Malware Analysis Report

2024-11-13 15:09

Sample ID 231201-p2mf9ahh8x
Target _RUNECE.vmp.exe
SHA256 a614d740ca78216237022406c3b8df12dfe982d75d8973299d1ffa3a63974546
Tags
spyware stealer upx pyinstaller pysilon
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a614d740ca78216237022406c3b8df12dfe982d75d8973299d1ffa3a63974546

Threat Level: Known bad

The file _RUNECE.vmp.exe was found to be: Known bad.

Malicious Activity Summary

spyware stealer upx pyinstaller pysilon

Pysilon family

Detect Pysilon

Enumerates VirtualBox DLL files

Loads dropped DLL

UPX packed file

Reads user/profile data of web browsers

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Drops file in Program Files directory

Unsigned PE

Detects Pyinstaller

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Gathers system information

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-01 12:49

Signatures

Detect Pysilon

Description Indicator Process Target
N/A N/A N/A N/A

Pysilon family

pysilon

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-01 12:49

Reported

2023-12-01 12:55

Platform

win10v2004-20231127-en

Max time kernel

150s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe"

Signatures

Enumerates VirtualBox DLL files

Description Indicator Process Target
File opened (read-only) C:\windows\system32\vboxhook.dll C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
File opened (read-only) C:\windows\system32\vboxmrxnp.dll C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Description Indicator Process Target
N/A ident.me N/A N/A
N/A ident.me N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_debug.log C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_debug.log C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4776 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe
PID 4776 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe
PID 2012 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe C:\Windows\system32\cmd.exe
PID 2012 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe C:\Windows\system32\cmd.exe
PID 4492 wrote to memory of 1532 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4492 wrote to memory of 1532 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2012 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe C:\Windows\system32\cmd.exe
PID 2012 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe C:\Windows\system32\cmd.exe
PID 388 wrote to memory of 1448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 388 wrote to memory of 1448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 2012 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2012 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 4456 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 4456 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 2540 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 4468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 4468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 3988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 3988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 3988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 3988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 3988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2340 wrote to memory of 3988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe

"C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe"

C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe

"C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x380 0x2d0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\RuneCE\""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --screenshot=C:\Users\Admin\AppData\Local\Temp\image.png --window-size=500,300 --default-background-color=00000000 --hide-scrollbars C:\Users\Admin\AppData\Local\Temp\html2image\image.html

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe75709758,0x7ffe75709768,0x7ffe75709778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --mojo-platform-channel-handle=1328 --field-trial-handle=1428,i,18253718647961849901,4433687442985130824,131072 --disable-features=PaintHolding /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --headless --mojo-platform-channel-handle=1520 --field-trial-handle=1428,i,18253718647961849901,4433687442985130824,131072 --disable-features=PaintHolding /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --headless --lang=en-US --first-renderer-process --allow-pre-commit-input --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1900 --field-trial-handle=1428,i,18253718647961849901,4433687442985130824,131072 --disable-features=PaintHolding /prefetch:1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "del C:\Users\Admin\RuneCE\image.png"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --screenshot=C:\Users\Admin\AppData\Local\Temp\image.png --window-size=500,300 --default-background-color=00000000 --hide-scrollbars C:\Users\Admin\AppData\Local\Temp\html2image\image.html

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe75709758,0x7ffe75709768,0x7ffe75709778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --mojo-platform-channel-handle=1340 --field-trial-handle=1412,i,2078417359987312438,1553324061374729150,131072 --disable-features=PaintHolding /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --headless --mojo-platform-channel-handle=1648 --field-trial-handle=1412,i,2078417359987312438,1553324061374729150,131072 --disable-features=PaintHolding /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --headless --lang=en-US --first-renderer-process --allow-pre-commit-input --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1892 --field-trial-handle=1412,i,2078417359987312438,1553324061374729150,131072 --disable-features=PaintHolding /prefetch:1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "del C:\Users\Admin\RuneCE\image.png"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
N/A 127.0.0.1:65500 tcp
US 162.159.136.232:443 discord.com tcp
US 8.8.8.8:53 232.136.159.162.in-addr.arpa udp
US 8.8.8.8:53 gateway.discord.gg udp
US 162.159.136.234:443 gateway.discord.gg tcp
US 8.8.8.8:53 234.136.159.162.in-addr.arpa udp
US 8.8.8.8:53 ident.me udp
DE 49.12.234.183:443 ident.me tcp
US 8.8.8.8:53 183.234.12.49.in-addr.arpa udp
US 8.8.8.8:53 ipv4.lafibre.info udp
NL 51.158.154.169:443 ipv4.lafibre.info tcp
US 8.8.8.8:53 169.154.158.51.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 65.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 209.78.101.95.in-addr.arpa udp
US 162.159.136.232:443 discord.com tcp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 27.73.42.20.in-addr.arpa udp
US 162.159.136.232:443 discord.com tcp
US 162.159.138.232:443 discord.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI47762\setuptools-49.2.1.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

C:\Users\Admin\AppData\Local\Temp\_MEI47762\python39.dll

MD5 2dcee515eef346a7c77d2e6d37e6d761
SHA1 9daecbcbb7d599ad5167dfa21c719b3eb72f9c3c
SHA256 610a12bccc3545376ae42ee74be12d5481ab35ec7cca01cb02a8e95e2793a2e5
SHA512 d9d89b9a83312f53db69d351054a226146135200eb88e9e69227a953d844cb26af9546baf54da83aa744c91304ba1c8ba077b78096a0a4ac12cce1ee6b8ba6f2

C:\Users\Admin\AppData\Local\Temp\_MEI47762\VCRUNTIME140.dll

MD5 7942be5474a095f673582997ae3054f1
SHA1 e982f6ebc74d31153ba9738741a7eec03a9fa5e8
SHA256 8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
SHA512 49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039

C:\Users\Admin\AppData\Local\Temp\_MEI47762\VCRUNTIME140.dll

MD5 7942be5474a095f673582997ae3054f1
SHA1 e982f6ebc74d31153ba9738741a7eec03a9fa5e8
SHA256 8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
SHA512 49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039

memory/2012-1264-0x00007FFE5DD00000-0x00007FFE5E17F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI47762\python39.dll

MD5 2dcee515eef346a7c77d2e6d37e6d761
SHA1 9daecbcbb7d599ad5167dfa21c719b3eb72f9c3c
SHA256 610a12bccc3545376ae42ee74be12d5481ab35ec7cca01cb02a8e95e2793a2e5
SHA512 d9d89b9a83312f53db69d351054a226146135200eb88e9e69227a953d844cb26af9546baf54da83aa744c91304ba1c8ba077b78096a0a4ac12cce1ee6b8ba6f2

C:\Users\Admin\AppData\Local\Temp\_MEI47762\base_library.zip

MD5 8c6e026e2e7867af97d5231b86cb35d4
SHA1 46f7b262d82ec044cb68b4f81fdba5775e7d4499
SHA256 2c4921453ef057ce597c793a0a229e3107acf015192b779a8f96e35c72eb735f
SHA512 021f70dc6ce4de9ebb400b9ca198ed8e0a1dc70b838c61a5748cf7070d0390954b899a3c9361e5242f21c286defd5492d7647471266d569babffb8e48698a554

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_ctypes.pyd

MD5 d99f0b5b9edad831e10573824d7448ed
SHA1 2d090e089ebb14c6b8b5994b83f4f7d84fbbc8ee
SHA256 09bfa7972ee50bf650afce11098f97043902010a442ac17758bf2f8fc5062359
SHA512 59a4534729b5026c03c7bdaedd4c2cfb6ecb9ba784aedb065b41503cee30136905845e1b57e707cd2e32cda5a511f4d9d850419d5a6c80392e6f000468ad5e73

C:\Users\Admin\AppData\Local\Temp\_MEI47762\python3.DLL

MD5 eb0a803cf72653c78fe900551f961da4
SHA1 d76cb52625e9cf88c588c34ba1759d8987acc8e7
SHA256 e9e4a9b271b692c331dc091825ac1ff51b01cd159f2e5c2553756c79ff272fa2
SHA512 2d77a84fe905d969f1789764a4138f6c461bff44bc264bf1883883cacec35d6e98abce1129312119eb2f8aca2ad6a899e6956c7287ae5b83430cea3f5e845697

memory/2012-1270-0x00007FFE6E760000-0x00007FFE6E785000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_ctypes.pyd

MD5 d99f0b5b9edad831e10573824d7448ed
SHA1 2d090e089ebb14c6b8b5994b83f4f7d84fbbc8ee
SHA256 09bfa7972ee50bf650afce11098f97043902010a442ac17758bf2f8fc5062359
SHA512 59a4534729b5026c03c7bdaedd4c2cfb6ecb9ba784aedb065b41503cee30136905845e1b57e707cd2e32cda5a511f4d9d850419d5a6c80392e6f000468ad5e73

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_bz2.pyd

MD5 d00b46d95b4dae50bf4cb46f6a6d119f
SHA1 6029f48e3f771c9ce7470595fde08847aa7d2906
SHA256 b5e9c0d4b1b4482767296bea9d033c88d9d8a11d26da9ec787e761980d186727
SHA512 6d2f78c21c05b446ebea93b65085b119de9a0d5d2b75edd15b4a291c27045a903ad6c27ac869c6234e54bba677dfc6187d8d48d79e38e7e9d450474714994b84

memory/2012-1275-0x00007FFE72640000-0x00007FFE7264F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_uuid.pyd

MD5 3b051685635b87540aa7e162903833b5
SHA1 fd5f7ce61fe4f45d92a83e126a3b116619d52f2c
SHA256 63ceacdaac82e11dbaeb274a10d1a02974b7fcfbe21f8b3350d14735956732d3
SHA512 55a0aac327ac5b3a986e2cfc890016a6373579de09c287aaa83cddefd2312f4cd51248063aa7aff940c0ee55972a85dd477e555b345d06927c5c0ce5e23c53b0

memory/2012-1319-0x00007FFE6E4F0000-0x00007FFE6E507000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libcrypto-1_1.dll

MD5 3ba3ec8c8e092360c72b93c4bdf3d655
SHA1 aff2407b6aa96effd1e15f2f724616a0f2a8811d
SHA256 8d671bc3f80a0ffe684943f4f650fe52db35a9da81f81a1354c31c5d092349b7
SHA512 44eb07fcc8f6faa122bdca482c5b80b2f578761f2d4162ccfb5d42cc772fa5dd2183babd736275bb172703cd544e1f1114518790f63dd7af8893711eb64f2d83

memory/2012-1321-0x00007FFE6DBE0000-0x00007FFE6DF4C000-memory.dmp

memory/2012-1320-0x00007FFE72330000-0x00007FFE7234B000-memory.dmp

memory/2012-1317-0x00007FFE6E730000-0x00007FFE6E75E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_hashlib.pyd

MD5 bb1a279b5ba3632d63879d1c08a25d1e
SHA1 9b1d6c51bb9c6354037c6cffaa718327124d4159
SHA256 4c3165a5863b8b372f7b8d5eb15faf619284f38cdc7e58ded040afb044dd573d
SHA512 6ae0a6cfe117a1521134c17a26304aba741ab694fdd57a0f2ee33c77055cc88a39500e413257f17c825d9959b60d3722e729d4f85139a6ed06e3c227c8a26c8a

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_tkinter.pyd

MD5 b2f0fbe0d8d0efb72689723675151bcf
SHA1 25164f91987758dc069bb06dd902e6a0418c07ef
SHA256 69fc27b94ce23b6b78d1fa723a45995121cf894ffd565c1754f544d7626fcf3f
SHA512 3981bf096b266a44e02cf3594227c825cba8d2ed04195632f26d6f603e4cdbe68619e39b9d9725ceb6e5aae6f6f07cc3af9dcbacf285311428ec7a8acec89e55

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_ssl.pyd

MD5 46d8633523010ec4d661f6e936b1de83
SHA1 b5e2e1b6216a47bf1985045681b9e0606a751817
SHA256 117a81f953b19704d1fdc9652b27d1869971612a69a839de0fbd3fef04809af9
SHA512 bf53749c63fa21ae106fb346b8251e3a4ace606f3f94c3f7a868f2aebd6a1d4bc0cf24cfdcbcd7258b78eb43000ddcf0eaab55d71f75eaef0ea2983adc1d4a86

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_sqlite3.pyd

MD5 e2909efad7f9775ad5aca25d4e40a867
SHA1 aa664a89784ef18618c77ce483434f79617583bb
SHA256 58e8715c0125875783e64d1133e3cd7b42c843146396fdec73a12bfe88db7b8d
SHA512 d77a717b6ad0db866de9880dd1a9dc8c3b5afa1b610c341ec9aa87a0b873d2e44e6dc2a4807df5f6b0d3fc6e7f554745a1bffe9842768e57ddd93cac1d6dd7a4

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_socket.pyd

MD5 d7f0bded489264edb3a877cd99bd5f11
SHA1 83791fd65047f1d6010d0ebb2cdcf1c0e499476d
SHA256 bd43669e424487a957b1ba8b8cbddc13eea965c043cecfa7a3bddbbcb4ccc7f4
SHA512 038400b4e4f03e691f9fd8c54c400809891f56806556196ca77ac30d441ecc49092abd6f59c357130963b5b9431984ae5434a24bc4dea62a42205717e0da761d

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_queue.pyd

MD5 b10fea035f77acbec0e5a946548b3539
SHA1 ff6d9a7044b7637797f9528f1587337531d35c35
SHA256 532a453decbb3b2fed31e9067a35f61cf771ff857966a228f44314b91716a533
SHA512 1539b119a3ab5de5b2dd0a26be2c82fc982a89a2d5ecd84faf2c57b9c7a8aced6e69796255b74e178963854179ca9aabbbd18ba5e3a5519eb4152e9890194d7f

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_overlapped.pyd

MD5 dc82fb60536d1eec0a9288c51d0e6c86
SHA1 defce8cb7a7f61d83ffc45ba817a041a429bf316
SHA256 26753fe4ad5848f33d5b0d7a181e84af7080e97c209f1920fd1a38307d7c7649
SHA512 81e00812b1533f910a275ce8aebfb4b6780a03847bda86f5939f73ec6e329c7ad235a568ac15c422ac8c0e03a78d44edec5863ba662e8fe99f123724a9b048cf

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_multiprocessing.pyd

MD5 9d26913d2e92c59469ccbe25f32b61bd
SHA1 feb6a9550f5371fa3a5215ca22b2c9011c46719a
SHA256 819451ed960d3bddfe7f92db33688cfd5645f4eba746f381f958c39b48b2ba52
SHA512 d09c100f1d662f03a9dbf9e444f699a0113246cec0d5b673943c647b24265314c5cb7d8663ec75d3f16cbf4c9c6d3e5cf30c8364bb92e6db41d9ddd8157a7690

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_hashlib.pyd

MD5 bb1a279b5ba3632d63879d1c08a25d1e
SHA1 9b1d6c51bb9c6354037c6cffaa718327124d4159
SHA256 4c3165a5863b8b372f7b8d5eb15faf619284f38cdc7e58ded040afb044dd573d
SHA512 6ae0a6cfe117a1521134c17a26304aba741ab694fdd57a0f2ee33c77055cc88a39500e413257f17c825d9959b60d3722e729d4f85139a6ed06e3c227c8a26c8a

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_elementtree.pyd

MD5 497211b042897543270063b6bd40438f
SHA1 dd1aca8cf88dd0f57711aaf03b08d32359ae4b96
SHA256 27f4ac99ba76cc0c8a365ff307a83092883dbb2024776a0c3cd44eb83e690249
SHA512 8844f75003eaa2cb6758abd095e0bb634cb9ed8fc182b77830b0c40464f5ca0110f2af7d3b32ada423630f2bee20ca158603334fa7e15243d85aef2dc1f46f49

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_decimal.pyd

MD5 d8868002d1cf0a4ea35a459a9d4f21bb
SHA1 eba3577d24788335f6661e08d54249ca6c6c217b
SHA256 4c0afa6baca298507ad6622b626f3c59a75e292003223c026fddc13033c013f6
SHA512 7ff1c3599f8048979c49d647cdc86a6be049d4de690011dd32dae60a14f8205a2da35a99a388c9247832c541bb8e599a093803155b0919bb3c29e663d1f2a7a0

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_cffi_backend.cp39-win_amd64.pyd

MD5 448053098e0fe23744e74d45f210fdc4
SHA1 9971d1f7eb2ca44bbe51f612abb0ddb6963695cb
SHA256 3ad110dc493cb4d187bab4ffa9114db6f9b7e96e09f01edd654e77c8959e9f1e
SHA512 84074538cbc1a7a3b8a467e8b94d30dc5cd87f88f80bee66a526c106129e1c3d60f449e0538698177928126ad0cefa74b39383657641aa0deb8244b8dd56c7ea

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_asyncio.pyd

MD5 bd7244b8c85284f091ef307903fbb672
SHA1 7ac627671cf4646a3e9726c8042d1c406fc9a463
SHA256 36900bb183c2524a538254317584071d3a28eb4fe2280848d95186599133c80b
SHA512 6a9b916ff6f40fbdd09cb905759e446c83c1abf4bfffe3aeeeac077513f45b1bf617fb85ab4535254ea047ac752a09d7ef400cc28f55e958b0ceca78c7e25ddb

C:\Users\Admin\AppData\Local\Temp\_MEI47762\zlib1.dll

MD5 ee06185c239216ad4c70f74e7c011aa6
SHA1 40e66b92ff38c9b1216511d5b1119fe9da6c2703
SHA256 0391066f3e6385a9c0fe7218c38f7bd0b3e0da0f15a98ebb07f1ac38d6175466
SHA512 baae562a53d491e19dbf7ee2cff4c13d42de6833036bfdaed9ed441bcbf004b68e4088bd453b7413d60faaf1b334aee71241ba468437d49050b8ccfa9232425d

C:\Users\Admin\AppData\Local\Temp\_MEI47762\VCRUNTIME140_1.dll

MD5 ab03551e4ef279abed2d8c4b25f35bb8
SHA1 09bc7e4e1a8d79ee23c0c9c26b1ea39de12a550e
SHA256 f8bc270449ca6bb6345e88be3632d465c0a7595197c7954357dc5066ed50ae44
SHA512 0e7533b8d7e5019ffd1e73937c1627213711725e88c6d7321588f7fffe9e1b4ef5c38311548adbd2c0ee9b407135646593bf1498cbee92275f4e0a22ace78909

C:\Users\Admin\AppData\Local\Temp\_MEI47762\unicodedata.pyd

MD5 dc8ddb1574cb2f46dbce1ebcbaeb1d59
SHA1 dc8f7941569ffae6c50ebbb379aa47d2f4384b21
SHA256 fd624343ea2bbafa409f2999cdbb697af1953b68840d5e1e101a57cf46aa421b
SHA512 58083f5eab8decf282dc8fcd7ddbf4a6432091f83c14730d086abeead516c891c1cde58e5c199a0c46d2475a0fb2ea0c522fb709656b2221dda1e3c4bf1a4b33

C:\Users\Admin\AppData\Local\Temp\_MEI47762\tk86t.dll

MD5 b07255b25aa473717bc0d8cf76c25320
SHA1 3d94fc5279f2535021bef984efc3fc0ec83bfcc0
SHA256 9b09dd3f43719d9121a2ae48af446cfc7cbad1787f54994ad4973c7232d50dbf
SHA512 56f0481b954c192153b2924316f379b733ff435ef61437cf88f9b9e39c2cc95d1c731843b93d2a20fe9555a8c9b71844c7602ba19da689d897d8edd37a961517

C:\Users\Admin\AppData\Local\Temp\_MEI47762\tcl86t.dll

MD5 a446e391f6688329fcba5b9148e00154
SHA1 472a37e6d3d68ad2f4f9f8228540a9a7f20aa5fc
SHA256 2a29e49eff995ef8283ee59fdc14aad5bbb46ccbee39845c1b3444b79d0a988a
SHA512 ce030d755b18f0f80f53d2590eb933bb08f1af9d34b78a49e02f1108b2384fbb0fc01dad82b8e8ac9a2c01d228cddcca2f6f397cdbcf24a15618cdbc806f1246

C:\Users\Admin\AppData\Local\Temp\_MEI47762\sqlite3.dll

MD5 005eb576da36e275ac19c43fa0e7dae6
SHA1 2e9791cf27db1d4c722378fbfe3bcec1beec3721
SHA256 a9e800507457257d47418af6cb8aa51d2847b815b909c50156cfa64e28979098
SHA512 eed1ad39f1d7bf588c68c2173e05e6cdd2315295b0a0fb1f8d272a7e9eac4575a96f394accf30363f8d88fea6ac19d70580a6472b861a1f098a60a5b173cfff1

C:\Users\Admin\AppData\Local\Temp\_MEI47762\select.pyd

MD5 d78851bda853adfe99105c299bbc7e54
SHA1 dc041c49bd77d832496838659a43f8595e74467a
SHA256 44cb82b626a3e071ef3ab498e7523b749cb8e11db872971224d737157fc857d6
SHA512 54a0492fdfd08e5be90655c359eff735732f9ee4525963f51e956917ce0f4623c3aee401eedcb73ede9aa7616fa0554233a05d0c8f1b05b44f579758f22444b5

C:\Users\Admin\AppData\Local\Temp\_MEI47762\SDL2_ttf.dll

MD5 eb0ce62f775f8bd6209bde245a8d0b93
SHA1 5a5d039e0c2a9d763bb65082e09f64c8f3696a71
SHA256 74591aab94bb87fc9a2c45264930439bbc0d1525bf2571025cd9804e5a1cd11a
SHA512 34993240f14a89179ac95c461353b102ea74e4180f52c206250bb42c4c8427a019ea804b09a6903674ac00ab2a3c4c686a86334e483110e79733696aa17f4eb6

C:\Users\Admin\AppData\Local\Temp\_MEI47762\SDL2_mixer.dll

MD5 b7b45f61e3bb00ccd4ca92b2a003e3a3
SHA1 5018a7c95dc6d01ba6e3a7e77dd26c2c74fd69bc
SHA256 1327f84e3509f3ccefeef1c12578faf04e9921c145233687710253bf903ba095
SHA512 d3449019824124f3edbda57b3b578713e9c9915e173d31566cd8e4d18f307ac0f710250fe6a906dd53e748db14bfa76ec1b58a6aef7d074c913679a47c5fdbe7

C:\Users\Admin\AppData\Local\Temp\_MEI47762\SDL2_image.dll

MD5 25e2a737dcda9b99666da75e945227ea
SHA1 d38e086a6a0bacbce095db79411c50739f3acea4
SHA256 22b27380d4f1f217f0e5d5c767e5c244256386cd9d87f8ddf303baaf9239fc4c
SHA512 63de988387047c17fd028a894465286fd8f6f8bd3a1321b104c0ceb5473e3e0b923153b4999143efbdd28684329a33a5b468e43f25214037f6cddd4d1884adb8

C:\Users\Admin\AppData\Local\Temp\_MEI47762\SDL2.dll

MD5 2b13a3f2fc8f9cdb3161374c4bc85f86
SHA1 9039a90804dba7d6abb2bcf3068647ba8cab8901
SHA256 110567f1e5008c6d453732083b568b6a8d8da8077b9cb859f57b550fd3b05fb6
SHA512 2ee8e35624cb8d78baefafd6878c862b510200974bef265a9856e399578610362c7c46121a9f44d7ece6715e68475db6513e96bea3e26cdccbd333b0e14ccfd8

C:\Users\Admin\AppData\Local\Temp\_MEI47762\pyexpat.pyd

MD5 59181213f5cbb1aa57d0d23d335ba661
SHA1 8b0cf9ce379b0177bf4e8d140ee92da2374aa444
SHA256 e0de179b5e26a38c61d63b8e6fc6d49c70ef4f64311f8a4d9e68ab77e42ae141
SHA512 bf49f4c4286f67d1d951805c4d47849801daac00a9a0d5894409afb10ceac734d94c2eafee8bd23b046b2f616be3a16990ee7b26d237db2fe491c9540b84c2a6

C:\Users\Admin\AppData\Local\Temp\_MEI47762\portmidi.dll

MD5 0df0699727e9d2179f7fd85a61c58bdf
SHA1 82397ee85472c355725955257c0da207fa19bf59
SHA256 97a53e8de3f1b2512f0295b5de98fa7a23023a0e4c4008ae534acdba54110c61
SHA512 196e41a34a60de83cb24caa5fc95820fd36371719487350bc2768354edf39eeb6c7860ff3fd9ecf570abb4288523d7ab934e86e85202b9753b135d07180678cd

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libwebp-7.dll

MD5 b0dd211ec05b441767ea7f65a6f87235
SHA1 280f45a676c40bd85ed5541ceb4bafc94d7895f3
SHA256 fc06b8f92e86b848a17eaf7ed93464f54ed1f129a869868a74a75105ff8ce56e
SHA512 eaeb83e46c8ca261e79b3432ec2199f163c44f180eb483d66a71ad530ba488eb4cdbd911633e34696a4ccc035e238bc250a8247f318aa2f0cd9759cad4f90fff

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libtiff-5.dll

MD5 ebad1fa14342d14a6b30e01ebc6d23c1
SHA1 9c4718e98e90f176c57648fa4ed5476f438b80a7
SHA256 4f50820827ac76042752809479c357063fe5653188654a6ba4df639da2fbf3ca
SHA512 91872eaa1f3f45232ab2d753585e650ded24c6cc8cc1d2a476fa98a61210177bd83570c52594b5ad562fc27cb76e034122f16a922c6910e4ed486da1d3c45c24

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libssl-1_1.dll

MD5 bbc7d150cd0458ee620a4de481579f5e
SHA1 8392e442ed1213d210be8176ff84670104215725
SHA256 b222ee42f103f20e5e4e74d5f5db39de894602cea05a904661b4c31ed0a39361
SHA512 c70490a0d545cceb5579fe31b48508220fe1bc2bad2daf47c2ef04a619fb7da3a7f0d4ace83c93d1b78998413ef57acbeaea774f62ba1272c759e4f53e4644dd

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libpng16-16.dll

MD5 55009dd953f500022c102cfb3f6a8a6c
SHA1 07af9f4d456ddf86a51da1e4e4c5b54b0cf06ddb
SHA256 20391787cba331cfbe32fbf22f328a0fd48924e944e80de20ba32886bf4b6fd2
SHA512 4423d3ec8fef29782f3d4a21feeac9ba24c9c765d770b2920d47b4fb847a96ff5c793b20373833b4ff8bc3d8fa422159c64beffb78ce5768ed22742740a8c6c6

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libopusfile-0.dll

MD5 2d5274bea7ef82f6158716d392b1be52
SHA1 ce2ff6e211450352eec7417a195b74fbd736eb24
SHA256 6dea07c27c0cc5763347357e10c3b17af318268f0f17c7b165325ce524a0e8d5
SHA512 9973d68b23396b3aa09d2079d18f2c463e807c9c1fdf4b1a5f29d561e8d5e62153e0c7be23b63975ad179b9599ff6b0cf08ebdbe843d194483e7ec3e7aeb232a

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libopus-0.x64.dll

MD5 e56f1b8c782d39fd19b5c9ade735b51b
SHA1 3d1dc7e70a655ba9058958a17efabe76953a00b4
SHA256 fa8715dd0df84fdedbe4aa17763b2ab0db8941fa33421b6d42e25e59c4ae8732
SHA512 b7702e48b20a8991a5c537f5ba22834de8bb4ba55862b75024eace299263963b953606ee29e64d68b438bb0904273c4c20e71f22ccef3f93552c36fb2d1b2c46

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libopus-0.dll

MD5 3fb9d9e8daa2326aad43a5fc5ddab689
SHA1 55523c665414233863356d14452146a760747165
SHA256 fd8de9169ccf53c5968eec0c90e9ff3a66fb451a5bf063868f3e82007106b491
SHA512 f263ea6e0fab84a65fe3a9b6c0fe860919eee828c84b888a5aa52dea540434248d1e810a883a2aff273cd9f22c607db966dd8776e965be6d2cfe1b50a1af1f57

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libogg-0.dll

MD5 0d65168162287df89af79bb9be79f65b
SHA1 3e5af700b8c3e1a558105284ecd21b73b765a6dc
SHA256 2ec2322aec756b795c2e614dab467ef02c3d67d527ad117f905b3ab0968ccf24
SHA512 69af81fd2293c31f456b3c78588bb6a372fe4a449244d74bfe5bfaa3134a0709a685725fa05055cfd261c51a96df4b7ebd8b9e143f0e9312c374e54392f8a2c2

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libmodplug-1.dll

MD5 2bb2e7fa60884113f23dcb4fd266c4a6
SHA1 36bbd1e8f7ee1747c7007a3c297d429500183d73
SHA256 9319bf867ed6007f3c61da139c2ab8b74a4cb68bf56265a101e79396941f6d3b
SHA512 1ddd4b9b9238c1744e0a1fe403f136a1def8df94814b405e7b01dd871b3f22a2afe819a26e08752142f127c3efe4ebae8bfd1bd63563d5eb98b4644426f576b2

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libjpeg-9.dll

MD5 c22b781bb21bffbea478b76ad6ed1a28
SHA1 66cc6495ba5e531b0fe22731875250c720262db1
SHA256 1eed2385030348c84bbdb75d41d64891be910c27fab8d20fc9e85485fcb569dd
SHA512 9b42cad4a715680a27cd79f466fd2913649b80657ff042528cba2946631387ed9fb027014d215e1baf05839509ca5915d533b91aa958ae0525dea6e2a869b9e4

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libcrypto-1_1.dll

MD5 3ba3ec8c8e092360c72b93c4bdf3d655
SHA1 aff2407b6aa96effd1e15f2f724616a0f2a8811d
SHA256 8d671bc3f80a0ffe684943f4f650fe52db35a9da81f81a1354c31c5d092349b7
SHA512 44eb07fcc8f6faa122bdca482c5b80b2f578761f2d4162ccfb5d42cc772fa5dd2183babd736275bb172703cd544e1f1114518790f63dd7af8893711eb64f2d83

C:\Users\Admin\AppData\Local\Temp\_MEI47762\freetype.dll

MD5 04a9825dc286549ee3fa29e2b06ca944
SHA1 5bed779bf591752bb7aa9428189ec7f3c1137461
SHA256 50249f68b4faf85e7cd8d1220b7626a86bc507af9ae400d08c8e365f9ab97cde
SHA512 0e937e4de6cbc9d40035b94c289c2798c77c44fc1dc7097201f9fab97c7ff9e56113c06c51693f09908283eda92945b36de67351f893d4e3162e67c078cff4ec

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_lzma.pyd

MD5 e30e634444d71b9d1bc34561657de32b
SHA1 884dbc28f0310c1094b467fba6b1228db434ca44
SHA256 39aa633d1d1219b900233781f91a6fa27a6038a34e84950424fa080020519363
SHA512 fadea5015bbb5ccd7ad12a6ea39e16bb5666cba537811ec1d93b363b867d070c49bdcd41cd0110287b2150354cbd317c217fab950a231c428f91442606863baf

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_lzma.pyd

MD5 e30e634444d71b9d1bc34561657de32b
SHA1 884dbc28f0310c1094b467fba6b1228db434ca44
SHA256 39aa633d1d1219b900233781f91a6fa27a6038a34e84950424fa080020519363
SHA512 fadea5015bbb5ccd7ad12a6ea39e16bb5666cba537811ec1d93b363b867d070c49bdcd41cd0110287b2150354cbd317c217fab950a231c428f91442606863baf

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_bz2.pyd

MD5 d00b46d95b4dae50bf4cb46f6a6d119f
SHA1 6029f48e3f771c9ce7470595fde08847aa7d2906
SHA256 b5e9c0d4b1b4482767296bea9d033c88d9d8a11d26da9ec787e761980d186727
SHA512 6d2f78c21c05b446ebea93b65085b119de9a0d5d2b75edd15b4a291c27045a903ad6c27ac869c6234e54bba677dfc6187d8d48d79e38e7e9d450474714994b84

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libffi-7.dll

MD5 36b9af930baedaf9100630b96f241c6c
SHA1 b1d8416250717ed6b928b4632f2259492a1d64a4
SHA256 d2159e1d1c9853558b192c75d64033e09e7de2da2b3f1bf26745124ed33fbf86
SHA512 5984b32a63a4440a13ebd2f5ca0b22f1391e63ac15fe67a94d4a579d58b8bb0628980a2be484ac65ad3a215bbe44bd14fe33ec7b3581c6ab521f530395847dd5

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libffi-7.dll

MD5 36b9af930baedaf9100630b96f241c6c
SHA1 b1d8416250717ed6b928b4632f2259492a1d64a4
SHA256 d2159e1d1c9853558b192c75d64033e09e7de2da2b3f1bf26745124ed33fbf86
SHA512 5984b32a63a4440a13ebd2f5ca0b22f1391e63ac15fe67a94d4a579d58b8bb0628980a2be484ac65ad3a215bbe44bd14fe33ec7b3581c6ab521f530395847dd5

C:\Users\Admin\AppData\Local\Temp\_MEI47762\python3.dll

MD5 eb0a803cf72653c78fe900551f961da4
SHA1 d76cb52625e9cf88c588c34ba1759d8987acc8e7
SHA256 e9e4a9b271b692c331dc091825ac1ff51b01cd159f2e5c2553756c79ff272fa2
SHA512 2d77a84fe905d969f1789764a4138f6c461bff44bc264bf1883883cacec35d6e98abce1129312119eb2f8aca2ad6a899e6956c7287ae5b83430cea3f5e845697

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_socket.pyd

MD5 d7f0bded489264edb3a877cd99bd5f11
SHA1 83791fd65047f1d6010d0ebb2cdcf1c0e499476d
SHA256 bd43669e424487a957b1ba8b8cbddc13eea965c043cecfa7a3bddbbcb4ccc7f4
SHA512 038400b4e4f03e691f9fd8c54c400809891f56806556196ca77ac30d441ecc49092abd6f59c357130963b5b9431984ae5434a24bc4dea62a42205717e0da761d

memory/2012-1323-0x00007FFE6E4D0000-0x00007FFE6E4E9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_ssl.pyd

MD5 46d8633523010ec4d661f6e936b1de83
SHA1 b5e2e1b6216a47bf1985045681b9e0606a751817
SHA256 117a81f953b19704d1fdc9652b27d1869971612a69a839de0fbd3fef04809af9
SHA512 bf53749c63fa21ae106fb346b8251e3a4ace606f3f94c3f7a868f2aebd6a1d4bc0cf24cfdcbcd7258b78eb43000ddcf0eaab55d71f75eaef0ea2983adc1d4a86

memory/2012-1328-0x00007FFE6E140000-0x00007FFE6E16D000-memory.dmp

memory/2012-1327-0x00007FFE72630000-0x00007FFE7263D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI47762\_queue.pyd

MD5 b10fea035f77acbec0e5a946548b3539
SHA1 ff6d9a7044b7637797f9528f1587337531d35c35
SHA256 532a453decbb3b2fed31e9067a35f61cf771ff857966a228f44314b91716a533
SHA512 1539b119a3ab5de5b2dd0a26be2c82fc982a89a2d5ecd84faf2c57b9c7a8aced6e69796255b74e178963854179ca9aabbbd18ba5e3a5519eb4152e9890194d7f

C:\Users\Admin\AppData\Local\Temp\_MEI47762\charset_normalizer\md__mypyc.cp39-win_amd64.pyd

MD5 59e3e8ede02d1f8d65c5bc3aa2385135
SHA1 b6cbdbc5fd4d39ebb40c25c419878792f88c68f9
SHA256 50739ece7b483a214f1e332a4b64e3e7898ef08d15e557420f84ba751ed5d408
SHA512 0d908e12539a530a2b31590a57baa3305bbb7f32a37c58d4c5afebbab477ad441c300fb9b6de3bcf08d4ce8897e4d25d47d9ff418446b9aa275d90af16f66dcb

memory/2012-1335-0x00007FFE6E690000-0x00007FFE6E69B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI47762\charset_normalizer\md__mypyc.cp39-win_amd64.pyd

MD5 59e3e8ede02d1f8d65c5bc3aa2385135
SHA1 b6cbdbc5fd4d39ebb40c25c419878792f88c68f9
SHA256 50739ece7b483a214f1e332a4b64e3e7898ef08d15e557420f84ba751ed5d408
SHA512 0d908e12539a530a2b31590a57baa3305bbb7f32a37c58d4c5afebbab477ad441c300fb9b6de3bcf08d4ce8897e4d25d47d9ff418446b9aa275d90af16f66dcb

C:\Users\Admin\AppData\Local\Temp\_MEI47762\charset_normalizer\md.cp39-win_amd64.pyd

MD5 971c92ffa8660d0302fa20e6668baa1c
SHA1 286e0cb37032dd2216167ed273cfe2e692abba3c
SHA256 a9d312bd0e2dc3f94aa9dd8067c85ef59c1308a4895c426df977a2da3a749a01
SHA512 3a79c9a83408c4b166d0865d00ba37dba4b85a844808094e5e032bde0d07846e7ecc69e26ca090c384480f07922c167109e67d644c88c9a632c7416b3733004e

C:\Users\Admin\AppData\Local\Temp\_MEI47762\charset_normalizer\md.cp39-win_amd64.pyd

MD5 971c92ffa8660d0302fa20e6668baa1c
SHA1 286e0cb37032dd2216167ed273cfe2e692abba3c
SHA256 a9d312bd0e2dc3f94aa9dd8067c85ef59c1308a4895c426df977a2da3a749a01
SHA512 3a79c9a83408c4b166d0865d00ba37dba4b85a844808094e5e032bde0d07846e7ecc69e26ca090c384480f07922c167109e67d644c88c9a632c7416b3733004e

C:\Users\Admin\AppData\Local\Temp\_MEI47762\libssl-1_1.dll

MD5 bbc7d150cd0458ee620a4de481579f5e
SHA1 8392e442ed1213d210be8176ff84670104215725
SHA256 b222ee42f103f20e5e4e74d5f5db39de894602cea05a904661b4c31ed0a39361
SHA512 c70490a0d545cceb5579fe31b48508220fe1bc2bad2daf47c2ef04a619fb7da3a7f0d4ace83c93d1b78998413ef57acbeaea774f62ba1272c759e4f53e4644dd

C:\Users\Admin\AppData\Local\Temp\_MEI47762\select.pyd

MD5 d78851bda853adfe99105c299bbc7e54
SHA1 dc041c49bd77d832496838659a43f8595e74467a
SHA256 44cb82b626a3e071ef3ab498e7523b749cb8e11db872971224d737157fc857d6
SHA512 54a0492fdfd08e5be90655c359eff735732f9ee4525963f51e956917ce0f4623c3aee401eedcb73ede9aa7616fa0554233a05d0c8f1b05b44f579758f22444b5

memory/2012-1336-0x00007FFE6DFB0000-0x00007FFE6DFD6000-memory.dmp

memory/2012-1334-0x00007FFE6DFE0000-0x00007FFE6E096000-memory.dmp

memory/2012-1337-0x00007FFE5EE00000-0x00007FFE5EF18000-memory.dmp

memory/2012-1338-0x00007FFE6E720000-0x00007FFE6E72D000-memory.dmp

memory/2012-1339-0x00007FFE6DBA0000-0x00007FFE6DBD8000-memory.dmp

memory/2012-1340-0x00007FFE6E4C0000-0x00007FFE6E4CB000-memory.dmp

memory/2012-1341-0x00007FFE6E4B0000-0x00007FFE6E4BC000-memory.dmp

memory/2012-1342-0x00007FFE6E350000-0x00007FFE6E35B000-memory.dmp

memory/2012-1343-0x00007FFE6E340000-0x00007FFE6E34C000-memory.dmp

memory/2012-1344-0x00007FFE6E130000-0x00007FFE6E13B000-memory.dmp

memory/2012-1345-0x00007FFE6DFA0000-0x00007FFE6DFAC000-memory.dmp

memory/2012-1346-0x00007FFE6DB80000-0x00007FFE6DB8E000-memory.dmp

memory/2012-1347-0x00007FFE6DB70000-0x00007FFE6DB7C000-memory.dmp

memory/2012-1348-0x00007FFE6DB50000-0x00007FFE6DB5B000-memory.dmp

memory/2012-1349-0x00007FFE6DB40000-0x00007FFE6DB4B000-memory.dmp

memory/2012-1351-0x00007FFE6DB20000-0x00007FFE6DB2C000-memory.dmp

memory/2012-1350-0x00007FFE6DB30000-0x00007FFE6DB3C000-memory.dmp

memory/2012-1352-0x00007FFE6DB10000-0x00007FFE6DB1D000-memory.dmp

memory/2012-1353-0x00007FFE6DAF0000-0x00007FFE6DB02000-memory.dmp

memory/2012-1354-0x00007FFE6A280000-0x00007FFE6A296000-memory.dmp

memory/2012-1356-0x00007FFE6A240000-0x00007FFE6A254000-memory.dmp

memory/2012-1355-0x00007FFE6A260000-0x00007FFE6A271000-memory.dmp

memory/2012-1357-0x00007FFE69F60000-0x00007FFE69F78000-memory.dmp

memory/2012-1358-0x00007FFE693E0000-0x00007FFE69429000-memory.dmp

memory/2012-1359-0x00007FFE69210000-0x00007FFE69221000-memory.dmp

memory/2012-1360-0x00007FFE6D730000-0x00007FFE6D73C000-memory.dmp

memory/2012-1361-0x00007FFE68DB0000-0x00007FFE68DCD000-memory.dmp

memory/2012-1362-0x00007FFE6E630000-0x00007FFE6E63B000-memory.dmp

memory/2012-1363-0x00007FFE6DB90000-0x00007FFE6DB9D000-memory.dmp

memory/2012-1364-0x00007FFE6DB60000-0x00007FFE6DB6C000-memory.dmp

memory/2012-1365-0x00007FFE6D8C0000-0x00007FFE6D8CC000-memory.dmp

memory/2012-1366-0x00007FFE6A210000-0x00007FFE6A232000-memory.dmp

memory/2012-1367-0x00007FFE69F80000-0x00007FFE69F97000-memory.dmp

memory/2012-1368-0x00007FFE68DD0000-0x00007FFE68DEC000-memory.dmp

memory/2012-1370-0x00007FFE64B30000-0x00007FFE64B59000-memory.dmp

memory/2012-1369-0x00007FFE5F5E0000-0x00007FFE5F63D000-memory.dmp

memory/2012-1371-0x00007FFE5F5B0000-0x00007FFE5F5DE000-memory.dmp

memory/2012-1372-0x00007FFE5DB80000-0x00007FFE5DCF9000-memory.dmp

memory/2012-1373-0x00007FFE68AD0000-0x00007FFE68ADC000-memory.dmp

memory/2012-1374-0x00007FFE672E0000-0x00007FFE672EB000-memory.dmp

memory/2012-1375-0x00007FFE649D0000-0x00007FFE649DC000-memory.dmp

memory/2012-1376-0x00007FFE5F3E0000-0x00007FFE5F3EB000-memory.dmp

memory/2012-1377-0x00007FFE5F3D0000-0x00007FFE5F3DC000-memory.dmp

memory/2012-1378-0x00007FFE5F3C0000-0x00007FFE5F3CD000-memory.dmp

memory/2012-1379-0x00007FFE5EDE0000-0x00007FFE5EDEC000-memory.dmp

memory/2012-1380-0x00007FFE5EDD0000-0x00007FFE5EDDC000-memory.dmp

memory/2012-1383-0x00007FFE5EDC0000-0x00007FFE5EDCB000-memory.dmp

memory/2012-1384-0x00007FFE5EDB0000-0x00007FFE5EDBB000-memory.dmp

memory/2012-1386-0x00007FFE5ED90000-0x00007FFE5ED9C000-memory.dmp

memory/2012-1387-0x00007FFE5ED80000-0x00007FFE5ED8D000-memory.dmp

memory/2012-1385-0x00007FFE5EDA0000-0x00007FFE5EDAC000-memory.dmp

memory/2012-1388-0x00007FFE5ED60000-0x00007FFE5ED72000-memory.dmp

memory/2012-1389-0x00007FFE5ED50000-0x00007FFE5ED5C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3vuqwzog.i1a.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2012-1516-0x00007FFE5DD00000-0x00007FFE5E17F000-memory.dmp

memory/2012-1517-0x00007FFE6E760000-0x00007FFE6E785000-memory.dmp

memory/2012-1522-0x00007FFE6DBE0000-0x00007FFE6DF4C000-memory.dmp

memory/2012-1525-0x00007FFE6E140000-0x00007FFE6E16D000-memory.dmp

memory/2012-1526-0x00007FFE6DFE0000-0x00007FFE6E096000-memory.dmp

memory/2012-1527-0x00007FFE6E720000-0x00007FFE6E72D000-memory.dmp

memory/2012-1550-0x00007FFE6A280000-0x00007FFE6A296000-memory.dmp

memory/2012-1551-0x00007FFE6A260000-0x00007FFE6A271000-memory.dmp

memory/2012-1553-0x00007FFE6A210000-0x00007FFE6A232000-memory.dmp

memory/2012-1554-0x00007FFE69F80000-0x00007FFE69F97000-memory.dmp

memory/2012-1555-0x00007FFE69F60000-0x00007FFE69F78000-memory.dmp

memory/2012-1556-0x00007FFE693E0000-0x00007FFE69429000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-01 12:49

Reported

2023-12-01 12:55

Platform

win7-20231023-en

Max time kernel

121s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe

"C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe"

C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe

"C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI30362\setuptools-49.2.1.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

C:\Users\Admin\AppData\Local\Temp\_MEI30362\python39.dll

MD5 2dcee515eef346a7c77d2e6d37e6d761
SHA1 9daecbcbb7d599ad5167dfa21c719b3eb72f9c3c
SHA256 610a12bccc3545376ae42ee74be12d5481ab35ec7cca01cb02a8e95e2793a2e5
SHA512 d9d89b9a83312f53db69d351054a226146135200eb88e9e69227a953d844cb26af9546baf54da83aa744c91304ba1c8ba077b78096a0a4ac12cce1ee6b8ba6f2

\Users\Admin\AppData\Local\Temp\_MEI30362\python39.dll

MD5 2dcee515eef346a7c77d2e6d37e6d761
SHA1 9daecbcbb7d599ad5167dfa21c719b3eb72f9c3c
SHA256 610a12bccc3545376ae42ee74be12d5481ab35ec7cca01cb02a8e95e2793a2e5
SHA512 d9d89b9a83312f53db69d351054a226146135200eb88e9e69227a953d844cb26af9546baf54da83aa744c91304ba1c8ba077b78096a0a4ac12cce1ee6b8ba6f2

memory/2364-1262-0x000007FEF5C20000-0x000007FEF609F000-memory.dmp

memory/2364-1263-0x000007FEF5C20000-0x000007FEF609F000-memory.dmp