Malware Analysis Report

2024-11-30 12:28

Sample ID 231004-m82hmsda63
Target amazon_bot.exe
SHA256 49a9598d7681e08e63577d62462e808004fd44dc2bc590d476c671e987660241
Tags
pyinstaller pysilon
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

49a9598d7681e08e63577d62462e808004fd44dc2bc590d476c671e987660241

Threat Level: Known bad

The file amazon_bot.exe was found to be: Known bad.

Malicious Activity Summary

pyinstaller pysilon

Detect Pysilon

Pysilon family

Enumerates VirtualBox DLL files

Loads dropped DLL

Unsigned PE

Detects Pyinstaller

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-04 11:09

Signatures

Detect Pysilon

Description Indicator Process Target
N/A N/A N/A N/A

Pysilon family

pysilon

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-04 11:08

Reported

2023-10-04 11:10

Platform

win10v2004-20230915-en

Max time kernel

34s

Max time network

46s

Command Line

"C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe"

Signatures

Enumerates VirtualBox DLL files

Description Indicator Process Target
File opened (read-only) C:\windows\system32\vboxhook.dll C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
File opened (read-only) C:\windows\system32\vboxmrxnp.dll C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe

"C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe"

C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe

"C:\Users\Admin\AppData\Local\Temp\amazon_bot.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x418 0x2c8

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\amazon\""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\amazon\activate.bat

C:\Users\Admin\amazon\Amazon.exe

"Amazon.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI42642\python311.dll

MD5 58e01abc9c9b5c885635180ed104fe95
SHA1 1c2f7216b125539d63bd111a7aba615c69deb8ba
SHA256 de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
SHA512 cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081

C:\Users\Admin\AppData\Local\Temp\_MEI42642\VCRUNTIME140.dll

MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

C:\Users\Admin\AppData\Local\Temp\_MEI42642\base_library.zip

MD5 32ede00817b1d74ce945dcd1e8505ad0
SHA1 51b5390db339feeed89bffca925896aff49c63fb
SHA256 4a73d461851b484d213684f0aadf59d537cba6fe7e75497e609d54c9f2ba5d4a
SHA512 a0e070b2ee1347e85f37e9fd589bc8484f206fa9c8f4020de147b815d2041293551e3a14a09a6eb4050cfa1f74843525377e1a99bbdcfb867b61ebddb89f21f7

C:\Users\Admin\AppData\Local\Temp\_MEI42642\VCRUNTIME140.dll

MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

C:\Users\Admin\AppData\Local\Temp\_MEI42642\python311.dll

MD5 58e01abc9c9b5c885635180ed104fe95
SHA1 1c2f7216b125539d63bd111a7aba615c69deb8ba
SHA256 de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
SHA512 cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_ctypes.pyd

MD5 6114277c6fc040f68d25ca90e25924cd
SHA1 028179c77cb3ba29cd8494049421eaa4900ccd0e
SHA256 f07fe92ce85f7786f96a4d59c6ee5c05fe1db63a1889ba40a67e37069639b656
SHA512 76e8ebefb9ba4ea8dcab8fce50629946af4f2b3f2f43163f75483cfb0a97968478c8aaef1d6a37be85bfc4c91a859deda6da21d3e753daefe084a203d839353d

C:\Users\Admin\AppData\Local\Temp\_MEI42642\python3.DLL

MD5 0e105f62fdd1ff4157560fe38512220b
SHA1 99bd69a94b3dc99fe2c0f7bbbcd05aa0bc8cd45c
SHA256 803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423
SHA512 59c0f749ed9c59efdbcd04265b4985b1175fdd825e5a307745531ed2537397e739bc9290fdc3936cfd04f566e28bb76b878f124248b8344cf74f641c6b1101de

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_bz2.pyd

MD5 4438affaaa0ca1df5b9b1cdaa0115ec1
SHA1 4eda79eaf3de614d5f744aa9eea5bfcf66e2d386
SHA256 ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85
SHA512 6992107ac4d2108e477bc81af667b8b8e5439231e7e9f4b15ce4bce1aeea811bc0f1aaa438be3b0e38597760cb504367512809ee1937c4b538a86724ae543ba6

C:\Users\Admin\AppData\Local\Temp\_MEI42642\SDL2.dll

MD5 0293f98e4ae63f376f293c95f197b9ce
SHA1 6e6ae66a791001399d7dde625de50799decfbe9c
SHA256 2e4e823b46e95a29ad4ce4e7134417b0cd60145fefe606920ef6dc0ebcfb0021
SHA512 0f5f7537e414fbf04e54e744bd2c0d587c920e93ac8dcca58a15fbe041e53383b66bd7b2c1cd75f3584cab435e9ddb38354cfd7d4676dcf515642de601f3ed46

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_uuid.pyd

MD5 4faa479423c54d5be2a103b46ecb4d04
SHA1 011f6cdbd3badaa5c969595985a9ad18547dd7ec
SHA256 c2ad3c1b4333bc388b6a22049c89008505c434b1b85bff0823b19ef0cf48065a
SHA512 92d35824c30667af606bba883bf6e275f2a8b5cbfea2e84a77e256d122b91b3ee7e84d9f4e2a4946e903a11293af9648a45e8cfbe247cbdc3bcdea92eb5349c6

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libcrypto-3.dll

MD5 7a6a8c2a8c379b111cdceb66b18d687d
SHA1 f3b8a4c731fa0145f224112f91f046fddf642794
SHA256 8e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b
SHA512 f2ef1702df861ef55ef397ad69985d62b675d348cab3862f6ca761f1ce3ee896f663a77d7b69b286be64e7c69be1215b03945781450b186fc02cfb1e4cb226b5

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_hashlib.pyd

MD5 1524882af71247adecf5815a4e55366a
SHA1 e25014c793c53503bdff9af046140edda329d01b
SHA256 6f7742dfdd371c39048d775f37df3bc2d8d4316c9008e62347b337d64ebed327
SHA512 5b954bb7953f19aa6f7c65ad3f105b77d37077950fb1b50d9d8d337bdd4b95343bac2f4c9fe17a02d1738d1f87eeef73dbbf5cdddcb470588cbc5a63845b188a

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_tkinter.pyd

MD5 89f47cd630f7dfa63268fbc52d04f9e9
SHA1 0cc250df4c2f44d8ca8820756f9f05df1e893e28
SHA256 8e4cab61b3838f9545b5d1e0b287f18c22d360b8e6a8daca4178cc69df78f83d
SHA512 bd2406ea0d5396df0153ac22ce55ca49615291ead6419a96e99007ac85059054a718c4f98942e0adb23da85899f145504b79772866d683a9a686fde6ade784e0

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_ssl.pyd

MD5 a0b40f1f8fc6656c5637eacacf7021f6
SHA1 38813e25ffde1eee0b8154fa34af635186a243c1
SHA256 79d861f0670828dee06c2e3523e2f9a2a90d6c6996bde38201425aa4003119f1
SHA512 c18855d7c0069fff392d422e5b01fc518bbdf497eb3390c0b333ecac2497cd29abbdae4557e4f0c4e90321fba910fc3e4d235ce62b745fa34918f40fa667b713

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_sqlite3.pyd

MD5 a7df575bf69570944b004dfe150e8caf
SHA1 2fd19be98a07347d59afd78c167601479aac94bb
SHA256 b1223420e475348c0bfb90fae33fc44ce35d988270294158ec366893df221a4b
SHA512 18c381a4ded8d33271cbf0bea75af1c86c6d34cc436f68fb9342951c071c10d84cf9f96a0509c53e5886d47fed5bca113a7f7863f6873583daa7bb6af1aa9afa

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_socket.pyd

MD5 64a6c475f59e5c57b3f4dd935f429f09
SHA1 ca2e0719dc32f22163ae0e7b53b2caadb0b9d023
SHA256 d03fa645cde89b4b01f4a2577139fbb7e1392cb91dc26213b3b76419110d8e49
SHA512 cf9e03b7b34cc095fe05c465f9d794319aaa0428fe30ab4ddce14ba78e835edf228d11ec016fd31dfe9f09d84b6f73482fb8e0f574d1fd08943c1ec9e0584973

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_queue.pyd

MD5 8bbed19359892f8c95c802c6ad7598e9
SHA1 773fca164965241f63170e7a1f3a8fa17f73ea18
SHA256 4e5b7c653c1b3dc3fd7519e4f39cc8a2fb2746e0ecdc4e433fe6029f5f4d9065
SHA512 22ea7667689a9f049fa34ddae6b858e1af3e646a379d2c5a4aef3e74a4ff1a4109418b363c9be960127f1c7e020aa393a47885bc45517c9e9aebe71ec7cb61a0

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_overlapped.pyd

MD5 ac053ef737e4f13b02bfa81f9e46170b
SHA1 5d8ebeb30671b74d736731696fedc78c89da0e1f
SHA256 cb68e10748e2efd86f7495d647a2774cea9f97ad5c6fe179f90dc1c467b9280f
SHA512 6ac26f63981dc5e8dfb675880d6c43648e2bbe6711c75dcac20ebe4d8591e88fbfac3c60660ab28602352760b6f5e1cb587075072abd3333522e3e2549bfa02e

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_multiprocessing.pyd

MD5 2ca9fe51bf2ee9f56f633110a08b45cd
SHA1 88ba6525c71890a50f07547a5e9ead0754dd85b9
SHA256 1d6f1e7e9f55918967a37cbd744886c2b7ee193c5fb8f948132ba40b17119a81
SHA512 821551fa1a5aa21f76c4ae05f44ddd4c2daa00329439c6dadc861931fa7bd8e464b4441dfe14383f2bb30c2fc2dfb94578927615b089a303aa39240e15e89de5

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_hashlib.pyd

MD5 1524882af71247adecf5815a4e55366a
SHA1 e25014c793c53503bdff9af046140edda329d01b
SHA256 6f7742dfdd371c39048d775f37df3bc2d8d4316c9008e62347b337d64ebed327
SHA512 5b954bb7953f19aa6f7c65ad3f105b77d37077950fb1b50d9d8d337bdd4b95343bac2f4c9fe17a02d1738d1f87eeef73dbbf5cdddcb470588cbc5a63845b188a

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_elementtree.pyd

MD5 be02ef37d9a1c127253bc5a84705a3b7
SHA1 c313d01f999791abc9e4a7982ee6a814f8fbe6ef
SHA256 2ebb2bc6ce26d25bc2ad471f9d7edc4684064afa606f046ebf0a39c75031cb53
SHA512 2f582da0debbf5fb254e8d85e56765d2d59263a82fac91a75648575a8d95a814b231acc1a30c5bec3e3d087367996547c8affba2f09aff899a4123210e0451f9

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_decimal.pyd

MD5 be315973aff9bdeb06629cd90e1a901f
SHA1 151f98d278e1f1308f2be1788c9f3b950ab88242
SHA256 0f9c6cc463611a9b2c692382fe1cdd7a52fea4733ffaf645d433f716f8bbd725
SHA512 8ea715438472e9c174dee5ece3c7d9752c31159e2d5796e5229b1df19f87316579352fc3649373db066dc537adf4869198b70b7d4d1d39ac647da2dd7cfc21e8

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_cffi_backend.cp311-win_amd64.pyd

MD5 210def84bb2c35115a2b2ac25e3ffd8f
SHA1 0376b275c81c25d4df2be4789c875b31f106bd09
SHA256 59767b0918859beddf28a7d66a50431411ffd940c32b3e8347e6d938b60facdf
SHA512 cd5551eb7afd4645860c7edd7b0abd375ee6e1da934be21a6099879c8ee3812d57f2398cad28fbb6f75bba77471d9b32c96c7c1e9d3b4d26c7fc838745746c7f

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_asyncio.pyd

MD5 511a52bcb0bd19eda7aa980f96723c93
SHA1 b11ab01053b76ebb60ab31049f551e5229e68ddd
SHA256 d1fb700f280e7793e9b0dca33310ef9cd08e9e0ec4f7416854dffaf6f658a394
SHA512 d29750950db2ecbd941012d7fbdd74a2bbd619f1a92616a212acb144da75880ce8a29ec3313acbc419194219b17612b27a1833074bbbaa291cdb95b05f8486ff

C:\Users\Admin\AppData\Local\Temp\_MEI42642\zlib1.dll

MD5 5eac41b641e813f2a887c25e7c87a02e
SHA1 ec3f6cf88711ef8cfb3cc439cb75471a2bb9e1b5
SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
SHA512 cad34a495f1d67c4d79ed88c5c52cf9f2d724a1748ee92518b8ece4e8f2fe1d443dfe93fb9dba8959c0e44c7973af41eb1471507ab8a5b1200a25d75287d5de5

C:\Users\Admin\AppData\Local\Temp\_MEI42642\VCRUNTIME140_1.dll

MD5 cf0a1c4776ffe23ada5e570fc36e39fe
SHA1 2050fadecc11550ad9bde0b542bcf87e19d37f1a
SHA256 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
SHA512 d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168

C:\Users\Admin\AppData\Local\Temp\_MEI42642\unicodedata.pyd

MD5 1905b5d0f945499441e8cd58eb123d86
SHA1 117e584e6fcc0e8cfc8e24e3af527999f14bac30
SHA256 b1788b81fa160e5120451f9252c7745cdde98b8ce59bf273a3dd867bb034c532
SHA512 ed88cd7e3259239a0c8d42d95fa2447fc454a944c849fa97449ad88871236fefdafe21dbfa6e9b5d8a54ddf1d5281ec34d314cb93d47ce7b13912a69d284f522

C:\Users\Admin\AppData\Local\Temp\_MEI42642\tk86t.dll

MD5 499fa3dea045af56ee5356c0ce7d6ce2
SHA1 0444b7d4ecd25491245824c17b84916ee5b39f74
SHA256 20139f4c327711baf18289584fa0c8112f7bb3ba55475bded21f3d107672ed94
SHA512 d776749effa241ba1415b28d2fcff1d64ed903569a8c4e56dfddd672a53b2f44119734b1959b72a9b3f4060bb2c67b7dea959cc2d4a8e9f781f17009c6840fc1

C:\Users\Admin\AppData\Local\Temp\_MEI42642\tcl86t.dll

MD5 ac6cd2fb2cd91780db186b8d6e447b7c
SHA1 b387b9b6ca5f0a2b70028ab2147789c4fe24ef7a
SHA256 a91781fe13548b89817462b00058a75fb0b607ec8ce99d265719ced573ade7b6
SHA512 45b24ca07a44d8d90e5efeded2697a37f000b39d305fe63a67292fdd237de3f8efd5e85b139b5702faa695f9f27f12f24ac497e005e2f3c24c141d7cd85305b6

C:\Users\Admin\AppData\Local\Temp\_MEI42642\sqlite3.dll

MD5 b49b8fde59ee4e8178c4d02404d06ee7
SHA1 1816fc83155d01351e191d583c68e722928cce40
SHA256 1afd7f650596ad97fcf358b0e077121111641c38ca9d53132bab4c9588cf262f
SHA512 a033ce87c2e503b386fb92aa79a7ec14d6c96e4a35d0cb76d4989bacd16f44c4ed5ac4e13057f05f9d199a3fd8545b9a25296515ec456f29c464d949ff34942a

C:\Users\Admin\AppData\Local\Temp\_MEI42642\select.pyd

MD5 653bdccb7af2aa9ccf50cb050fd3be64
SHA1 afe0a85425ae911694c250ab4cb1f6c3d3f2cc69
SHA256 e24a3e7885df9a18c29ba058c49c3adcf59e4b58107847b98eca365b6d94f279
SHA512 07e841fda7a2295380bfa05db7a4699f18c6e639da91d8ee2d126d4f96e4cddaedbd490deb4d2a2e8e5877edfff877693f67a9dc487e29742943e062d7be6277

C:\Users\Admin\AppData\Local\Temp\_MEI42642\SDL2_ttf.dll

MD5 f187dfdccc102436e27704dc572a2c16
SHA1 be4d499e66b8c4eb92480e4f520ccd8eaaa39b04
SHA256 fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63
SHA512 75002d96153dfd2bfdd6291f842fb553695ef3997012dae0b9a537c95c3f3a83b844a8d1162faefcddf9e1807f3db23b1a10c2789c95dd5f6fad2286bae91afb

C:\Users\Admin\AppData\Local\Temp\_MEI42642\SDL2_mixer.dll

MD5 201aa86dc9349396b83eed4c15abe764
SHA1 1a239c479e275aa7be93c5372b2d35e98d8d8cec
SHA256 2a0fc5e9f72c2eaec3240cb82b7594a58ccda609485981f256b94d0a4dd8d6f8
SHA512 bb2cd185d1d936ceca3cc20372c98a1b1542288ad5523ff8b823fb5e842205656ec2f615f076929c69987c7468245a452238b509d37109c9bec26be5f638f3b7

C:\Users\Admin\AppData\Local\Temp\_MEI42642\SDL2_image.dll

MD5 b8d249a5e394b4e6a954c557af1b80e6
SHA1 b03bb9d09447114a018110bfb91d56ef8d5ec3bb
SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
SHA512 2f2e248c3963711f1a9f5d8baea5b8527d1df1748cd7e33bf898a380ae748f7a65629438711ff9a5343e64762ec0b5dc478cdf19fbf7111dac9d11a8427e0007

C:\Users\Admin\AppData\Local\Temp\_MEI42642\pyexpat.pyd

MD5 cdcf0e74a32ad7dfeda859a0ce4fcb20
SHA1 c72b42a59ba5d83e8d481c6f05b917871b415f25
SHA256 91fe5b1b2de2847946e5b3f060678971d8127dfd7d2d37603fdcd31bd5c71197
SHA512 c26fdf57299b2c6085f1166b49bd9608d2dd8bc804034ebb03fb2bba6337206b6018bf7f74c069493ffae42f2e9d6337f6f7df5306b80b63c8c3a386bce69ea6

C:\Users\Admin\AppData\Local\Temp\_MEI42642\portmidi.dll

MD5 df538704b8cd0b40096f009fd5d1b767
SHA1 d2399fbb69d237d43624e987445694ec7e0b8615
SHA256 c9f8d9043ac1570b10f104f2d00aec791f56261c84ee40773be73d0a3822e013
SHA512 408de3e99bc1bfb5b10e58ae621c0f9276530913ff26256135fe44ce78016de274cbe4c3e967457eb71870aad34dfeb362058afcebfa2d9e64f05604ab1517d4

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libwebp-7.dll

MD5 2c5aca898ff88eb2c9028bbeefebbd1e
SHA1 7a0048674ef614bebe6cc83b1228d670372076c9
SHA256 9a53563b6058f70f2725029b7dd2fe96f869c20e8090031cd303e994dfe07b50
SHA512 46fe8b151e3a13ab506c4fc8a9f3f0f47b21f64f37097a4f1f573b547443ed23e7b2f489807c1623fbc41015f7da11665d88690d8cd0ddd61aa53789586c5a13

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libtiff-5.dll

MD5 7d40a697ca6f21a8f09468b9fce565ad
SHA1 dc3b7f7fc0d9056af370e06f1451a65e77ff07f7
SHA256 ebfe97ac5ef26b94945af3db5ffd110a4b8e92dc02559bf81ccb33f0d5ebce95
SHA512 5a195e3123f7f17d92b7eca46b9afa1ea600623ad6929ac29197447bb4d474a068fd5f61fca6731a60514125d3b0b2cafe1ff6be3a0161251a366355b660d61a

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libssl-3.dll

MD5 64acb046fe68d64ee475e19f67253a3c
SHA1 d9e66c9437ce6f775189d6fdbd171635193ec4cc
SHA256 b21309abd3dbbb1bf8fb6aa3c250fc85d7b0d9984bf4c942d1d4421502f31a10
SHA512 f8b583981df528cf4f1854b94eff6f51dd9d4be91e6fa6329a8c4435b705457c868ae40ee030fa54bebb646a37b547bc182c9cbf0df9a07fea03a18cf85c6766

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libpng16-16.dll

MD5 3a26cd3f92436747d2285dcef1fae67f
SHA1 e3d1403be06beb32fc8dc7e8a58c31e18b586a70
SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
SHA512 73d651f063246723807d837811ead30e3faca8cb0581603f264c28fea1b2bdb6d874a73c1288c7770e95463786d6945b065d4ca1cf553e08220aea4e78a6f37f

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libopusfile-0.dll

MD5 245498839af5a75cd034190fe805d478
SHA1 d164c38fd9690b8649afaef7c048f4aabb51dba8
SHA256 ccaaca81810bd2d1cab4692b4253a639f8d5516996db0e24d881efd3efdcc6a4
SHA512 4181dea590cbc7a9e06729b79201aa29e8349408cb922de8d4cda555fc099b3e10fee4f5a9ddf1a22eaec8f5ede12f9d6e37ed7ad0486beb12b7330cca51a79e

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libopus-0.x64.dll

MD5 0e078e75ab375a38f99245b3fefa384a
SHA1 b4c2fda3d4d72c3e3294beb8aa164887637ca22a
SHA256 c84da836e8d92421ac305842cfe5a724898ed09d340d46b129e210bdc9448131
SHA512 fa838dab0a8a07ee7c370dd617073a5f795838c3518a6f79ee17d5ebc48b78cebd680e9c8cbe54f912ceb0ae6112147fb40182bcfdcc194b73aa6bab21427bfd

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libopus-0.dll

MD5 e1adac219ec78b7b2ac9999d8c2e1c94
SHA1 6910ec9351bee5c355587e42bbb2d75a65ffc0cf
SHA256 771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
SHA512 da1912243491227168e23fb92def056b229f9f1d8c35ae122e1a0474b0be84ceb7167b138f2ee5fffd812b80c6aca719250aca6b25931585e224e27384f4cc67

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libogg-0.dll

MD5 307ef797fc1af567101afba8f6ce6a8c
SHA1 0023f520f874a0c3eb3dc1fe8df73e71bde5f228
SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
SHA512 5b0b6049844c6fef0cd2b6b1267130bb6e4c17b26afc898cfc17499ef05e79096cd705007a74578f11a218786119be37289290c5c47541090d7b9dea2908688e

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libmodplug-1.dll

MD5 ead020db018b03e63a64ebff14c77909
SHA1 89bb59ae2b3b8ec56416440642076ae7b977080e
SHA256 0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
SHA512 c4742d657e5598c606ceff29c0abb19c588ba7976a7c4bff1df80a3109fe7df25e7d0dace962ec3962a94d2715a4848f2acc997a0552bf8d893ff6e7a78857e5

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libjpeg-9.dll

MD5 c540308d4a8e6289c40753fdd3e1c960
SHA1 1b84170212ca51970f794c967465ca7e84000d0e
SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
SHA512 1dadc6b92de9af998f83faf216d2ab6483b2dea7cdea3387ac846e924adbf624f36f8093daf5cee6010fea7f3556a5e2fcac494dbc87b5a55ce564c9cd76f92b

C:\Users\Admin\AppData\Local\Temp\_MEI42642\freetype.dll

MD5 236f879a5dd26dc7c118d43396444b1c
SHA1 5ed3e4e084471cf8600fb5e8c54e11a254914278
SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
SHA512 cc9326bf1ae8bf574a4715158eba889d7f0d5e3818e6f57395740a4b593567204d6eef95b6e99d2717128c3bffa34a8031c213ff3f2a05741e1eaf3ca07f2254

C:\Users\Admin\AppData\Local\Temp\_MEI42642\crypto_clipper.json

MD5 28ace1f269a7b6ddc508fe2ef995eb89
SHA1 fc25b159929682bff11e6d3b413acba80300418a
SHA256 8011959661b3c6efee432bdc16b358de1c371aaccdbec068c9e65004262f988e
SHA512 4c1172eead25d9c6037729ad372975d545153213dba99e7308308f1f1c6594bb1322b6c1332e44bd3677458160211046762a5dbf72564e4c7d36f7371177dcd2

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_lzma.pyd

MD5 737119a80303ef4eccaa998d500e7640
SHA1 328c67c6c4d297ac13da725bf24467d8b5e982e3
SHA256 7158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28
SHA512 1c9920e0841a65b01a0b339c5f5254d1039ef9a16fe0c2484a7e2a9048727f2cc081817aa771b0c574fb8d1a5a49dc39798a3c5e5b5e64392e9c168e1827be7c

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_lzma.pyd

MD5 737119a80303ef4eccaa998d500e7640
SHA1 328c67c6c4d297ac13da725bf24467d8b5e982e3
SHA256 7158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28
SHA512 1c9920e0841a65b01a0b339c5f5254d1039ef9a16fe0c2484a7e2a9048727f2cc081817aa771b0c574fb8d1a5a49dc39798a3c5e5b5e64392e9c168e1827be7c

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libcrypto-3.dll

MD5 7a6a8c2a8c379b111cdceb66b18d687d
SHA1 f3b8a4c731fa0145f224112f91f046fddf642794
SHA256 8e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b
SHA512 f2ef1702df861ef55ef397ad69985d62b675d348cab3862f6ca761f1ce3ee896f663a77d7b69b286be64e7c69be1215b03945781450b186fc02cfb1e4cb226b5

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_ctypes.pyd

MD5 6114277c6fc040f68d25ca90e25924cd
SHA1 028179c77cb3ba29cd8494049421eaa4900ccd0e
SHA256 f07fe92ce85f7786f96a4d59c6ee5c05fe1db63a1889ba40a67e37069639b656
SHA512 76e8ebefb9ba4ea8dcab8fce50629946af4f2b3f2f43163f75483cfb0a97968478c8aaef1d6a37be85bfc4c91a859deda6da21d3e753daefe084a203d839353d

C:\Users\Admin\AppData\Local\Temp\_MEI42642\python3.dll

MD5 0e105f62fdd1ff4157560fe38512220b
SHA1 99bd69a94b3dc99fe2c0f7bbbcd05aa0bc8cd45c
SHA256 803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423
SHA512 59c0f749ed9c59efdbcd04265b4985b1175fdd825e5a307745531ed2537397e739bc9290fdc3936cfd04f566e28bb76b878f124248b8344cf74f641c6b1101de

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_bz2.pyd

MD5 4438affaaa0ca1df5b9b1cdaa0115ec1
SHA1 4eda79eaf3de614d5f744aa9eea5bfcf66e2d386
SHA256 ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85
SHA512 6992107ac4d2108e477bc81af667b8b8e5439231e7e9f4b15ce4bce1aeea811bc0f1aaa438be3b0e38597760cb504367512809ee1937c4b538a86724ae543ba6

C:\Users\Admin\AppData\Local\Temp\_MEI42642\python3.dll

MD5 0e105f62fdd1ff4157560fe38512220b
SHA1 99bd69a94b3dc99fe2c0f7bbbcd05aa0bc8cd45c
SHA256 803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423
SHA512 59c0f749ed9c59efdbcd04265b4985b1175fdd825e5a307745531ed2537397e739bc9290fdc3936cfd04f566e28bb76b878f124248b8344cf74f641c6b1101de

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_socket.pyd

MD5 64a6c475f59e5c57b3f4dd935f429f09
SHA1 ca2e0719dc32f22163ae0e7b53b2caadb0b9d023
SHA256 d03fa645cde89b4b01f4a2577139fbb7e1392cb91dc26213b3b76419110d8e49
SHA512 cf9e03b7b34cc095fe05c465f9d794319aaa0428fe30ab4ddce14ba78e835edf228d11ec016fd31dfe9f09d84b6f73482fb8e0f574d1fd08943c1ec9e0584973

C:\Users\Admin\AppData\Local\Temp\_MEI42642\select.pyd

MD5 653bdccb7af2aa9ccf50cb050fd3be64
SHA1 afe0a85425ae911694c250ab4cb1f6c3d3f2cc69
SHA256 e24a3e7885df9a18c29ba058c49c3adcf59e4b58107847b98eca365b6d94f279
SHA512 07e841fda7a2295380bfa05db7a4699f18c6e639da91d8ee2d126d4f96e4cddaedbd490deb4d2a2e8e5877edfff877693f67a9dc487e29742943e062d7be6277

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_ssl.pyd

MD5 a0b40f1f8fc6656c5637eacacf7021f6
SHA1 38813e25ffde1eee0b8154fa34af635186a243c1
SHA256 79d861f0670828dee06c2e3523e2f9a2a90d6c6996bde38201425aa4003119f1
SHA512 c18855d7c0069fff392d422e5b01fc518bbdf497eb3390c0b333ecac2497cd29abbdae4557e4f0c4e90321fba910fc3e4d235ce62b745fa34918f40fa667b713

C:\Users\Admin\AppData\Local\Temp\_MEI42642\libssl-3.dll

MD5 64acb046fe68d64ee475e19f67253a3c
SHA1 d9e66c9437ce6f775189d6fdbd171635193ec4cc
SHA256 b21309abd3dbbb1bf8fb6aa3c250fc85d7b0d9984bf4c942d1d4421502f31a10
SHA512 f8b583981df528cf4f1854b94eff6f51dd9d4be91e6fa6329a8c4435b705457c868ae40ee030fa54bebb646a37b547bc182c9cbf0df9a07fea03a18cf85c6766

C:\Users\Admin\AppData\Local\Temp\_MEI42642\_queue.pyd

MD5 8bbed19359892f8c95c802c6ad7598e9
SHA1 773fca164965241f63170e7a1f3a8fa17f73ea18
SHA256 4e5b7c653c1b3dc3fd7519e4f39cc8a2fb2746e0ecdc4e433fe6029f5f4d9065
SHA512 22ea7667689a9f049fa34ddae6b858e1af3e646a379d2c5a4aef3e74a4ff1a4109418b363c9be960127f1c7e020aa393a47885bc45517c9e9aebe71ec7cb61a0

C:\Users\Admin\AppData\Local\Temp\_MEI42642\charset_normalizer\md.cp311-win_amd64.pyd

MD5 25e5dd43a30808f30857c6e46e6bc8df
SHA1 679cb7169813a9a0224f03624984645ea18aabe6
SHA256 62639a735008dd068142c0efca7f3d0f96f4959a52278fcf70012946e8552974
SHA512 904855da98f610a6ebe18ba76f7130a7f9a0ba5da0364fbc9ce79127728597c473aa85f8c0ccaf9f0af81da8f4e6ad7b722890839ee03f381e50177301661cc3

C:\Users\Admin\AppData\Local\Temp\_MEI42642\charset_normalizer\md.cp311-win_amd64.pyd

MD5 25e5dd43a30808f30857c6e46e6bc8df
SHA1 679cb7169813a9a0224f03624984645ea18aabe6
SHA256 62639a735008dd068142c0efca7f3d0f96f4959a52278fcf70012946e8552974
SHA512 904855da98f610a6ebe18ba76f7130a7f9a0ba5da0364fbc9ce79127728597c473aa85f8c0ccaf9f0af81da8f4e6ad7b722890839ee03f381e50177301661cc3

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dsom5a4e.vdv.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1708-1322-0x00000266E44B0000-0x00000266E44D2000-memory.dmp

memory/1708-1323-0x00007FFDBCF90000-0x00007FFDBDA51000-memory.dmp

memory/1708-1324-0x00000266E4430000-0x00000266E4440000-memory.dmp

memory/1708-1325-0x00000266E4430000-0x00000266E4440000-memory.dmp

memory/1708-1328-0x00007FFDBCF90000-0x00007FFDBDA51000-memory.dmp

memory/2036-1334-0x00007FFDC40C0000-0x00007FFDC6176000-memory.dmp

memory/2036-1336-0x00007FFDC3BC0000-0x00007FFDC3FCC000-memory.dmp

memory/2036-1335-0x00007FFDC3FD0000-0x00007FFDC3FE7000-memory.dmp

memory/2036-1337-0x00007FFDC3B30000-0x00007FFDC3BBF000-memory.dmp

memory/2036-1339-0x00007FFDC3AE0000-0x00007FFDC3B28000-memory.dmp

memory/2036-1340-0x00007FFDC1C20000-0x00007FFDC3ADD000-memory.dmp

memory/2036-1346-0x00007FFDC1B70000-0x00007FFDC1C15000-memory.dmp