Analysis Overview
SHA256
c597e0fc16402b1e4d03969819fa2c30ecc1e9969da2f688251a7d32f9214e77
Threat Level: Known bad
The file GraveYard.Client.rar was found to be: Known bad.
Malicious Activity Summary
Detect Pysilon
Quasar family
Quasar RAT
Quasar payload
Pysilon family
Enumerates VirtualBox DLL files
Loads dropped DLL
Executes dropped EXE
UPX packed file
Adds Run key to start application
Detects Pyinstaller
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Kills process with taskkill
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-21 01:41
Signatures
Detect Pysilon
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Pysilon family
Quasar family
Quasar payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral4
Detonation Overview
Submitted
2023-10-21 01:40
Reported
2023-10-21 01:52
Platform
win10v2004-20231020-en
Max time kernel
0s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\mods\configs\client.exe
"C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\mods\configs\client.exe"
Network
| Country | Destination | Domain | Proto |
| N/A | 20.123.104.105:443 | tcp |
Files
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-21 01:40
Reported
2023-10-21 01:48
Platform
win10-20231020-en
Max time kernel
67s
Max time network
78s
Command Line
Signatures
Enumerates VirtualBox DLL files
| Description | Indicator | Process | Target |
| File opened (read-only) | C:\windows\system32\vboxhook.dll | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| File opened (read-only) | C:\windows\system32\vboxmrxnp.dll | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Black Star ID\Black star ID.exe | N/A |
Loads dropped DLL
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2640874492-649017405-3475600720-1000\Software\Microsoft\Windows\CurrentVersion\Run\Laughing coffin = "C:\\Users\\Admin\\Black Star ID\\Black star ID.exe" | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe
"C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe"
C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe
"C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3b8
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Black Star ID\""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Black Star ID\activate.bat""
C:\Users\Admin\Black Star ID\Black star ID.exe
"Black star ID.exe"
C:\Windows\system32\taskkill.exe
taskkill /f /im "black star ID.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI39162\python311.dll
| MD5 | 5792adeab1e4414e0129ce7a228eb8b8 |
| SHA1 | e9f022e687b6d88d20ee96d9509f82e916b9ee8c |
| SHA256 | 7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967 |
| SHA512 | c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b |
\Users\Admin\AppData\Local\Temp\_MEI39162\python311.dll
| MD5 | 5792adeab1e4414e0129ce7a228eb8b8 |
| SHA1 | e9f022e687b6d88d20ee96d9509f82e916b9ee8c |
| SHA256 | 7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967 |
| SHA512 | c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b |
memory/4960-1255-0x00007FFCA8950000-0x00007FFCA8F39000-memory.dmp
\Users\Admin\AppData\Local\Temp\_MEI39162\VCRUNTIME140.dll
| MD5 | 4585a96cc4eef6aafd5e27ea09147dc6 |
| SHA1 | 489cfff1b19abbec98fda26ac8958005e88dd0cb |
| SHA256 | a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736 |
| SHA512 | d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\VCRUNTIME140.dll
| MD5 | 4585a96cc4eef6aafd5e27ea09147dc6 |
| SHA1 | 489cfff1b19abbec98fda26ac8958005e88dd0cb |
| SHA256 | a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736 |
| SHA512 | d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\base_library.zip
| MD5 | 2f6d57bccf7f7735acb884a980410f6a |
| SHA1 | 93a6926887a08dc09cd92864cd82b2bec7b24ec5 |
| SHA256 | 1b7d326bad406e96a4c83b5a49714819467e3174ed0a74f81c9ebd96d1dd40b3 |
| SHA512 | 95bcfc66dbe7b6ad324bd2dc2258a3366a3594bfc50118ab37a2a204906109e42192fb10a91172b340cc28c12640513db268c854947fb9ed8426f214ff8889b4 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_ctypes.pyd
| MD5 | 1adfe4d0f4d68c9c539489b89717984d |
| SHA1 | 8ae31b831b3160f5b88dda58ad3959c7423f8eb2 |
| SHA256 | 64e8fd952ccf5b8adca80ce8c7bc6c96ec7df381789256fe8d326f111f02e95c |
| SHA512 | b403cc46e0874a75e3c0819784244ed6557eae19b0d76ffd86f56b3739db10ea8deec3dc1ca9e94c101263d0ccf506978443085a70c3ab0816885046b5ef5117 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\python3.DLL
| MD5 | b711598fc3ed0fe4cf2c7f3e0877979e |
| SHA1 | 299c799e5d697834aa2447d8a313588ab5c5e433 |
| SHA256 | 520169aa6cf49d7ee724d1178de1be0e809e4bdcf671e06f3d422a0dd5fd294a |
| SHA512 | b3d59eff5e38cef651c9603971bde77be7231ea8b7bdb444259390a8a9e452e107a0b6cb9cc93e37fd3b40afb2ba9e67217d648bfca52f7cdc4b60c7493b6b84 |
\Users\Admin\AppData\Local\Temp\_MEI39162\python3.dll
| MD5 | b711598fc3ed0fe4cf2c7f3e0877979e |
| SHA1 | 299c799e5d697834aa2447d8a313588ab5c5e433 |
| SHA256 | 520169aa6cf49d7ee724d1178de1be0e809e4bdcf671e06f3d422a0dd5fd294a |
| SHA512 | b3d59eff5e38cef651c9603971bde77be7231ea8b7bdb444259390a8a9e452e107a0b6cb9cc93e37fd3b40afb2ba9e67217d648bfca52f7cdc4b60c7493b6b84 |
\Users\Admin\AppData\Local\Temp\_MEI39162\python3.dll
| MD5 | b711598fc3ed0fe4cf2c7f3e0877979e |
| SHA1 | 299c799e5d697834aa2447d8a313588ab5c5e433 |
| SHA256 | 520169aa6cf49d7ee724d1178de1be0e809e4bdcf671e06f3d422a0dd5fd294a |
| SHA512 | b3d59eff5e38cef651c9603971bde77be7231ea8b7bdb444259390a8a9e452e107a0b6cb9cc93e37fd3b40afb2ba9e67217d648bfca52f7cdc4b60c7493b6b84 |
\Users\Admin\AppData\Local\Temp\_MEI39162\_ctypes.pyd
| MD5 | 1adfe4d0f4d68c9c539489b89717984d |
| SHA1 | 8ae31b831b3160f5b88dda58ad3959c7423f8eb2 |
| SHA256 | 64e8fd952ccf5b8adca80ce8c7bc6c96ec7df381789256fe8d326f111f02e95c |
| SHA512 | b403cc46e0874a75e3c0819784244ed6557eae19b0d76ffd86f56b3739db10ea8deec3dc1ca9e94c101263d0ccf506978443085a70c3ab0816885046b5ef5117 |
memory/4960-1263-0x00007FFCBAF70000-0x00007FFCBAF93000-memory.dmp
\Users\Admin\AppData\Local\Temp\_MEI39162\libffi-8.dll
| MD5 | 08b000c3d990bc018fcb91a1e175e06e |
| SHA1 | bd0ce09bb3414d11c91316113c2becfff0862d0d |
| SHA256 | 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece |
| SHA512 | 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\libffi-8.dll
| MD5 | 08b000c3d990bc018fcb91a1e175e06e |
| SHA1 | bd0ce09bb3414d11c91316113c2becfff0862d0d |
| SHA256 | 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece |
| SHA512 | 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf |
memory/4960-1265-0x00007FFCBAF60000-0x00007FFCBAF6F000-memory.dmp
\Users\Admin\AppData\Local\Temp\_MEI39162\_bz2.pyd
| MD5 | 2d461b41f6e9a305dde68e9c59e4110a |
| SHA1 | 97c2266f47a651e37a72c153116d81d93c7556e8 |
| SHA256 | abbe3933a34a9653a757244e8e55b0d7d3a108527a3e9e8a7f2013b5f2a9eff4 |
| SHA512 | eef132df6e52eb783bad3e6af0d57cb48cda2eb0edb6e282753b02d21970c1eea6bab03c835ff9f28f2d3e25f5e9e18f176a8c5680522c09da358a1c48cf14c8 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_bz2.pyd
| MD5 | 2d461b41f6e9a305dde68e9c59e4110a |
| SHA1 | 97c2266f47a651e37a72c153116d81d93c7556e8 |
| SHA256 | abbe3933a34a9653a757244e8e55b0d7d3a108527a3e9e8a7f2013b5f2a9eff4 |
| SHA512 | eef132df6e52eb783bad3e6af0d57cb48cda2eb0edb6e282753b02d21970c1eea6bab03c835ff9f28f2d3e25f5e9e18f176a8c5680522c09da358a1c48cf14c8 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_lzma.pyd
| MD5 | 3798175fd77eded46a8af6b03c5e5f6d |
| SHA1 | f637eaf42080dcc620642400571473a3fdf9174f |
| SHA256 | 3c9d5a9433b22538fc64141cd3784800c567c18e4379003329cf69a1d59b2a41 |
| SHA512 | 1f7351c9e905265625d725551d8ea1de5d9999bc333d29e6510a5bca4e4d7c1472b2a637e892a485a7437ea4768329e5365b209dd39d7c1995fe3317dc5aecdf |
memory/4960-1269-0x00007FFCBAF40000-0x00007FFCBAF59000-memory.dmp
\Users\Admin\AppData\Local\Temp\_MEI39162\_lzma.pyd
| MD5 | 3798175fd77eded46a8af6b03c5e5f6d |
| SHA1 | f637eaf42080dcc620642400571473a3fdf9174f |
| SHA256 | 3c9d5a9433b22538fc64141cd3784800c567c18e4379003329cf69a1d59b2a41 |
| SHA512 | 1f7351c9e905265625d725551d8ea1de5d9999bc333d29e6510a5bca4e4d7c1472b2a637e892a485a7437ea4768329e5365b209dd39d7c1995fe3317dc5aecdf |
memory/4960-1310-0x00007FFCB7D30000-0x00007FFCB7D5D000-memory.dmp
\Users\Admin\AppData\Local\Temp\_MEI39162\libcrypto-1_1.dll
| MD5 | dffcab08f94e627de159e5b27326d2fc |
| SHA1 | ab8954e9ae94ae76067e5a0b1df074bccc7c3b68 |
| SHA256 | 135b115e77479eedd908d7a782e004ece6dd900bb1ca05cc1260d5dd6273ef15 |
| SHA512 | 57e175a5883edb781cdb2286167d027fdb4b762f41fb1fc9bd26b5544096a9c5dda7bccbb6795dcc37ed5d8d03dc0a406bf1a59adb3aeb41714f1a7c8901a17d |
memory/4960-1312-0x00007FFCB7B50000-0x00007FFCB7B64000-memory.dmp
memory/4960-1314-0x00007FFCA85D0000-0x00007FFCA8948000-memory.dmp
\Users\Admin\AppData\Local\Temp\_MEI39162\_hashlib.pyd
| MD5 | f10d896ed25751ead72d8b03e404ea36 |
| SHA1 | eb8e0fd6e2356f76b5ea0cb72ab37399ec9d8ecb |
| SHA256 | 3660b985ca47ca1bba07db01458b3153e4e692ee57a8b23ce22f1a5ca18707c3 |
| SHA512 | 7f234e0d197ba48396fabd1fccc2f19e5d4ad922a2b3fe62920cd485e5065b66813b4b2a2477d2f7f911004e1bc6e5a6ec5e873d8ff81e642fee9e77b428fb42 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_uuid.pyd
| MD5 | 46e9d7b5d9668c9db5caa48782ca71ba |
| SHA1 | 6bbc83a542053991b57f431dd377940418848131 |
| SHA256 | f6063622c0a0a34468679413d1b18d1f3be67e747696ab972361faed4b8d6735 |
| SHA512 | c5b171ebdb51b1755281c3180b30e88796db8aa96073489613dab96b6959a205846711187266a0ba30782102ce14fbfa4d9f413a2c018494597600482329ebf7 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_tkinter.pyd
| MD5 | cf3e7e439f68aef285c58a34d074deaf |
| SHA1 | e911d6dff1c4d23c8e4807f949a9730315d6b619 |
| SHA256 | bff186ec3a0e4cb2728c93246d85b1277ed81114e60ddf43d9be420a7c88916b |
| SHA512 | ae793b900c890739485292a3592cc88c4e833d0c42c825248fac2089f2b35a28bd5fb353123e6d3dcd7772dc36332956499af6248c112858495219d89b6f2d5e |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_ssl.pyd
| MD5 | 2089768e25606262921e4424a590ff05 |
| SHA1 | bc94a8ff462547ab48c2fbf705673a1552545b76 |
| SHA256 | 3e6e9fc56e1a9fe5edb39ee03e5d47fa0e3f6adb17be1f087dc6f891d3b0bbca |
| SHA512 | 371aa8e5c722307fff65e00968b14280ee5046cfcf4a1d9522450688d75a3b0362f2c9ec0ec117b2fc566664f2f52a1b47fe62f28466488163f9f0f1ce367f86 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_sqlite3.pyd
| MD5 | eb6313b94292c827a5758eea82d018d9 |
| SHA1 | 7070f715d088c669eda130d0f15e4e4e9c4b7961 |
| SHA256 | 6b41dfd7d6ac12afe523d74a68f8bd984a75e438dcf2daa23a1f934ca02e89da |
| SHA512 | 23bfc3abf71b04ccffc51cedf301fadb038c458c06d14592bf1198b61758810636d9bbac9e4188e72927b49cb490aeafa313a04e3460c3fb4f22bdddf112ae56 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_socket.pyd
| MD5 | bcc3e26a18d59d76fd6cf7cd64e9e14d |
| SHA1 | b85e4e7d300dbeec942cb44e4a38f2c6314d3166 |
| SHA256 | 4e19f29266a3d6c127e5e8de01d2c9b68bc55075dd3d6aabe22cf0de4b946a98 |
| SHA512 | 65026247806feab6e1e5bf2b29a439bdc1543977c1457f6d3ddfbb7684e04f11aba10d58cc5e7ea0c2f07c8eb3c9b1c8a3668d7854a9a6e4340e6d3e43543b74 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_queue.pyd
| MD5 | decdabaca104520549b0f66c136a9dc1 |
| SHA1 | 423e6f3100013e5a2c97e65e94834b1b18770a87 |
| SHA256 | 9d4880f7d0129b1de95becd8ea8bbbf0c044d63e87764d18f9ec00d382e43f84 |
| SHA512 | d89ee3779bf7d446514fc712dafb3ebc09069e4f665529a7a1af6494f8955ceb040bef7d18f017bcc3b6fe7addeab104535655971be6eed38d0fc09ec2c37d88 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_overlapped.pyd
| MD5 | e1339a750d518d9e3b8500817d8334fb |
| SHA1 | 23a2795e41153f782a23717872240ab3e4c8c9b1 |
| SHA256 | 1e80734d2466925be480ccf198de76efd58393601cd3f0265850d18a629626e2 |
| SHA512 | 07055de2b82824df7babf4e17cf5015cfec9d803f0f22a625ddf2ef99fcd64b0ec36cf01d6df49a56cd437795db3da2aab7a445c0333693ca38e0460682fbe42 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_multiprocessing.pyd
| MD5 | b6b3185a2c82bd93dfc03e837826997f |
| SHA1 | 4eed50c2a2c3e85e414d8414485a4aa244746d4e |
| SHA256 | 2313c1ba0887b185716c908b92b6391ca587f27d4e93228d7c9fc8f8ca21cefd |
| SHA512 | 24ef70f81a6b5f14492d201ddd57fe6c0ab99c7031ffdcf5daceb904f87bbe97732369abf90c58b38d4e1b367b7d732e7e24b4d3bc68d1f7c0e83f3d2fd7d49a |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_hashlib.pyd
| MD5 | f10d896ed25751ead72d8b03e404ea36 |
| SHA1 | eb8e0fd6e2356f76b5ea0cb72ab37399ec9d8ecb |
| SHA256 | 3660b985ca47ca1bba07db01458b3153e4e692ee57a8b23ce22f1a5ca18707c3 |
| SHA512 | 7f234e0d197ba48396fabd1fccc2f19e5d4ad922a2b3fe62920cd485e5065b66813b4b2a2477d2f7f911004e1bc6e5a6ec5e873d8ff81e642fee9e77b428fb42 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_elementtree.pyd
| MD5 | ff94faaa5b10e11ffb36d1ef5681ce33 |
| SHA1 | d8cd479bb762a3d89970fc383733cd4be91ca24c |
| SHA256 | 98665270dd81e6c57c74746e8496f40391575faa8f5c81b1cb62f4389735d7ee |
| SHA512 | 354c7b73bd97625921b4154847f61d6a7cb00d3c6142883c911c6a20e67890f449ac8a305074be012c8d682e163c48ab16ad62892d7f84bbf6bdcb62c46b4396 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_decimal.pyd
| MD5 | a8952538e090e2ff0efb0ba3c890cd04 |
| SHA1 | cdc8bd05a3178a95416e1c15b6c875ee026274df |
| SHA256 | c4e8740c5dbbd2741fc4124908da4b65fa9c3e17d9c9bf3f634710202e0c7009 |
| SHA512 | 5c16f595f17bedaa9c1fdd14c724bbb404ed59421c63f6fbd3bfd54ce8d6f550147d419ec0430d008c91b01b0c42934c2a08dae844c308feec077da713ac842e |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_cffi_backend.cp311-win_amd64.pyd
| MD5 | 1518035a65a45c274f1557ff5655e2d7 |
| SHA1 | 2676d452113c68aa316cba9a03565ec146088c3f |
| SHA256 | 9ca400d84a52ae61c5613403ba379d69c271e8e9e9c3f253f93434c9336bc6e8 |
| SHA512 | b5932a2eadd2981a3bbc0918643a9936c9aaafc606d833d5ef2758061e05a3148826060ed52a2d121fabfd719ad9736b3402683640a4c4846b6aaaa457366b66 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\_asyncio.pyd
| MD5 | d8ea889dd0e6d149b48e455207d058ab |
| SHA1 | a2260643af8803ae10e0a886ec444d5a0e870a69 |
| SHA256 | 367dec80ffa627219edc9eb681ab21ed1fdb24b372ad7691dd7d76fde65bc029 |
| SHA512 | 39153493b945fddad178303e6752f0eb764347cedaf1b180f9af73527e33781130b4484b8100cf3246468a9a552bed3b52a788573e2d84818f84e86f5db03241 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\zlib1.dll
| MD5 | a35d7eeae683a35acb99e72e01cf132f |
| SHA1 | cc37f1e0641f6afc821ef45a65986422eb853366 |
| SHA256 | c84547746f4c328daa9637414bbb252ec7124005d0cb7d4a8c62779cf641271c |
| SHA512 | dd7996756a3aed62251f90cd0ae95feafa7bc1cfe7c51e7e2e09bfd30bf0bbb2775fe397a1963f63aed7ad49957b4dd75faed022c6ec4ed9576822f650612f2c |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\VCRUNTIME140_1.dll
| MD5 | 7e668ab8a78bd0118b94978d154c85bc |
| SHA1 | dbac42a02a8d50639805174afd21d45f3c56e3a0 |
| SHA256 | e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f |
| SHA512 | 72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\unicodedata.pyd
| MD5 | c2556dc74aea61b0bd9bd15e9cd7b0d6 |
| SHA1 | 05eff76e393bfb77958614ff08229b6b770a1750 |
| SHA256 | 987a6d21ce961afeaaa40ba69859d4dd80d20b77c4ca6d2b928305a873d6796d |
| SHA512 | f29841f262934c810dd1062151aefac78cd6a42d959a8b9ac832455c646645c07fd9220866b262de1bc501e1a9570591c0050d5d3607f1683437dea1ff04c32b |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\tk86t.dll
| MD5 | a3b28c19b23fddf32c8920a4d492be47 |
| SHA1 | 2b9aedaf02d2ec7dbb36596b8ceeb10657480e43 |
| SHA256 | c611b2a311da589f93e83f0662dcb8b3bb3db8450c64084da4b067b36a52ecb2 |
| SHA512 | 24d44d6ddde9d05eaabfa58aadeef85443be46c535d3f290b50f2208fd79f27215f65b099389a04381b6b44a812b17687886185b49eb94f7fd193114cf3c9436 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\tcl86t.dll
| MD5 | ad6e74d50f92edcdb4420750d190610c |
| SHA1 | af6b5fae4d3d5a064df0e727bfd63e8ff82828bc |
| SHA256 | 6074ed09ce5ff856dd8f3b27a3207cf31d8f48fa1247853773609357b511068d |
| SHA512 | 18630348aa556a672bb1675f2cae3182929c3c4a6c3c5745dfda9865b17d19f895d5f1da98ec6b03ffe921abd34b16a90a56bfede64c351f307491a7f3df6e3e |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\sqlite3.dll
| MD5 | 395332e795cb6abaca7d0126d6c1f215 |
| SHA1 | b845bd8864cd35dcb61f6db3710acc2659ed9f18 |
| SHA256 | 8e8870dac8c96217feff4fa8af7c687470fbccd093d97121bc1eac533f47316c |
| SHA512 | 8bc8c8c5f10127289dedb012b636bc3959acb5c15638e7ed92dacdc8d8dba87a8d994aaffc88bc7dc89ccfeef359e3e79980dfa293a9acae0dc00181096a0d66 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\select.pyd
| MD5 | 90fea71c9828751e36c00168b9ba4b2b |
| SHA1 | 15b506df7d02612e3ba49f816757ad0c141e9dc1 |
| SHA256 | 5bbbb4f0b4f9e5329ba1d518d6e8144b1f7d83e2d7eaf6c50eef6a304d78f37d |
| SHA512 | e424be422bf0ef06e7f9ff21e844a84212bfa08d7f9fbd4490cbbcb6493cc38cc1223aaf8b7c9cd637323b81ee93600d107cc1c982a2288eb2a0f80e2ad1f3c5 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\SDL2_ttf.dll
| MD5 | 9f5ece4e13e42058fa5ea65215c41c5d |
| SHA1 | eddcecb4f10f2bb9b61c57b88fb6bd1b1d560a07 |
| SHA256 | f5f2690285fc087376ff03edb8849ab5f24c6e9d60ae3661013bea621786582b |
| SHA512 | 09cf0927b7cdb84f9ddec465ba10874af6160f947e58e9ff9ead2aa6d10e7d164dd8c5e2df6314f0dd8a84d0b104b48dbac8cc96522f749d54041b3e8ec03400 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\SDL2_mixer.dll
| MD5 | 1230b474eca2c4cefb13cf0aaa2fc5d0 |
| SHA1 | e23f9cf8cb7dd47e92a02f7508922f01d4d1364b |
| SHA256 | 6879a16d963159cb0666e654ea4d5e9a92abffd96cfc6fffe6b39ae81b4ffca3 |
| SHA512 | 2520fdfbd1370bb9683c29fe1722f771e3d4c7df635987371190be5445237f9e96ae506bbeb79035f6f483ac116995b56bb1e9fc35b6f6a6d49bb940dbf72ead |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\SDL2_image.dll
| MD5 | 7174d7a8eec42d7700c5f4adfff39b57 |
| SHA1 | b850f0814e77a67f0414a85aae88c9534ca857e5 |
| SHA256 | 155eab85fe565f6dd1ecb29d6496425539c994bc0d14b52cabd850df5927f9bf |
| SHA512 | 9a79cc9661cdab7efeb096f1eb121807ba937b444546d46a321613f6d2792ebf09cc62ff067ece7cb0458b988d6081feadd33e93a52c24faac53dc1539bf32c9 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\SDL2.dll
| MD5 | 9684069bb2b8892408ccb50d66abbeda |
| SHA1 | 7df5e8f28481c4e7aef128e017a53a36b86c3b7b |
| SHA256 | 123c8a0d647e5b866545f8e1cc4cfba5fdadf8c1a247692050355a609d81996b |
| SHA512 | fbe493326da9b582c9c4fa1b16ba02e5befcf5787324116656e108527894f692c3fc21493419a419833ab37a5fa5fb5e38e2c04a8cbdbc3c8afeba08df390697 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\pyexpat.pyd
| MD5 | 9225fcea61b20b8cd4c86a1115d96a2a |
| SHA1 | 2f7bdc404a7151bfa8b437a0dc9ad5eb728654de |
| SHA256 | 04928a947886566f522c5f42fa5846afe69aace9ae5036e8ac4d649eed969e8d |
| SHA512 | 2c490de77873019743b1845afe717826564c3cfff9e8000bd1d80a212285bd51944ae9b05a5801eac4b04aaa222bce7c3c0c41ddb3c0044202e1963862e1a969 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\portmidi.dll
| MD5 | 1b443fe9c75d57eedcf5fd67493573e2 |
| SHA1 | 27504e51f5f19d3d73ed2a0ba473dc5cda787679 |
| SHA256 | 96b2ba3d433b0e0a0ce72c72725e033ca35b570225b55b38fb7d71c716418ee3 |
| SHA512 | 02f0ee765490d999ac621f54411b039ef42dddeba17d2edbb9970db20e481d29aed4d607d8330a7c5cd7133b214f13dcb427e89903f9baaef20ffc4a431bb0c4 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\libwebp-7.dll
| MD5 | 4276d3cb447a08644a2c1d3b7afb9fdf |
| SHA1 | d63f34d0b4e8eb660a92a3843b695eda16294b80 |
| SHA256 | cc3831ce9ff18f5ebfde8b20d1ee237e2336e4d9ca6405392ac5ec9c8c948174 |
| SHA512 | d3a539176243e31a15877b0a6c40c295036ccac5c3ac13cd7b74a340c4183a661a630bbe6b5b0c0ff54b4b27fc72bc154883c7ba5167cb4baeb4b0a528f514bc |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\libtiff-5.dll
| MD5 | f374796886d56c6c552f3a92a81c3338 |
| SHA1 | d61f0297386e9925a6ac0c6469ba40b86d3c98cd |
| SHA256 | e2c5b370bcade6a167dba5dc9bb33107d4ed2612e7e8af8d1035be72f35f90d7 |
| SHA512 | b59cd888b41c67bf139c2c78d7968a33c84e9127752b9fa276b7b3b461a01cd71dc72936e51a334ddad7fa8e67dd4c250a3495ce544aa156efacb77e7f1dce9f |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\libssl-1_1.dll
| MD5 | 8e8a145e122a593af7d6cde06d2bb89f |
| SHA1 | b0e7d78bb78108d407239e9f1b376e0c8c295175 |
| SHA256 | a6a14c1beccbd4128763e78c3ec588f747640297ffb3cc5604a9728e8ef246b1 |
| SHA512 | d104d81aca91c067f2d69fd8cec3f974d23fb5372a8f2752ad64391da3dbf5ffe36e2645a18a9a74b70b25462d73d9ea084318846b7646d39ce1d3e65a1c47c4 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\libpng16-16.dll
| MD5 | 8f3bf615136b7241204419fb24c8d5ad |
| SHA1 | d107f0b405c566974c37be20e1abbd365ccbb750 |
| SHA256 | a9c4d2443d6de90091eff8a5adfd7a3c207b0c7aefb913b855320866e93f8039 |
| SHA512 | a2ced7974c086291e69dce39f841335c771088aecbbc52b049d7af51c81342bd1e8bd0d8c78e62529e2041d15d8f5317e5a41727e299c2d827027bcbb0382aa1 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\libopusfile-0.dll
| MD5 | a729c1b14d695b00ae79472d3fe45339 |
| SHA1 | 20cd334187fc7297138f014303e5c82b5f918c80 |
| SHA256 | 57bb8b7dec2bd35ff1031f12c4ba3aa3cb2e8de2445e21ea29ffa3ad13e7be3a |
| SHA512 | 1da8060b1767bdf811b005e4a476c18f1c2f93186334aa40ca59937cec7aed37267c45a3b5aaeb8fa13d9b0639959d128d957e6d08fcb9787926df850e42fc22 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\libopus-0.x64.dll
| MD5 | 17bed62f3389d532d3dfc59071bbd214 |
| SHA1 | 2b0894cc48dd3756f0ff6602bf8c1e24cb8b6642 |
| SHA256 | 4fd26640721088ac31fdac941db6fa3c094ca17bd97d240992969aefae19ff91 |
| SHA512 | 976c5e0dd50487eb5f88c195633805cccbf34566496065eaf8f3ecbbea0300653097bfbbf628dbb2c238a4d552460187794bcebcb8d41452a3f873f0244fc6a4 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\libopus-0.dll
| MD5 | 3c2e93c3d2b292a0f489449209f8e099 |
| SHA1 | 751f18a79c6da4e7162439cef4d481189d17a242 |
| SHA256 | b6b32593c0bcecea7b31a900086870bbab039f25b29067170ac461cf2479dea5 |
| SHA512 | a0ec68d2a1c650720b4e3e437a5841e8d04d165fc920ce26a41cc20d6ddf4c761b05bbf3426e241c2ee13a9fbe146fc889aa45df70397600b2d962bdaa1bedbb |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\libogg-0.dll
| MD5 | 6ffebd7d283079e9029c7f29d8ca7fba |
| SHA1 | b470b09c8aa2f3e42bcff8392d95b6259cb87555 |
| SHA256 | 0d9a915ea29ed4da271f86dbcfa90b52064a26b5136af590b2bb430d5dd6a67e |
| SHA512 | 2b9a9b5f298eefccf0a08af52d7c2c803db19ab9f3cedad2bb19df50466527c05e31f956b6018c9a337565448249465eba8952e9e8397b728b7f76e4f0561c68 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\libmodplug-1.dll
| MD5 | 072093b2671589d4ce465de2b92ebee4 |
| SHA1 | 821d9827286271859640984df28e01b4a37341fb |
| SHA256 | 04d07b4dcae8d3998156d563df20881ba790c32389aca23ade91de9cf9f4a3d4 |
| SHA512 | 522d5faa8d17017f1891374a23d6e653cd62b51818734bf1f7343248d09e1e314ae49821595818fe69af62c9e51debca4ae384e421ad8fa658aced95f977379e |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\libjpeg-9.dll
| MD5 | 6e67e46f957f50215b7e68c9091db53f |
| SHA1 | e969fa4858351c95c337352dd0578fe5a83403f0 |
| SHA256 | 24b25fe9ebe303496973c4d11144b053a5f5a03eabf53f9d8eab0c15fdbfbffe |
| SHA512 | 86af5560269ef21490f5343ea3e0522f35e271d42e64f61a2f05471302856de79d34bf00658e1667d7145af48667627fa3897bca2fc479928ab9a62ecba81396 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\libcrypto-1_1.dll
| MD5 | dffcab08f94e627de159e5b27326d2fc |
| SHA1 | ab8954e9ae94ae76067e5a0b1df074bccc7c3b68 |
| SHA256 | 135b115e77479eedd908d7a782e004ece6dd900bb1ca05cc1260d5dd6273ef15 |
| SHA512 | 57e175a5883edb781cdb2286167d027fdb4b762f41fb1fc9bd26b5544096a9c5dda7bccbb6795dcc37ed5d8d03dc0a406bf1a59adb3aeb41714f1a7c8901a17d |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\freetype.dll
| MD5 | 522257e451efcc3bfe980f56d3fed113 |
| SHA1 | f5e12321517f523842943ea7f3ba74d449dba1f4 |
| SHA256 | 8c74376e7932eebcd084191b40774056b32525ba48e375d942754cdc4fc03c60 |
| SHA512 | d590cd813281278be4aec86af3713216dd306399b4910221a2447a3200accbca1b5f8d9495bf21f69ff8e09e5465a71c715a85ce0d87cdc26cbf27b0fae2cc4c |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\crypto_clipper.json
| MD5 | 28ace1f269a7b6ddc508fe2ef995eb89 |
| SHA1 | fc25b159929682bff11e6d3b413acba80300418a |
| SHA256 | 8011959661b3c6efee432bdc16b358de1c371aaccdbec068c9e65004262f988e |
| SHA512 | 4c1172eead25d9c6037729ad372975d545153213dba99e7308308f1f1c6594bb1322b6c1332e44bd3677458160211046762a5dbf72564e4c7d36f7371177dcd2 |
\Users\Admin\AppData\Local\Temp\_MEI39162\select.pyd
| MD5 | 90fea71c9828751e36c00168b9ba4b2b |
| SHA1 | 15b506df7d02612e3ba49f816757ad0c141e9dc1 |
| SHA256 | 5bbbb4f0b4f9e5329ba1d518d6e8144b1f7d83e2d7eaf6c50eef6a304d78f37d |
| SHA512 | e424be422bf0ef06e7f9ff21e844a84212bfa08d7f9fbd4490cbbcb6493cc38cc1223aaf8b7c9cd637323b81ee93600d107cc1c982a2288eb2a0f80e2ad1f3c5 |
\Users\Admin\AppData\Local\Temp\_MEI39162\_socket.pyd
| MD5 | bcc3e26a18d59d76fd6cf7cd64e9e14d |
| SHA1 | b85e4e7d300dbeec942cb44e4a38f2c6314d3166 |
| SHA256 | 4e19f29266a3d6c127e5e8de01d2c9b68bc55075dd3d6aabe22cf0de4b946a98 |
| SHA512 | 65026247806feab6e1e5bf2b29a439bdc1543977c1457f6d3ddfbb7684e04f11aba10d58cc5e7ea0c2f07c8eb3c9b1c8a3668d7854a9a6e4340e6d3e43543b74 |
memory/4960-1318-0x00007FFCBAF20000-0x00007FFCBAF2D000-memory.dmp
memory/4960-1317-0x00007FFCB7B30000-0x00007FFCB7B49000-memory.dmp
memory/4960-1320-0x00007FFCBAF70000-0x00007FFCBAF93000-memory.dmp
\Users\Admin\AppData\Local\Temp\_MEI39162\_ssl.pyd
| MD5 | 2089768e25606262921e4424a590ff05 |
| SHA1 | bc94a8ff462547ab48c2fbf705673a1552545b76 |
| SHA256 | 3e6e9fc56e1a9fe5edb39ee03e5d47fa0e3f6adb17be1f087dc6f891d3b0bbca |
| SHA512 | 371aa8e5c722307fff65e00968b14280ee5046cfcf4a1d9522450688d75a3b0362f2c9ec0ec117b2fc566664f2f52a1b47fe62f28466488163f9f0f1ce367f86 |
memory/4960-1321-0x00007FFCB7B00000-0x00007FFCB7B2E000-memory.dmp
\Users\Admin\AppData\Local\Temp\_MEI39162\libssl-1_1.dll
| MD5 | 8e8a145e122a593af7d6cde06d2bb89f |
| SHA1 | b0e7d78bb78108d407239e9f1b376e0c8c295175 |
| SHA256 | a6a14c1beccbd4128763e78c3ec588f747640297ffb3cc5604a9728e8ef246b1 |
| SHA512 | d104d81aca91c067f2d69fd8cec3f974d23fb5372a8f2752ad64391da3dbf5ffe36e2645a18a9a74b70b25462d73d9ea084318846b7646d39ce1d3e65a1c47c4 |
memory/4960-1323-0x00007FFCA8950000-0x00007FFCA8F39000-memory.dmp
\Users\Admin\AppData\Local\Temp\_MEI39162\_queue.pyd
| MD5 | decdabaca104520549b0f66c136a9dc1 |
| SHA1 | 423e6f3100013e5a2c97e65e94834b1b18770a87 |
| SHA256 | 9d4880f7d0129b1de95becd8ea8bbbf0c044d63e87764d18f9ec00d382e43f84 |
| SHA512 | d89ee3779bf7d446514fc712dafb3ebc09069e4f665529a7a1af6494f8955ceb040bef7d18f017bcc3b6fe7addeab104535655971be6eed38d0fc09ec2c37d88 |
C:\Users\Admin\AppData\Local\Temp\_MEI39162\charset_normalizer\md.cp311-win_amd64.pyd
| MD5 | 5733500569fd188a6d8b5451b20b2410 |
| SHA1 | 0d67f1dd322557467640638266ffaa6be16c552e |
| SHA256 | b063faae068f5c6635f8742ae57dd26dc5874ddd3fc7724a23e75f9aef36c493 |
| SHA512 | 42c143ae71248550eeee15725d8b37d3480dcad7ec51b6ed93eccbb75057baa3f766c23861ce277d5711aa75b8079964cc72cd3142e28c4b8658689276ce35e9 |
memory/4960-1326-0x00007FFCB7800000-0x00007FFCB78B8000-memory.dmp
memory/4960-1328-0x00007FFCB7970000-0x00007FFCB797D000-memory.dmp
memory/4960-1329-0x00007FFCB7930000-0x00007FFCB7953000-memory.dmp
memory/4960-1330-0x00007FFCB7960000-0x00007FFCB796B000-memory.dmp
memory/4960-1331-0x00007FFCB7620000-0x00007FFCB773C000-memory.dmp
\Users\Admin\AppData\Local\Temp\_MEI39162\charset_normalizer\md.cp311-win_amd64.pyd
| MD5 | 5733500569fd188a6d8b5451b20b2410 |
| SHA1 | 0d67f1dd322557467640638266ffaa6be16c552e |
| SHA256 | b063faae068f5c6635f8742ae57dd26dc5874ddd3fc7724a23e75f9aef36c493 |
| SHA512 | 42c143ae71248550eeee15725d8b37d3480dcad7ec51b6ed93eccbb75057baa3f766c23861ce277d5711aa75b8079964cc72cd3142e28c4b8658689276ce35e9 |
memory/4960-1333-0x00007FFCB7B50000-0x00007FFCB7B64000-memory.dmp
memory/4960-1332-0x00007FFCB77C0000-0x00007FFCB77F8000-memory.dmp
memory/4960-1334-0x00007FFCB75F0000-0x00007FFCB75FC000-memory.dmp
memory/4960-1335-0x00007FFCB7610000-0x00007FFCB761B000-memory.dmp
memory/4960-1336-0x00007FFCB7600000-0x00007FFCB760B000-memory.dmp
memory/4960-1337-0x00007FFCB75E0000-0x00007FFCB75EB000-memory.dmp
memory/4960-1338-0x00007FFCA85D0000-0x00007FFCA8948000-memory.dmp
memory/4960-1339-0x00007FFCB75D0000-0x00007FFCB75DC000-memory.dmp
memory/4960-1341-0x00007FFCB75A0000-0x00007FFCB75AD000-memory.dmp
memory/4960-1340-0x00007FFCB75B0000-0x00007FFCB75BC000-memory.dmp
memory/4960-1342-0x00007FFCB75C0000-0x00007FFCB75CB000-memory.dmp
memory/4960-1343-0x00007FFCB7590000-0x00007FFCB759E000-memory.dmp
memory/4960-1344-0x00007FFCB7B30000-0x00007FFCB7B49000-memory.dmp
memory/4960-1345-0x00007FFCB7B00000-0x00007FFCB7B2E000-memory.dmp
memory/4960-1346-0x00007FFCB74B0000-0x00007FFCB74BC000-memory.dmp
memory/4960-1347-0x00007FFCB7480000-0x00007FFCB748B000-memory.dmp
memory/4960-1349-0x00007FFCB7490000-0x00007FFCB749B000-memory.dmp
memory/4960-1348-0x00007FFCB74A0000-0x00007FFCB74AC000-memory.dmp
memory/4960-1350-0x00007FFCB7470000-0x00007FFCB747C000-memory.dmp
memory/4960-1351-0x00007FFCB7930000-0x00007FFCB7953000-memory.dmp
memory/4960-1352-0x00007FFCB7460000-0x00007FFCB746C000-memory.dmp
memory/4960-1353-0x00007FFCB7420000-0x00007FFCB742C000-memory.dmp
memory/4960-1354-0x00007FFCB7450000-0x00007FFCB745D000-memory.dmp
memory/4960-1355-0x00007FFCB7430000-0x00007FFCB7442000-memory.dmp
memory/4960-1356-0x00007FFCB77C0000-0x00007FFCB77F8000-memory.dmp
memory/4960-1357-0x00007FFCB73F0000-0x00007FFCB7405000-memory.dmp
memory/4960-1358-0x00007FFCB6F40000-0x00007FFCB6F52000-memory.dmp
memory/4960-1359-0x00007FFCB6F20000-0x00007FFCB6F34000-memory.dmp
memory/4960-1360-0x00007FFCB6F00000-0x00007FFCB6F1B000-memory.dmp
memory/4960-1361-0x00007FFCB6EE0000-0x00007FFCB6EF2000-memory.dmp
memory/4960-1362-0x00007FFCB6EC0000-0x00007FFCB6ED5000-memory.dmp
memory/4960-1363-0x00007FFCB6E80000-0x00007FFCB6EBF000-memory.dmp
memory/4960-1364-0x00007FFCB6E70000-0x00007FFCB6E7E000-memory.dmp
memory/4960-1365-0x00007FFCB6E40000-0x00007FFCB6E5C000-memory.dmp
memory/4960-1366-0x00007FFCB6DE0000-0x00007FFCB6E3D000-memory.dmp
memory/4960-1367-0x00007FFCB73F0000-0x00007FFCB7405000-memory.dmp
memory/4960-1368-0x00007FFCB6DB0000-0x00007FFCB6DD9000-memory.dmp
memory/4960-1369-0x00007FFCB6F40000-0x00007FFCB6F52000-memory.dmp
memory/4960-1370-0x00007FFCB6D80000-0x00007FFCB6DAE000-memory.dmp
memory/4960-1371-0x00007FFCB6F20000-0x00007FFCB6F34000-memory.dmp
memory/4960-1372-0x00007FFCB6D40000-0x00007FFCB6D63000-memory.dmp
memory/4960-1373-0x00007FFCB6F00000-0x00007FFCB6F1B000-memory.dmp
memory/4960-1374-0x00007FFCB6870000-0x00007FFCB69E7000-memory.dmp
memory/4960-1375-0x00007FFCB6EE0000-0x00007FFCB6EF2000-memory.dmp
memory/4960-1376-0x00007FFCB6D20000-0x00007FFCB6D38000-memory.dmp
memory/4960-1377-0x00007FFCB6EC0000-0x00007FFCB6ED5000-memory.dmp
memory/4960-1378-0x00007FFCB6CC0000-0x00007FFCB6CCB000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ijtdy1nh.5bs.ps1
| MD5 | c4ca4238a0b923820dcc509a6f75849b |
| SHA1 | 356a192b7913b04c54574d18c28d46e6395428ab |
| SHA256 | 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b |
| SHA512 | 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a |
memory/4960-1566-0x00007FFCA8950000-0x00007FFCA8F39000-memory.dmp
memory/4960-1567-0x00007FFCBAF70000-0x00007FFCBAF93000-memory.dmp
memory/4960-1581-0x00007FFCB77C0000-0x00007FFCB77F8000-memory.dmp
memory/4960-1609-0x00007FFCB73F0000-0x00007FFCB7405000-memory.dmp
memory/4960-1615-0x00007FFCB6F00000-0x00007FFCB6F1B000-memory.dmp
memory/4960-1617-0x00007FFCB6EE0000-0x00007FFCB6EF2000-memory.dmp
memory/4960-1620-0x00007FFCB6E80000-0x00007FFCB6EBF000-memory.dmp
memory/4960-1624-0x00007FFCB6E40000-0x00007FFCB6E5C000-memory.dmp
memory/4960-1625-0x00007FFCB6DE0000-0x00007FFCB6E3D000-memory.dmp
memory/4960-1628-0x00007FFCBAF70000-0x00007FFCBAF93000-memory.dmp
memory/4960-1630-0x00007FFCBAF60000-0x00007FFCBAF6F000-memory.dmp
memory/4960-1626-0x00007FFCA8950000-0x00007FFCA8F39000-memory.dmp
memory/4960-1627-0x00007FFCB6DB0000-0x00007FFCB6DD9000-memory.dmp
memory/4960-1629-0x00007FFCB6D80000-0x00007FFCB6DAE000-memory.dmp
memory/4960-1631-0x00007FFCB6D40000-0x00007FFCB6D63000-memory.dmp
memory/4960-1633-0x00007FFCB6870000-0x00007FFCB69E7000-memory.dmp
memory/4960-1635-0x00007FFCB6D20000-0x00007FFCB6D38000-memory.dmp
memory/4960-1636-0x00007FFCB7B50000-0x00007FFCB7B64000-memory.dmp
memory/4960-1637-0x00007FFCA85D0000-0x00007FFCA8948000-memory.dmp
memory/4960-1634-0x00007FFCB7D30000-0x00007FFCB7D5D000-memory.dmp
memory/4960-1639-0x00007FFCB7B30000-0x00007FFCB7B49000-memory.dmp
memory/4960-1643-0x00007FFCB7B00000-0x00007FFCB7B2E000-memory.dmp
memory/4960-1645-0x00007FFCB7800000-0x00007FFCB78B8000-memory.dmp
memory/4960-1648-0x00007FFCB7970000-0x00007FFCB797D000-memory.dmp
memory/4960-1642-0x00007FFCBAF20000-0x00007FFCBAF2D000-memory.dmp
memory/4960-1650-0x00007FFCB7960000-0x00007FFCB796B000-memory.dmp
memory/4960-1632-0x00007FFCBAF40000-0x00007FFCBAF59000-memory.dmp
memory/4960-1653-0x00007FFCB7930000-0x00007FFCB7953000-memory.dmp
memory/4960-1655-0x00007FFCB7620000-0x00007FFCB773C000-memory.dmp
memory/4960-1659-0x00007FFCB73F0000-0x00007FFCB7405000-memory.dmp
memory/4960-1657-0x00007FFCB77C0000-0x00007FFCB77F8000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-21 01:40
Reported
2023-10-21 01:50
Platform
win10v2004-20231020-en
Max time kernel
81s
Max time network
90s
Command Line
Signatures
Enumerates VirtualBox DLL files
| Description | Indicator | Process | Target |
| File opened (read-only) | C:\windows\system32\vboxhook.dll | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| File opened (read-only) | C:\windows\system32\vboxmrxnp.dll | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Black Star ID\Black star ID.exe | N/A |
Loads dropped DLL
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Laughing coffin = "C:\\Users\\Admin\\Black Star ID\\Black star ID.exe" | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\taskkill.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe
"C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe"
C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe
"C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\black star ID.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x4f4
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\Black Star ID\""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Black Star ID\activate.bat""
C:\Users\Admin\Black Star ID\Black star ID.exe
"Black star ID.exe"
C:\Windows\system32\taskkill.exe
taskkill /f /im "black star ID.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 29.81.57.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.202.248.87.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI45682\python311.dll
| MD5 | 5792adeab1e4414e0129ce7a228eb8b8 |
| SHA1 | e9f022e687b6d88d20ee96d9509f82e916b9ee8c |
| SHA256 | 7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967 |
| SHA512 | c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\VCRUNTIME140.dll
| MD5 | 4585a96cc4eef6aafd5e27ea09147dc6 |
| SHA1 | 489cfff1b19abbec98fda26ac8958005e88dd0cb |
| SHA256 | a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736 |
| SHA512 | d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\VCRUNTIME140.dll
| MD5 | 4585a96cc4eef6aafd5e27ea09147dc6 |
| SHA1 | 489cfff1b19abbec98fda26ac8958005e88dd0cb |
| SHA256 | a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736 |
| SHA512 | d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\python311.dll
| MD5 | 5792adeab1e4414e0129ce7a228eb8b8 |
| SHA1 | e9f022e687b6d88d20ee96d9509f82e916b9ee8c |
| SHA256 | 7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967 |
| SHA512 | c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b |
memory/4668-1251-0x00007FFDC17D0000-0x00007FFDC1DB9000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45682\base_library.zip
| MD5 | 2f6d57bccf7f7735acb884a980410f6a |
| SHA1 | 93a6926887a08dc09cd92864cd82b2bec7b24ec5 |
| SHA256 | 1b7d326bad406e96a4c83b5a49714819467e3174ed0a74f81c9ebd96d1dd40b3 |
| SHA512 | 95bcfc66dbe7b6ad324bd2dc2258a3366a3594bfc50118ab37a2a204906109e42192fb10a91172b340cc28c12640513db268c854947fb9ed8426f214ff8889b4 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_ctypes.pyd
| MD5 | 1adfe4d0f4d68c9c539489b89717984d |
| SHA1 | 8ae31b831b3160f5b88dda58ad3959c7423f8eb2 |
| SHA256 | 64e8fd952ccf5b8adca80ce8c7bc6c96ec7df381789256fe8d326f111f02e95c |
| SHA512 | b403cc46e0874a75e3c0819784244ed6557eae19b0d76ffd86f56b3739db10ea8deec3dc1ca9e94c101263d0ccf506978443085a70c3ab0816885046b5ef5117 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\python3.DLL
| MD5 | b711598fc3ed0fe4cf2c7f3e0877979e |
| SHA1 | 299c799e5d697834aa2447d8a313588ab5c5e433 |
| SHA256 | 520169aa6cf49d7ee724d1178de1be0e809e4bdcf671e06f3d422a0dd5fd294a |
| SHA512 | b3d59eff5e38cef651c9603971bde77be7231ea8b7bdb444259390a8a9e452e107a0b6cb9cc93e37fd3b40afb2ba9e67217d648bfca52f7cdc4b60c7493b6b84 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\python3.dll
| MD5 | b711598fc3ed0fe4cf2c7f3e0877979e |
| SHA1 | 299c799e5d697834aa2447d8a313588ab5c5e433 |
| SHA256 | 520169aa6cf49d7ee724d1178de1be0e809e4bdcf671e06f3d422a0dd5fd294a |
| SHA512 | b3d59eff5e38cef651c9603971bde77be7231ea8b7bdb444259390a8a9e452e107a0b6cb9cc93e37fd3b40afb2ba9e67217d648bfca52f7cdc4b60c7493b6b84 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\python3.dll
| MD5 | b711598fc3ed0fe4cf2c7f3e0877979e |
| SHA1 | 299c799e5d697834aa2447d8a313588ab5c5e433 |
| SHA256 | 520169aa6cf49d7ee724d1178de1be0e809e4bdcf671e06f3d422a0dd5fd294a |
| SHA512 | b3d59eff5e38cef651c9603971bde77be7231ea8b7bdb444259390a8a9e452e107a0b6cb9cc93e37fd3b40afb2ba9e67217d648bfca52f7cdc4b60c7493b6b84 |
memory/4668-1259-0x00007FFDD5E10000-0x00007FFDD5E33000-memory.dmp
memory/4668-1261-0x00007FFDD2850000-0x00007FFDD285F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_bz2.pyd
| MD5 | 2d461b41f6e9a305dde68e9c59e4110a |
| SHA1 | 97c2266f47a651e37a72c153116d81d93c7556e8 |
| SHA256 | abbe3933a34a9653a757244e8e55b0d7d3a108527a3e9e8a7f2013b5f2a9eff4 |
| SHA512 | eef132df6e52eb783bad3e6af0d57cb48cda2eb0edb6e282753b02d21970c1eea6bab03c835ff9f28f2d3e25f5e9e18f176a8c5680522c09da358a1c48cf14c8 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_bz2.pyd
| MD5 | 2d461b41f6e9a305dde68e9c59e4110a |
| SHA1 | 97c2266f47a651e37a72c153116d81d93c7556e8 |
| SHA256 | abbe3933a34a9653a757244e8e55b0d7d3a108527a3e9e8a7f2013b5f2a9eff4 |
| SHA512 | eef132df6e52eb783bad3e6af0d57cb48cda2eb0edb6e282753b02d21970c1eea6bab03c835ff9f28f2d3e25f5e9e18f176a8c5680522c09da358a1c48cf14c8 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libffi-8.dll
| MD5 | 08b000c3d990bc018fcb91a1e175e06e |
| SHA1 | bd0ce09bb3414d11c91316113c2becfff0862d0d |
| SHA256 | 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece |
| SHA512 | 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libffi-8.dll
| MD5 | 08b000c3d990bc018fcb91a1e175e06e |
| SHA1 | bd0ce09bb3414d11c91316113c2becfff0862d0d |
| SHA256 | 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece |
| SHA512 | 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_lzma.pyd
| MD5 | 3798175fd77eded46a8af6b03c5e5f6d |
| SHA1 | f637eaf42080dcc620642400571473a3fdf9174f |
| SHA256 | 3c9d5a9433b22538fc64141cd3784800c567c18e4379003329cf69a1d59b2a41 |
| SHA512 | 1f7351c9e905265625d725551d8ea1de5d9999bc333d29e6510a5bca4e4d7c1472b2a637e892a485a7437ea4768329e5365b209dd39d7c1995fe3317dc5aecdf |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_ctypes.pyd
| MD5 | 1adfe4d0f4d68c9c539489b89717984d |
| SHA1 | 8ae31b831b3160f5b88dda58ad3959c7423f8eb2 |
| SHA256 | 64e8fd952ccf5b8adca80ce8c7bc6c96ec7df381789256fe8d326f111f02e95c |
| SHA512 | b403cc46e0874a75e3c0819784244ed6557eae19b0d76ffd86f56b3739db10ea8deec3dc1ca9e94c101263d0ccf506978443085a70c3ab0816885046b5ef5117 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_lzma.pyd
| MD5 | 3798175fd77eded46a8af6b03c5e5f6d |
| SHA1 | f637eaf42080dcc620642400571473a3fdf9174f |
| SHA256 | 3c9d5a9433b22538fc64141cd3784800c567c18e4379003329cf69a1d59b2a41 |
| SHA512 | 1f7351c9e905265625d725551d8ea1de5d9999bc333d29e6510a5bca4e4d7c1472b2a637e892a485a7437ea4768329e5365b209dd39d7c1995fe3317dc5aecdf |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_uuid.pyd
| MD5 | 46e9d7b5d9668c9db5caa48782ca71ba |
| SHA1 | 6bbc83a542053991b57f431dd377940418848131 |
| SHA256 | f6063622c0a0a34468679413d1b18d1f3be67e747696ab972361faed4b8d6735 |
| SHA512 | c5b171ebdb51b1755281c3180b30e88796db8aa96073489613dab96b6959a205846711187266a0ba30782102ce14fbfa4d9f413a2c018494597600482329ebf7 |
memory/4668-1306-0x00007FFDD1CB0000-0x00007FFDD1CDD000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_hashlib.pyd
| MD5 | f10d896ed25751ead72d8b03e404ea36 |
| SHA1 | eb8e0fd6e2356f76b5ea0cb72ab37399ec9d8ecb |
| SHA256 | 3660b985ca47ca1bba07db01458b3153e4e692ee57a8b23ce22f1a5ca18707c3 |
| SHA512 | 7f234e0d197ba48396fabd1fccc2f19e5d4ad922a2b3fe62920cd485e5065b66813b4b2a2477d2f7f911004e1bc6e5a6ec5e873d8ff81e642fee9e77b428fb42 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libcrypto-1_1.dll
| MD5 | dffcab08f94e627de159e5b27326d2fc |
| SHA1 | ab8954e9ae94ae76067e5a0b1df074bccc7c3b68 |
| SHA256 | 135b115e77479eedd908d7a782e004ece6dd900bb1ca05cc1260d5dd6273ef15 |
| SHA512 | 57e175a5883edb781cdb2286167d027fdb4b762f41fb1fc9bd26b5544096a9c5dda7bccbb6795dcc37ed5d8d03dc0a406bf1a59adb3aeb41714f1a7c8901a17d |
memory/4668-1308-0x00007FFDD1FB0000-0x00007FFDD1FC4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45682\select.pyd
| MD5 | 90fea71c9828751e36c00168b9ba4b2b |
| SHA1 | 15b506df7d02612e3ba49f816757ad0c141e9dc1 |
| SHA256 | 5bbbb4f0b4f9e5329ba1d518d6e8144b1f7d83e2d7eaf6c50eef6a304d78f37d |
| SHA512 | e424be422bf0ef06e7f9ff21e844a84212bfa08d7f9fbd4490cbbcb6493cc38cc1223aaf8b7c9cd637323b81ee93600d107cc1c982a2288eb2a0f80e2ad1f3c5 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libssl-1_1.dll
| MD5 | 8e8a145e122a593af7d6cde06d2bb89f |
| SHA1 | b0e7d78bb78108d407239e9f1b376e0c8c295175 |
| SHA256 | a6a14c1beccbd4128763e78c3ec588f747640297ffb3cc5604a9728e8ef246b1 |
| SHA512 | d104d81aca91c067f2d69fd8cec3f974d23fb5372a8f2752ad64391da3dbf5ffe36e2645a18a9a74b70b25462d73d9ea084318846b7646d39ce1d3e65a1c47c4 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_ssl.pyd
| MD5 | 2089768e25606262921e4424a590ff05 |
| SHA1 | bc94a8ff462547ab48c2fbf705673a1552545b76 |
| SHA256 | 3e6e9fc56e1a9fe5edb39ee03e5d47fa0e3f6adb17be1f087dc6f891d3b0bbca |
| SHA512 | 371aa8e5c722307fff65e00968b14280ee5046cfcf4a1d9522450688d75a3b0362f2c9ec0ec117b2fc566664f2f52a1b47fe62f28466488163f9f0f1ce367f86 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_queue.pyd
| MD5 | decdabaca104520549b0f66c136a9dc1 |
| SHA1 | 423e6f3100013e5a2c97e65e94834b1b18770a87 |
| SHA256 | 9d4880f7d0129b1de95becd8ea8bbbf0c044d63e87764d18f9ec00d382e43f84 |
| SHA512 | d89ee3779bf7d446514fc712dafb3ebc09069e4f665529a7a1af6494f8955ceb040bef7d18f017bcc3b6fe7addeab104535655971be6eed38d0fc09ec2c37d88 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\charset_normalizer\md.cp311-win_amd64.pyd
| MD5 | 5733500569fd188a6d8b5451b20b2410 |
| SHA1 | 0d67f1dd322557467640638266ffaa6be16c552e |
| SHA256 | b063faae068f5c6635f8742ae57dd26dc5874ddd3fc7724a23e75f9aef36c493 |
| SHA512 | 42c143ae71248550eeee15725d8b37d3480dcad7ec51b6ed93eccbb75057baa3f766c23861ce277d5711aa75b8079964cc72cd3142e28c4b8658689276ce35e9 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\charset_normalizer\md.cp311-win_amd64.pyd
| MD5 | 5733500569fd188a6d8b5451b20b2410 |
| SHA1 | 0d67f1dd322557467640638266ffaa6be16c552e |
| SHA256 | b063faae068f5c6635f8742ae57dd26dc5874ddd3fc7724a23e75f9aef36c493 |
| SHA512 | 42c143ae71248550eeee15725d8b37d3480dcad7ec51b6ed93eccbb75057baa3f766c23861ce277d5711aa75b8079964cc72cd3142e28c4b8658689276ce35e9 |
memory/4668-1314-0x00007FFDD1E60000-0x00007FFDD1E79000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_socket.pyd
| MD5 | bcc3e26a18d59d76fd6cf7cd64e9e14d |
| SHA1 | b85e4e7d300dbeec942cb44e4a38f2c6314d3166 |
| SHA256 | 4e19f29266a3d6c127e5e8de01d2c9b68bc55075dd3d6aabe22cf0de4b946a98 |
| SHA512 | 65026247806feab6e1e5bf2b29a439bdc1543977c1457f6d3ddfbb7684e04f11aba10d58cc5e7ea0c2f07c8eb3c9b1c8a3668d7854a9a6e4340e6d3e43543b74 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_hashlib.pyd
| MD5 | f10d896ed25751ead72d8b03e404ea36 |
| SHA1 | eb8e0fd6e2356f76b5ea0cb72ab37399ec9d8ecb |
| SHA256 | 3660b985ca47ca1bba07db01458b3153e4e692ee57a8b23ce22f1a5ca18707c3 |
| SHA512 | 7f234e0d197ba48396fabd1fccc2f19e5d4ad922a2b3fe62920cd485e5065b66813b4b2a2477d2f7f911004e1bc6e5a6ec5e873d8ff81e642fee9e77b428fb42 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_tkinter.pyd
| MD5 | cf3e7e439f68aef285c58a34d074deaf |
| SHA1 | e911d6dff1c4d23c8e4807f949a9730315d6b619 |
| SHA256 | bff186ec3a0e4cb2728c93246d85b1277ed81114e60ddf43d9be420a7c88916b |
| SHA512 | ae793b900c890739485292a3592cc88c4e833d0c42c825248fac2089f2b35a28bd5fb353123e6d3dcd7772dc36332956499af6248c112858495219d89b6f2d5e |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_ssl.pyd
| MD5 | 2089768e25606262921e4424a590ff05 |
| SHA1 | bc94a8ff462547ab48c2fbf705673a1552545b76 |
| SHA256 | 3e6e9fc56e1a9fe5edb39ee03e5d47fa0e3f6adb17be1f087dc6f891d3b0bbca |
| SHA512 | 371aa8e5c722307fff65e00968b14280ee5046cfcf4a1d9522450688d75a3b0362f2c9ec0ec117b2fc566664f2f52a1b47fe62f28466488163f9f0f1ce367f86 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_sqlite3.pyd
| MD5 | eb6313b94292c827a5758eea82d018d9 |
| SHA1 | 7070f715d088c669eda130d0f15e4e4e9c4b7961 |
| SHA256 | 6b41dfd7d6ac12afe523d74a68f8bd984a75e438dcf2daa23a1f934ca02e89da |
| SHA512 | 23bfc3abf71b04ccffc51cedf301fadb038c458c06d14592bf1198b61758810636d9bbac9e4188e72927b49cb490aeafa313a04e3460c3fb4f22bdddf112ae56 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_socket.pyd
| MD5 | bcc3e26a18d59d76fd6cf7cd64e9e14d |
| SHA1 | b85e4e7d300dbeec942cb44e4a38f2c6314d3166 |
| SHA256 | 4e19f29266a3d6c127e5e8de01d2c9b68bc55075dd3d6aabe22cf0de4b946a98 |
| SHA512 | 65026247806feab6e1e5bf2b29a439bdc1543977c1457f6d3ddfbb7684e04f11aba10d58cc5e7ea0c2f07c8eb3c9b1c8a3668d7854a9a6e4340e6d3e43543b74 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_queue.pyd
| MD5 | decdabaca104520549b0f66c136a9dc1 |
| SHA1 | 423e6f3100013e5a2c97e65e94834b1b18770a87 |
| SHA256 | 9d4880f7d0129b1de95becd8ea8bbbf0c044d63e87764d18f9ec00d382e43f84 |
| SHA512 | d89ee3779bf7d446514fc712dafb3ebc09069e4f665529a7a1af6494f8955ceb040bef7d18f017bcc3b6fe7addeab104535655971be6eed38d0fc09ec2c37d88 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_overlapped.pyd
| MD5 | e1339a750d518d9e3b8500817d8334fb |
| SHA1 | 23a2795e41153f782a23717872240ab3e4c8c9b1 |
| SHA256 | 1e80734d2466925be480ccf198de76efd58393601cd3f0265850d18a629626e2 |
| SHA512 | 07055de2b82824df7babf4e17cf5015cfec9d803f0f22a625ddf2ef99fcd64b0ec36cf01d6df49a56cd437795db3da2aab7a445c0333693ca38e0460682fbe42 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_multiprocessing.pyd
| MD5 | b6b3185a2c82bd93dfc03e837826997f |
| SHA1 | 4eed50c2a2c3e85e414d8414485a4aa244746d4e |
| SHA256 | 2313c1ba0887b185716c908b92b6391ca587f27d4e93228d7c9fc8f8ca21cefd |
| SHA512 | 24ef70f81a6b5f14492d201ddd57fe6c0ab99c7031ffdcf5daceb904f87bbe97732369abf90c58b38d4e1b367b7d732e7e24b4d3bc68d1f7c0e83f3d2fd7d49a |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_elementtree.pyd
| MD5 | ff94faaa5b10e11ffb36d1ef5681ce33 |
| SHA1 | d8cd479bb762a3d89970fc383733cd4be91ca24c |
| SHA256 | 98665270dd81e6c57c74746e8496f40391575faa8f5c81b1cb62f4389735d7ee |
| SHA512 | 354c7b73bd97625921b4154847f61d6a7cb00d3c6142883c911c6a20e67890f449ac8a305074be012c8d682e163c48ab16ad62892d7f84bbf6bdcb62c46b4396 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_decimal.pyd
| MD5 | a8952538e090e2ff0efb0ba3c890cd04 |
| SHA1 | cdc8bd05a3178a95416e1c15b6c875ee026274df |
| SHA256 | c4e8740c5dbbd2741fc4124908da4b65fa9c3e17d9c9bf3f634710202e0c7009 |
| SHA512 | 5c16f595f17bedaa9c1fdd14c724bbb404ed59421c63f6fbd3bfd54ce8d6f550147d419ec0430d008c91b01b0c42934c2a08dae844c308feec077da713ac842e |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_cffi_backend.cp311-win_amd64.pyd
| MD5 | 1518035a65a45c274f1557ff5655e2d7 |
| SHA1 | 2676d452113c68aa316cba9a03565ec146088c3f |
| SHA256 | 9ca400d84a52ae61c5613403ba379d69c271e8e9e9c3f253f93434c9336bc6e8 |
| SHA512 | b5932a2eadd2981a3bbc0918643a9936c9aaafc606d833d5ef2758061e05a3148826060ed52a2d121fabfd719ad9736b3402683640a4c4846b6aaaa457366b66 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\_asyncio.pyd
| MD5 | d8ea889dd0e6d149b48e455207d058ab |
| SHA1 | a2260643af8803ae10e0a886ec444d5a0e870a69 |
| SHA256 | 367dec80ffa627219edc9eb681ab21ed1fdb24b372ad7691dd7d76fde65bc029 |
| SHA512 | 39153493b945fddad178303e6752f0eb764347cedaf1b180f9af73527e33781130b4484b8100cf3246468a9a552bed3b52a788573e2d84818f84e86f5db03241 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\zlib1.dll
| MD5 | a35d7eeae683a35acb99e72e01cf132f |
| SHA1 | cc37f1e0641f6afc821ef45a65986422eb853366 |
| SHA256 | c84547746f4c328daa9637414bbb252ec7124005d0cb7d4a8c62779cf641271c |
| SHA512 | dd7996756a3aed62251f90cd0ae95feafa7bc1cfe7c51e7e2e09bfd30bf0bbb2775fe397a1963f63aed7ad49957b4dd75faed022c6ec4ed9576822f650612f2c |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\VCRUNTIME140_1.dll
| MD5 | 7e668ab8a78bd0118b94978d154c85bc |
| SHA1 | dbac42a02a8d50639805174afd21d45f3c56e3a0 |
| SHA256 | e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f |
| SHA512 | 72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\unicodedata.pyd
| MD5 | c2556dc74aea61b0bd9bd15e9cd7b0d6 |
| SHA1 | 05eff76e393bfb77958614ff08229b6b770a1750 |
| SHA256 | 987a6d21ce961afeaaa40ba69859d4dd80d20b77c4ca6d2b928305a873d6796d |
| SHA512 | f29841f262934c810dd1062151aefac78cd6a42d959a8b9ac832455c646645c07fd9220866b262de1bc501e1a9570591c0050d5d3607f1683437dea1ff04c32b |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\tk86t.dll
| MD5 | a3b28c19b23fddf32c8920a4d492be47 |
| SHA1 | 2b9aedaf02d2ec7dbb36596b8ceeb10657480e43 |
| SHA256 | c611b2a311da589f93e83f0662dcb8b3bb3db8450c64084da4b067b36a52ecb2 |
| SHA512 | 24d44d6ddde9d05eaabfa58aadeef85443be46c535d3f290b50f2208fd79f27215f65b099389a04381b6b44a812b17687886185b49eb94f7fd193114cf3c9436 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\tcl86t.dll
| MD5 | ad6e74d50f92edcdb4420750d190610c |
| SHA1 | af6b5fae4d3d5a064df0e727bfd63e8ff82828bc |
| SHA256 | 6074ed09ce5ff856dd8f3b27a3207cf31d8f48fa1247853773609357b511068d |
| SHA512 | 18630348aa556a672bb1675f2cae3182929c3c4a6c3c5745dfda9865b17d19f895d5f1da98ec6b03ffe921abd34b16a90a56bfede64c351f307491a7f3df6e3e |
memory/4668-1318-0x00007FFDD1C10000-0x00007FFDD1C1D000-memory.dmp
memory/4668-1319-0x00007FFDD1BE0000-0x00007FFDD1C0E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45682\sqlite3.dll
| MD5 | 395332e795cb6abaca7d0126d6c1f215 |
| SHA1 | b845bd8864cd35dcb61f6db3710acc2659ed9f18 |
| SHA256 | 8e8870dac8c96217feff4fa8af7c687470fbccd093d97121bc1eac533f47316c |
| SHA512 | 8bc8c8c5f10127289dedb012b636bc3959acb5c15638e7ed92dacdc8d8dba87a8d994aaffc88bc7dc89ccfeef359e3e79980dfa293a9acae0dc00181096a0d66 |
memory/4668-1320-0x00007FFDD18D0000-0x00007FFDD1988000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45682\select.pyd
| MD5 | 90fea71c9828751e36c00168b9ba4b2b |
| SHA1 | 15b506df7d02612e3ba49f816757ad0c141e9dc1 |
| SHA256 | 5bbbb4f0b4f9e5329ba1d518d6e8144b1f7d83e2d7eaf6c50eef6a304d78f37d |
| SHA512 | e424be422bf0ef06e7f9ff21e844a84212bfa08d7f9fbd4490cbbcb6493cc38cc1223aaf8b7c9cd637323b81ee93600d107cc1c982a2288eb2a0f80e2ad1f3c5 |
memory/4668-1321-0x00007FFDD1BC0000-0x00007FFDD1BCB000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45682\SDL2_ttf.dll
| MD5 | 9f5ece4e13e42058fa5ea65215c41c5d |
| SHA1 | eddcecb4f10f2bb9b61c57b88fb6bd1b1d560a07 |
| SHA256 | f5f2690285fc087376ff03edb8849ab5f24c6e9d60ae3661013bea621786582b |
| SHA512 | 09cf0927b7cdb84f9ddec465ba10874af6160f947e58e9ff9ead2aa6d10e7d164dd8c5e2df6314f0dd8a84d0b104b48dbac8cc96522f749d54041b3e8ec03400 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\SDL2_mixer.dll
| MD5 | 1230b474eca2c4cefb13cf0aaa2fc5d0 |
| SHA1 | e23f9cf8cb7dd47e92a02f7508922f01d4d1364b |
| SHA256 | 6879a16d963159cb0666e654ea4d5e9a92abffd96cfc6fffe6b39ae81b4ffca3 |
| SHA512 | 2520fdfbd1370bb9683c29fe1722f771e3d4c7df635987371190be5445237f9e96ae506bbeb79035f6f483ac116995b56bb1e9fc35b6f6a6d49bb940dbf72ead |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\SDL2_image.dll
| MD5 | 7174d7a8eec42d7700c5f4adfff39b57 |
| SHA1 | b850f0814e77a67f0414a85aae88c9534ca857e5 |
| SHA256 | 155eab85fe565f6dd1ecb29d6496425539c994bc0d14b52cabd850df5927f9bf |
| SHA512 | 9a79cc9661cdab7efeb096f1eb121807ba937b444546d46a321613f6d2792ebf09cc62ff067ece7cb0458b988d6081feadd33e93a52c24faac53dc1539bf32c9 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\SDL2.dll
| MD5 | 9684069bb2b8892408ccb50d66abbeda |
| SHA1 | 7df5e8f28481c4e7aef128e017a53a36b86c3b7b |
| SHA256 | 123c8a0d647e5b866545f8e1cc4cfba5fdadf8c1a247692050355a609d81996b |
| SHA512 | fbe493326da9b582c9c4fa1b16ba02e5befcf5787324116656e108527894f692c3fc21493419a419833ab37a5fa5fb5e38e2c04a8cbdbc3c8afeba08df390697 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\pyexpat.pyd
| MD5 | 9225fcea61b20b8cd4c86a1115d96a2a |
| SHA1 | 2f7bdc404a7151bfa8b437a0dc9ad5eb728654de |
| SHA256 | 04928a947886566f522c5f42fa5846afe69aace9ae5036e8ac4d649eed969e8d |
| SHA512 | 2c490de77873019743b1845afe717826564c3cfff9e8000bd1d80a212285bd51944ae9b05a5801eac4b04aaa222bce7c3c0c41ddb3c0044202e1963862e1a969 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\portmidi.dll
| MD5 | 1b443fe9c75d57eedcf5fd67493573e2 |
| SHA1 | 27504e51f5f19d3d73ed2a0ba473dc5cda787679 |
| SHA256 | 96b2ba3d433b0e0a0ce72c72725e033ca35b570225b55b38fb7d71c716418ee3 |
| SHA512 | 02f0ee765490d999ac621f54411b039ef42dddeba17d2edbb9970db20e481d29aed4d607d8330a7c5cd7133b214f13dcb427e89903f9baaef20ffc4a431bb0c4 |
memory/4668-1322-0x00007FFDD1B90000-0x00007FFDD1BB3000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libwebp-7.dll
| MD5 | 4276d3cb447a08644a2c1d3b7afb9fdf |
| SHA1 | d63f34d0b4e8eb660a92a3843b695eda16294b80 |
| SHA256 | cc3831ce9ff18f5ebfde8b20d1ee237e2336e4d9ca6405392ac5ec9c8c948174 |
| SHA512 | d3a539176243e31a15877b0a6c40c295036ccac5c3ac13cd7b74a340c4183a661a630bbe6b5b0c0ff54b4b27fc72bc154883c7ba5167cb4baeb4b0a528f514bc |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libtiff-5.dll
| MD5 | f374796886d56c6c552f3a92a81c3338 |
| SHA1 | d61f0297386e9925a6ac0c6469ba40b86d3c98cd |
| SHA256 | e2c5b370bcade6a167dba5dc9bb33107d4ed2612e7e8af8d1035be72f35f90d7 |
| SHA512 | b59cd888b41c67bf139c2c78d7968a33c84e9127752b9fa276b7b3b461a01cd71dc72936e51a334ddad7fa8e67dd4c250a3495ce544aa156efacb77e7f1dce9f |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libssl-1_1.dll
| MD5 | 8e8a145e122a593af7d6cde06d2bb89f |
| SHA1 | b0e7d78bb78108d407239e9f1b376e0c8c295175 |
| SHA256 | a6a14c1beccbd4128763e78c3ec588f747640297ffb3cc5604a9728e8ef246b1 |
| SHA512 | d104d81aca91c067f2d69fd8cec3f974d23fb5372a8f2752ad64391da3dbf5ffe36e2645a18a9a74b70b25462d73d9ea084318846b7646d39ce1d3e65a1c47c4 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libpng16-16.dll
| MD5 | 8f3bf615136b7241204419fb24c8d5ad |
| SHA1 | d107f0b405c566974c37be20e1abbd365ccbb750 |
| SHA256 | a9c4d2443d6de90091eff8a5adfd7a3c207b0c7aefb913b855320866e93f8039 |
| SHA512 | a2ced7974c086291e69dce39f841335c771088aecbbc52b049d7af51c81342bd1e8bd0d8c78e62529e2041d15d8f5317e5a41727e299c2d827027bcbb0382aa1 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libopusfile-0.dll
| MD5 | a729c1b14d695b00ae79472d3fe45339 |
| SHA1 | 20cd334187fc7297138f014303e5c82b5f918c80 |
| SHA256 | 57bb8b7dec2bd35ff1031f12c4ba3aa3cb2e8de2445e21ea29ffa3ad13e7be3a |
| SHA512 | 1da8060b1767bdf811b005e4a476c18f1c2f93186334aa40ca59937cec7aed37267c45a3b5aaeb8fa13d9b0639959d128d957e6d08fcb9787926df850e42fc22 |
memory/4668-1323-0x00007FFDC2780000-0x00007FFDC289C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libopus-0.x64.dll
| MD5 | 17bed62f3389d532d3dfc59071bbd214 |
| SHA1 | 2b0894cc48dd3756f0ff6602bf8c1e24cb8b6642 |
| SHA256 | 4fd26640721088ac31fdac941db6fa3c094ca17bd97d240992969aefae19ff91 |
| SHA512 | 976c5e0dd50487eb5f88c195633805cccbf34566496065eaf8f3ecbbea0300653097bfbbf628dbb2c238a4d552460187794bcebcb8d41452a3f873f0244fc6a4 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libopus-0.dll
| MD5 | 3c2e93c3d2b292a0f489449209f8e099 |
| SHA1 | 751f18a79c6da4e7162439cef4d481189d17a242 |
| SHA256 | b6b32593c0bcecea7b31a900086870bbab039f25b29067170ac461cf2479dea5 |
| SHA512 | a0ec68d2a1c650720b4e3e437a5841e8d04d165fc920ce26a41cc20d6ddf4c761b05bbf3426e241c2ee13a9fbe146fc889aa45df70397600b2d962bdaa1bedbb |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libogg-0.dll
| MD5 | 6ffebd7d283079e9029c7f29d8ca7fba |
| SHA1 | b470b09c8aa2f3e42bcff8392d95b6259cb87555 |
| SHA256 | 0d9a915ea29ed4da271f86dbcfa90b52064a26b5136af590b2bb430d5dd6a67e |
| SHA512 | 2b9a9b5f298eefccf0a08af52d7c2c803db19ab9f3cedad2bb19df50466527c05e31f956b6018c9a337565448249465eba8952e9e8397b728b7f76e4f0561c68 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libmodplug-1.dll
| MD5 | 072093b2671589d4ce465de2b92ebee4 |
| SHA1 | 821d9827286271859640984df28e01b4a37341fb |
| SHA256 | 04d07b4dcae8d3998156d563df20881ba790c32389aca23ade91de9cf9f4a3d4 |
| SHA512 | 522d5faa8d17017f1891374a23d6e653cd62b51818734bf1f7343248d09e1e314ae49821595818fe69af62c9e51debca4ae384e421ad8fa658aced95f977379e |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libjpeg-9.dll
| MD5 | 6e67e46f957f50215b7e68c9091db53f |
| SHA1 | e969fa4858351c95c337352dd0578fe5a83403f0 |
| SHA256 | 24b25fe9ebe303496973c4d11144b053a5f5a03eabf53f9d8eab0c15fdbfbffe |
| SHA512 | 86af5560269ef21490f5343ea3e0522f35e271d42e64f61a2f05471302856de79d34bf00658e1667d7145af48667627fa3897bca2fc479928ab9a62ecba81396 |
C:\Users\Admin\AppData\Local\Temp\_MEI45682\libcrypto-1_1.dll
| MD5 | dffcab08f94e627de159e5b27326d2fc |
| SHA1 | ab8954e9ae94ae76067e5a0b1df074bccc7c3b68 |
| SHA256 | 135b115e77479eedd908d7a782e004ece6dd900bb1ca05cc1260d5dd6273ef15 |
| SHA512 | 57e175a5883edb781cdb2286167d027fdb4b762f41fb1fc9bd26b5544096a9c5dda7bccbb6795dcc37ed5d8d03dc0a406bf1a59adb3aeb41714f1a7c8901a17d |
memory/4668-1324-0x00007FFDD1B70000-0x00007FFDD1B7B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45682\freetype.dll
| MD5 | 522257e451efcc3bfe980f56d3fed113 |
| SHA1 | f5e12321517f523842943ea7f3ba74d449dba1f4 |
| SHA256 | 8c74376e7932eebcd084191b40774056b32525ba48e375d942754cdc4fc03c60 |
| SHA512 | d590cd813281278be4aec86af3713216dd306399b4910221a2447a3200accbca1b5f8d9495bf21f69ff8e09e5465a71c715a85ce0d87cdc26cbf27b0fae2cc4c |
memory/4668-1325-0x00007FFDD1790000-0x00007FFDD179C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI45682\crypto_clipper.json
| MD5 | 28ace1f269a7b6ddc508fe2ef995eb89 |
| SHA1 | fc25b159929682bff11e6d3b413acba80300418a |
| SHA256 | 8011959661b3c6efee432bdc16b358de1c371aaccdbec068c9e65004262f988e |
| SHA512 | 4c1172eead25d9c6037729ad372975d545153213dba99e7308308f1f1c6594bb1322b6c1332e44bd3677458160211046762a5dbf72564e4c7d36f7371177dcd2 |
memory/4668-1266-0x00007FFDD2830000-0x00007FFDD2849000-memory.dmp
memory/4668-1326-0x00007FFDD1780000-0x00007FFDD178B000-memory.dmp
memory/4668-1327-0x00007FFDC28A0000-0x00007FFDC2C18000-memory.dmp
memory/4668-1328-0x00007FFDD1BD0000-0x00007FFDD1BDD000-memory.dmp
memory/4668-1330-0x00007FFDD1B80000-0x00007FFDD1B8B000-memory.dmp
memory/4668-1329-0x00007FFDD1840000-0x00007FFDD1878000-memory.dmp
memory/4668-1331-0x00007FFDD19D0000-0x00007FFDD19DC000-memory.dmp
memory/4668-1332-0x00007FFDD1830000-0x00007FFDD183B000-memory.dmp
memory/4668-1333-0x00007FFDD10E0000-0x00007FFDD10EC000-memory.dmp
memory/4668-1334-0x00007FFDD10D0000-0x00007FFDD10DD000-memory.dmp
memory/4668-1335-0x00007FFDD10B0000-0x00007FFDD10BC000-memory.dmp
memory/4668-1336-0x00007FFDD10A0000-0x00007FFDD10AC000-memory.dmp
memory/4668-1337-0x00007FFDD1090000-0x00007FFDD109B000-memory.dmp
memory/4668-1338-0x00007FFDD10C0000-0x00007FFDD10CE000-memory.dmp
memory/4668-1339-0x00007FFDD0ED0000-0x00007FFDD0EDB000-memory.dmp
memory/4668-1340-0x00007FFDC17D0000-0x00007FFDC1DB9000-memory.dmp
memory/4668-1342-0x00007FFDD05C0000-0x00007FFDD05CD000-memory.dmp
memory/4668-1341-0x00007FFDD0EC0000-0x00007FFDD0ECC000-memory.dmp
memory/4668-1343-0x00007FFDD05A0000-0x00007FFDD05B2000-memory.dmp
memory/4668-1345-0x00007FFDD5E10000-0x00007FFDD5E33000-memory.dmp
memory/4668-1344-0x00007FFDCF080000-0x00007FFDCF08C000-memory.dmp
memory/4668-1346-0x00007FFDD0750000-0x00007FFDD075C000-memory.dmp
memory/4668-1348-0x00007FFDCF040000-0x00007FFDCF052000-memory.dmp
memory/4668-1347-0x00007FFDCF060000-0x00007FFDCF075000-memory.dmp
memory/4668-1349-0x00007FFDCE3E0000-0x00007FFDCE3F4000-memory.dmp
memory/4668-1350-0x00007FFDCE3C0000-0x00007FFDCE3DB000-memory.dmp
memory/4668-1351-0x00007FFDCD9D0000-0x00007FFDCD9E2000-memory.dmp
memory/4668-1352-0x00007FFDD1FB0000-0x00007FFDD1FC4000-memory.dmp
memory/4668-1353-0x00007FFDCD9B0000-0x00007FFDCD9C5000-memory.dmp
memory/4668-1355-0x00007FFDCF030000-0x00007FFDCF03E000-memory.dmp
memory/4668-1354-0x00007FFDCD970000-0x00007FFDCD9AF000-memory.dmp
memory/4668-1356-0x00007FFDD1840000-0x00007FFDD1878000-memory.dmp
memory/4668-1357-0x00007FFDC8A70000-0x00007FFDC8A8C000-memory.dmp
memory/4668-1358-0x00007FFDC2720000-0x00007FFDC277D000-memory.dmp
memory/4668-1359-0x00007FFDC8380000-0x00007FFDC83A9000-memory.dmp
memory/4668-1360-0x00007FFDC26F0000-0x00007FFDC271E000-memory.dmp
memory/4668-1361-0x00007FFDC26C0000-0x00007FFDC26E3000-memory.dmp
memory/4668-1362-0x00007FFDCE3E0000-0x00007FFDCE3F4000-memory.dmp
memory/4668-1363-0x00007FFDC1650000-0x00007FFDC17C7000-memory.dmp
memory/4668-1364-0x00007FFDCD8F0000-0x00007FFDCD8FB000-memory.dmp
memory/4668-1365-0x00007FFDC2690000-0x00007FFDC269C000-memory.dmp
memory/4668-1366-0x00007FFDC2680000-0x00007FFDC268B000-memory.dmp
memory/4668-1367-0x00007FFDC2670000-0x00007FFDC267C000-memory.dmp
memory/4668-1368-0x00007FFDC2660000-0x00007FFDC266B000-memory.dmp
memory/4668-1369-0x00007FFDC2650000-0x00007FFDC265C000-memory.dmp
memory/4668-1370-0x00007FFDC1640000-0x00007FFDC164D000-memory.dmp
memory/4668-1371-0x00007FFDC1630000-0x00007FFDC163E000-memory.dmp
memory/4668-1372-0x00007FFDC1620000-0x00007FFDC162C000-memory.dmp
memory/4668-1373-0x00007FFDC1610000-0x00007FFDC161C000-memory.dmp
memory/4668-1374-0x00007FFDC1600000-0x00007FFDC160B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zclnz35p.jyc.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4668-1527-0x00007FFDC17D0000-0x00007FFDC1DB9000-memory.dmp
memory/4668-1530-0x00007FFDD2830000-0x00007FFDD2849000-memory.dmp
memory/4668-1528-0x00007FFDD5E10000-0x00007FFDD5E33000-memory.dmp
memory/4668-1529-0x00007FFDD2850000-0x00007FFDD285F000-memory.dmp
memory/4668-1531-0x00007FFDD1CB0000-0x00007FFDD1CDD000-memory.dmp
memory/4668-1532-0x00007FFDD1FB0000-0x00007FFDD1FC4000-memory.dmp
memory/4668-1533-0x00007FFDC28A0000-0x00007FFDC2C18000-memory.dmp
memory/4668-1534-0x00007FFDD1E60000-0x00007FFDD1E79000-memory.dmp
memory/4668-1536-0x00007FFDD1BE0000-0x00007FFDD1C0E000-memory.dmp
memory/4668-1537-0x00007FFDD18D0000-0x00007FFDD1988000-memory.dmp
memory/4668-1538-0x00007FFDD1BD0000-0x00007FFDD1BDD000-memory.dmp
memory/4668-1535-0x00007FFDD1C10000-0x00007FFDD1C1D000-memory.dmp
memory/4668-1539-0x00007FFDD1BC0000-0x00007FFDD1BCB000-memory.dmp
memory/4668-1540-0x00007FFDD1B90000-0x00007FFDD1BB3000-memory.dmp
memory/4668-1541-0x00007FFDC2780000-0x00007FFDC289C000-memory.dmp
memory/4668-1542-0x00007FFDD1840000-0x00007FFDD1878000-memory.dmp
memory/4668-1543-0x00007FFDCF060000-0x00007FFDCF075000-memory.dmp
memory/4668-1545-0x00007FFDCF040000-0x00007FFDCF052000-memory.dmp
memory/4668-1547-0x00007FFDCE3E0000-0x00007FFDCE3F4000-memory.dmp
memory/4668-1549-0x00007FFDCE3C0000-0x00007FFDCE3DB000-memory.dmp
memory/4668-1551-0x00007FFDCD9D0000-0x00007FFDCD9E2000-memory.dmp
memory/4668-1554-0x00007FFDCD9B0000-0x00007FFDCD9C5000-memory.dmp
memory/4668-1556-0x00007FFDCD970000-0x00007FFDCD9AF000-memory.dmp
memory/4668-1558-0x00007FFDCF030000-0x00007FFDCF03E000-memory.dmp
memory/4668-1560-0x00007FFDC8A70000-0x00007FFDC8A8C000-memory.dmp
memory/4668-1562-0x00007FFDC2720000-0x00007FFDC277D000-memory.dmp
memory/4668-1565-0x00007FFDC8380000-0x00007FFDC83A9000-memory.dmp
memory/4668-1566-0x00007FFDC26F0000-0x00007FFDC271E000-memory.dmp
memory/4668-1569-0x00007FFDC26C0000-0x00007FFDC26E3000-memory.dmp
memory/4668-1571-0x00007FFDC1650000-0x00007FFDC17C7000-memory.dmp
memory/4668-1573-0x00007FFDC26A0000-0x00007FFDC26B8000-memory.dmp
memory/4668-1576-0x00007FFDC1550000-0x00007FFDC1585000-memory.dmp
memory/4668-1578-0x00007FFDC1490000-0x00007FFDC154C000-memory.dmp
memory/4668-1580-0x00007FFDC1460000-0x00007FFDC148B000-memory.dmp
memory/4668-1582-0x00007FFDC11D0000-0x00007FFDC1453000-memory.dmp
memory/4668-1584-0x00007FFDC1170000-0x00007FFDC11C5000-memory.dmp
memory/4668-1586-0x00007FFDC0E60000-0x00007FFDC113F000-memory.dmp
memory/4668-1592-0x00007FFDBED60000-0x00007FFDC0E53000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2023-10-21 01:40
Reported
2023-10-21 01:52
Platform
win10-20231020-en
Max time kernel
12s
Max time network
24s
Command Line
Signatures
Quasar RAT
Quasar payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\mods\configs\client.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\mods\configs\client.exe
"C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\mods\configs\client.exe"
Network
Files
memory/2240-0-0x0000000000140000-0x000000000046A000-memory.dmp
memory/2240-1-0x00007FF941CF0000-0x00007FF9426DC000-memory.dmp
memory/2240-2-0x000000001B050000-0x000000001B060000-memory.dmp
memory/2240-4-0x00007FF941CF0000-0x00007FF9426DC000-memory.dmp