffd32843c895948e460af4dc02cf05c521909555061ed108e3 |
| SHA512 | 7b0a1fc00c14575b8f415fadc2078bebd157830887dc5b0c4414c8edfaf9fc4a65f58e5cceced11252ade4e627bf17979db397f4f0def9a908efb2eb68cd645c |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_cffi_backend.cp311-win_amd64.pyd
| MD5 | 1518035a65a45c274f1557ff5655e2d7 |
| SHA1 | 2676d452113c68aa316cba9a03565ec146088c3f |
| SHA256 | 9ca400d84a52ae61c5613403ba379d69c271e8e9e9c3f253f93434c9336bc6e8 |
| SHA512 | b5932a2eadd2981a3bbc0918643a9936c9aaafc606d833d5ef2758061e05a3148826060ed52a2d121fabfd719ad9736b3402683640a4c4846b6aaaa457366b66 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_asyncio.pyd
| MD5 | d776dbe9c3b432e7be82f61e491c598a |
| SHA1 | f4b562ebdf18e60ae06d971cccc6108f3b2bc23d |
| SHA256 | c3b2836defd08c6a5fac8bd375a7a7d4671d902af31011d60c463ac1100f3418 |
| SHA512 | c68070d2d33665ebb550df0eb4b512c86432fc79fec803bb4a6be8bc487a8b81fa5bdada6894c38944b7ac39603c965fda0e1b467edb1e2918c1bbf29faf0378 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\zlib1.dll
| MD5 | a35d7eeae683a35acb99e72e01cf132f |
| SHA1 | cc37f1e0641f6afc821ef45a65986422eb853366 |
| SHA256 | c84547746f4c328daa9637414bbb252ec7124005d0cb7d4a8c62779cf641271c |
| SHA512 | dd7996756a3aed62251f90cd0ae95feafa7bc1cfe7c51e7e2e09bfd30bf0bbb2775fe397a1963f63aed7ad49957b4dd75faed022c6ec4ed9576822f650612f2c |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\VCRUNTIME140_1.dll
| MD5 | cf0a1c4776ffe23ada5e570fc36e39fe |
| SHA1 | 2050fadecc11550ad9bde0b542bcf87e19d37f1a |
| SHA256 | 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47 |
| SHA512 | d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\unicodedata.pyd
| MD5 | 8c42fcc013a1820f82667188e77be22d |
| SHA1 | fba7e4e0f86619aaf2868cedd72149e56a5a87d4 |
| SHA256 | 0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2 |
| SHA512 | 3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\tk86t.dll
| MD5 | a3b28c19b23fddf32c8920a4d492be47 |
| SHA1 | 2b9aedaf02d2ec7dbb36596b8ceeb10657480e43 |
| SHA256 | c611b2a311da589f93e83f0662dcb8b3bb3db8450c64084da4b067b36a52ecb2 |
| SHA512 | 24d44d6ddde9d05eaabfa58aadeef85443be46c535d3f290b50f2208fd79f27215f65b099389a04381b6b44a812b17687886185b49eb94f7fd193114cf3c9436 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\tcl86t.dll
| MD5 | ad6e74d50f92edcdb4420750d190610c |
| SHA1 | af6b5fae4d3d5a064df0e727bfd63e8ff82828bc |
| SHA256 | 6074ed09ce5ff856dd8f3b27a3207cf31d8f48fa1247853773609357b511068d |
| SHA512 | 18630348aa556a672bb1675f2cae3182929c3c4a6c3c5745dfda9865b17d19f895d5f1da98ec6b03ffe921abd34b16a90a56bfede64c351f307491a7f3df6e3e |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\sqlite3.dll
| MD5 | dbc64142944210671cca9d449dab62e6 |
| SHA1 | a2a2098b04b1205ba221244be43b88d90688334c |
| SHA256 | 6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c |
| SHA512 | 3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\select.pyd
| MD5 | 45d5a749e3cd3c2de26a855b582373f6 |
| SHA1 | 90bb8ac4495f239c07ec2090b935628a320b31fc |
| SHA256 | 2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876 |
| SHA512 | c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\SDL2_ttf.dll
| MD5 | 9f5ece4e13e42058fa5ea65215c41c5d |
| SHA1 | eddcecb4f10f2bb9b61c57b88fb6bd1b1d560a07 |
| SHA256 | f5f2690285fc087376ff03edb8849ab5f24c6e9d60ae3661013bea621786582b |
| SHA512 | 09cf0927b7cdb84f9ddec465ba10874af6160f947e58e9ff9ead2aa6d10e7d164dd8c5e2df6314f0dd8a84d0b104b48dbac8cc96522f749d54041b3e8ec03400 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\SDL2_mixer.dll
| MD5 | 1230b474eca2c4cefb13cf0aaa2fc5d0 |
| SHA1 | e23f9cf8cb7dd47e92a02f7508922f01d4d1364b |
| SHA256 | 6879a16d963159cb0666e654ea4d5e9a92abffd96cfc6fffe6b39ae81b4ffca3 |
| SHA512 | 2520fdfbd1370bb9683c29fe1722f771e3d4c7df635987371190be5445237f9e96ae506bbeb79035f6f483ac116995b56bb1e9fc35b6f6a6d49bb940dbf72ead |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\SDL2_image.dll
| MD5 | 7174d7a8eec42d7700c5f4adfff39b57 |
| SHA1 | b850f0814e77a67f0414a85aae88c9534ca857e5 |
| SHA256 | 155eab85fe565f6dd1ecb29d6496425539c994bc0d14b52cabd850df5927f9bf |
| SHA512 | 9a79cc9661cdab7efeb096f1eb121807ba937b444546d46a321613f6d2792ebf09cc62ff067ece7cb0458b988d6081feadd33e93a52c24faac53dc1539bf32c9 |
memory/740-1345-0x00007FFCD0BE0000-0x00007FFCD0BEC000-memory.dmp
memory/740-1346-0x00007FFCCE3A0000-0x00007FFCCE3AB000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45162\SDL2.dll
| MD5 | 9684069bb2b8892408ccb50d66abbeda |
| SHA1 | 7df5e8f28481c4e7aef128e017a53a36b86c3b7b |
| SHA256 | 123c8a0d647e5b866545f8e1cc4cfba5fdadf8c1a247692050355a609d81996b |
| SHA512 | fbe493326da9b582c9c4fa1b16ba02e5befcf5787324116656e108527894f692c3fc21493419a419833ab37a5fa5fb5e38e2c04a8cbdbc3c8afeba08df390697 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\pyexpat.pyd
| MD5 | 07c481d3ecdc06b1c5fd15c503490298 |
| SHA1 | 656c79384d418de31b84c7b68b30a7e37251a475 |
| SHA256 | 40672a3fc0931133fd74802ec34edc4a91fccf432d8fc1b63e693f64912f8284 |
| SHA512 | c7ed37aa552e72106d590206d77836f9e32f2285bc767e55579b17dd97d6e48a5201fb53fff4641a9a84c261343e8b00ec3899c16ccf50c707af858f4bf4e501 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\portmidi.dll
| MD5 | 1b443fe9c75d57eedcf5fd67493573e2 |
| SHA1 | 27504e51f5f19d3d73ed2a0ba473dc5cda787679 |
| SHA256 | 96b2ba3d433b0e0a0ce72c72725e033ca35b570225b55b38fb7d71c716418ee3 |
| SHA512 | 02f0ee765490d999ac621f54411b039ef42dddeba17d2edbb9970db20e481d29aed4d607d8330a7c5cd7133b214f13dcb427e89903f9baaef20ffc4a431bb0c4 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libwebp-7.dll
| MD5 | 4276d3cb447a08644a2c1d3b7afb9fdf |
| SHA1 | d63f34d0b4e8eb660a92a3843b695eda16294b80 |
| SHA256 | cc3831ce9ff18f5ebfde8b20d1ee237e2336e4d9ca6405392ac5ec9c8c948174 |
| SHA512 | d3a539176243e31a15877b0a6c40c295036ccac5c3ac13cd7b74a340c4183a661a630bbe6b5b0c0ff54b4b27fc72bc154883c7ba5167cb4baeb4b0a528f514bc |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libtiff-5.dll
| MD5 | f374796886d56c6c552f3a92a81c3338 |
| SHA1 | d61f0297386e9925a6ac0c6469ba40b86d3c98cd |
| SHA256 | e2c5b370bcade6a167dba5dc9bb33107d4ed2612e7e8af8d1035be72f35f90d7 |
| SHA512 | b59cd888b41c67bf139c2c78d7968a33c84e9127752b9fa276b7b3b461a01cd71dc72936e51a334ddad7fa8e67dd4c250a3495ce544aa156efacb77e7f1dce9f |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libssl-3.dll
| MD5 | bf4a722ae2eae985bacc9d2117d90a6f |
| SHA1 | 3e29de32176d695d49c6b227ffd19b54abb521ef |
| SHA256 | 827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147 |
| SHA512 | dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libpng16-16.dll
| MD5 | 8f3bf615136b7241204419fb24c8d5ad |
| SHA1 | d107f0b405c566974c37be20e1abbd365ccbb750 |
| SHA256 | a9c4d2443d6de90091eff8a5adfd7a3c207b0c7aefb913b855320866e93f8039 |
| SHA512 | a2ced7974c086291e69dce39f841335c771088aecbbc52b049d7af51c81342bd1e8bd0d8c78e62529e2041d15d8f5317e5a41727e299c2d827027bcbb0382aa1 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libopusfile-0.dll
| MD5 | a729c1b14d695b00ae79472d3fe45339 |
| SHA1 | 20cd334187fc7297138f014303e5c82b5f918c80 |
| SHA256 | 57bb8b7dec2bd35ff1031f12c4ba3aa3cb2e8de2445e21ea29ffa3ad13e7be3a |
| SHA512 | 1da8060b1767bdf811b005e4a476c18f1c2f93186334aa40ca59937cec7aed37267c45a3b5aaeb8fa13d9b0639959d128d957e6d08fcb9787926df850e42fc22 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libopus-0.x64.dll
| MD5 | 17bed62f3389d532d3dfc59071bbd214 |
| SHA1 | 2b0894cc48dd3756f0ff6602bf8c1e24cb8b6642 |
| SHA256 | 4fd26640721088ac31fdac941db6fa3c094ca17bd97d240992969aefae19ff91 |
| SHA512 | 976c5e0dd50487eb5f88c195633805cccbf34566496065eaf8f3ecbbea0300653097bfbbf628dbb2c238a4d552460187794bcebcb8d41452a3f873f0244fc6a4 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libopus-0.dll
| MD5 | 3c2e93c3d2b292a0f489449209f8e099 |
| SHA1 | 751f18a79c6da4e7162439cef4d481189d17a242 |
| SHA256 | b6b32593c0bcecea7b31a900086870bbab039f25b29067170ac461cf2479dea5 |
| SHA512 | a0ec68d2a1c650720b4e3e437a5841e8d04d165fc920ce26a41cc20d6ddf4c761b05bbf3426e241c2ee13a9fbe146fc889aa45df70397600b2d962bdaa1bedbb |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libogg-0.dll
| MD5 | 6ffebd7d283079e9029c7f29d8ca7fba |
| SHA1 | b470b09c8aa2f3e42bcff8392d95b6259cb87555 |
| SHA256 | 0d9a915ea29ed4da271f86dbcfa90b52064a26b5136af590b2bb430d5dd6a67e |
| SHA512 | 2b9a9b5f298eefccf0a08af52d7c2c803db19ab9f3cedad2bb19df50466527c05e31f956b6018c9a337565448249465eba8952e9e8397b728b7f76e4f0561c68 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libmodplug-1.dll
| MD5 | 072093b2671589d4ce465de2b92ebee4 |
| SHA1 | 821d9827286271859640984df28e01b4a37341fb |
| SHA256 | 04d07b4dcae8d3998156d563df20881ba790c32389aca23ade91de9cf9f4a3d4 |
| SHA512 | 522d5faa8d17017f1891374a23d6e653cd62b51818734bf1f7343248d09e1e314ae49821595818fe69af62c9e51debca4ae384e421ad8fa658aced95f977379e |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libjpeg-9.dll
| MD5 | 6e67e46f957f50215b7e68c9091db53f |
| SHA1 | e969fa4858351c95c337352dd0578fe5a83403f0 |
| SHA256 | 24b25fe9ebe303496973c4d11144b053a5f5a03eabf53f9d8eab0c15fdbfbffe |
| SHA512 | 86af5560269ef21490f5343ea3e0522f35e271d42e64f61a2f05471302856de79d34bf00658e1667d7145af48667627fa3897bca2fc479928ab9a62ecba81396 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libcrypto-3.dll
| MD5 | 78ebd9cb6709d939e4e0f2a6bbb80da9 |
| SHA1 | ea5d7307e781bc1fa0a2d098472e6ea639d87b73 |
| SHA256 | 6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e |
| SHA512 | b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\freetype.dll
| MD5 | 522257e451efcc3bfe980f56d3fed113 |
| SHA1 | f5e12321517f523842943ea7f3ba74d449dba1f4 |
| SHA256 | 8c74376e7932eebcd084191b40774056b32525ba48e375d942754cdc4fc03c60 |
| SHA512 | d590cd813281278be4aec86af3713216dd306399b4910221a2447a3200accbca1b5f8d9495bf21f69ff8e09e5465a71c715a85ce0d87cdc26cbf27b0fae2cc4c |
memory/740-1276-0x00007FFCDAEF0000-0x00007FFCDAEFF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_lzma.pyd
| MD5 | 542eab18252d569c8abef7c58d303547 |
| SHA1 | 05eff580466553f4687ae43acba8db3757c08151 |
| SHA256 | d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9 |
| SHA512 | b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958 |
memory/740-1271-0x00007FFCD55D0000-0x00007FFCD55F3000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45162\libffi-8.dll
| MD5 | 08b000c3d990bc018fcb91a1e175e06e |
| SHA1 | bd0ce09bb3414d11c91316113c2becfff0862d0d |
| SHA256 | 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece |
| SHA512 | 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\_ctypes.pyd
| MD5 | 00f75daaa7f8a897f2a330e00fad78ac |
| SHA1 | 44aec43e5f8f1282989b14c4e3bd238c45d6e334 |
| SHA256 | 9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f |
| SHA512 | f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4 |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\python3.dll
| MD5 | 0e105f62fdd1ff4157560fe38512220b |
| SHA1 | 99bd69a94b3dc99fe2c0f7bbbcd05aa0bc8cd45c |
| SHA256 | 803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423 |
| SHA512 | 59c0f749ed9c59efdbcd04265b4985b1175fdd825e5a307745531ed2537397e739bc9290fdc3936cfd04f566e28bb76b878f124248b8344cf74f641c6b1101de |
C:\Users\Admin\AppData\Local\Temp\_MEI45162\python3.dll
| MD5 | 0e105f62fdd1ff4157560fe38512220b |
| SHA1 | 99bd69a94b3dc99fe2c0f7bbbcd05aa0bc8cd45c |
| SHA256 | 803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423 |
| SHA512 | 59c0f749ed9c59efdbcd04265b4985b1175fdd825e5a307745531ed2537397e739bc9290fdc3936cfd04f566e28bb76b878f124248b8344cf74f641c6b1101de |
memory/740-1347-0x00007FFCCB4A0000-0x00007FFCCB4AC000-memory.dmp
memory/740-1348-0x00007FFCC6350000-0x00007FFCC635C000-memory.dmp
memory/740-1349-0x00007FFCC6340000-0x00007FFCC634D000-memory.dmp
memory/740-1350-0x00007FFCC6320000-0x00007FFCC6332000-memory.dmp
memory/740-1351-0x00007FFCC6310000-0x00007FFCC631C000-memory.dmp
memory/740-1352-0x00007FFCC5F90000-0x00007FFCC5FA2000-memory.dmp
memory/740-1353-0x00007FFCC5F70000-0x00007FFCC5F84000-memory.dmp
memory/740-1354-0x00007FFCC5F40000-0x00007FFCC5F62000-memory.dmp
memory/740-1355-0x00007FFCC5C00000-0x00007FFCC5C19000-memory.dmp
memory/740-1356-0x00007FFCC5BB0000-0x00007FFCC5BFA000-memory.dmp
memory/740-1357-0x00007FFCC5B60000-0x00007FFCC5B7C000-memory.dmp
memory/740-1358-0x00007FFCC5FB0000-0x00007FFCC60CC000-memory.dmp
memory/740-1359-0x00007FFCD55C0000-0x00007FFCD55CB000-memory.dmp
memory/740-1363-0x00007FFCC5E80000-0x00007FFCC5E97000-memory.dmp
memory/740-1362-0x00007FFCC62F0000-0x00007FFCC6305000-memory.dmp
memory/740-1361-0x00007FFCCBE10000-0x00007FFCCBE1B000-memory.dmp
memory/740-1360-0x00007FFCD0BF0000-0x00007FFCD0BFC000-memory.dmp
memory/740-1364-0x00007FFCC5B90000-0x00007FFCC5BA1000-memory.dmp
memory/740-1365-0x00007FFCC47E0000-0x00007FFCC483D000-memory.dmp
memory/740-1366-0x00007FFCC5B30000-0x00007FFCC5B59000-memory.dmp
memory/740-1367-0x00007FFCC47B0000-0x00007FFCC47DE000-memory.dmp
memory/740-1368-0x00007FFCC4780000-0x00007FFCC47A3000-memory.dmp
memory/740-1369-0x00007FFCC4600000-0x00007FFCC4777000-memory.dmp
memory/740-1370-0x00007FFCC45E0000-0x00007FFCC45F8000-memory.dmp
memory/740-1371-0x00007FFCC4580000-0x00007FFCC458B000-memory.dmp
memory/740-1372-0x00007FFCC4570000-0x00007FFCC457C000-memory.dmp
memory/740-1373-0x00007FFCC4560000-0x00007FFCC456B000-memory.dmp
memory/740-1375-0x00007FFCC4530000-0x00007FFCC453C000-memory.dmp
memory/740-1376-0x00007FFCC4520000-0x00007FFCC452D000-memory.dmp
memory/740-1374-0x00007FFCC4540000-0x00007FFCC454B000-memory.dmp
memory/740-1377-0x00007FFCC4510000-0x00007FFCC451E000-memory.dmp
memory/740-1378-0x00007FFCC4500000-0x00007FFCC450C000-memory.dmp
memory/740-1380-0x00007FFCC44E0000-0x00007FFCC44EB000-memory.dmp
memory/740-1379-0x00007FFCC44F0000-0x00007FFCC44FC000-memory.dmp
memory/740-1381-0x00007FFCC44D0000-0x00007FFCC44DB000-memory.dmp
memory/740-1382-0x00007FFCC44C0000-0x00007FFCC44CC000-memory.dmp
memory/740-1386-0x00007FFCC44A0000-0x00007FFCC44AD000-memory.dmp
memory/740-1387-0x00007FFCC4480000-0x00007FFCC4492000-memory.dmp
memory/740-1385-0x00007FFCC44B0000-0x00007FFCC44BC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lr0kjxvo.14k.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/740-1510-0x00007FFCC4F60000-0x00007FFCC5549000-memory.dmp
memory/740-1511-0x00007FFCD55D0000-0x00007FFCD55F3000-memory.dmp
memory/740-1512-0x00007FFCDAEF0000-0x00007FFCDAEFF000-memory.dmp
memory/740-1513-0x00007FFCD5290000-0x00007FFCD52A9000-memory.dmp
memory/740-1515-0x00007FFCD4910000-0x00007FFCD4924000-memory.dmp
memory/740-1514-0x00007FFCD4CA0000-0x00007FFCD4CCD000-memory.dmp
memory/740-1516-0x00007FFCC4A40000-0x00007FFCC4F60000-memory.dmp
memory/740-1517-0x00007FFCD48F0000-0x00007FFCD4909000-memory.dmp
memory/740-1519-0x00007FFCD0C00000-0x00007FFCD0C33000-memory.dmp
memory/740-1518-0x00007FFCD6350000-0x00007FFCD635D000-memory.dmp
memory/740-1520-0x00007FFCCB4B0000-0x00007FFCCB57D000-memory.dmp
memory/740-1521-0x00007FFCD6280000-0x00007FFCD628D000-memory.dmp
memory/740-1523-0x00007FFCCB9E0000-0x00007FFCCBA06000-memory.dmp
memory/740-1522-0x00007FFCD5F60000-0x00007FFCD5F6B000-memory.dmp
memory/740-1524-0x00007FFCC5FB0000-0x00007FFCC60CC000-memory.dmp
memory/740-1525-0x00007FFCCB9A0000-0x00007FFCCB9D8000-memory.dmp
memory/740-1526-0x00007FFCC62F0000-0x00007FFCC6305000-memory.dmp
memory/740-1527-0x00007FFCC5F90000-0x00007FFCC5FA2000-memory.dmp
memory/740-1528-0x00007FFCC5F70000-0x00007FFCC5F84000-memory.dmp
memory/740-1529-0x00007FFCC5F40000-0x00007FFCC5F62000-memory.dmp
memory/740-1530-0x00007FFCC5E80000-0x00007FFCC5E97000-memory.dmp
memory/740-1532-0x00007FFCC5BB0000-0x00007FFCC5BFA000-memory.dmp
memory/740-1531-0x00007FFCC5C00000-0x00007FFCC5C19000-memory.dmp
memory/740-1533-0x00007FFCC5B90000-0x00007FFCC5BA1000-memory.dmp
memory/740-1534-0x00007FFCC5B60000-0x00007FFCC5B7C000-memory.dmp
memory/740-1535-0x00007FFCC47E0000-0x00007FFCC483D000-memory.dmp
memory/740-1536-0x00007FFCC5B30000-0x00007FFCC5B59000-memory.dmp
memory/740-1538-0x00007FFCC47B0000-0x00007FFCC47DE000-memory.dmp
memory/740-1539-0x00007FFCC4780000-0x00007FFCC47A3000-memory.dmp
memory/740-1540-0x00007FFCC4600000-0x00007FFCC4777000-memory.dmp
memory/740-1541-0x00007FFCC45E0000-0x00007FFCC45F8000-memory.dmp
memory/740-1542-0x00007FFCC4430000-0x00007FFCC4466000-memory.dmp
memory/740-1543-0x00007FFCC4370000-0x00007FFCC442C000-memory.dmp
memory/740-1544-0x00007FFCC4340000-0x00007FFCC436B000-memory.dmp
memory/740-1545-0x00007FFCC40B0000-0x00007FFCC4333000-memory.dmp
memory/740-1546-0x00007FFCC3A40000-0x00007FFCC40A8000-memory.dmp
memory/740-1548-0x00007FFCC36D0000-0x00007FFCC39AF000-memory.dmp
memory/740-1547-0x00007FFCC39E0000-0x00007FFCC3A35000-memory.dmp
memory/740-1549-0x00007FFCC15D0000-0x00007FFCC36C3000-memory.dmp
memory/740-1642-0x00007FFCC15B0000-0x00007FFCC15C7000-memory.dmp
memory/740-1662-0x00007FFCC1580000-0x00007FFCC15A1000-memory.dmp
memory/740-1674-0x00007FFCC1550000-0x00007FFCC1572000-memory.dmp
memory/740-1680-0x00007FFCC14B0000-0x00007FFCC154C000-memory.dmp
memory/740-1690-0x00007FFCC1480000-0x00007FFCC14B0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI46842\cryptography-41.0.5.dist-info\INSTALLER
| MD5 | 365c9bfeb7d89244f2ce01c1de44cb85 |
| SHA1 | d7a03141d5d6b1e88b6b59ef08b6681df212c599 |
| SHA256 | ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508 |
| SHA512 | d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1 |
memory/740-1693-0x00007FFCC1440000-0x00007FFCC1473000-memory.dmp
memory/740-1695-0x00007FFCC13D0000-0x00007FFCC13EA000-memory.dmp
memory/740-1694-0x00007FFCC13F0000-0x00007FFCC1437000-memory.dmp
memory/740-1702-0x00007FFCC13B0000-0x00007FFCC13C9000-memory.dmp
memory/740-1704-0x00007FFCC1390000-0x00007FFCC13AD000-memory.dmp
memory/740-1713-0x00007FFCC1370000-0x00007FFCC1383000-memory.dmp
memory/740-1714-0x00007FFCC12B0000-0x00007FFCC1364000-memory.dmp
memory/740-1716-0x00007FFCC1290000-0x00007FFCC12AA000-memory.dmp
memory/740-1720-0x00007FFCC0E80000-0x00007FFCC128F000-memory.dmp
memory/740-1736-0x00007FFCC0DE0000-0x00007FFCC0E73000-memory.dmp
memory/740-1777-0x00007FFCC0D90000-0x00007FFCC0DDB000-memory.dmp
memory/740-1781-0x00007FFCB6730000-0x00007FFCB8623000-memory.dmp
memory/740-1856-0x00007FFCC0CE0000-0x00007FFCC0D89000-memory.dmp
memory/740-1863-0x00007FFCC0AB0000-0x00007FFCC0CD6000-memory.dmp
memory/740-1874-0x00007FFCC0A30000-0x00007FFCC0AAB000-memory.dmp
memory/740-1895-0x00007FFCC0950000-0x00007FFCC0998000-memory.dmp
memory/740-1876-0x00007FFCC09A0000-0x00007FFCC0A2A000-memory.dmp
memory/740-1933-0x00007FFCC08B0000-0x00007FFCC08F2000-memory.dmp
memory/740-1940-0x00007FFCC0840000-0x00007FFCC08AC000-memory.dmp
memory/740-1908-0x00007FFCC0900000-0x00007FFCC0942000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\jumpscare.mp4
| MD5 | 5ac44ced534a47dc15b18990d8af0e49 |
| SHA1 | 11add282a818408965d4455333a7d3d6e30923f1 |
| SHA256 | bea9d33028271f219a9c1786489dbfe8fa7191ba2fe2fbf8bd291130889a6448 |
| SHA512 | 0ac4256e7dcc6697e7bb6d118a6cd6dbbfe2601a6487512d2c0ca3d73bc6ed4bc3f61d1c76e1c4316ec15c6bc3c5749fd8faf8636bc556a16844811586e21998 |
Analysis: behavioral3
Detonation Overview
Submitted
2023-11-25 14:21
Reported
2023-11-25 14:26
Platform
win7-20231023-en
Max time kernel
150s
Max time network
127s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.pyc\ = "pyc_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\pyc_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\pyc_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\pyc_auto_file | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\pyc_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.pyc | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\pyc_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2136 wrote to memory of 2612 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2136 wrote to memory of 2612 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2136 wrote to memory of 2612 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2612 wrote to memory of 2588 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2612 wrote to memory of 2588 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2612 wrote to memory of 2588 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2612 wrote to memory of 2588 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | 6b36d670805383e43eef08965a5dcd63 |
| SHA1 | 4d8bbb6cf9d8140e2602a289fa06da6baa74c5e6 |
| SHA256 | 7513c33123d6289cc8fe083196a5bf268a7761c831b1df3e4242507acce4035e |
| SHA512 | 38d9ae4ce2b13449160415e99bdefc62fc6f39be4c60d336421b0c08656e42794ef688de625dc8f588adf86a274e9bdaf7254581cb2d5aa17c74ad08264110e1 |
Analysis: behavioral7
Detonation Overview
Submitted
2023-11-25 14:21
Reported
2023-11-25 14:26
Platform
win7-20231023-en
Max time kernel
149s
Max time network
126s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\pyc_auto_file | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\.pyc | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\pyc_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\pyc_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\pyc_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\.pyc\ = "pyc_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\pyc_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2224 wrote to memory of 2608 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2224 wrote to memory of 2608 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2224 wrote to memory of 2608 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2608 wrote to memory of 2700 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2608 wrote to memory of 2700 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2608 wrote to memory of 2700 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2608 wrote to memory of 2700 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\misc.pyc
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\misc.pyc
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\misc.pyc"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | 3c5c0f088b529bedb82a3c16c676f14b |
| SHA1 | ed2993bd35248233165367c054014df735cfaeec |
| SHA256 | ccc10931b82e4c5a4dfc973474f00cc1bf9ab2a2b37452af5dbb9ddacb925c49 |
| SHA512 | 00ee84253a8654cf8bdb5b861c1f5d5770f827cea484815c82e0d55c7a95933f07016d1a54b76e218b37a6b59501a4b66ec81d6213eeafc1541754c2dc313466 |
Analysis: behavioral8
Detonation Overview
Submitted
2023-11-25 14:21
Reported
2023-11-25 14:26
Platform
win10v2004-20231020-en
Max time kernel
92s
Max time network
150s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\misc.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 218.240.110.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.78.101.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 152.78.101.95.in-addr.arpa | udp |
Files
Analysis: behavioral9
Detonation Overview
Submitted
2023-11-25 14:21
Reported
2023-11-25 14:26
Platform
win7-20231020-en
Max time kernel
150s
Max time network
126s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\pyc_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\.pyc | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\pyc_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\pyc_auto_file | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\.pyc\ = "pyc_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\pyc_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000_CLASSES\pyc_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2116 wrote to memory of 2864 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2116 wrote to memory of 2864 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2116 wrote to memory of 2864 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2864 wrote to memory of 2740 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2864 wrote to memory of 2740 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2864 wrote to memory of 2740 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2864 wrote to memory of 2740 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | c9d4cfce500faac96d2fc3a96d1358cc |
| SHA1 | e2f72ca00e8cc84a9f061759ccd30d4ae0a6dd59 |
| SHA256 | f1b71c906f65af7f9ce502ece4f1f2633d8abd9656fcc962f22d89dff0f59769 |
| SHA512 | 986e7bb66de2328ec0705ac783ec713ea986708c8781362a36767769144fac49685c60df444cfa44178ef6a484a85edb1dc694f7c0247d0ce5804110e5b1b1e6 |
Analysis: behavioral4
Detonation Overview
Submitted
2023-11-25 14:21
Reported
2023-11-25 14:26
Platform
win10v2004-20231023-en
Max time kernel
91s
Max time network
143s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 218.240.110.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral5
Detonation Overview
Submitted
2023-11-25 14:21
Reported
2023-11-25 14:26
Platform
win7-20231023-en
Max time kernel
150s
Max time network
122s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\pyc_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.pyc | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\.pyc\ = "pyc_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\pyc_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\pyc_auto_file | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\pyc_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\pyc_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1464 wrote to memory of 2676 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 1464 wrote to memory of 2676 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 1464 wrote to memory of 2676 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2676 wrote to memory of 2480 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2676 wrote to memory of 2480 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2676 wrote to memory of 2480 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2676 wrote to memory of 2480 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | d6726862ca257be3023d724220dbf034 |
| SHA1 | e56a4181165dbf3ef7bb4a9738976510ec650bfe |
| SHA256 | f86f5b3391445fe5e39df80bf53f2af7b59403575c9d138f3b26b35b3d2672a3 |
| SHA512 | a5a46d5f7f87a6b0b0316fb5a19e24afeae1e1bec1afb01db75cea97104b2532b75b1c7a9242224b53fb5fab4fb2463b4ee818529910d1fc55a8b35f90d6e94b |
Analysis: behavioral6
Detonation Overview
Submitted
2023-11-25 14:21
Reported
2023-11-25 14:26
Platform
win10v2004-20231020-en
Max time kernel
142s
Max time network
150s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.111.26.67.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.112.168.52.in-addr.arpa | udp |
Files
Analysis: behavioral11
Detonation Overview
Submitted
2023-11-25 14:21
Reported
2023-11-25 14:26
Platform
win7-20231023-en
Max time kernel
150s
Max time network
123s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\pyc_auto_file | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\pyc_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.pyc | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.pyc\ = "pyc_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\pyc_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\pyc_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\pyc_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2124 wrote to memory of 2988 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2124 wrote to memory of 2988 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2124 wrote to memory of 2988 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2988 wrote to memory of 2712 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2988 wrote to memory of 2712 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2988 wrote to memory of 2712 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2988 wrote to memory of 2712 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | 6d3b1e29681ca1d1ee080d2b3a61263a |
| SHA1 | 5e2e153e6658e681a0bf8b25d6efef9a9001c503 |
| SHA256 | 82847c39ecfbb324ff5877e246444d90c28daadca6c1c68a2629bcfead66d6b2 |
| SHA512 | 17b7678855ae78eb7454e9f0439e4600d7ea04e938295f79a9118c01a2e6dca70f1782fbf9885986b3d1392b96d760662ce9f2f3249c6e5f242e33863b66013d |
Analysis: behavioral12
Detonation Overview
Submitted
2023-11-25 14:21
Reported
2023-11-25 14:26
Platform
win10v2004-20231023-en
Max time kernel
139s
Max time network
146s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.240.110.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.111.26.67.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.112.168.52.in-addr.arpa | udp |