Analysis

  • max time kernel
    256s
  • max time network
    261s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-03-2024 20:09

General

  • Target

    TeddyPcFiles/Teddy PC (main).exe

  • Size

    15.4MB

  • MD5

    31183e0d16f4c66a59e6989212ade4e0

  • SHA1

    c8ba290a15f9086b55504083c96a4f4391ec22f8

  • SHA256

    1e440b158dc8162de4704d5985c4c15000df2e2b703dfeaec22fbe6bf7a59b73

  • SHA512

    237a70a53ca0f8c9cf51e755355210220fd04d0f621e331eab4530d897edd18de699488907ff01ce2836ad1c22253323b2a5146b511196f9c6e60ea9676c6a55

  • SSDEEP

    196608:Mq9XaO93xXh04A1HeT39IigwIc0/ajaA0W8/LV2ck3FEpXSOq33NUqfEx:8eXh0h1+TtIiFU/MaHW8p2ypfg62Ex

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\Teddy PC (main).exe
    "C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\Teddy PC (main).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3520
    • C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\Teddy PC (main).exe
      "C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\Teddy PC (main).exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3496
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:3504
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/api/redirect?clientId=3446cd72694c4a4485d81b77adbb2141&responseType=code
          3⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4308
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8bd8546f8,0x7ff8bd854708,0x7ff8bd854718
            4⤵
              PID:4348
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
              4⤵
                PID:2536
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3504
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
                4⤵
                  PID:1708
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
                  4⤵
                    PID:4120
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
                    4⤵
                      PID:3644
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
                      4⤵
                        PID:1564
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4612
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5532 /prefetch:8
                        4⤵
                          PID:5044
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
                          4⤵
                            PID:3796
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
                            4⤵
                              PID:3652
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
                              4⤵
                                PID:3208
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
                                4⤵
                                  PID:4232
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4712 /prefetch:2
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2740
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3968
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:3648

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                1eb86108cb8f5a956fdf48efbd5d06fe

                                SHA1

                                7b2b299f753798e4891df2d9cbf30f94b39ef924

                                SHA256

                                1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

                                SHA512

                                e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                f35bb0615bb9816f562b83304e456294

                                SHA1

                                1049e2bd3e1bbb4cea572467d7c4a96648659cb4

                                SHA256

                                05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

                                SHA512

                                db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                185B

                                MD5

                                fa88c3bfda3b1796f85a6a584c6d1aa7

                                SHA1

                                84d491531661b24cf143c3ec93cadcd5577c3424

                                SHA256

                                9868ffd2c601b0c0c34326e353e44641cb4ef25177773db6c1d9a576551ad74d

                                SHA512

                                4d32859e058d66d523fe873dfa5a60aa1566211758ac62e74ceb6afeb177d9444566bbb57886cd82f062f934b43619ca132f3ad1b306f7a9eb0800e6d949c78a

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                06658efaa7787ef5d39071900ec62af0

                                SHA1

                                62f1179862c112200070b2994575647cda8fc08c

                                SHA256

                                ac8be622d7352d8c481180e7e108950c1c6b8c2121617d881e86241663ee8aef

                                SHA512

                                13d22ec5abeb93fec68257516b439b73f7396ea3ac12cb5fd9cc8496ad1ade58051614ac2732a0053701f8a60b9918059312e743e189f65b93117dd999273826

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                5d99d55c909619af751806e48233a265

                                SHA1

                                c76056128350f20a7a55f105b0be476546b01141

                                SHA256

                                bbd7ff226f2f5bb8e9b542522d07c61404de1c308a90f9ea4050a888d44555b7

                                SHA512

                                fdc3278b942425a3a21191fd78427c20a424776a8eb6515f054a50e2126b4bb6a59f3d946020c1681d309ebead293fa9b226e6807c6854054f2b9a307ceadf30

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                11KB

                                MD5

                                e71b0023cb018c1334d69f8722071e15

                                SHA1

                                2847c27a3e021c6c4b7af2e0e2ce9607a7689334

                                SHA256

                                9b3629c248fc80ea947fa19d366a9a005a858afd0e6b0da49893dd5b606e3107

                                SHA512

                                49a2ba4291ede09cdcc135515ff4582b16ebf0fe53e25d35d7c3775a60de9be3cbe8259adec8be07e62a1abd40f8520ff686572a929c3d93425ee898a58f34f2

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                11KB

                                MD5

                                339e4b50a34301683a40afd297101a26

                                SHA1

                                66050ca72ec07b7470cbe7c9b453a46e19ad7a5c

                                SHA256

                                1d64ab3304ea927979aea9e38dadb74e5f51e62bde10ea87c2d4551bcb4e4ccf

                                SHA512

                                5063dd00c50480a0b53d263d3285ea48aa1b94cd9e654a56d771d0b64ccb9a1dd5cb4f77b9e45d4e185cd1fe1109dbb7baca803d6d2e17dec5d361443901a447

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\CopyAuthCodeImage.png

                                Filesize

                                13KB

                                MD5

                                8013d237df05fd4e4c56a2735b666464

                                SHA1

                                f48c1b06aedf324c14b98935461f3cf1d5cdb5ab

                                SHA256

                                61199bfa141342ece07c99b1bd37484f569c0952672816fa8ebfcb34fd209898

                                SHA512

                                e783c88c7a1082ef975222db6e7ec49009e311297ccc2e66895420447d10b2b9c331cee1f308ec37b6db9eab842982fd75d76f1530ced9d5c81e7a38cad708b8

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\PIL\_imaging.cp311-win_amd64.pyd

                                Filesize

                                796KB

                                MD5

                                d218b7dc4c1879a98e2cc1d40a1efcc0

                                SHA1

                                cbc1d7135e8acb0b6afa6e2be0ac8fbc22ab8903

                                SHA256

                                00621235f2a05b7d11b966eeb0c2e6284891b38a635c543d97c9d4dda71295f5

                                SHA512

                                37aefbf2d611c228b201d89c13f213f290f4a40a15133c5ce4ff09a74c44c2f2c32abc3783029a90b5dd8af544b9d94dde97857d160307c86a9c77a3a2f7d291

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\PIL\_imaging.cp311-win_amd64.pyd

                                Filesize

                                750KB

                                MD5

                                0ed8efdbb9d2747f12118f041ce15d28

                                SHA1

                                b63b12c8da1bc76f61ae669047fa0b937bf3ae5c

                                SHA256

                                10170e6e0bd1fccda5047d9f509b708d5add7ac4d5767ca161cf1478d3bca616

                                SHA512

                                c51c7ad17f961a16ae6c4b501e81d5bfe00d6c9118d9f31b0e44d0ac33c0db36ec795d2ac47f5817d5961b3fe4a19b4dcbe0053465db7d04b9a02a984247d874

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\TeddyLauncherIcon.ico

                                Filesize

                                158KB

                                MD5

                                3151f5be4d073c7a25f5c492a4b99874

                                SHA1

                                6bb05a280ae97e5e4e6f5eb96c94c2f9fa61ecb4

                                SHA256

                                db6a580afeb112af6abc4091f8cdb2f4275fb6fde5f02549ff3771db2d78c4b0

                                SHA512

                                3d3d0274dc31399f6048aa3c211bb94c6a703cca808b01efbd621d5d3490db9acb80a19d6e56b273f422760c434bc4ae904355137904ee202d2cf164616b31da

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\VCRUNTIME140.dll

                                Filesize

                                116KB

                                MD5

                                be8dbe2dc77ebe7f88f910c61aec691a

                                SHA1

                                a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                SHA256

                                4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                SHA512

                                0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\_asyncio.pyd

                                Filesize

                                63KB

                                MD5

                                41806866d74e5edce05edc0ad47752b9

                                SHA1

                                c3d603c029fdac45bac37bb2f449fab86b8845dd

                                SHA256

                                76db93bd64cb4a36edb37694456f89bb588db98cf2733eb436f000b309eec3b2

                                SHA512

                                2a019efaf3315b8b98be93ac4bea15cec8b9ecc6eab298fa93d3947bad2422b5a126d52cb4998363bdc82641fba9b8f42d589afe52d02914e55a5a6116989fde

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\_bz2.pyd

                                Filesize

                                82KB

                                MD5

                                37eace4b806b32f829de08db3803b707

                                SHA1

                                8a4e2bb2d04685856d1de95b00f3ffc6ea1e76b9

                                SHA256

                                1be51ef2b5acbe490217aa1ff12618d24b95df6136c6844714b9ca997b4c7f9b

                                SHA512

                                1591a263de16373ee84594943a0993721b1e1a2f56140d348a646347a8e9760930df4f632adcee9c9870f9c20d7818a3a8c61b956723bf94777e0b7fb7689b2d

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\_ctypes.pyd

                                Filesize

                                121KB

                                MD5

                                a25cdcf630c024047a47a53728dc87cd

                                SHA1

                                8555ae488e0226a272fd7db9f9bdbb7853e61a21

                                SHA256

                                3d43869a4507ed8ece285ae85782d83bb16328cf636170acb895c227ebb142ac

                                SHA512

                                f6a4272deddc5c5c033a06e80941a16f688e28179eab3dbc4f7a9085ea4ad6998b89fc9ac501c5bf6fea87e0ba1d9f2eda819ad183b6fa7b6ddf1e91366c12af

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\_decimal.pyd

                                Filesize

                                247KB

                                MD5

                                e4e032221aca4033f9d730f19dc3b21a

                                SHA1

                                584a3b4bc26a323ce268a64aad90c746731f9a48

                                SHA256

                                23bdd07b84d2dbcb077624d6dcbfc66ab13a9ef5f9eebe31dc0ffece21b9e50c

                                SHA512

                                4a350ba9e8481b66e7047c9e6c68e6729f8074a29ef803ed8452c04d6d61f8f70300d5788c4c3164b0c8fb63e7c9715236c0952c3166b606e1c7d7fff36b7c4c

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\_hashlib.pyd

                                Filesize

                                63KB

                                MD5

                                ba682dfcdd600a4bb43a51a0d696a64c

                                SHA1

                                df85ad909e9641f8fcaa0f8f5622c88d904e9e20

                                SHA256

                                2ad55e11bddb5b65cdf6e9e126d82a3b64551f7ad9d4cbf74a1058fd7e5993bd

                                SHA512

                                79c607e58881d3c3dfb83886fe7aa4cddb5221c50499d33fe21e1efb0ffa1fd0d3f52cbe97b16b04fbe2b067d6eb5997ac66dec9d2a160d3cb6d44ffca0f5636

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\_lzma.pyd

                                Filesize

                                155KB

                                MD5

                                3273720ddf2c5b75b072a1fb13476751

                                SHA1

                                5fe0a4f98e471eb801a57b8c987f0feb1781ca8b

                                SHA256

                                663f1087c2ed664c5995a3ffa64546d2e33a0fce8a9121b48cc7c056b74a2948

                                SHA512

                                919dbbfcc2f5913655d77f6c4ae9baa3a300153a5821dc9f23e0aceb89f69cb9fb86d6ce8f367b9301e0f7b6027e6b2f0911a2e73255ab5150a74b862f8af18e

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\_multiprocessing.pyd

                                Filesize

                                33KB

                                MD5

                                758128e09779a4baa28e68a8b9ee2476

                                SHA1

                                4e81c682cf18e2a4b46e50f037799c43c6075f11

                                SHA256

                                3c5b0823e30810aee47fdfad567491bc33dd640c37e35c8600e75c5a8d05ce2a

                                SHA512

                                5096f0daacf72012a7ad08b177c366b4fe1ded3a18aebfe438820b79c7cb735350ef831a7fb7d10482eefd4c0b8a41511042bb41f4507bbc0332c52df9288088

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\_overlapped.pyd

                                Filesize

                                50KB

                                MD5

                                e2a301b3fd3bdfec3bf6ca006189b2ac

                                SHA1

                                86b29ee1a42de70135a6786cdce69987f1f61193

                                SHA256

                                4990f62e11c0a5ab15a9ffce9d054f06d0bc9213aea0c2a414a54fa01a5eb6dc

                                SHA512

                                4e5493cc4061be923b253164fd785685d5eccf16fd3acb246b9d840f6f7d9ed53555f53725af7956157d89eaa248a3505c30bd88c26e04aabdae62e4774ffa4e

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\_queue.pyd

                                Filesize

                                31KB

                                MD5

                                284fbc1b32f0282fc968045b922a4ee2

                                SHA1

                                7ccea7a48084f2c8463ba30ddae8af771538ae82

                                SHA256

                                ac3b144d7d7c8ee39f29d8749c5a35c4314b5365198821605c883fd11807e766

                                SHA512

                                baa75f7553cf595ad78c84cbb0f2a50917c93596ece1ff6221e64272adc6facdd8376e00918c6c3246451211d9dfc66442d31759bd52c26985c7f133cf011065

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\_socket.pyd

                                Filesize

                                77KB

                                MD5

                                485d998a2de412206f04fa028fe6ba90

                                SHA1

                                286e29d4f91a46171ba1e3c8229e6de94b499f1d

                                SHA256

                                8f9ede5044643413c3b072cd31a565956498ca07cdd17fb6a04483d388fdad76

                                SHA512

                                68591522e9188f06ff81cd2b3506b40b9ad508d6e34f0111819bf5eff47ed9adf95ebfae5d05b685c4f53b186d15cc45e0d831d96be926f7a5762ee2f1341f1f

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\_ssl.pyd

                                Filesize

                                172KB

                                MD5

                                e5b1a076e9828985ea8ea07d22c6abd0

                                SHA1

                                2a2827938a490cd847ea4e67e945deb4eef8cbb1

                                SHA256

                                591589dadc659d1ad4856d16cd25dc8e57eaa085bf68eb2929f8f93aba69db1b

                                SHA512

                                0afd20f581efb08a7943a1984e469f1587c96252e44b3a05ca3dfb6c7b8b9d1b9fd609e03a292de6ec63b6373aeacc822e30d550b2f2d35bf7bf8dd6fc11f54f

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\_tkinter.pyd

                                Filesize

                                62KB

                                MD5

                                b9433c77e6b04532ac587056d21947c2

                                SHA1

                                0bcbf7b0ae1c3b815788b62879384217d9744abf

                                SHA256

                                a3488d90b5493dd0af5054750194cdeafbf05db42e881c78d92449932565308d

                                SHA512

                                a0fcbf898038f2337db8b2aa5873e3fd8970f5f7d01725e9a20be091985495feab01d7dc7b8a6b7ab898d2875566029fd3d217883a1301bf67f8c4288bb29b4f

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\_uuid.pyd

                                Filesize

                                24KB

                                MD5

                                b21b864e357ccd72f35f2814bd1e6012

                                SHA1

                                2ff0740c26137c6a81b96099c1f5209db33ac56a

                                SHA256

                                ce9e2a30c20e6b83446d9ba83bb83c5570e1b1da0e87ff467d1b4fc090da6c53

                                SHA512

                                29667eb0e070063ef28b7f8cc39225136065340ae358ad0136802770b2f48ac4bda5e60f2e2083f588859b7429b9ea3bad1596a380601e3b2b4bb74791df92a3

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\aiohttp\_helpers.cp311-win_amd64.pyd

                                Filesize

                                53KB

                                MD5

                                e3d1b83909f6f1eee896ac57bb24bbdf

                                SHA1

                                20992879399bee44184240d5091172882da1019e

                                SHA256

                                c0dafa83e6cb70a399028ce9d1f20931a597e11a8854e2fddb1fd90129d6da55

                                SHA512

                                b4ae7f50f14795edfb355ed1fdfdf4902283b0b354d801bf440ca47e4ae55a8f990392c1f515e55b145ee414c8522382b67a5b7da0630b232fffa88f89cef033

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\aiohttp\_http_parser.cp311-win_amd64.pyd

                                Filesize

                                249KB

                                MD5

                                5b1b2e84229d6156b45ac9c2f3a8e779

                                SHA1

                                02101e65d75b6b74251632cb1d854da7da813955

                                SHA256

                                ba8405808a14825cbc4c41968e21dae0bdfff7adcc30407c24de45dbdb6c124a

                                SHA512

                                ed8a8f8cd54c0f2096c985e6648b82664c1eca8153f59b2971700350576458536f29ac94f5c2848e661d08eacd10809376adc7b0e4b15c86becaa342b21bffa2

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\aiohttp\_http_parser.cp311-win_amd64.pyd

                                Filesize

                                195KB

                                MD5

                                dc3fa55903a323b0d879867bfb33748b

                                SHA1

                                922b708b3968055132915c4b267b4eb2777ddf27

                                SHA256

                                21e63e841890417eb1b64fc7e0927c9e36eb8baf2dd3212fe764590a1fcd40d4

                                SHA512

                                93923f87550f9823594b118520a00f15bf325a02157b3541e25c8db15956b4b12af8c05034267ef817221827a287bb126245147c53d10b3c2789c40aa0576d64

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\aiohttp\_http_writer.cp311-win_amd64.pyd

                                Filesize

                                48KB

                                MD5

                                1351a17fe8b2915c7b939f85ed80eb11

                                SHA1

                                480eac8f353e4a32c0d0ccf8a7d5fcec14a56137

                                SHA256

                                29f767807ea5a9a463cbec1f4cd5b435e0e9259f7e43206dec15e6c7139352f8

                                SHA512

                                a7c3d2382cfab1c5e856fd53115f074197a35b12d8e373d75709d48a68e88467c26e71df92864ab249ebbb82b8edd3933bb9a76d97a7aa4def64a97d41d2f21f

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\aiohttp\_websocket.cp311-win_amd64.pyd

                                Filesize

                                35KB

                                MD5

                                7a783b3600b6c90ed11078bc9d25e78b

                                SHA1

                                da19a65ba602658805ea5800de0f2089e002978e

                                SHA256

                                c93ecab23a1d0d1088aa3b8c6273ca4ee2df9593d3c167d13dfb79bfc155b60e

                                SHA512

                                80a7a9b47d75e1269c4ced87a196402dc16ec71e231d8e8841bb14aabaec0ae6b0338a659654af9d3068ec81f2ee439d342410192c65bf900181d0189f3684c2

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\base_library.zip

                                Filesize

                                1.4MB

                                MD5

                                852a31cacf70f1eb49e7141dd8ba3467

                                SHA1

                                e95f27b99b94c4aa38b3cd57abad60beba7910ae

                                SHA256

                                4a19b01c865bfb5d8a96e772d7986dc3aa9af72adf6ab20702538b7f38c2404b

                                SHA512

                                b752313e966a6729da337fa542e63f62b2942381a2edbb70fa865b3f62af232858394720682283110cba12736a662ce156636a3ed9e3e0e4478516d5fe9ed7bc

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\customtkinter\assets\themes\blue.json

                                Filesize

                                4KB

                                MD5

                                05eb3947ce9a8c3bef66c14d0f938671

                                SHA1

                                06ffc811ee51609809d88894022e222b339aefee

                                SHA256

                                c9417470c16ced7a43d6c4a8e027afa6edc62c24d5aee7c4c2dcd11385964d3b

                                SHA512

                                4db7c14fba78185edf6459016608cb8fa0a250dfb48432c552bb4e0466cf49622b34d847e17c254bb1c8d15bf365e91bce3ede552ba8733fde9d21779f7f1c13

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\libcrypto-3.dll

                                Filesize

                                979KB

                                MD5

                                d39e8831d3386055f5e62f72ce06250e

                                SHA1

                                0675273ff19fbf719a20eb1fa39c020ceaa77015

                                SHA256

                                c486372dc708dd42888e3f35c361447d8fa97e0921a203fb29f0e19d25f56931

                                SHA512

                                37c8b8cb20109879f211f10f8e3f9712992c961905de31aa1ac7a032f7bd96c5bbbbbdab4330c2c8f8ed4e4c473fa5df5809177fe412d841c7beba73118e0d40

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\libcrypto-3.dll

                                Filesize

                                844KB

                                MD5

                                63a9e111d85173b018afc553b0de35dc

                                SHA1

                                e3d261bf92053feae69b790c577ba6489b212b04

                                SHA256

                                f96d78f3cc409cd2988462e5994ebde65d554a4fc128d033c0745c5295d24984

                                SHA512

                                1d0db30739aa5475f99bf7310514b82a4179c564d0eb11215613cb0555171c88d72648846ddb8b78626578c0e43a970656934abba8abd8c6987142d01ff62c3e

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\libcrypto-3.dll

                                Filesize

                                1.7MB

                                MD5

                                07a6895c2f99a69a7d60b1ba7ad4fc8c

                                SHA1

                                9c5a6d215727589c446b502bad34531d8dff92a4

                                SHA256

                                267b6f073f8b6f96c1551d7c8b9bf2849fc3f4bdd1335144d4b866243badead5

                                SHA512

                                f00fa8289dbe0ace3023fe9e74f7f868b1a8fa137845236914cd36d77d362d15aa63dfe24cd5755fe45117ce800d949ac777386e29235770bb83e209310c23f0

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\libffi-8.dll

                                Filesize

                                38KB

                                MD5

                                0f8e4992ca92baaf54cc0b43aaccce21

                                SHA1

                                c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

                                SHA256

                                eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

                                SHA512

                                6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\libssl-3.dll

                                Filesize

                                768KB

                                MD5

                                19a2aba25456181d5fb572d88ac0e73e

                                SHA1

                                656ca8cdfc9c3a6379536e2027e93408851483db

                                SHA256

                                2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

                                SHA512

                                df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\multidict\_multidict.cp311-win_amd64.pyd

                                Filesize

                                45KB

                                MD5

                                53c003dec693f83c57f326b6df5d5f05

                                SHA1

                                6977ebcbf74a039501825697021c504d7cc63928

                                SHA256

                                32555defdb044714dbaaec281820fa7a0c226545d40561b905294d2e0bdba102

                                SHA512

                                2c4b9dff022d25906981d52f68a9bda8e7840597bea6cbea9bc8036392dea56fbecaedcd1b9f6547074c28b018266e424ca0ae8e66bad947544a8571f83fd2f4

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\pyexpat.pyd

                                Filesize

                                193KB

                                MD5

                                d7ecc2746314fec5ca46b64c964ea93e

                                SHA1

                                39fc49d4058a65f0aa4fbdc3d3bcc8c7beecaa01

                                SHA256

                                58b95f03a2d7ec49f5260e3e874d2b9fb76e95ecc80537e27abef0c74d03cb00

                                SHA512

                                d5a595aaf3c7603804deae4d4cc34130876a4c38ccd9f9f29d8b8b11906fa1a03dd9a1f8f5dbde9dc2c62b89fe52dfe5b4ee409a8d336edf7b5b8141d12e82d2

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\python311.dll

                                Filesize

                                3.0MB

                                MD5

                                fb19048d232625c9a6f890125c22cab3

                                SHA1

                                75674d6d3d925eb08014c48a20c275225aaf1d52

                                SHA256

                                f1b547edf006e32ac72344ad2508751eeb58e39b6885cc153493945a494b264e

                                SHA512

                                a1f9da8ce6aebd75512d56635a7b8aa7455ebdd65b208f0356e59995a92baf2dd0cc0ae2624f5f7a2e1a206ddd0bd937dbe5778a94de6646c3092ff646fffe98

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\python311.dll

                                Filesize

                                1.6MB

                                MD5

                                2eaeff28f7d131518ea7fe461b448fcd

                                SHA1

                                68735a5a0fd8ea2ba6e526897778996e0798698c

                                SHA256

                                71812cfdd792a404817df2e2c158366736b93ee47e4e95e8fdf29834d45763b6

                                SHA512

                                9aa2ff371d8f4a434acc73e1b6f3a90a571dcae18e495b1f1decae9273b0a9870d6057fb57688a6c58cc1c5828737a9f7f5f7183121a12563690a555731e7ad6

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\select.pyd

                                Filesize

                                29KB

                                MD5

                                e07ae2f7f28305b81adfd256716ae8c6

                                SHA1

                                9222cd34c14a116e7b9b70a82f72fc523ef2b2f6

                                SHA256

                                fb06ac13f8b444c3f7ae5d2af15710a4e60a126c3c61a1f1e1683f05f685626c

                                SHA512

                                acb143194ca465936a48366265ae3e11a2256aeae333c576c8c74f8ed9b60987daff81647aef74e236b30687a28bc7e3aa21c6aedbfa47b1501658a2bfd117b4

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\tcl86t.dll

                                Filesize

                                904KB

                                MD5

                                efd5258e678588bdbd51f368fef66931

                                SHA1

                                df5fb5978aad9e93b25a10dfc4d1aab26cf403b4

                                SHA256

                                fbe0768ac49e4e18340b9ae064a07374ef3553164eb1d07d62b4c0b50239fbe1

                                SHA512

                                fbf4ebfc66a6f6ef3a6ff7281c0abf9fc0d08fc7144abf1a3ed9c5a6d26c858d65c2f49cc00e02ecff1257eb7a54c4cd493b867567ed5e14574eb801c3a38455

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\tcl86t.dll

                                Filesize

                                1.3MB

                                MD5

                                e247959584dc5499917d90a95c317097

                                SHA1

                                4f0556140af9bf7f1274b283e1692f5924d2cb3c

                                SHA256

                                d5bcf9ceb3dc3e602e55631e2c1f03cba1afff9604e69606994d5d6f81dc7d20

                                SHA512

                                1b60dab541e18ec75155eaa4c2f00facebe2c46dfbe772698d0f7fbb8fa444966f48e8a4fa26476d43c42586239fcab2c2083ebff95e5937b1bb6011418d0b52

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\tcl\encoding\cp1252.enc

                                Filesize

                                1KB

                                MD5

                                e9117326c06fee02c478027cb625c7d8

                                SHA1

                                2ed4092d573289925a5b71625cf43cc82b901daf

                                SHA256

                                741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e

                                SHA512

                                d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\tk86t.dll

                                Filesize

                                1.2MB

                                MD5

                                b4f3df75c561e63439d8719e9fd6d4e9

                                SHA1

                                35752499de304188c126da75cf29032bc4e0d34f

                                SHA256

                                7b139fc3c4e15be72fcd1aaebefc693648d0e83226c7d4383e9ba1b095a1ad9d

                                SHA512

                                60b596e6aaa5eba3a4b62f647879edb129f6619ec989dd27c7321c911e20acb24e11a95c5f2efd100e7f6ea9abf1d47e3000c84e58160de15ee017c9de54b1e6

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\tk86t.dll

                                Filesize

                                1.4MB

                                MD5

                                7ab45516793ff472a38f5f1f2aa80e77

                                SHA1

                                507f13c4e1aada406a1c2a63b2f508a24edd1054

                                SHA256

                                57d0870ba485d8e4d895886a9c0726b393db4f09bbd55780165ad35488cd0f52

                                SHA512

                                58b87f1c028a8235cff830351d0828d79eb0ae780af1f29c946965b93cc934a1159443e9f6d14c63eaa9b00f5b519300dff4219fad920b52b63294f610229852

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\unicodedata.pyd

                                Filesize

                                722KB

                                MD5

                                f6d3ca5d7db9c6e983ac00bc1eee98a5

                                SHA1

                                4b88457f65c33f327eb5026f0b1c49392109c4b9

                                SHA256

                                e4d32388852b8094ecc4e25255514d313e085237170e76946e40e487b3e5fb51

                                SHA512

                                e2b2f6fc0b49548028ca270736a688e032fa298b43921030614c49cb4d7e470db3c62935dc6b92ad9dfd2d4e51a92deba49f428e0dac042b2fdc7f64d381336d

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\unicodedata.pyd

                                Filesize

                                1.1MB

                                MD5

                                5cc36a5de45a2c16035ade016b4348eb

                                SHA1

                                35b159110e284b83b7065d2cff0b5ef4ccfa7bf1

                                SHA256

                                f28ac3e3ad02f9e1d8b22df15fa30b2190b080261a9adc6855248548cd870d20

                                SHA512

                                9cccbf81e80c32976b7b2e0e3978e8f7350cce542356131b24ebab34b256efd44643d41ee4b2994b9152c2e5af302aa182a1889c99605140f47494a501ef46c1

                              • C:\Users\Admin\AppData\Local\Temp\_MEI35202\yarl\_quoting_c.cp311-win_amd64.pyd

                                Filesize

                                93KB

                                MD5

                                3ccc89b98dab137bc5af9c1e62923829

                                SHA1

                                55d93e9782094925d80e4ce27d13a0a9761b7002

                                SHA256

                                40e91aaa369a5c171c0d30630707ae9bb64412fedf149aeecfa5707a2324f770

                                SHA512

                                4ebe427c75d83c019f8d378a030ae21e07decf30cd10623115eb0cc6ad7a689159e95c7fabac82ce82cea3720fae6c6faf712b600236dad039255884872eb6c0