Analysis Overview
SHA256
ee3c781cb6ddc979fd4b312d53c4c1a35291fa48f85525de9f99ad9b9e5a8766
Threat Level: Known bad
The file source_prepared.exe was found to be: Known bad.
Malicious Activity Summary
Pysilon family
Detect Pysilon
Enumerates VirtualBox DLL files
Command and Scripting Interpreter: PowerShell
Loads dropped DLL
Legitimate hosting services abused for malware hosting/C2
UPX packed file
Enumerates physical storage devices
Detects Pyinstaller
Unsigned PE
Modifies registry class
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-14 06:13
Signatures
Detect Pysilon
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Pysilon family
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-14 06:13
Reported
2024-12-14 06:17
Platform
win10v2004-20241007-en
Max time kernel
148s
Max time network
157s
Command Line
Signatures
Enumerates VirtualBox DLL files
| Description | Indicator | Process | Target |
| File opened (read-only) | C:\windows\system32\vboxhook.dll | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | N/A |
| File opened (read-only) | C:\windows\system32\vboxmrxnp.dll | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Loads dropped DLL
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 5080 wrote to memory of 4424 | N/A | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe |
| PID 5080 wrote to memory of 4424 | N/A | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe |
| PID 4424 wrote to memory of 4252 | N/A | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | C:\Windows\system32\cmd.exe |
| PID 4424 wrote to memory of 4252 | N/A | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | C:\Windows\system32\cmd.exe |
| PID 4424 wrote to memory of 2724 | N/A | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 4424 wrote to memory of 2724 | N/A | C:\Users\Admin\AppData\Local\Temp\source_prepared.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x338
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\asdas\""
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.138.232:443 | discord.com | tcp |
| N/A | 127.0.0.1:64471 | tcp | |
| US | 8.8.8.8:53 | 232.138.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 85.49.80.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 25.73.42.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI50802\python311.dll
| MD5 | 5f6fd64ec2d7d73ae49c34dd12cedb23 |
| SHA1 | c6e0385a868f3153a6e8879527749db52dce4125 |
| SHA256 | ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967 |
| SHA512 | c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\VCRUNTIME140.dll
| MD5 | 49c96cecda5c6c660a107d378fdfc3d4 |
| SHA1 | 00149b7a66723e3f0310f139489fe172f818ca8e |
| SHA256 | 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc |
| SHA512 | e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d |
memory/4424-1260-0x00007FFB5E880000-0x00007FFB5EE69000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI50802\base_library.zip
| MD5 | bf6cd99ec3d2a7bc939a8f3d14121641 |
| SHA1 | ca8eafb77077e23fb23a45784ea17b19e93c99bc |
| SHA256 | 01be805110393abf9f1c57084dc026cdbc7135a4081f604579e3bf8f1dd23bd5 |
| SHA512 | e74f6dfbb0d7b56d4201339cca3896bef9af652e1cd031207a683b490433f1de82d0557d5d551db4c656d5f503639d16fb27cda30dff21b1399bd8bd339d3ec8 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_ctypes.pyd
| MD5 | 00f75daaa7f8a897f2a330e00fad78ac |
| SHA1 | 44aec43e5f8f1282989b14c4e3bd238c45d6e334 |
| SHA256 | 9ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f |
| SHA512 | f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\python3.DLL
| MD5 | 0e105f62fdd1ff4157560fe38512220b |
| SHA1 | 99bd69a94b3dc99fe2c0f7bbbcd05aa0bc8cd45c |
| SHA256 | 803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423 |
| SHA512 | 59c0f749ed9c59efdbcd04265b4985b1175fdd825e5a307745531ed2537397e739bc9290fdc3936cfd04f566e28bb76b878f124248b8344cf74f641c6b1101de |
memory/4424-1268-0x00007FFB6E210000-0x00007FFB6E233000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI50802\libffi-8.dll
| MD5 | 08b000c3d990bc018fcb91a1e175e06e |
| SHA1 | bd0ce09bb3414d11c91316113c2becfff0862d0d |
| SHA256 | 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece |
| SHA512 | 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf |
memory/4424-1270-0x00007FFB71850000-0x00007FFB7185F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_bz2.pyd
| MD5 | c413931b63def8c71374d7826fbf3ab4 |
| SHA1 | 8b93087be080734db3399dc415cc5c875de857e2 |
| SHA256 | 17bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293 |
| SHA512 | 7dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f |
memory/4424-1274-0x00007FFB6E1F0000-0x00007FFB6E209000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_lzma.pyd
| MD5 | 542eab18252d569c8abef7c58d303547 |
| SHA1 | 05eff580466553f4687ae43acba8db3757c08151 |
| SHA256 | d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9 |
| SHA512 | b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958 |
memory/4424-1276-0x00007FFB6E0B0000-0x00007FFB6E0DD000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_hashlib.pyd
| MD5 | b227bf5d9fec25e2b36d416ccd943ca3 |
| SHA1 | 4fae06f24a1b61e6594747ec934cbf06e7ec3773 |
| SHA256 | d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7 |
| SHA512 | c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e |
memory/4424-1317-0x00007FFB6E090000-0x00007FFB6E0A4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_uuid.pyd
| MD5 | 4faa479423c54d5be2a103b46ecb4d04 |
| SHA1 | 011f6cdbd3badaa5c969595985a9ad18547dd7ec |
| SHA256 | c2ad3c1b4333bc388b6a22049c89008505c434b1b85bff0823b19ef0cf48065a |
| SHA512 | 92d35824c30667af606bba883bf6e275f2a8b5cbfea2e84a77e256d122b91b3ee7e84d9f4e2a4946e903a11293af9648a45e8cfbe247cbdc3bcdea92eb5349c6 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_tkinter.pyd
| MD5 | a767cfb787977e55fc39a83b109bdcd0 |
| SHA1 | 3abcde648969cc507a539eb7c02f0389939e96fe |
| SHA256 | 251b3a319066baff90b0981e805fcd4e789c64a3e7ed5d4b3b7ddc499d6be7e8 |
| SHA512 | c541c1bf9c1ad4022a1f135d38e47a8c00a96c152c86504224a9127b09b5e2234b924eaea1e985e4f29eefdbac4dcb43c9410ec14681d117f5dfae658f05dbe2 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_ssl.pyd
| MD5 | f9cc7385b4617df1ddf030f594f37323 |
| SHA1 | ebceec12e43bee669f586919a928a1fd93e23a97 |
| SHA256 | b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6 |
| SHA512 | 3f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_sqlite3.pyd
| MD5 | 1a8fdc36f7138edcc84ee506c5ec9b92 |
| SHA1 | e5e2da357fe50a0927300e05c26a75267429db28 |
| SHA256 | 8e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882 |
| SHA512 | 462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_socket.pyd
| MD5 | 1a34253aa7c77f9534561dc66ac5cf49 |
| SHA1 | fcd5e952f8038a16da6c3092183188d997e32fb9 |
| SHA256 | dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f |
| SHA512 | ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_queue.pyd
| MD5 | 347d6a8c2d48003301032546c140c145 |
| SHA1 | 1a3eb60ad4f3da882a3fd1e4248662f21bd34193 |
| SHA256 | e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192 |
| SHA512 | b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_overlapped.pyd
| MD5 | ca0e43ce25d485f81f7f2d2b58fc56a4 |
| SHA1 | cb77824660780b180bcca8d19b4e4d70462c8c64 |
| SHA256 | 092607eb742294dea8820f4fd2fed5f8a67d02c3fb24c88d4639e93c08fd365a |
| SHA512 | cc62d0cabad85093c6a5be635e531e2b461af7d9d13967a06cc22ada1b9168a4156206fc9b4b3944189c97e11d23b42ee526c2146c58d6819430d7b209754fb7 |
memory/4424-1319-0x00007FFB5E360000-0x00007FFB5E880000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI50802\libcrypto-3.dll
| MD5 | 78ebd9cb6709d939e4e0f2a6bbb80da9 |
| SHA1 | ea5d7307e781bc1fa0a2d098472e6ea639d87b73 |
| SHA256 | 6a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e |
| SHA512 | b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_multiprocessing.pyd
| MD5 | 801a3a476235eb8fcf9249c8a4364b9a |
| SHA1 | aebe1f4c29f68ad1fce39b78d6a3e57b998bd79e |
| SHA256 | 61879e8db5dab209eb6e9540ab073d258a1b7287c3368fc0337c3ee35f5aa2e8 |
| SHA512 | 20b47018fbd444d6b2f2439195fdc484d8c275d57d8066d750d8f0f721eba5afe4787e34db185a27016098a900075f0873e20bd019fbf9cffa15647d61183252 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_elementtree.pyd
| MD5 | aa14c7d9644ada44bf3fae2a324e8abf |
| SHA1 | 0db1026f9fd8fe7df3c5e4c95cba872d03620d8a |
| SHA256 | 7e5114bf2f348a3dad6ec627fd5f3c1cdf85c6510a4da6c5aa3325b4ecca6071 |
| SHA512 | 17025ea0994376bb1541cb2f4f9c760e58b9b54703d0c3cca9884bc19bfffa1279ab2730752895a367fd676384a957c29c71479a66e521645dd7771e59e25bbc |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_decimal.pyd
| MD5 | e3fb8bf23d857b1eb860923ccc47baa5 |
| SHA1 | 46e9d5f746c047e1b2fefaaf8d3ec0f2c56c42f0 |
| SHA256 | 7da13df1f416d3ffd32843c895948e460af4dc02cf05c521909555061ed108e3 |
| SHA512 | 7b0a1fc00c14575b8f415fadc2078bebd157830887dc5b0c4414c8edfaf9fc4a65f58e5cceced11252ade4e627bf17979db397f4f0def9a908efb2eb68cd645c |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_cffi_backend.cp311-win_amd64.pyd
| MD5 | c4a0ceacd79d2c06956d24bf1c028a35 |
| SHA1 | 1dfc5c777435a46a69c984411d4dfb717b47c537 |
| SHA256 | 1ec4cd20853191e91e36556c6fe1a8bb14d162ee9904acc897cd8f694089f0e7 |
| SHA512 | da57381043a500a5bc826215d9c253e22139dd3e9e28a870b03d2d7d486aa8eb1a78a45ba45ee9c86b3a9bb264f20a9a776e5e3ab1e921ea6d0747275410746d |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\_asyncio.pyd
| MD5 | be419e5a211ec39c5c9a12cb8ebce2e0 |
| SHA1 | 1894b7255a431ab15f52013d35646936cc954ce9 |
| SHA256 | ca8095f88eedea1227d3306d6c28f0b1771c9613a17cb8d7dd2d9911b7485783 |
| SHA512 | 65d667785c1a00a41e77e02bb7f89b00eefc216e2096b53ad77173e2d3397682f06e11fd196428ccbd1ad4d7e3c0aa043ec4dc53c5ce9ea0b684016dfedaf954 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\zlib1.dll
| MD5 | ee06185c239216ad4c70f74e7c011aa6 |
| SHA1 | 40e66b92ff38c9b1216511d5b1119fe9da6c2703 |
| SHA256 | 0391066f3e6385a9c0fe7218c38f7bd0b3e0da0f15a98ebb07f1ac38d6175466 |
| SHA512 | baae562a53d491e19dbf7ee2cff4c13d42de6833036bfdaed9ed441bcbf004b68e4088bd453b7413d60faaf1b334aee71241ba468437d49050b8ccfa9232425d |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\VCRUNTIME140_1.dll
| MD5 | cf0a1c4776ffe23ada5e570fc36e39fe |
| SHA1 | 2050fadecc11550ad9bde0b542bcf87e19d37f1a |
| SHA256 | 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47 |
| SHA512 | d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\unicodedata.pyd
| MD5 | 8c42fcc013a1820f82667188e77be22d |
| SHA1 | fba7e4e0f86619aaf2868cedd72149e56a5a87d4 |
| SHA256 | 0e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2 |
| SHA512 | 3a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\tk86t.dll
| MD5 | 7d85f7480f2d8389f562723090be1370 |
| SHA1 | edfa05dc669a8486977e983173ec61cc5097bbb0 |
| SHA256 | aaeda7b65e1e33c74a807109360435a6b63a2994243c437e0cdaa69d2b8c6ac5 |
| SHA512 | a886475aeea6c4003dd35e518a0833574742b62cdbbbe5b098a5c0f74e89795ebddac31c4107dae6edee8fc476addaa34253af560d33bed8b9df9192c3e7f084 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\tcl86t.dll
| MD5 | 755bec8838059147b46f8e297d05fba2 |
| SHA1 | 9ff0665cddcf1eb7ff8de015b10cc9fcceb49753 |
| SHA256 | 744a13c384e136f373f9dc7f7c2eb2536591ec89304e3fa064cac0f0bf135130 |
| SHA512 | e61dc700975d28b2257da99b81d135aa7d284c6084877fe81b3cc7b42ac180728f79f4c1663e375680a26f5194ab641c4a40e09f8dbdeb99e1dfa1a57d6f9b34 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\sqlite3.dll
| MD5 | dbc64142944210671cca9d449dab62e6 |
| SHA1 | a2a2098b04b1205ba221244be43b88d90688334c |
| SHA256 | 6e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c |
| SHA512 | 3bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\select.pyd
| MD5 | 45d5a749e3cd3c2de26a855b582373f6 |
| SHA1 | 90bb8ac4495f239c07ec2090b935628a320b31fc |
| SHA256 | 2d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876 |
| SHA512 | c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\SDL2_ttf.dll
| MD5 | eb0ce62f775f8bd6209bde245a8d0b93 |
| SHA1 | 5a5d039e0c2a9d763bb65082e09f64c8f3696a71 |
| SHA256 | 74591aab94bb87fc9a2c45264930439bbc0d1525bf2571025cd9804e5a1cd11a |
| SHA512 | 34993240f14a89179ac95c461353b102ea74e4180f52c206250bb42c4c8427a019ea804b09a6903674ac00ab2a3c4c686a86334e483110e79733696aa17f4eb6 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\SDL2_mixer.dll
| MD5 | b7b45f61e3bb00ccd4ca92b2a003e3a3 |
| SHA1 | 5018a7c95dc6d01ba6e3a7e77dd26c2c74fd69bc |
| SHA256 | 1327f84e3509f3ccefeef1c12578faf04e9921c145233687710253bf903ba095 |
| SHA512 | d3449019824124f3edbda57b3b578713e9c9915e173d31566cd8e4d18f307ac0f710250fe6a906dd53e748db14bfa76ec1b58a6aef7d074c913679a47c5fdbe7 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\SDL2_image.dll
| MD5 | 25e2a737dcda9b99666da75e945227ea |
| SHA1 | d38e086a6a0bacbce095db79411c50739f3acea4 |
| SHA256 | 22b27380d4f1f217f0e5d5c767e5c244256386cd9d87f8ddf303baaf9239fc4c |
| SHA512 | 63de988387047c17fd028a894465286fd8f6f8bd3a1321b104c0ceb5473e3e0b923153b4999143efbdd28684329a33a5b468e43f25214037f6cddd4d1884adb8 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\SDL2.dll
| MD5 | ec3c1d17b379968a4890be9eaab73548 |
| SHA1 | 7dbc6acee3b9860b46c0290a9b94a344d1927578 |
| SHA256 | aaa11e97c3621ed680ff2388b91acb394173b96a6e8ffbf3b656079cd00a0b9f |
| SHA512 | 06a7880ec80174b48156acd6614ab42fb4422cd89c62d11a7723a3c872f213bfc6c1006df8bdc918bb79009943d2b65c6a5c5e89ad824d1a940ddd41b88a1edb |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\pyexpat.pyd
| MD5 | 07c5f67084263fa3347895068a1e8de4 |
| SHA1 | 07264827f186d1e2e6ccc6fe8374bc85d454e85e |
| SHA256 | 65080629dabb433d139706e3845b534c16b89957615cafc6e70edbe7078956f9 |
| SHA512 | d0086abd8f97b8a758a027f13784d84a9085e8678731e4135ab83554121fc6e06d3284beb57aa04cdfbb3c13589254db838dac32da88d515505ba175f52c71f5 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\portmidi.dll
| MD5 | 0df0699727e9d2179f7fd85a61c58bdf |
| SHA1 | 82397ee85472c355725955257c0da207fa19bf59 |
| SHA256 | 97a53e8de3f1b2512f0295b5de98fa7a23023a0e4c4008ae534acdba54110c61 |
| SHA512 | 196e41a34a60de83cb24caa5fc95820fd36371719487350bc2768354edf39eeb6c7860ff3fd9ecf570abb4288523d7ab934e86e85202b9753b135d07180678cd |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\libwebp-7.dll
| MD5 | b0dd211ec05b441767ea7f65a6f87235 |
| SHA1 | 280f45a676c40bd85ed5541ceb4bafc94d7895f3 |
| SHA256 | fc06b8f92e86b848a17eaf7ed93464f54ed1f129a869868a74a75105ff8ce56e |
| SHA512 | eaeb83e46c8ca261e79b3432ec2199f163c44f180eb483d66a71ad530ba488eb4cdbd911633e34696a4ccc035e238bc250a8247f318aa2f0cd9759cad4f90fff |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\libtiff-5.dll
| MD5 | ebad1fa14342d14a6b30e01ebc6d23c1 |
| SHA1 | 9c4718e98e90f176c57648fa4ed5476f438b80a7 |
| SHA256 | 4f50820827ac76042752809479c357063fe5653188654a6ba4df639da2fbf3ca |
| SHA512 | 91872eaa1f3f45232ab2d753585e650ded24c6cc8cc1d2a476fa98a61210177bd83570c52594b5ad562fc27cb76e034122f16a922c6910e4ed486da1d3c45c24 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\libssl-3.dll
| MD5 | bf4a722ae2eae985bacc9d2117d90a6f |
| SHA1 | 3e29de32176d695d49c6b227ffd19b54abb521ef |
| SHA256 | 827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147 |
| SHA512 | dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\libpng16-16.dll
| MD5 | 55009dd953f500022c102cfb3f6a8a6c |
| SHA1 | 07af9f4d456ddf86a51da1e4e4c5b54b0cf06ddb |
| SHA256 | 20391787cba331cfbe32fbf22f328a0fd48924e944e80de20ba32886bf4b6fd2 |
| SHA512 | 4423d3ec8fef29782f3d4a21feeac9ba24c9c765d770b2920d47b4fb847a96ff5c793b20373833b4ff8bc3d8fa422159c64beffb78ce5768ed22742740a8c6c6 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\libopusfile-0.dll
| MD5 | 2d5274bea7ef82f6158716d392b1be52 |
| SHA1 | ce2ff6e211450352eec7417a195b74fbd736eb24 |
| SHA256 | 6dea07c27c0cc5763347357e10c3b17af318268f0f17c7b165325ce524a0e8d5 |
| SHA512 | 9973d68b23396b3aa09d2079d18f2c463e807c9c1fdf4b1a5f29d561e8d5e62153e0c7be23b63975ad179b9599ff6b0cf08ebdbe843d194483e7ec3e7aeb232a |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\libopus-0.x64.dll
| MD5 | e56f1b8c782d39fd19b5c9ade735b51b |
| SHA1 | 3d1dc7e70a655ba9058958a17efabe76953a00b4 |
| SHA256 | fa8715dd0df84fdedbe4aa17763b2ab0db8941fa33421b6d42e25e59c4ae8732 |
| SHA512 | b7702e48b20a8991a5c537f5ba22834de8bb4ba55862b75024eace299263963b953606ee29e64d68b438bb0904273c4c20e71f22ccef3f93552c36fb2d1b2c46 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\libopus-0.dll
| MD5 | 3fb9d9e8daa2326aad43a5fc5ddab689 |
| SHA1 | 55523c665414233863356d14452146a760747165 |
| SHA256 | fd8de9169ccf53c5968eec0c90e9ff3a66fb451a5bf063868f3e82007106b491 |
| SHA512 | f263ea6e0fab84a65fe3a9b6c0fe860919eee828c84b888a5aa52dea540434248d1e810a883a2aff273cd9f22c607db966dd8776e965be6d2cfe1b50a1af1f57 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\libogg-0.dll
| MD5 | 0d65168162287df89af79bb9be79f65b |
| SHA1 | 3e5af700b8c3e1a558105284ecd21b73b765a6dc |
| SHA256 | 2ec2322aec756b795c2e614dab467ef02c3d67d527ad117f905b3ab0968ccf24 |
| SHA512 | 69af81fd2293c31f456b3c78588bb6a372fe4a449244d74bfe5bfaa3134a0709a685725fa05055cfd261c51a96df4b7ebd8b9e143f0e9312c374e54392f8a2c2 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\libmodplug-1.dll
| MD5 | 2bb2e7fa60884113f23dcb4fd266c4a6 |
| SHA1 | 36bbd1e8f7ee1747c7007a3c297d429500183d73 |
| SHA256 | 9319bf867ed6007f3c61da139c2ab8b74a4cb68bf56265a101e79396941f6d3b |
| SHA512 | 1ddd4b9b9238c1744e0a1fe403f136a1def8df94814b405e7b01dd871b3f22a2afe819a26e08752142f127c3efe4ebae8bfd1bd63563d5eb98b4644426f576b2 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\libjpeg-9.dll
| MD5 | c22b781bb21bffbea478b76ad6ed1a28 |
| SHA1 | 66cc6495ba5e531b0fe22731875250c720262db1 |
| SHA256 | 1eed2385030348c84bbdb75d41d64891be910c27fab8d20fc9e85485fcb569dd |
| SHA512 | 9b42cad4a715680a27cd79f466fd2913649b80657ff042528cba2946631387ed9fb027014d215e1baf05839509ca5915d533b91aa958ae0525dea6e2a869b9e4 |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\freetype.dll
| MD5 | 04a9825dc286549ee3fa29e2b06ca944 |
| SHA1 | 5bed779bf591752bb7aa9428189ec7f3c1137461 |
| SHA256 | 50249f68b4faf85e7cd8d1220b7626a86bc507af9ae400d08c8e365f9ab97cde |
| SHA512 | 0e937e4de6cbc9d40035b94c289c2798c77c44fc1dc7097201f9fab97c7ff9e56113c06c51693f09908283eda92945b36de67351f893d4e3162e67c078cff4ec |
C:\Users\Admin\AppData\Local\Temp\_MEI50802\crypto_clipper.json
| MD5 | 8bff94a9573315a9d1820d9bb710d97f |
| SHA1 | e69a43d343794524b771d0a07fd4cb263e5464d5 |
| SHA256 | 3f7446866f42bcbeb8426324d3ea58f386f3171abe94279ea7ec773a4adde7d7 |
| SHA512 | d5ece1ea9630488245c578cb22d6d9d902839e53b4550c6232b4fb9389ef6c5d5392426ea4a9e3c461979d6d6aa94ddf3b2755f48e9988864788b530cdfcf80f |
memory/4424-1325-0x00007FFB6E030000-0x00007FFB6E063000-memory.dmp
memory/4424-1329-0x00007FFB5E880000-0x00007FFB5EE69000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI50802\charset_normalizer\md.cp311-win_amd64.pyd
| MD5 | ecfbd9b49ae51f8e3374e17aff3aec1e |
| SHA1 | 3e66e0f757d0f18afd546d158a96fd1707b35a5f |
| SHA256 | 1237b21174cd4aee97aa4d80ee953dd4ce91b2e1beb4788a55cb25a0213521aa |
| SHA512 | 9c9f682b55a589f1c10c99b89cc2620ce3d89d96c17096feb7e0ddfd6ac2f2b279885084b131080a57a6a324a9bce928e618348545c2b0af06c0ec4c267362c8 |
memory/4424-1336-0x00007FFB6E020000-0x00007FFB6E02B000-memory.dmp
memory/4424-1335-0x00007FFB6E210000-0x00007FFB6E233000-memory.dmp
memory/4424-1334-0x00007FFB6E1E0000-0x00007FFB6E1ED000-memory.dmp
memory/4424-1333-0x00007FFB6D740000-0x00007FFB6D85C000-memory.dmp
memory/4424-1332-0x00007FFB6DF90000-0x00007FFB6DFB7000-memory.dmp
memory/4424-1331-0x00007FFB6D860000-0x00007FFB6D92D000-memory.dmp
memory/4424-1323-0x00007FFB717D0000-0x00007FFB717DD000-memory.dmp
memory/4424-1321-0x00007FFB6E070000-0x00007FFB6E089000-memory.dmp
memory/4424-1337-0x00007FFB6DDE0000-0x00007FFB6DE17000-memory.dmp
memory/4424-1338-0x00007FFB6DF80000-0x00007FFB6DF8B000-memory.dmp
memory/4424-1339-0x00007FFB6DF70000-0x00007FFB6DF7B000-memory.dmp
memory/4424-1349-0x00007FFB6E070000-0x00007FFB6E089000-memory.dmp
memory/4424-1348-0x00007FFB6DC00000-0x00007FFB6DC0E000-memory.dmp
memory/4424-1347-0x00007FFB6DC50000-0x00007FFB6DC5B000-memory.dmp
memory/4424-1346-0x00007FFB6DC10000-0x00007FFB6DC1D000-memory.dmp
memory/4424-1345-0x00007FFB6DC20000-0x00007FFB6DC2C000-memory.dmp
memory/4424-1344-0x00007FFB6DC30000-0x00007FFB6DC3B000-memory.dmp
memory/4424-1343-0x00007FFB6DC40000-0x00007FFB6DC4C000-memory.dmp
memory/4424-1342-0x00007FFB6DDD0000-0x00007FFB6DDDC000-memory.dmp
memory/4424-1341-0x00007FFB5E360000-0x00007FFB5E880000-memory.dmp
memory/4424-1340-0x00007FFB6E090000-0x00007FFB6E0A4000-memory.dmp
memory/4424-1359-0x00007FFB6D430000-0x00007FFB6D445000-memory.dmp
memory/4424-1358-0x00007FFB6E030000-0x00007FFB6E063000-memory.dmp
memory/4424-1357-0x00007FFB6D450000-0x00007FFB6D45C000-memory.dmp
memory/4424-1356-0x00007FFB6D460000-0x00007FFB6D472000-memory.dmp
memory/4424-1355-0x00007FFB6D480000-0x00007FFB6D48D000-memory.dmp
memory/4424-1354-0x00007FFB6D490000-0x00007FFB6D49B000-memory.dmp
memory/4424-1353-0x00007FFB6D4A0000-0x00007FFB6D4AC000-memory.dmp
memory/4424-1352-0x00007FFB6DAB0000-0x00007FFB6DABB000-memory.dmp
memory/4424-1351-0x00007FFB6DAC0000-0x00007FFB6DACB000-memory.dmp
memory/4424-1350-0x00007FFB6DBF0000-0x00007FFB6DBFC000-memory.dmp
memory/4424-1360-0x00007FFB6D410000-0x00007FFB6D422000-memory.dmp
memory/4424-1361-0x00007FFB6DDE0000-0x00007FFB6DE17000-memory.dmp
memory/4424-1362-0x00007FFB6D3F0000-0x00007FFB6D404000-memory.dmp
memory/4424-1363-0x00007FFB6D3C0000-0x00007FFB6D3E2000-memory.dmp
memory/4424-1364-0x00007FFB6BDB0000-0x00007FFB6BDCB000-memory.dmp
memory/4424-1365-0x00007FFB6BD60000-0x00007FFB6BD79000-memory.dmp
memory/4424-1367-0x00007FFB649B0000-0x00007FFB649FD000-memory.dmp
memory/4424-1366-0x00007FFB6DC00000-0x00007FFB6DC0E000-memory.dmp
memory/4424-1369-0x00007FFB6BCF0000-0x00007FFB6BD22000-memory.dmp
memory/4424-1368-0x00007FFB6BD40000-0x00007FFB6BD51000-memory.dmp
memory/4424-1371-0x00007FFB64F40000-0x00007FFB64F5E000-memory.dmp
memory/4424-1370-0x00007FFB6D430000-0x00007FFB6D445000-memory.dmp
memory/4424-1372-0x00007FFB5E300000-0x00007FFB5E35D000-memory.dmp
memory/4424-1373-0x00007FFB6D410000-0x00007FFB6D422000-memory.dmp
memory/4424-1374-0x00007FFB5F6B0000-0x00007FFB5F6D9000-memory.dmp
memory/4424-1375-0x00007FFB6D3F0000-0x00007FFB6D404000-memory.dmp
memory/4424-1376-0x00007FFB5F4F0000-0x00007FFB5F51E000-memory.dmp
memory/4424-1379-0x00007FFB5E150000-0x00007FFB5E2C7000-memory.dmp
memory/4424-1380-0x00007FFB6BDB0000-0x00007FFB6BDCB000-memory.dmp
memory/4424-1378-0x00007FFB5E2D0000-0x00007FFB5E2F3000-memory.dmp
memory/4424-1377-0x00007FFB6D3C0000-0x00007FFB6D3E2000-memory.dmp
memory/4424-1381-0x00007FFB6BD60000-0x00007FFB6BD79000-memory.dmp
memory/4424-1382-0x00007FFB64990000-0x00007FFB649A8000-memory.dmp
memory/4424-1384-0x00007FFB69FA0000-0x00007FFB69FAB000-memory.dmp
memory/4424-1383-0x00007FFB649B0000-0x00007FFB649FD000-memory.dmp
memory/4424-1387-0x00007FFB5F6A0000-0x00007FFB5F6AB000-memory.dmp
memory/4424-1388-0x00007FFB6BCF0000-0x00007FFB6BD22000-memory.dmp
memory/4424-1386-0x00007FFB67090000-0x00007FFB6709C000-memory.dmp
memory/4424-1385-0x00007FFB69BE0000-0x00007FFB69BEB000-memory.dmp
memory/4424-1389-0x00007FFB5F4E0000-0x00007FFB5F4EC000-memory.dmp
memory/4424-1402-0x00007FFB64990000-0x00007FFB649A8000-memory.dmp
memory/4424-1401-0x00007FFB5E100000-0x00007FFB5E10B000-memory.dmp
memory/4424-1400-0x00007FFB5E0F0000-0x00007FFB5E0FC000-memory.dmp
memory/4424-1399-0x00007FFB5E110000-0x00007FFB5E11B000-memory.dmp
memory/4424-1398-0x00007FFB5E150000-0x00007FFB5E2C7000-memory.dmp
memory/4424-1397-0x00007FFB5E120000-0x00007FFB5E12C000-memory.dmp
memory/4424-1396-0x00007FFB5E130000-0x00007FFB5E13E000-memory.dmp
memory/4424-1395-0x00007FFB5E2D0000-0x00007FFB5E2F3000-memory.dmp
memory/4424-1394-0x00007FFB5F4F0000-0x00007FFB5F51E000-memory.dmp
memory/4424-1393-0x00007FFB5E140000-0x00007FFB5E14D000-memory.dmp
memory/4424-1392-0x00007FFB5F6B0000-0x00007FFB5F6D9000-memory.dmp
memory/4424-1391-0x00007FFB5F460000-0x00007FFB5F46C000-memory.dmp
memory/4424-1390-0x00007FFB5F4D0000-0x00007FFB5F4DB000-memory.dmp
memory/4424-1407-0x00007FFB5F6A0000-0x00007FFB5F6AB000-memory.dmp
memory/4424-1408-0x00007FFB5E060000-0x00007FFB5E096000-memory.dmp
memory/4424-1406-0x00007FFB5E0A0000-0x00007FFB5E0AC000-memory.dmp
memory/4424-1405-0x00007FFB5E0B0000-0x00007FFB5E0C2000-memory.dmp
memory/4424-1404-0x00007FFB5E0D0000-0x00007FFB5E0DD000-memory.dmp
memory/4424-1403-0x00007FFB5E0E0000-0x00007FFB5E0EB000-memory.dmp
memory/4424-1409-0x00007FFB5DFA0000-0x00007FFB5E05C000-memory.dmp
memory/4424-1410-0x00007FFB5DF70000-0x00007FFB5DF9B000-memory.dmp
memory/4424-1411-0x00007FFB5DD20000-0x00007FFB5DF69000-memory.dmp
memory/4424-1412-0x00007FFB5E140000-0x00007FFB5E14D000-memory.dmp
memory/4424-1413-0x00007FFB5DCC0000-0x00007FFB5DD15000-memory.dmp
memory/4424-1414-0x00007FFB5D9B0000-0x00007FFB5DC8F000-memory.dmp
memory/4424-1415-0x00007FFB5B8B0000-0x00007FFB5D9A3000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5msqpnpl.sao.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4424-1459-0x00007FFB5E360000-0x00007FFB5E880000-memory.dmp
memory/4424-1492-0x00007FFB649B0000-0x00007FFB649FD000-memory.dmp
memory/4424-1491-0x00007FFB6BD60000-0x00007FFB6BD79000-memory.dmp
memory/4424-1487-0x00007FFB6D410000-0x00007FFB6D422000-memory.dmp
memory/4424-1486-0x00007FFB6D430000-0x00007FFB6D445000-memory.dmp
memory/4424-1468-0x00007FFB6DDE0000-0x00007FFB6DE17000-memory.dmp
memory/4424-1464-0x00007FFB6E1E0000-0x00007FFB6E1ED000-memory.dmp
memory/4424-1453-0x00007FFB5E880000-0x00007FFB5EE69000-memory.dmp
memory/4424-1462-0x00007FFB6E030000-0x00007FFB6E063000-memory.dmp
memory/4424-1454-0x00007FFB6E210000-0x00007FFB6E233000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-12-14 06:13
Reported
2024-12-14 06:16
Platform
win10v2004-20241007-en
Max time kernel
94s
Max time network
150s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral3
Detonation Overview
Submitted
2024-12-14 06:13
Reported
2024-12-14 06:16
Platform
win10v2004-20241007-en
Max time kernel
95s
Max time network
144s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-12-14 06:13
Reported
2024-12-14 06:16
Platform
win10v2004-20241007-en
Max time kernel
92s
Max time network
145s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\misc.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
Files
Analysis: behavioral5
Detonation Overview
Submitted
2024-12-14 06:13
Reported
2024-12-14 06:16
Platform
win10v2004-20241007-en
Max time kernel
148s
Max time network
151s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 181.129.81.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.130.81.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral6
Detonation Overview
Submitted
2024-12-14 06:13
Reported
2024-12-14 06:17
Platform
win10v2004-20241007-en
Max time kernel
94s
Max time network
140s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.49.80.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |