Analysis Overview
SHA256
a3454cd22568fe6e617734e051eb68218bd977bf48a43e06a22d06afaae42976
Threat Level: Known bad
The file Robux Haker (1).exe was found to be: Known bad.
Malicious Activity Summary
Detect Xworm Payload
Xworm
Enumerates VirtualBox DLL files
Sets file to hidden
Command and Scripting Interpreter: PowerShell
Loads dropped DLL
Executes dropped EXE
UPX packed file
Drops startup file
Checks computer location settings
Looks up external IP address via web service
Adds Run key to start application
Enumerates physical storage devices
Unsigned PE
Creates scheduled task(s)
Views/modifies file attributes
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Suspicious use of SetWindowsHookEx
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Kills process with taskkill
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-26 19:05
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-26 19:05
Reported
2024-05-26 19:08
Platform
win7-20240221-en
Max time kernel
142s
Max time network
145s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Xworm
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk | C:\Users\Admin\Runtime Broker.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk | C:\Users\Admin\Runtime Broker.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Robux Hacker.exe | N/A |
| N/A | N/A | C:\Users\Admin\Runtime Broker.exe | N/A |
| N/A | N/A | C:\Users\Admin\Robux Hacker.exe | N/A |
| N/A | N/A | N/A | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Robux Haker (1).exe | N/A |
| N/A | N/A | C:\Users\Admin\Robux Hacker.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\Users\\Admin\\AppData\\Roaming\\Runtime Broker.exe" | C:\Users\Admin\Runtime Broker.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\schtasks.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Runtime Broker.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\Runtime Broker.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\Runtime Broker.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\Runtime Broker.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Runtime Broker.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\Robux Haker (1).exe
"C:\Users\Admin\AppData\Local\Temp\Robux Haker (1).exe"
C:\Users\Admin\Robux Hacker.exe
"C:\Users\Admin\Robux Hacker.exe"
C:\Users\Admin\Runtime Broker.exe
"C:\Users\Admin\Runtime Broker.exe"
C:\Users\Admin\Robux Hacker.exe
"C:\Users\Admin\Robux Hacker.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Runtime Broker.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Runtime Broker.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
C:\Windows\system32\taskeng.exe
taskeng.exe {9EE8F392-B97C-4850-8828-1003B84E8B86} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
Files
memory/2184-0-0x000007FEF5C53000-0x000007FEF5C54000-memory.dmp
memory/2184-1-0x0000000000E80000-0x0000000005ECA000-memory.dmp
C:\Users\Admin\Runtime Broker.exe
| MD5 | 445493577b60096722caaf69aef28074 |
| SHA1 | 25e88b3f7cec46fdb78d4c6d7c0e8bb2d1db673f |
| SHA256 | 23e0d419f8d2a9fa38e7e38650e2f27f83a28ff66d43fa4ca342e1b3508e215f |
| SHA512 | dea6a4346492327f83171aac4a42dc572c76e164047285f3134ae7de9d62327104c6e60ac30ff158f54770713a134e53f383bd0de3e4de9ad6b2296155b91cbb |
memory/2608-20-0x0000000001270000-0x0000000001288000-memory.dmp
memory/2608-145-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI25162\python311.dll
| MD5 | 546cc5fe76abc35fdbf92f682124e23d |
| SHA1 | 5c1030752d32aa067b49125194befee7b3ee985a |
| SHA256 | 43bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76 |
| SHA512 | cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720 |
memory/2928-1279-0x000007FEF2820000-0x000007FEF2E09000-memory.dmp
memory/2608-1280-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp
memory/2736-1286-0x000000001B6C0000-0x000000001B9A2000-memory.dmp
memory/2736-1287-0x0000000002250000-0x0000000002258000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
| MD5 | ec3301cd9964b8306b639e0fe90c3707 |
| SHA1 | 43120321be505a9d2157bd29b1a781b350372546 |
| SHA256 | 553f5c0457eff07b79d3aee8215003c5803023ff11835a504a3b64ef523a2fae |
| SHA512 | 26ea334762fa06671ca8d168f89096640c7a057d4128471375e8e4f4e621bdec4de63938abfbe25fb3ca2417075a49a564851d67e34c546855ba27503ec9b1fa |
memory/1904-1293-0x000000001B680000-0x000000001B962000-memory.dmp
memory/1904-1294-0x0000000002340000-0x0000000002348000-memory.dmp
memory/2608-2569-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp
memory/2608-2570-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-26 19:05
Reported
2024-05-26 19:08
Platform
win10v2004-20240226-en
Max time kernel
153s
Max time network
164s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Xworm
Enumerates VirtualBox DLL files
| Description | Indicator | Process | Target |
| File opened (read-only) | C:\windows\system32\vboxhook.dll | C:\Users\Admin\Robux Hacker.exe | N/A |
| File opened (read-only) | C:\windows\system32\vboxmrxnp.dll | C:\Users\Admin\Robux Hacker.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Sets file to hidden
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Robux Haker (1).exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\Runtime Broker.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk | C:\Users\Admin\Runtime Broker.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk | C:\Users\Admin\Runtime Broker.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Robux Hacker.exe | N/A |
| N/A | N/A | C:\Users\Admin\Runtime Broker.exe | N/A |
| N/A | N/A | C:\Users\Admin\Robux Hacker.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Runtime Broker.exe | N/A |
| N/A | N/A | C:\Users\Admin\User Data Startup\Robux Hacker.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Runtime Broker.exe | N/A |
Loads dropped DLL
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\Users\\Admin\\AppData\\Roaming\\Runtime Broker.exe" | C:\Users\Admin\Runtime Broker.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Robux Hacker = "C:\\Users\\Admin\\User Data Startup\\Robux Hacker.exe" | C:\Users\Admin\Robux Hacker.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\schtasks.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Runtime Broker.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\Runtime Broker.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\Robux Hacker.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\Runtime Broker.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\Runtime Broker.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\taskkill.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\Runtime Broker.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Runtime Broker.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Robux Haker (1).exe
"C:\Users\Admin\AppData\Local\Temp\Robux Haker (1).exe"
C:\Users\Admin\Robux Hacker.exe
"C:\Users\Admin\Robux Hacker.exe"
C:\Users\Admin\Runtime Broker.exe
"C:\Users\Admin\Runtime Broker.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Runtime Broker.exe'
C:\Users\Admin\Robux Hacker.exe
"C:\Users\Admin\Robux Hacker.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Runtime Broker.exe'
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4124 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b8 0x2c8
C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\User Data Startup\""
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\User Data Startup\activate.bat""
C:\Windows\system32\attrib.exe
attrib +s +h .
C:\Users\Admin\User Data Startup\Robux Hacker.exe
"Robux Hacker.exe"
C:\Windows\system32\taskkill.exe
taskkill /f /im "Robux Hacker.exe"
C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
"C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.58.20.217.in-addr.arpa | udp |
| GB | 142.250.187.202:443 | tcp | |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| NL | 52.142.223.178:80 | tcp | |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 8.8.8.8:53 | 220.167.154.149.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 144.107.17.2.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 91.16.208.104.in-addr.arpa | udp |
Files
memory/1304-0-0x00007FFC8CBB3000-0x00007FFC8CBB5000-memory.dmp
memory/1304-1-0x0000000000010000-0x000000000505A000-memory.dmp
C:\Users\Admin\Runtime Broker.exe
| MD5 | 445493577b60096722caaf69aef28074 |
| SHA1 | 25e88b3f7cec46fdb78d4c6d7c0e8bb2d1db673f |
| SHA256 | 23e0d419f8d2a9fa38e7e38650e2f27f83a28ff66d43fa4ca342e1b3508e215f |
| SHA512 | dea6a4346492327f83171aac4a42dc572c76e164047285f3134ae7de9d62327104c6e60ac30ff158f54770713a134e53f383bd0de3e4de9ad6b2296155b91cbb |
memory/112-72-0x0000000000FE0000-0x0000000000FF8000-memory.dmp
memory/112-241-0x00007FFC8CBB0000-0x00007FFC8D671000-memory.dmp
memory/112-468-0x00007FFC8CBB0000-0x00007FFC8D671000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_atq4h0fn.fe2.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4996-1240-0x00000188E6140000-0x00000188E6162000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI27042\python311.dll
| MD5 | 546cc5fe76abc35fdbf92f682124e23d |
| SHA1 | 5c1030752d32aa067b49125194befee7b3ee985a |
| SHA256 | 43bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76 |
| SHA512 | cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\VCRUNTIME140.dll
| MD5 | 4585a96cc4eef6aafd5e27ea09147dc6 |
| SHA1 | 489cfff1b19abbec98fda26ac8958005e88dd0cb |
| SHA256 | a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736 |
| SHA512 | d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286 |
memory/2880-1328-0x00007FFC84240000-0x00007FFC84829000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI27042\python3.DLL
| MD5 | b711598fc3ed0fe4cf2c7f3e0877979e |
| SHA1 | 299c799e5d697834aa2447d8a313588ab5c5e433 |
| SHA256 | 520169aa6cf49d7ee724d1178de1be0e809e4bdcf671e06f3d422a0dd5fd294a |
| SHA512 | b3d59eff5e38cef651c9603971bde77be7231ea8b7bdb444259390a8a9e452e107a0b6cb9cc93e37fd3b40afb2ba9e67217d648bfca52f7cdc4b60c7493b6b84 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_ctypes.pyd
| MD5 | 4d322ecdfec6fd9114af7febfeabd49a |
| SHA1 | ae4527639a69e178d679251ca487b17130e9bd67 |
| SHA256 | 633edc33259db27f9136ffa5ddfb4e824cc3fe0523464ca51aac978f56a6cd8d |
| SHA512 | f610fec7fa09f003c44a905391a1ec231c7e1efe244b98c6a9c838d61b957e9ba3e436375a7c1f86069ae0094ad19a401c2c8cd465c03c1ec556ad452b0887e5 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\base_library.zip
| MD5 | 2f6d57bccf7f7735acb884a980410f6a |
| SHA1 | 93a6926887a08dc09cd92864cd82b2bec7b24ec5 |
| SHA256 | 1b7d326bad406e96a4c83b5a49714819467e3174ed0a74f81c9ebd96d1dd40b3 |
| SHA512 | 95bcfc66dbe7b6ad324bd2dc2258a3366a3594bfc50118ab37a2a204906109e42192fb10a91172b340cc28c12640513db268c854947fb9ed8426f214ff8889b4 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\libffi-8.dll
| MD5 | 013a0b2653aa0eb6075419217a1ed6bd |
| SHA1 | 1b58ff8e160b29a43397499801cf8ab0344371e7 |
| SHA256 | e9d8eb01bb9b02ce3859ba4527938a71b4668f98897d46f29e94b27014036523 |
| SHA512 | 0bd13fa1d55133ee2a96387e0756f48133987bacd99d1f58bab3be7bffdf868092060c17ab792dcfbb4680f984f40d3f7cc24abdd657b756496aa8884b8f6099 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\freetype.dll
| MD5 | 04a9825dc286549ee3fa29e2b06ca944 |
| SHA1 | 5bed779bf591752bb7aa9428189ec7f3c1137461 |
| SHA256 | 50249f68b4faf85e7cd8d1220b7626a86bc507af9ae400d08c8e365f9ab97cde |
| SHA512 | 0e937e4de6cbc9d40035b94c289c2798c77c44fc1dc7097201f9fab97c7ff9e56113c06c51693f09908283eda92945b36de67351f893d4e3162e67c078cff4ec |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_uuid.pyd
| MD5 | 46e9d7b5d9668c9db5caa48782ca71ba |
| SHA1 | 6bbc83a542053991b57f431dd377940418848131 |
| SHA256 | f6063622c0a0a34468679413d1b18d1f3be67e747696ab972361faed4b8d6735 |
| SHA512 | c5b171ebdb51b1755281c3180b30e88796db8aa96073489613dab96b6959a205846711187266a0ba30782102ce14fbfa4d9f413a2c018494597600482329ebf7 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\libcrypto-1_1.dll
| MD5 | 164f1ca9781e832764f5184b8ecd3936 |
| SHA1 | 314336f680fa6a2f5d077137242e93d3bbe1f95b |
| SHA256 | 3bdd29a6bc5d0be745e2a5c051d7e12d420f238386cd56d466a4965ae1722d9d |
| SHA512 | 839c06afb73d2b08205501e53a8900992befe658f57235593c6d593a2bea985be4c74cf440652ff97e6e85b1b89820531ed294e609747675c72a005f13ed8407 |
memory/112-1384-0x00007FFC8CBB0000-0x00007FFC8D671000-memory.dmp
memory/2880-1386-0x00007FFC882C0000-0x00007FFC882ED000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_socket.pyd
| MD5 | 8e5cd89d016284aba536f189bb473bc3 |
| SHA1 | ce0294f44d3dfe2b5dd4cca52a4c40955db04b40 |
| SHA256 | 185c41b8f772b63bf649d818350031cecc34cd98a5752a4c090e82ebd01c5b3c |
| SHA512 | 279ee4ea3b3b18f16536ae06970879af5d1b296c82e8ee2823a4081a633ac7b16fa37a4b87d870b4f2c0f60ea1fcf39f610718079bd03094e38f76f1594c1597 |
memory/2880-1385-0x00007FFC956A0000-0x00007FFC956B9000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_hashlib.pyd
| MD5 | 290a8608872b47cfd6135407c357bf8a |
| SHA1 | 6d49052f3c242bdf80bcd6e80b31b61b17c7c865 |
| SHA256 | 7cdec175deff9c54df8e6ce117047580ed9dc5f1a3cd25adfab8b397d3bca764 |
| SHA512 | 7cffced9e5e39d5e7b054ae0e8f102d6db6cc2b0d10170a41d58f4f8fbba500e395bd47210ed320f5c18ab1b664fd308b5ffc6e6bfd358e9c747aeb77de100a7 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_tkinter.pyd
| MD5 | bd62e34283812da3487154594296db60 |
| SHA1 | 3664b4425cbdc5a49d7bb13bd09c9aae89058152 |
| SHA256 | 7932a64e347ca9d6099cbb764958610a37e652c709d792a1348e2f56c6b20dbd |
| SHA512 | 62ebb04660a5a51796ee1b69f1118ae1b9deb8f01e73c840eb3ab01c7fad45c48fd0edd7285d041fa6df94ac6b3d728b6799d2d1f7bb266cb0bcdc793444735f |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_ssl.pyd
| MD5 | 3cb7ec631bde473e9e3d6a49e8dab9ac |
| SHA1 | 46f4543389fb1e142e7447401c7682b01e6342f2 |
| SHA256 | 2c0eaf32c3604695512dd496332b29c8bb15c062a3c4fec9f3ef1dd6c728e2c0 |
| SHA512 | 02c0eb354d59ec41d62e3d60e82d5d9826c78b4f396b147063f04b02212d0eb524f62c096f9d51c2b4e4d07bd3e412c2f59842c613d11b79074b87321ba6efa3 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_sqlite3.pyd
| MD5 | 60c217b6e42731e6093fb49a1e885cd4 |
| SHA1 | 5e9363974fbd6784f57c7b324bbd8708eb47d6ac |
| SHA256 | 6a57626ee460680f7c57547d798e6841a932f9046c25b02cf1b9a605fb6f4345 |
| SHA512 | e356b08ae0dc6804eecafda6c6d99cb9fc336338357ad350111513f1694ddbdd14494c3e5525d124b79d0ed4575384ecfbac46ec3a2502ef3fe9074844525bf9 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\select.pyd
| MD5 | d16bf8f23b4c384cb556a40bcca22e2a |
| SHA1 | ff74c6e50d114de2a8397a3d56543d2a95961d3b |
| SHA256 | bdb9aa2e07e8681338ade75811592388adad2aad27aba935f1e490c90de296da |
| SHA512 | 0a9c6fd95b480dcb1b6fd4f592349e2d75b5c74511932bb6bac43d427ae02e5e8ba78171186c055b31907b5c6dc9d6d808b7cb3eebf62324d3259cb3eece0ef8 |
memory/2880-1391-0x00007FFC88250000-0x00007FFC8827E000-memory.dmp
memory/2880-1393-0x00007FFC882A0000-0x00007FFC882B4000-memory.dmp
memory/2880-1394-0x00007FFC88280000-0x00007FFC88299000-memory.dmp
memory/2880-1397-0x00007FFC97760000-0x00007FFC9776B000-memory.dmp
memory/2880-1396-0x00007FFC9A1B0000-0x00007FFC9A1BD000-memory.dmp
memory/2880-1395-0x00007FFC88220000-0x00007FFC88246000-memory.dmp
memory/2880-1392-0x00007FFC867F0000-0x00007FFC868A8000-memory.dmp
memory/2880-1390-0x00007FFC9DBC0000-0x00007FFC9DBCD000-memory.dmp
memory/2880-1389-0x00007FFC83EC0000-0x00007FFC84238000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_queue.pyd
| MD5 | 3e69272442ffcc003ad604c3431954fa |
| SHA1 | f2ed25992f77361c112de4914b21a0599dd406d3 |
| SHA256 | 779706a35cd3ba765b0d384254890a9ea789ecadc696a524a2e46bf69bfb4a9d |
| SHA512 | 8b35b15ee2aca71cac0aa108196da9a4186acd6728d04e75a0294b2eeeeae594fe6eede394be365ae062f23b3a7362f410e3290cb9e7ff32afab980c5e631f58 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_overlapped.pyd
| MD5 | 6344223b2c04b31fc69b988f76ad0fee |
| SHA1 | 7012f4f8bcf181e1a7e30203fbcdec0c0afb5c9c |
| SHA256 | 5adfbf048f45eb734974fdc6416e96f7904736f033648d0190bef3422b676df5 |
| SHA512 | 378dc5e900433b5412a035fc52be50285d10fbb2d3b3c488cae15cf1f84fcf7f2e082ec4bf14370b4c6cb8aefc6a64a625fff902b519c78b58bf68268ae444a9 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_multiprocessing.pyd
| MD5 | 75bca8d4f1e829385e25abc39d8fc437 |
| SHA1 | 0f289665b36aabc6f6f21b284f7d89ec320f56d3 |
| SHA256 | d0d4bbe992ef1e60af922926d1446a908c51cbf089b53b2c27166c90be7cd08c |
| SHA512 | bb0881a3bd765850a322f0fa4fc3014feafb081f17bb4cab705dccf77d7f2fc30fd200e5d6499041adfae5f2a0307804b69953086426f1c4e4eced2f5a979804 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_elementtree.pyd
| MD5 | d64c52f740ac6f158a59736563b64c38 |
| SHA1 | f8cf372283b2599c894fa4d836f8d7700abbd5ed |
| SHA256 | 232933953bf1cdb575231c8f57cf7d9d00bd2179feb938ae34962f2c371bd0fa |
| SHA512 | 43879cba03c58935794c64dbfb0f4b2ed9e1b492ee75edd2720ee18c2089f1325dc01e3f8ee43e02fd7c8d2e923f10d0ee76d9a1edc9f946ebac1ea8b23a887a |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_decimal.pyd
| MD5 | 9d3b3610f25a51e1cee7baa292f5167b |
| SHA1 | 525ce88860323d0f51b2e32acaa9b9bb782694f1 |
| SHA256 | 69455c4588c939b76d23e3daad9c1f92dc0277b30dc67538496bc38e93b58975 |
| SHA512 | bca7b962ca59cad7f1ae29d7eaeae1e4d7e2884ac4781c3cd0bac7bce5e2084775320375600e15dd7940ccdba1d17f6c2405cea756402808823c436db16c8a8d |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_cffi_backend.cp311-win_amd64.pyd
| MD5 | cdc182dc9761dbad548061af8ed0bacb |
| SHA1 | 646c648471552ab5abb49ed07d0bdc9e88a26d75 |
| SHA256 | 213a68dface36e70bfc33d9b5932f01aab69010d50397f909b6721bfa42bf9dd |
| SHA512 | 968f518dbc5dd60c56e71cf7ca0331e1ebdab3c4ebb7614a2a8cbdee8d1e143e5103e37ec7fbb9d710bd0eca3cbda018564cfc08450178cf448086b1b5b86c1e |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_asyncio.pyd
| MD5 | 45f8a7ec700c08b35cd2e7a3ef8b4580 |
| SHA1 | 87ffe8dcabec09de34b60f71c9cfdc998fc6c152 |
| SHA256 | 6517366fa68c1c970e458132842b26e48db3c931f043142f84c3785b5373c236 |
| SHA512 | 474a1ec014d05ab1cf151b48ab3dbf361151614345878c2463f401b18621329aece959280db5e67c48bb48617b57f36760dde35f71470dd5ab9f48fb6155c870 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\zlib1.dll
| MD5 | ee06185c239216ad4c70f74e7c011aa6 |
| SHA1 | 40e66b92ff38c9b1216511d5b1119fe9da6c2703 |
| SHA256 | 0391066f3e6385a9c0fe7218c38f7bd0b3e0da0f15a98ebb07f1ac38d6175466 |
| SHA512 | baae562a53d491e19dbf7ee2cff4c13d42de6833036bfdaed9ed441bcbf004b68e4088bd453b7413d60faaf1b334aee71241ba468437d49050b8ccfa9232425d |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\VCRUNTIME140_1.dll
| MD5 | 7e668ab8a78bd0118b94978d154c85bc |
| SHA1 | dbac42a02a8d50639805174afd21d45f3c56e3a0 |
| SHA256 | e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f |
| SHA512 | 72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\unicodedata.pyd
| MD5 | efd4d801473e5885bc6a595bf945e1fc |
| SHA1 | 104a0ed3c41307032e70d358c291dbaa0332b97c |
| SHA256 | d1d0d5853ec90d2797535e2aef8ef8d368245ec65b2607a74f10409815fd810c |
| SHA512 | 5d6fa1326e0a338cff2a571f2848b11e004cf421daadf858d687618f31c13481dc08b9be28b70d6300f9fefc2aa43a36a441bf9cbe91b780e802b5501fa9008c |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\tk86t.dll
| MD5 | 7d85f7480f2d8389f562723090be1370 |
| SHA1 | edfa05dc669a8486977e983173ec61cc5097bbb0 |
| SHA256 | aaeda7b65e1e33c74a807109360435a6b63a2994243c437e0cdaa69d2b8c6ac5 |
| SHA512 | a886475aeea6c4003dd35e518a0833574742b62cdbbbe5b098a5c0f74e89795ebddac31c4107dae6edee8fc476addaa34253af560d33bed8b9df9192c3e7f084 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\tcl86t.dll
| MD5 | 755bec8838059147b46f8e297d05fba2 |
| SHA1 | 9ff0665cddcf1eb7ff8de015b10cc9fcceb49753 |
| SHA256 | 744a13c384e136f373f9dc7f7c2eb2536591ec89304e3fa064cac0f0bf135130 |
| SHA512 | e61dc700975d28b2257da99b81d135aa7d284c6084877fe81b3cc7b42ac180728f79f4c1663e375680a26f5194ab641c4a40e09f8dbdeb99e1dfa1a57d6f9b34 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\sqlite3.dll
| MD5 | 018d9408a713c27c1f26d7a0406ef083 |
| SHA1 | ef334109c3750858ac0d4d056aaaec387dd07e70 |
| SHA256 | c227be3f8e63b0251f5216af58c9ef3ea0b949707dc9e7207cc05f8bd96bc761 |
| SHA512 | 0c7425d8e32b18a69add3864ad745eb4ff78760e21c214a9086a5392d79cc7afb0815ba04ade13c8b3c043d9bdbee4eaa6bea4e7fe7593a99ecee6fab1addbf8 |
memory/2880-1398-0x00007FFC866D0000-0x00007FFC867EC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI27042\SDL2_ttf.dll
| MD5 | eb0ce62f775f8bd6209bde245a8d0b93 |
| SHA1 | 5a5d039e0c2a9d763bb65082e09f64c8f3696a71 |
| SHA256 | 74591aab94bb87fc9a2c45264930439bbc0d1525bf2571025cd9804e5a1cd11a |
| SHA512 | 34993240f14a89179ac95c461353b102ea74e4180f52c206250bb42c4c8427a019ea804b09a6903674ac00ab2a3c4c686a86334e483110e79733696aa17f4eb6 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\SDL2_mixer.dll
| MD5 | b7b45f61e3bb00ccd4ca92b2a003e3a3 |
| SHA1 | 5018a7c95dc6d01ba6e3a7e77dd26c2c74fd69bc |
| SHA256 | 1327f84e3509f3ccefeef1c12578faf04e9921c145233687710253bf903ba095 |
| SHA512 | d3449019824124f3edbda57b3b578713e9c9915e173d31566cd8e4d18f307ac0f710250fe6a906dd53e748db14bfa76ec1b58a6aef7d074c913679a47c5fdbe7 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\SDL2_image.dll
| MD5 | 25e2a737dcda9b99666da75e945227ea |
| SHA1 | d38e086a6a0bacbce095db79411c50739f3acea4 |
| SHA256 | 22b27380d4f1f217f0e5d5c767e5c244256386cd9d87f8ddf303baaf9239fc4c |
| SHA512 | 63de988387047c17fd028a894465286fd8f6f8bd3a1321b104c0ceb5473e3e0b923153b4999143efbdd28684329a33a5b468e43f25214037f6cddd4d1884adb8 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\SDL2.dll
| MD5 | 2b13a3f2fc8f9cdb3161374c4bc85f86 |
| SHA1 | 9039a90804dba7d6abb2bcf3068647ba8cab8901 |
| SHA256 | 110567f1e5008c6d453732083b568b6a8d8da8077b9cb859f57b550fd3b05fb6 |
| SHA512 | 2ee8e35624cb8d78baefafd6878c862b510200974bef265a9856e399578610362c7c46121a9f44d7ece6715e68475db6513e96bea3e26cdccbd333b0e14ccfd8 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\pyexpat.pyd
| MD5 | f2d02bd2c933f5bd1f9f3d55c57a7417 |
| SHA1 | 40ce29a427bfd980bb8d7b95d75964e12a3cdf7f |
| SHA256 | c0a7b8d4458a7b3652e8e139285fc3743f5bbf5812ab744a3aa1d1aeab009959 |
| SHA512 | 4d18fb9b74ffcb9dd3d3cb61d6495fa5a75549cffbd8cbe3031fd6215fafe11e05a57b3bad07bc58c80321e1c443f1491ef65c4c65340c1ba7d7529c366939b6 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\portmidi.dll
| MD5 | 0df0699727e9d2179f7fd85a61c58bdf |
| SHA1 | 82397ee85472c355725955257c0da207fa19bf59 |
| SHA256 | 97a53e8de3f1b2512f0295b5de98fa7a23023a0e4c4008ae534acdba54110c61 |
| SHA512 | 196e41a34a60de83cb24caa5fc95820fd36371719487350bc2768354edf39eeb6c7860ff3fd9ecf570abb4288523d7ab934e86e85202b9753b135d07180678cd |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\libwebp-7.dll
| MD5 | b0dd211ec05b441767ea7f65a6f87235 |
| SHA1 | 280f45a676c40bd85ed5541ceb4bafc94d7895f3 |
| SHA256 | fc06b8f92e86b848a17eaf7ed93464f54ed1f129a869868a74a75105ff8ce56e |
| SHA512 | eaeb83e46c8ca261e79b3432ec2199f163c44f180eb483d66a71ad530ba488eb4cdbd911633e34696a4ccc035e238bc250a8247f318aa2f0cd9759cad4f90fff |
memory/2880-1399-0x00007FFC87760000-0x00007FFC87798000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI27042\libtiff-5.dll
| MD5 | ebad1fa14342d14a6b30e01ebc6d23c1 |
| SHA1 | 9c4718e98e90f176c57648fa4ed5476f438b80a7 |
| SHA256 | 4f50820827ac76042752809479c357063fe5653188654a6ba4df639da2fbf3ca |
| SHA512 | 91872eaa1f3f45232ab2d753585e650ded24c6cc8cc1d2a476fa98a61210177bd83570c52594b5ad562fc27cb76e034122f16a922c6910e4ed486da1d3c45c24 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\libssl-1_1.dll
| MD5 | 6ccbd783667c9a9d0976c03970a87c7f |
| SHA1 | 9191eedddb1be78c0ee6acd262a63cf4d1a37e69 |
| SHA256 | 9cc268c1dd9cb8c1ce39f274ae5ce3c31ee085eb8ecddb3c63b464bcd483f3b8 |
| SHA512 | 89699351709fb2ecfddd8964579f81858203969ae9427a9918a8b79296170e84471894060395254d509bfdd7a0e909cad8fa7ee18714828932654e4527455909 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\libpng16-16.dll
| MD5 | 55009dd953f500022c102cfb3f6a8a6c |
| SHA1 | 07af9f4d456ddf86a51da1e4e4c5b54b0cf06ddb |
| SHA256 | 20391787cba331cfbe32fbf22f328a0fd48924e944e80de20ba32886bf4b6fd2 |
| SHA512 | 4423d3ec8fef29782f3d4a21feeac9ba24c9c765d770b2920d47b4fb847a96ff5c793b20373833b4ff8bc3d8fa422159c64beffb78ce5768ed22742740a8c6c6 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\libopusfile-0.dll
| MD5 | 2d5274bea7ef82f6158716d392b1be52 |
| SHA1 | ce2ff6e211450352eec7417a195b74fbd736eb24 |
| SHA256 | 6dea07c27c0cc5763347357e10c3b17af318268f0f17c7b165325ce524a0e8d5 |
| SHA512 | 9973d68b23396b3aa09d2079d18f2c463e807c9c1fdf4b1a5f29d561e8d5e62153e0c7be23b63975ad179b9599ff6b0cf08ebdbe843d194483e7ec3e7aeb232a |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\libopus-0.x64.dll
| MD5 | e56f1b8c782d39fd19b5c9ade735b51b |
| SHA1 | 3d1dc7e70a655ba9058958a17efabe76953a00b4 |
| SHA256 | fa8715dd0df84fdedbe4aa17763b2ab0db8941fa33421b6d42e25e59c4ae8732 |
| SHA512 | b7702e48b20a8991a5c537f5ba22834de8bb4ba55862b75024eace299263963b953606ee29e64d68b438bb0904273c4c20e71f22ccef3f93552c36fb2d1b2c46 |
memory/2880-1400-0x00007FFC94FF0000-0x00007FFC94FFB000-memory.dmp
memory/2880-1406-0x00007FFC8F1F0000-0x00007FFC8F1FC000-memory.dmp
memory/2880-1408-0x00007FFC88200000-0x00007FFC8820C000-memory.dmp
memory/2880-1415-0x00007FFC86680000-0x00007FFC8668C000-memory.dmp
memory/2880-1414-0x00007FFC866C0000-0x00007FFC866CC000-memory.dmp
memory/2880-1413-0x00007FFC86FD0000-0x00007FFC86FDE000-memory.dmp
memory/2880-1412-0x00007FFC86690000-0x00007FFC8669C000-memory.dmp
memory/2880-1411-0x00007FFC866A0000-0x00007FFC866AB000-memory.dmp
memory/2880-1410-0x00007FFC866B0000-0x00007FFC866BB000-memory.dmp
memory/2880-1409-0x00007FFC83EC0000-0x00007FFC84238000-memory.dmp
memory/2880-1407-0x00007FFC88210000-0x00007FFC8821B000-memory.dmp
memory/2880-1405-0x00007FFC86FE0000-0x00007FFC86FEC000-memory.dmp
memory/2880-1404-0x00007FFC87740000-0x00007FFC8774C000-memory.dmp
memory/2880-1403-0x00007FFC87750000-0x00007FFC8775B000-memory.dmp
memory/2880-1402-0x00007FFC84240000-0x00007FFC84829000-memory.dmp
memory/2880-1401-0x00007FFC8F9D0000-0x00007FFC8F9DB000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI27042\libopus-0.dll
| MD5 | 3fb9d9e8daa2326aad43a5fc5ddab689 |
| SHA1 | 55523c665414233863356d14452146a760747165 |
| SHA256 | fd8de9169ccf53c5968eec0c90e9ff3a66fb451a5bf063868f3e82007106b491 |
| SHA512 | f263ea6e0fab84a65fe3a9b6c0fe860919eee828c84b888a5aa52dea540434248d1e810a883a2aff273cd9f22c607db966dd8776e965be6d2cfe1b50a1af1f57 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\libogg-0.dll
| MD5 | 0d65168162287df89af79bb9be79f65b |
| SHA1 | 3e5af700b8c3e1a558105284ecd21b73b765a6dc |
| SHA256 | 2ec2322aec756b795c2e614dab467ef02c3d67d527ad117f905b3ab0968ccf24 |
| SHA512 | 69af81fd2293c31f456b3c78588bb6a372fe4a449244d74bfe5bfaa3134a0709a685725fa05055cfd261c51a96df4b7ebd8b9e143f0e9312c374e54392f8a2c2 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\libmodplug-1.dll
| MD5 | 2bb2e7fa60884113f23dcb4fd266c4a6 |
| SHA1 | 36bbd1e8f7ee1747c7007a3c297d429500183d73 |
| SHA256 | 9319bf867ed6007f3c61da139c2ab8b74a4cb68bf56265a101e79396941f6d3b |
| SHA512 | 1ddd4b9b9238c1744e0a1fe403f136a1def8df94814b405e7b01dd871b3f22a2afe819a26e08752142f127c3efe4ebae8bfd1bd63563d5eb98b4644426f576b2 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\libjpeg-9.dll
| MD5 | c22b781bb21bffbea478b76ad6ed1a28 |
| SHA1 | 66cc6495ba5e531b0fe22731875250c720262db1 |
| SHA256 | 1eed2385030348c84bbdb75d41d64891be910c27fab8d20fc9e85485fcb569dd |
| SHA512 | 9b42cad4a715680a27cd79f466fd2913649b80657ff042528cba2946631387ed9fb027014d215e1baf05839509ca5915d533b91aa958ae0525dea6e2a869b9e4 |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_lzma.pyd
| MD5 | 13258372b5dfb02dbda211215fccb280 |
| SHA1 | cf4133e1ae68c8a68d89bc67bed768bb8c1072a4 |
| SHA256 | 9f76f430165413110c9b4fa1d10cb37e883b3efa79b840aeedcef3df9e092676 |
| SHA512 | bfad643d2c06824b171ce299fe6d55db147171e7c2e3db1038bf5476ffad6c3ec05a8b024316a1d69f739f8f5cbbbc8bca1bfdfb1baa9481a5f2be36fa5138aa |
C:\Users\Admin\AppData\Local\Temp\_MEI27042\_bz2.pyd
| MD5 | 847efeb4166ef379cdf030c605fa3889 |
| SHA1 | f8668295340c91170ba45d8539442727037e4f19 |
| SHA256 | a760d53f6e3fa01fa7aee66a10eb55ad1f10594966c6af97fb0c1c3e16a26a4a |
| SHA512 | 95f1fbde26a4df2a351edff10d72e2a20c80f9b60306199c11492e64e8cfc41d7c01ce9390d4e120657863228b42bf7e090053d9e4ec1be7abe7e50433b7125f |
memory/2880-1339-0x00007FFC9DC60000-0x00007FFC9DC6F000-memory.dmp
memory/2880-1338-0x00007FFC8F200000-0x00007FFC8F223000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI27042\crypto_clipper.json
| MD5 | 6f7984b7fffe835d59f387ec567b62ad |
| SHA1 | 8eb4ed9ea86bf696ef77cbe0ffeeee76f0b39ee0 |
| SHA256 | 519fc78e5abcdba889647540ca681f4bcb75ab57624675fc60d60ab0e8e6b1c5 |
| SHA512 | 51d11368f704920fa5d993a73e3528037b5416213eed5cf1fbbea2817c7c0694518f08a272ad812166e15fcc5223be1bf766e38d3ee23e2528b58500f4c4932a |
memory/2880-1419-0x00007FFC85E60000-0x00007FFC85E75000-memory.dmp
memory/2880-1418-0x00007FFC865C0000-0x00007FFC865CC000-memory.dmp
memory/2880-1417-0x00007FFC86650000-0x00007FFC86662000-memory.dmp
memory/2880-1416-0x00007FFC86670000-0x00007FFC8667D000-memory.dmp
memory/2880-1420-0x00007FFC88250000-0x00007FFC8827E000-memory.dmp
memory/2880-1422-0x00007FFC85E40000-0x00007FFC85E52000-memory.dmp
memory/2880-1421-0x00007FFC867F0000-0x00007FFC868A8000-memory.dmp
memory/2880-1424-0x00007FFC85E20000-0x00007FFC85E34000-memory.dmp
memory/2880-1423-0x00007FFC88220000-0x00007FFC88246000-memory.dmp
memory/2880-1425-0x00007FFC85DF0000-0x00007FFC85E12000-memory.dmp
memory/2880-1427-0x00007FFC85CD0000-0x00007FFC85CE7000-memory.dmp
memory/2880-1431-0x00007FFC85C90000-0x00007FFC85CA1000-memory.dmp
memory/2880-1430-0x00007FFC85BF0000-0x00007FFC85C3D000-memory.dmp
memory/2880-1432-0x00007FFC85BD0000-0x00007FFC85BEE000-memory.dmp
memory/2880-1429-0x00007FFC85CB0000-0x00007FFC85CC9000-memory.dmp
memory/2880-1433-0x00007FFC85B70000-0x00007FFC85BCD000-memory.dmp
memory/2880-1428-0x00007FFC87760000-0x00007FFC87798000-memory.dmp
memory/2880-1426-0x00007FFC866D0000-0x00007FFC867EC000-memory.dmp
memory/2880-1435-0x00007FFC84A00000-0x00007FFC84A2E000-memory.dmp
memory/2880-1436-0x00007FFC849D0000-0x00007FFC849F3000-memory.dmp
memory/2880-1434-0x00007FFC84A30000-0x00007FFC84A59000-memory.dmp
memory/2880-1438-0x00007FFC83D40000-0x00007FFC83EB7000-memory.dmp
memory/2880-1437-0x00007FFC85E60000-0x00007FFC85E75000-memory.dmp
memory/2880-1439-0x00007FFC85B50000-0x00007FFC85B68000-memory.dmp
memory/2880-1446-0x00007FFC85DF0000-0x00007FFC85E12000-memory.dmp
memory/2880-1457-0x00007FFC84A00000-0x00007FFC84A2E000-memory.dmp
memory/2880-1456-0x00007FFC84A30000-0x00007FFC84A59000-memory.dmp
memory/2880-1455-0x00007FFC83D00000-0x00007FFC83D0C000-memory.dmp
memory/2880-1454-0x00007FFC83D10000-0x00007FFC83D1B000-memory.dmp
memory/2880-1453-0x00007FFC83D20000-0x00007FFC83D2B000-memory.dmp
memory/2880-1452-0x00007FFC85BF0000-0x00007FFC85C3D000-memory.dmp
memory/2880-1451-0x00007FFC83D30000-0x00007FFC83D3C000-memory.dmp
memory/2880-1450-0x00007FFC84950000-0x00007FFC8495E000-memory.dmp
memory/2880-1449-0x00007FFC84960000-0x00007FFC8496C000-memory.dmp
memory/2880-1448-0x00007FFC84970000-0x00007FFC8497C000-memory.dmp
memory/2880-1447-0x00007FFC85CD0000-0x00007FFC85CE7000-memory.dmp
memory/2880-1445-0x00007FFC84980000-0x00007FFC8498B000-memory.dmp
memory/2880-1444-0x00007FFC84990000-0x00007FFC8499C000-memory.dmp
memory/2880-1443-0x00007FFC849A0000-0x00007FFC849AB000-memory.dmp
memory/2880-1442-0x00007FFC849B0000-0x00007FFC849BC000-memory.dmp
memory/2880-1441-0x00007FFC849C0000-0x00007FFC849CB000-memory.dmp
memory/2880-1440-0x00007FFC956C0000-0x00007FFC956CB000-memory.dmp
memory/2880-1458-0x00007FFC849D0000-0x00007FFC849F3000-memory.dmp
memory/2880-1460-0x00007FFC83CF0000-0x00007FFC83CFC000-memory.dmp
memory/2880-1463-0x00007FFC83CB0000-0x00007FFC83CBC000-memory.dmp
memory/2880-1462-0x00007FFC83CC0000-0x00007FFC83CD2000-memory.dmp
memory/2880-1461-0x00007FFC83CE0000-0x00007FFC83CED000-memory.dmp
memory/2880-1459-0x00007FFC83D40000-0x00007FFC83EB7000-memory.dmp
memory/2880-1466-0x00007FFC83C70000-0x00007FFC83CA5000-memory.dmp
memory/2880-1468-0x00007FFC83BB0000-0x00007FFC83C6C000-memory.dmp
memory/4996-1467-0x00000188FE880000-0x00000188FE9CE000-memory.dmp
memory/2880-1469-0x00007FFC9AD40000-0x00007FFC9AD6B000-memory.dmp
memory/2880-1470-0x00007FFC852F0000-0x00007FFC85535000-memory.dmp
memory/2880-1480-0x00007FFC81B80000-0x00007FFC82275000-memory.dmp
memory/2880-1481-0x00007FFC84C90000-0x00007FFC84CE5000-memory.dmp
memory/2880-1482-0x00007FFC82F60000-0x00007FFC8323F000-memory.dmp
memory/2880-1483-0x00007FFC6AF00000-0x00007FFC6CFF3000-memory.dmp
memory/2880-1484-0x00007FFC9E8B0000-0x00007FFC9E8C7000-memory.dmp
memory/1244-1505-0x000001F1FE470000-0x000001F1FE5BE000-memory.dmp
memory/2376-1516-0x0000014D44030000-0x0000014D4417E000-memory.dmp
memory/4980-1527-0x0000023533EA0000-0x0000023533FEE000-memory.dmp
memory/2880-1529-0x00007FFC8F200000-0x00007FFC8F223000-memory.dmp
memory/2880-1528-0x00007FFC84240000-0x00007FFC84829000-memory.dmp
memory/2880-1543-0x00007FFC87760000-0x00007FFC87798000-memory.dmp
memory/2880-1567-0x00007FFC85BF0000-0x00007FFC85C3D000-memory.dmp