Analysis Overview
SHA256
49a9598d7681e08e63577d62462e808004fd44dc2bc590d476c671e987660241
Threat Level: Known bad
The file amazon_bot.exe was found to be: Known bad.
Malicious Activity Summary
Detect Pysilon
Pysilon family
Enumerates VirtualBox DLL files
Loads dropped DLL
Unsigned PE
Detects Pyinstaller
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-04 11:09
Signatures
Detect Pysilon
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Pysilon family
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-04 11:08
Reported
2023-10-04 11:10
Platform
win10v2004-20230915-en
Max time kernel
34s
Max time network
46s
Command Line
Signatures
Enumerates VirtualBox DLL files
| Description | Indicator | Process | Target |
| File opened (read-only) | C:\windows\system32\vboxhook.dll | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | N/A |
| File opened (read-only) | C:\windows\system32\vboxmrxnp.dll | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | N/A |
Loads dropped DLL
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4264 wrote to memory of 2036 | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe |
| PID 4264 wrote to memory of 2036 | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe |
| PID 2036 wrote to memory of 1500 | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | C:\Windows\system32\cmd.exe |
| PID 2036 wrote to memory of 1500 | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | C:\Windows\system32\cmd.exe |
| PID 2036 wrote to memory of 1708 | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2036 wrote to memory of 1708 | N/A | C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe
"C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe"
C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe
"C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x418 0x2c8
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\amazon\""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\amazon\activate.bat
C:\Users\Admin\amazon\Amazon.exe
"Amazon.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI42642\python311.dll
| MD5 | 58e01abc9c9b5c885635180ed104fe95 |
| SHA1 | 1c2f7216b125539d63bd111a7aba615c69deb8ba |
| SHA256 | de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837 |
| SHA512 | cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\VCRUNTIME140.dll
| MD5 | 49c96cecda5c6c660a107d378fdfc3d4 |
| SHA1 | 00149b7a66723e3f0310f139489fe172f818ca8e |
| SHA256 | 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc |
| SHA512 | e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\base_library.zip
| MD5 | 32ede00817b1d74ce945dcd1e8505ad0 |
| SHA1 | 51b5390db339feeed89bffca925896aff49c63fb |
| SHA256 | 4a73d461851b484d213684f0aadf59d537cba6fe7e75497e609d54c9f2ba5d4a |
| SHA512 | a0e070b2ee1347e85f37e9fd589bc8484f206fa9c8f4020de147b815d2041293551e3a14a09a6eb4050cfa1f74843525377e1a99bbdcfb867b61ebddb89f21f7 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\VCRUNTIME140.dll
| MD5 | 49c96cecda5c6c660a107d378fdfc3d4 |
| SHA1 | 00149b7a66723e3f0310f139489fe172f818ca8e |
| SHA256 | 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc |
| SHA512 | e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\python311.dll
| MD5 | 58e01abc9c9b5c885635180ed104fe95 |
| SHA1 | 1c2f7216b125539d63bd111a7aba615c69deb8ba |
| SHA256 | de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837 |
| SHA512 | cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_ctypes.pyd
| MD5 | 6114277c6fc040f68d25ca90e25924cd |
| SHA1 | 028179c77cb3ba29cd8494049421eaa4900ccd0e |
| SHA256 | f07fe92ce85f7786f96a4d59c6ee5c05fe1db63a1889ba40a67e37069639b656 |
| SHA512 | 76e8ebefb9ba4ea8dcab8fce50629946af4f2b3f2f43163f75483cfb0a97968478c8aaef1d6a37be85bfc4c91a859deda6da21d3e753daefe084a203d839353d |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\python3.DLL
| MD5 | 0e105f62fdd1ff4157560fe38512220b |
| SHA1 | 99bd69a94b3dc99fe2c0f7bbbcd05aa0bc8cd45c |
| SHA256 | 803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423 |
| SHA512 | 59c0f749ed9c59efdbcd04265b4985b1175fdd825e5a307745531ed2537397e739bc9290fdc3936cfd04f566e28bb76b878f124248b8344cf74f641c6b1101de |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libffi-8.dll
| MD5 | 0f8e4992ca92baaf54cc0b43aaccce21 |
| SHA1 | c7300975df267b1d6adcbac0ac93fd7b1ab49bd2 |
| SHA256 | eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a |
| SHA512 | 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_bz2.pyd
| MD5 | 4438affaaa0ca1df5b9b1cdaa0115ec1 |
| SHA1 | 4eda79eaf3de614d5f744aa9eea5bfcf66e2d386 |
| SHA256 | ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85 |
| SHA512 | 6992107ac4d2108e477bc81af667b8b8e5439231e7e9f4b15ce4bce1aeea811bc0f1aaa438be3b0e38597760cb504367512809ee1937c4b538a86724ae543ba6 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\SDL2.dll
| MD5 | 0293f98e4ae63f376f293c95f197b9ce |
| SHA1 | 6e6ae66a791001399d7dde625de50799decfbe9c |
| SHA256 | 2e4e823b46e95a29ad4ce4e7134417b0cd60145fefe606920ef6dc0ebcfb0021 |
| SHA512 | 0f5f7537e414fbf04e54e744bd2c0d587c920e93ac8dcca58a15fbe041e53383b66bd7b2c1cd75f3584cab435e9ddb38354cfd7d4676dcf515642de601f3ed46 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_uuid.pyd
| MD5 | 4faa479423c54d5be2a103b46ecb4d04 |
| SHA1 | 011f6cdbd3badaa5c969595985a9ad18547dd7ec |
| SHA256 | c2ad3c1b4333bc388b6a22049c89008505c434b1b85bff0823b19ef0cf48065a |
| SHA512 | 92d35824c30667af606bba883bf6e275f2a8b5cbfea2e84a77e256d122b91b3ee7e84d9f4e2a4946e903a11293af9648a45e8cfbe247cbdc3bcdea92eb5349c6 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libcrypto-3.dll
| MD5 | 7a6a8c2a8c379b111cdceb66b18d687d |
| SHA1 | f3b8a4c731fa0145f224112f91f046fddf642794 |
| SHA256 | 8e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b |
| SHA512 | f2ef1702df861ef55ef397ad69985d62b675d348cab3862f6ca761f1ce3ee896f663a77d7b69b286be64e7c69be1215b03945781450b186fc02cfb1e4cb226b5 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_hashlib.pyd
| MD5 | 1524882af71247adecf5815a4e55366a |
| SHA1 | e25014c793c53503bdff9af046140edda329d01b |
| SHA256 | 6f7742dfdd371c39048d775f37df3bc2d8d4316c9008e62347b337d64ebed327 |
| SHA512 | 5b954bb7953f19aa6f7c65ad3f105b77d37077950fb1b50d9d8d337bdd4b95343bac2f4c9fe17a02d1738d1f87eeef73dbbf5cdddcb470588cbc5a63845b188a |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_tkinter.pyd
| MD5 | 89f47cd630f7dfa63268fbc52d04f9e9 |
| SHA1 | 0cc250df4c2f44d8ca8820756f9f05df1e893e28 |
| SHA256 | 8e4cab61b3838f9545b5d1e0b287f18c22d360b8e6a8daca4178cc69df78f83d |
| SHA512 | bd2406ea0d5396df0153ac22ce55ca49615291ead6419a96e99007ac85059054a718c4f98942e0adb23da85899f145504b79772866d683a9a686fde6ade784e0 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_ssl.pyd
| MD5 | a0b40f1f8fc6656c5637eacacf7021f6 |
| SHA1 | 38813e25ffde1eee0b8154fa34af635186a243c1 |
| SHA256 | 79d861f0670828dee06c2e3523e2f9a2a90d6c6996bde38201425aa4003119f1 |
| SHA512 | c18855d7c0069fff392d422e5b01fc518bbdf497eb3390c0b333ecac2497cd29abbdae4557e4f0c4e90321fba910fc3e4d235ce62b745fa34918f40fa667b713 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_sqlite3.pyd
| MD5 | a7df575bf69570944b004dfe150e8caf |
| SHA1 | 2fd19be98a07347d59afd78c167601479aac94bb |
| SHA256 | b1223420e475348c0bfb90fae33fc44ce35d988270294158ec366893df221a4b |
| SHA512 | 18c381a4ded8d33271cbf0bea75af1c86c6d34cc436f68fb9342951c071c10d84cf9f96a0509c53e5886d47fed5bca113a7f7863f6873583daa7bb6af1aa9afa |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_socket.pyd
| MD5 | 64a6c475f59e5c57b3f4dd935f429f09 |
| SHA1 | ca2e0719dc32f22163ae0e7b53b2caadb0b9d023 |
| SHA256 | d03fa645cde89b4b01f4a2577139fbb7e1392cb91dc26213b3b76419110d8e49 |
| SHA512 | cf9e03b7b34cc095fe05c465f9d794319aaa0428fe30ab4ddce14ba78e835edf228d11ec016fd31dfe9f09d84b6f73482fb8e0f574d1fd08943c1ec9e0584973 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_queue.pyd
| MD5 | 8bbed19359892f8c95c802c6ad7598e9 |
| SHA1 | 773fca164965241f63170e7a1f3a8fa17f73ea18 |
| SHA256 | 4e5b7c653c1b3dc3fd7519e4f39cc8a2fb2746e0ecdc4e433fe6029f5f4d9065 |
| SHA512 | 22ea7667689a9f049fa34ddae6b858e1af3e646a379d2c5a4aef3e74a4ff1a4109418b363c9be960127f1c7e020aa393a47885bc45517c9e9aebe71ec7cb61a0 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_overlapped.pyd
| MD5 | ac053ef737e4f13b02bfa81f9e46170b |
| SHA1 | 5d8ebeb30671b74d736731696fedc78c89da0e1f |
| SHA256 | cb68e10748e2efd86f7495d647a2774cea9f97ad5c6fe179f90dc1c467b9280f |
| SHA512 | 6ac26f63981dc5e8dfb675880d6c43648e2bbe6711c75dcac20ebe4d8591e88fbfac3c60660ab28602352760b6f5e1cb587075072abd3333522e3e2549bfa02e |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_multiprocessing.pyd
| MD5 | 2ca9fe51bf2ee9f56f633110a08b45cd |
| SHA1 | 88ba6525c71890a50f07547a5e9ead0754dd85b9 |
| SHA256 | 1d6f1e7e9f55918967a37cbd744886c2b7ee193c5fb8f948132ba40b17119a81 |
| SHA512 | 821551fa1a5aa21f76c4ae05f44ddd4c2daa00329439c6dadc861931fa7bd8e464b4441dfe14383f2bb30c2fc2dfb94578927615b089a303aa39240e15e89de5 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_hashlib.pyd
| MD5 | 1524882af71247adecf5815a4e55366a |
| SHA1 | e25014c793c53503bdff9af046140edda329d01b |
| SHA256 | 6f7742dfdd371c39048d775f37df3bc2d8d4316c9008e62347b337d64ebed327 |
| SHA512 | 5b954bb7953f19aa6f7c65ad3f105b77d37077950fb1b50d9d8d337bdd4b95343bac2f4c9fe17a02d1738d1f87eeef73dbbf5cdddcb470588cbc5a63845b188a |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_elementtree.pyd
| MD5 | be02ef37d9a1c127253bc5a84705a3b7 |
| SHA1 | c313d01f999791abc9e4a7982ee6a814f8fbe6ef |
| SHA256 | 2ebb2bc6ce26d25bc2ad471f9d7edc4684064afa606f046ebf0a39c75031cb53 |
| SHA512 | 2f582da0debbf5fb254e8d85e56765d2d59263a82fac91a75648575a8d95a814b231acc1a30c5bec3e3d087367996547c8affba2f09aff899a4123210e0451f9 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_decimal.pyd
| MD5 | be315973aff9bdeb06629cd90e1a901f |
| SHA1 | 151f98d278e1f1308f2be1788c9f3b950ab88242 |
| SHA256 | 0f9c6cc463611a9b2c692382fe1cdd7a52fea4733ffaf645d433f716f8bbd725 |
| SHA512 | 8ea715438472e9c174dee5ece3c7d9752c31159e2d5796e5229b1df19f87316579352fc3649373db066dc537adf4869198b70b7d4d1d39ac647da2dd7cfc21e8 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_cffi_backend.cp311-win_amd64.pyd
| MD5 | 210def84bb2c35115a2b2ac25e3ffd8f |
| SHA1 | 0376b275c81c25d4df2be4789c875b31f106bd09 |
| SHA256 | 59767b0918859beddf28a7d66a50431411ffd940c32b3e8347e6d938b60facdf |
| SHA512 | cd5551eb7afd4645860c7edd7b0abd375ee6e1da934be21a6099879c8ee3812d57f2398cad28fbb6f75bba77471d9b32c96c7c1e9d3b4d26c7fc838745746c7f |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_asyncio.pyd
| MD5 | 511a52bcb0bd19eda7aa980f96723c93 |
| SHA1 | b11ab01053b76ebb60ab31049f551e5229e68ddd |
| SHA256 | d1fb700f280e7793e9b0dca33310ef9cd08e9e0ec4f7416854dffaf6f658a394 |
| SHA512 | d29750950db2ecbd941012d7fbdd74a2bbd619f1a92616a212acb144da75880ce8a29ec3313acbc419194219b17612b27a1833074bbbaa291cdb95b05f8486ff |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\zlib1.dll
| MD5 | 5eac41b641e813f2a887c25e7c87a02e |
| SHA1 | ec3f6cf88711ef8cfb3cc439cb75471a2bb9e1b5 |
| SHA256 | b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08 |
| SHA512 | cad34a495f1d67c4d79ed88c5c52cf9f2d724a1748ee92518b8ece4e8f2fe1d443dfe93fb9dba8959c0e44c7973af41eb1471507ab8a5b1200a25d75287d5de5 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\VCRUNTIME140_1.dll
| MD5 | cf0a1c4776ffe23ada5e570fc36e39fe |
| SHA1 | 2050fadecc11550ad9bde0b542bcf87e19d37f1a |
| SHA256 | 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47 |
| SHA512 | d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\unicodedata.pyd
| MD5 | 1905b5d0f945499441e8cd58eb123d86 |
| SHA1 | 117e584e6fcc0e8cfc8e24e3af527999f14bac30 |
| SHA256 | b1788b81fa160e5120451f9252c7745cdde98b8ce59bf273a3dd867bb034c532 |
| SHA512 | ed88cd7e3259239a0c8d42d95fa2447fc454a944c849fa97449ad88871236fefdafe21dbfa6e9b5d8a54ddf1d5281ec34d314cb93d47ce7b13912a69d284f522 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\tk86t.dll
| MD5 | 499fa3dea045af56ee5356c0ce7d6ce2 |
| SHA1 | 0444b7d4ecd25491245824c17b84916ee5b39f74 |
| SHA256 | 20139f4c327711baf18289584fa0c8112f7bb3ba55475bded21f3d107672ed94 |
| SHA512 | d776749effa241ba1415b28d2fcff1d64ed903569a8c4e56dfddd672a53b2f44119734b1959b72a9b3f4060bb2c67b7dea959cc2d4a8e9f781f17009c6840fc1 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\tcl86t.dll
| MD5 | ac6cd2fb2cd91780db186b8d6e447b7c |
| SHA1 | b387b9b6ca5f0a2b70028ab2147789c4fe24ef7a |
| SHA256 | a91781fe13548b89817462b00058a75fb0b607ec8ce99d265719ced573ade7b6 |
| SHA512 | 45b24ca07a44d8d90e5efeded2697a37f000b39d305fe63a67292fdd237de3f8efd5e85b139b5702faa695f9f27f12f24ac497e005e2f3c24c141d7cd85305b6 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\sqlite3.dll
| MD5 | b49b8fde59ee4e8178c4d02404d06ee7 |
| SHA1 | 1816fc83155d01351e191d583c68e722928cce40 |
| SHA256 | 1afd7f650596ad97fcf358b0e077121111641c38ca9d53132bab4c9588cf262f |
| SHA512 | a033ce87c2e503b386fb92aa79a7ec14d6c96e4a35d0cb76d4989bacd16f44c4ed5ac4e13057f05f9d199a3fd8545b9a25296515ec456f29c464d949ff34942a |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\select.pyd
| MD5 | 653bdccb7af2aa9ccf50cb050fd3be64 |
| SHA1 | afe0a85425ae911694c250ab4cb1f6c3d3f2cc69 |
| SHA256 | e24a3e7885df9a18c29ba058c49c3adcf59e4b58107847b98eca365b6d94f279 |
| SHA512 | 07e841fda7a2295380bfa05db7a4699f18c6e639da91d8ee2d126d4f96e4cddaedbd490deb4d2a2e8e5877edfff877693f67a9dc487e29742943e062d7be6277 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\SDL2_ttf.dll
| MD5 | f187dfdccc102436e27704dc572a2c16 |
| SHA1 | be4d499e66b8c4eb92480e4f520ccd8eaaa39b04 |
| SHA256 | fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63 |
| SHA512 | 75002d96153dfd2bfdd6291f842fb553695ef3997012dae0b9a537c95c3f3a83b844a8d1162faefcddf9e1807f3db23b1a10c2789c95dd5f6fad2286bae91afb |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\SDL2_mixer.dll
| MD5 | 201aa86dc9349396b83eed4c15abe764 |
| SHA1 | 1a239c479e275aa7be93c5372b2d35e98d8d8cec |
| SHA256 | 2a0fc5e9f72c2eaec3240cb82b7594a58ccda609485981f256b94d0a4dd8d6f8 |
| SHA512 | bb2cd185d1d936ceca3cc20372c98a1b1542288ad5523ff8b823fb5e842205656ec2f615f076929c69987c7468245a452238b509d37109c9bec26be5f638f3b7 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\SDL2_image.dll
| MD5 | b8d249a5e394b4e6a954c557af1b80e6 |
| SHA1 | b03bb9d09447114a018110bfb91d56ef8d5ec3bb |
| SHA256 | 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194 |
| SHA512 | 2f2e248c3963711f1a9f5d8baea5b8527d1df1748cd7e33bf898a380ae748f7a65629438711ff9a5343e64762ec0b5dc478cdf19fbf7111dac9d11a8427e0007 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\pyexpat.pyd
| MD5 | cdcf0e74a32ad7dfeda859a0ce4fcb20 |
| SHA1 | c72b42a59ba5d83e8d481c6f05b917871b415f25 |
| SHA256 | 91fe5b1b2de2847946e5b3f060678971d8127dfd7d2d37603fdcd31bd5c71197 |
| SHA512 | c26fdf57299b2c6085f1166b49bd9608d2dd8bc804034ebb03fb2bba6337206b6018bf7f74c069493ffae42f2e9d6337f6f7df5306b80b63c8c3a386bce69ea6 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\portmidi.dll
| MD5 | df538704b8cd0b40096f009fd5d1b767 |
| SHA1 | d2399fbb69d237d43624e987445694ec7e0b8615 |
| SHA256 | c9f8d9043ac1570b10f104f2d00aec791f56261c84ee40773be73d0a3822e013 |
| SHA512 | 408de3e99bc1bfb5b10e58ae621c0f9276530913ff26256135fe44ce78016de274cbe4c3e967457eb71870aad34dfeb362058afcebfa2d9e64f05604ab1517d4 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libwebp-7.dll
| MD5 | 2c5aca898ff88eb2c9028bbeefebbd1e |
| SHA1 | 7a0048674ef614bebe6cc83b1228d670372076c9 |
| SHA256 | 9a53563b6058f70f2725029b7dd2fe96f869c20e8090031cd303e994dfe07b50 |
| SHA512 | 46fe8b151e3a13ab506c4fc8a9f3f0f47b21f64f37097a4f1f573b547443ed23e7b2f489807c1623fbc41015f7da11665d88690d8cd0ddd61aa53789586c5a13 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libtiff-5.dll
| MD5 | 7d40a697ca6f21a8f09468b9fce565ad |
| SHA1 | dc3b7f7fc0d9056af370e06f1451a65e77ff07f7 |
| SHA256 | ebfe97ac5ef26b94945af3db5ffd110a4b8e92dc02559bf81ccb33f0d5ebce95 |
| SHA512 | 5a195e3123f7f17d92b7eca46b9afa1ea600623ad6929ac29197447bb4d474a068fd5f61fca6731a60514125d3b0b2cafe1ff6be3a0161251a366355b660d61a |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libssl-3.dll
| MD5 | 64acb046fe68d64ee475e19f67253a3c |
| SHA1 | d9e66c9437ce6f775189d6fdbd171635193ec4cc |
| SHA256 | b21309abd3dbbb1bf8fb6aa3c250fc85d7b0d9984bf4c942d1d4421502f31a10 |
| SHA512 | f8b583981df528cf4f1854b94eff6f51dd9d4be91e6fa6329a8c4435b705457c868ae40ee030fa54bebb646a37b547bc182c9cbf0df9a07fea03a18cf85c6766 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libpng16-16.dll
| MD5 | 3a26cd3f92436747d2285dcef1fae67f |
| SHA1 | e3d1403be06beb32fc8dc7e8a58c31e18b586a70 |
| SHA256 | e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5 |
| SHA512 | 73d651f063246723807d837811ead30e3faca8cb0581603f264c28fea1b2bdb6d874a73c1288c7770e95463786d6945b065d4ca1cf553e08220aea4e78a6f37f |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libopusfile-0.dll
| MD5 | 245498839af5a75cd034190fe805d478 |
| SHA1 | d164c38fd9690b8649afaef7c048f4aabb51dba8 |
| SHA256 | ccaaca81810bd2d1cab4692b4253a639f8d5516996db0e24d881efd3efdcc6a4 |
| SHA512 | 4181dea590cbc7a9e06729b79201aa29e8349408cb922de8d4cda555fc099b3e10fee4f5a9ddf1a22eaec8f5ede12f9d6e37ed7ad0486beb12b7330cca51a79e |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libopus-0.x64.dll
| MD5 | 0e078e75ab375a38f99245b3fefa384a |
| SHA1 | b4c2fda3d4d72c3e3294beb8aa164887637ca22a |
| SHA256 | c84da836e8d92421ac305842cfe5a724898ed09d340d46b129e210bdc9448131 |
| SHA512 | fa838dab0a8a07ee7c370dd617073a5f795838c3518a6f79ee17d5ebc48b78cebd680e9c8cbe54f912ceb0ae6112147fb40182bcfdcc194b73aa6bab21427bfd |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libopus-0.dll
| MD5 | e1adac219ec78b7b2ac9999d8c2e1c94 |
| SHA1 | 6910ec9351bee5c355587e42bbb2d75a65ffc0cf |
| SHA256 | 771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806 |
| SHA512 | da1912243491227168e23fb92def056b229f9f1d8c35ae122e1a0474b0be84ceb7167b138f2ee5fffd812b80c6aca719250aca6b25931585e224e27384f4cc67 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libogg-0.dll
| MD5 | 307ef797fc1af567101afba8f6ce6a8c |
| SHA1 | 0023f520f874a0c3eb3dc1fe8df73e71bde5f228 |
| SHA256 | 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe |
| SHA512 | 5b0b6049844c6fef0cd2b6b1267130bb6e4c17b26afc898cfc17499ef05e79096cd705007a74578f11a218786119be37289290c5c47541090d7b9dea2908688e |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libmodplug-1.dll
| MD5 | ead020db018b03e63a64ebff14c77909 |
| SHA1 | 89bb59ae2b3b8ec56416440642076ae7b977080e |
| SHA256 | 0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e |
| SHA512 | c4742d657e5598c606ceff29c0abb19c588ba7976a7c4bff1df80a3109fe7df25e7d0dace962ec3962a94d2715a4848f2acc997a0552bf8d893ff6e7a78857e5 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libjpeg-9.dll
| MD5 | c540308d4a8e6289c40753fdd3e1c960 |
| SHA1 | 1b84170212ca51970f794c967465ca7e84000d0e |
| SHA256 | 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69 |
| SHA512 | 1dadc6b92de9af998f83faf216d2ab6483b2dea7cdea3387ac846e924adbf624f36f8093daf5cee6010fea7f3556a5e2fcac494dbc87b5a55ce564c9cd76f92b |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\freetype.dll
| MD5 | 236f879a5dd26dc7c118d43396444b1c |
| SHA1 | 5ed3e4e084471cf8600fb5e8c54e11a254914278 |
| SHA256 | 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f |
| SHA512 | cc9326bf1ae8bf574a4715158eba889d7f0d5e3818e6f57395740a4b593567204d6eef95b6e99d2717128c3bffa34a8031c213ff3f2a05741e1eaf3ca07f2254 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\crypto_clipper.json
| MD5 | 28ace1f269a7b6ddc508fe2ef995eb89 |
| SHA1 | fc25b159929682bff11e6d3b413acba80300418a |
| SHA256 | 8011959661b3c6efee432bdc16b358de1c371aaccdbec068c9e65004262f988e |
| SHA512 | 4c1172eead25d9c6037729ad372975d545153213dba99e7308308f1f1c6594bb1322b6c1332e44bd3677458160211046762a5dbf72564e4c7d36f7371177dcd2 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_lzma.pyd
| MD5 | 737119a80303ef4eccaa998d500e7640 |
| SHA1 | 328c67c6c4d297ac13da725bf24467d8b5e982e3 |
| SHA256 | 7158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28 |
| SHA512 | 1c9920e0841a65b01a0b339c5f5254d1039ef9a16fe0c2484a7e2a9048727f2cc081817aa771b0c574fb8d1a5a49dc39798a3c5e5b5e64392e9c168e1827be7c |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_lzma.pyd
| MD5 | 737119a80303ef4eccaa998d500e7640 |
| SHA1 | 328c67c6c4d297ac13da725bf24467d8b5e982e3 |
| SHA256 | 7158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28 |
| SHA512 | 1c9920e0841a65b01a0b339c5f5254d1039ef9a16fe0c2484a7e2a9048727f2cc081817aa771b0c574fb8d1a5a49dc39798a3c5e5b5e64392e9c168e1827be7c |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libcrypto-3.dll
| MD5 | 7a6a8c2a8c379b111cdceb66b18d687d |
| SHA1 | f3b8a4c731fa0145f224112f91f046fddf642794 |
| SHA256 | 8e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b |
| SHA512 | f2ef1702df861ef55ef397ad69985d62b675d348cab3862f6ca761f1ce3ee896f663a77d7b69b286be64e7c69be1215b03945781450b186fc02cfb1e4cb226b5 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libffi-8.dll
| MD5 | 0f8e4992ca92baaf54cc0b43aaccce21 |
| SHA1 | c7300975df267b1d6adcbac0ac93fd7b1ab49bd2 |
| SHA256 | eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a |
| SHA512 | 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_ctypes.pyd
| MD5 | 6114277c6fc040f68d25ca90e25924cd |
| SHA1 | 028179c77cb3ba29cd8494049421eaa4900ccd0e |
| SHA256 | f07fe92ce85f7786f96a4d59c6ee5c05fe1db63a1889ba40a67e37069639b656 |
| SHA512 | 76e8ebefb9ba4ea8dcab8fce50629946af4f2b3f2f43163f75483cfb0a97968478c8aaef1d6a37be85bfc4c91a859deda6da21d3e753daefe084a203d839353d |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\python3.dll
| MD5 | 0e105f62fdd1ff4157560fe38512220b |
| SHA1 | 99bd69a94b3dc99fe2c0f7bbbcd05aa0bc8cd45c |
| SHA256 | 803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423 |
| SHA512 | 59c0f749ed9c59efdbcd04265b4985b1175fdd825e5a307745531ed2537397e739bc9290fdc3936cfd04f566e28bb76b878f124248b8344cf74f641c6b1101de |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_bz2.pyd
| MD5 | 4438affaaa0ca1df5b9b1cdaa0115ec1 |
| SHA1 | 4eda79eaf3de614d5f744aa9eea5bfcf66e2d386 |
| SHA256 | ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85 |
| SHA512 | 6992107ac4d2108e477bc81af667b8b8e5439231e7e9f4b15ce4bce1aeea811bc0f1aaa438be3b0e38597760cb504367512809ee1937c4b538a86724ae543ba6 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\python3.dll
| MD5 | 0e105f62fdd1ff4157560fe38512220b |
| SHA1 | 99bd69a94b3dc99fe2c0f7bbbcd05aa0bc8cd45c |
| SHA256 | 803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423 |
| SHA512 | 59c0f749ed9c59efdbcd04265b4985b1175fdd825e5a307745531ed2537397e739bc9290fdc3936cfd04f566e28bb76b878f124248b8344cf74f641c6b1101de |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_socket.pyd
| MD5 | 64a6c475f59e5c57b3f4dd935f429f09 |
| SHA1 | ca2e0719dc32f22163ae0e7b53b2caadb0b9d023 |
| SHA256 | d03fa645cde89b4b01f4a2577139fbb7e1392cb91dc26213b3b76419110d8e49 |
| SHA512 | cf9e03b7b34cc095fe05c465f9d794319aaa0428fe30ab4ddce14ba78e835edf228d11ec016fd31dfe9f09d84b6f73482fb8e0f574d1fd08943c1ec9e0584973 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\select.pyd
| MD5 | 653bdccb7af2aa9ccf50cb050fd3be64 |
| SHA1 | afe0a85425ae911694c250ab4cb1f6c3d3f2cc69 |
| SHA256 | e24a3e7885df9a18c29ba058c49c3adcf59e4b58107847b98eca365b6d94f279 |
| SHA512 | 07e841fda7a2295380bfa05db7a4699f18c6e639da91d8ee2d126d4f96e4cddaedbd490deb4d2a2e8e5877edfff877693f67a9dc487e29742943e062d7be6277 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_ssl.pyd
| MD5 | a0b40f1f8fc6656c5637eacacf7021f6 |
| SHA1 | 38813e25ffde1eee0b8154fa34af635186a243c1 |
| SHA256 | 79d861f0670828dee06c2e3523e2f9a2a90d6c6996bde38201425aa4003119f1 |
| SHA512 | c18855d7c0069fff392d422e5b01fc518bbdf497eb3390c0b333ecac2497cd29abbdae4557e4f0c4e90321fba910fc3e4d235ce62b745fa34918f40fa667b713 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\libssl-3.dll
| MD5 | 64acb046fe68d64ee475e19f67253a3c |
| SHA1 | d9e66c9437ce6f775189d6fdbd171635193ec4cc |
| SHA256 | b21309abd3dbbb1bf8fb6aa3c250fc85d7b0d9984bf4c942d1d4421502f31a10 |
| SHA512 | f8b583981df528cf4f1854b94eff6f51dd9d4be91e6fa6329a8c4435b705457c868ae40ee030fa54bebb646a37b547bc182c9cbf0df9a07fea03a18cf85c6766 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\_queue.pyd
| MD5 | 8bbed19359892f8c95c802c6ad7598e9 |
| SHA1 | 773fca164965241f63170e7a1f3a8fa17f73ea18 |
| SHA256 | 4e5b7c653c1b3dc3fd7519e4f39cc8a2fb2746e0ecdc4e433fe6029f5f4d9065 |
| SHA512 | 22ea7667689a9f049fa34ddae6b858e1af3e646a379d2c5a4aef3e74a4ff1a4109418b363c9be960127f1c7e020aa393a47885bc45517c9e9aebe71ec7cb61a0 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\charset_normalizer\md.cp311-win_amd64.pyd
| MD5 | 25e5dd43a30808f30857c6e46e6bc8df |
| SHA1 | 679cb7169813a9a0224f03624984645ea18aabe6 |
| SHA256 | 62639a735008dd068142c0efca7f3d0f96f4959a52278fcf70012946e8552974 |
| SHA512 | 904855da98f610a6ebe18ba76f7130a7f9a0ba5da0364fbc9ce79127728597c473aa85f8c0ccaf9f0af81da8f4e6ad7b722890839ee03f381e50177301661cc3 |
C:\Users\Admin\AppData\Local\Temp\_MEI42642\charset_normalizer\md.cp311-win_amd64.pyd
| MD5 | 25e5dd43a30808f30857c6e46e6bc8df |
| SHA1 | 679cb7169813a9a0224f03624984645ea18aabe6 |
| SHA256 | 62639a735008dd068142c0efca7f3d0f96f4959a52278fcf70012946e8552974 |
| SHA512 | 904855da98f610a6ebe18ba76f7130a7f9a0ba5da0364fbc9ce79127728597c473aa85f8c0ccaf9f0af81da8f4e6ad7b722890839ee03f381e50177301661cc3 |
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dsom5a4e.vdv.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1708-1322-0x00000266E44B0000-0x00000266E44D2000-memory.dmp
memory/1708-1323-0x00007FFDBCF90000-0x00007FFDBDA51000-memory.dmp
memory/1708-1324-0x00000266E4430000-0x00000266E4440000-memory.dmp
memory/1708-1325-0x00000266E4430000-0x00000266E4440000-memory.dmp
memory/1708-1328-0x00007FFDBCF90000-0x00007FFDBDA51000-memory.dmp
memory/2036-1334-0x00007FFDC40C0000-0x00007FFDC6176000-memory.dmp
memory/2036-1336-0x00007FFDC3BC0000-0x00007FFDC3FCC000-memory.dmp
memory/2036-1335-0x00007FFDC3FD0000-0x00007FFDC3FE7000-memory.dmp
memory/2036-1337-0x00007FFDC3B30000-0x00007FFDC3BBF000-memory.dmp
memory/2036-1339-0x00007FFDC3AE0000-0x00007FFDC3B28000-memory.dmp
memory/2036-1340-0x00007FFDC1C20000-0x00007FFDC3ADD000-memory.dmp
memory/2036-1346-0x00007FFDC1B70000-0x00007FFDC1C15000-memory.dmp