Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

04/10/2024, 15:16

241004-snqhja1ejk 7

04/10/2024, 15:04

241004-sfzfga1all 7

Analysis

  • max time kernel
    28s
  • max time network
    24s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 15:04

General

  • Target

    minecraft.exe

  • Size

    14.0MB

  • MD5

    c472b83a60aa74c29765d96e691da702

  • SHA1

    616cdd8d01bac7c0feb928e51a3ed5b69dae096c

  • SHA256

    94d4b2ce684cebf2ef20fc14b78041a257cf50e2197a6ce6bec74f2470590379

  • SHA512

    1fdfbe354c90574fd48ad8c285a4cd2e99d8d0726fdb61515a132c425f318f472406aafc8e55dcbaa7492ef276cac990bbaff4e97698fdee27b127d1f15440d0

  • SSDEEP

    393216:7ZV2+W80KygpgPYVnNSMF1+TtIiLQSUau504NsIy5HVZ14:7HPW80KygpgPQH1QtI2a50DIaZi

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 21 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\minecraft.exe
    "C:\Users\Admin\AppData\Local\Temp\minecraft.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Users\Admin\AppData\Local\Temp\minecraft.exe
      "C:\Users\Admin\AppData\Local\Temp\minecraft.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4016
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youtube.com/conetic
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xdc,0x104,0x7ffe22d246f8,0x7ffe22d24708,0x7ffe22d24718
          4⤵
            PID:4968
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,696556437174458338,2495319231795736544,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
            4⤵
              PID:4792
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,696556437174458338,2495319231795736544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:4372
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,696556437174458338,2495319231795736544,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
              4⤵
                PID:1364
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,696556437174458338,2495319231795736544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2884 /prefetch:1
                4⤵
                  PID:2696
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,696556437174458338,2495319231795736544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2892 /prefetch:1
                  4⤵
                    PID:872
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,696556437174458338,2495319231795736544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
                    4⤵
                      PID:720
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,696556437174458338,2495319231795736544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
                      4⤵
                        PID:4744
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,696556437174458338,2495319231795736544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
                        4⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5488
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/olliesmarket
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4224
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffe22d246f8,0x7ffe22d24708,0x7ffe22d24718
                        4⤵
                          PID:4088
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15695218018098590185,17642144452752530770,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
                          4⤵
                            PID:4460
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15695218018098590185,17642144452752530770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4356
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:4344
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:3168
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4844
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3848

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              ff63763eedb406987ced076e36ec9acf

                              SHA1

                              16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

                              SHA256

                              8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

                              SHA512

                              ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              2783c40400a8912a79cfd383da731086

                              SHA1

                              001a131fe399c30973089e18358818090ca81789

                              SHA256

                              331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

                              SHA512

                              b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              632B

                              MD5

                              69e340f7311d33276e1711bd3d7ced87

                              SHA1

                              77a212efd82cb0f1ba8d8f1cf7a769b08dba9b6b

                              SHA256

                              eb4a8d2174ae2a67b64b349b9e4fc8a4a9ed7d1331f90ccf708befdc51dbb052

                              SHA512

                              94f96cde67b3269248a5a9627835f6b50866981933c542152455dfffce146d3be2c8258ac969b883426c0e68ad5032e252ca514245d18793ddc3a950bad70c04

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              75ef1f2e0e6272eff231dce70a5d2d22

                              SHA1

                              0be646889157e0175ad00eabaafeeefce522bb6e

                              SHA256

                              02cccfb35e9b5324af21c09eff566e3cf47d5fe80ace1539728204f58a47bfd9

                              SHA512

                              318364d9d58f51731253a57190514cbe39696206e1caf13af029cbb8f0178a6ea29e80555d5fd713af50badf2aa5ccaa33003098044b4f8a59fd8e90432be175

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              015735d6083206341cd81c99354cd986

                              SHA1

                              8018621cf25526d4bdb44121f20213d724c9d285

                              SHA256

                              e832d81c708d54208ca8af79c8794c7f23279a280987446c750c48eb9c9069e0

                              SHA512

                              c2cc55e3dea0b052dffa765c9629c99280b70fd58fac39bfec3b9b5472c5a4465a89d866edb088cee3b0b765a68a20d2c47c39ca5aca81d69cd1b833cacfc2b2

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              10KB

                              MD5

                              9e39b094d86efb53a1a9f6f06b6f79a4

                              SHA1

                              3be03ae8346088754e5c124958b42e801a354af6

                              SHA256

                              1e8dbb5ba2469d8585721359e066a18a04077ee94dae1c6dd8f8a9ed807e9350

                              SHA512

                              fef5f0032ea9e8d751fab85254a68ef773fb6a4b3295edd70cf12b25b67db1b1f641e34d7e2ebfd778185f936222732eb1f01ccd9b219ceee878e2b2c530410e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              8KB

                              MD5

                              514c79cad053c0fcdac2b682cd606706

                              SHA1

                              8d1f88c583f11eb3b5c6dee00b48f1185152bf00

                              SHA256

                              abf8dd3358a9fbe662930adbb9317011573d38f66a25bc518a07e9568c6e87a7

                              SHA512

                              6a47108b587e69e4c2648aa6a9d5ec6213b1039e94d6c0f7ebaa6b7a697ed3297a8307416d4bf9c3b9b7d06005f9ea35850b83076834c4434ee083d3b208eb89

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\VCRUNTIME140.dll

                              Filesize

                              116KB

                              MD5

                              be8dbe2dc77ebe7f88f910c61aec691a

                              SHA1

                              a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                              SHA256

                              4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                              SHA512

                              0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\_bz2.pyd

                              Filesize

                              83KB

                              MD5

                              dd26ed92888de9c57660a7ad631bb916

                              SHA1

                              77d479d44d9e04f0a1355569332233459b69a154

                              SHA256

                              324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697

                              SHA512

                              d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\_cffi_backend.cp312-win_amd64.pyd

                              Filesize

                              178KB

                              MD5

                              0572b13646141d0b1a5718e35549577c

                              SHA1

                              eeb40363c1f456c1c612d3c7e4923210eae4cdf7

                              SHA256

                              d8a76d1e31bbd62a482dea9115fc1a109cb39af4cf6d1323409175f3c93113a7

                              SHA512

                              67c28432ca8b389acc26e47eb8c4977fddd4af9214819f89df07fecbc8ed750d5f35807a1b195508dd1d77e2a7a9d7265049dcfbfe7665a7fd1ba45da1e4e842

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\_decimal.pyd

                              Filesize

                              251KB

                              MD5

                              cea3b419c7ca87140a157629c6dbd299

                              SHA1

                              7dbff775235b1937b150ae70302b3208833dc9be

                              SHA256

                              95b9850e6fb335b235589dd1348e007507c6b28e332c9abb111f2a0035c358e5

                              SHA512

                              6e3a6781c0f05bb5182073cca1e69b6df55f05ff7cdcea394bacf50f88605e2241b7387f1d8ba9f40a96832d04f55edb80003f0cf1e537a26f99408ee9312f5b

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\_hashlib.pyd

                              Filesize

                              64KB

                              MD5

                              d19cb5ca144ae1fd29b6395b0225cf40

                              SHA1

                              5b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4

                              SHA256

                              f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa

                              SHA512

                              9ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\_lzma.pyd

                              Filesize

                              156KB

                              MD5

                              8cfbafe65d6e38dde8e2e8006b66bb3e

                              SHA1

                              cb63addd102e47c777d55753c00c29c547e2243c

                              SHA256

                              6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff

                              SHA512

                              fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\_queue.pyd

                              Filesize

                              31KB

                              MD5

                              7d91dd8e5f1dbc3058ea399f5f31c1e6

                              SHA1

                              b983653b9f2df66e721ece95f086c2f933d303fc

                              SHA256

                              76bba42b1392dc57a867aef385b990fa302a4f1dcf453705ac119c9c98a36e8d

                              SHA512

                              b8e7369da79255a4bb2ed91ba0c313b4578ee45c94e6bc74582fc14f8b2984ed8fcda0434a5bd3b72ea704e6e8fd8cbf1901f325e774475e4f28961483d6c7cf

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\_socket.pyd

                              Filesize

                              81KB

                              MD5

                              e43aed7d6a8bcd9ddfc59c2d1a2c4b02

                              SHA1

                              36f367f68fb9868412246725b604b27b5019d747

                              SHA256

                              2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a

                              SHA512

                              d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\_ssl.pyd

                              Filesize

                              174KB

                              MD5

                              6a2b0f8f50b47d05f96deff7883c1270

                              SHA1

                              2b1aeb6fe9a12e0d527b042512fc8890eedb10d8

                              SHA256

                              68dad60ff6fb36c88ef1c47d1855517bfe8de0f5ddea0f630b65b622a645d53a

                              SHA512

                              a080190d4e7e1abb186776ae6e83dab4b21a77093a88fca59ce1f63c683f549a28d094818a0ee44186ddea2095111f1879008c0d631fc4a8d69dd596ef76ca37

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\_tcl_data\encoding\cp1252.enc

                              Filesize

                              1KB

                              MD5

                              e9117326c06fee02c478027cb625c7d8

                              SHA1

                              2ed4092d573289925a5b71625cf43cc82b901daf

                              SHA256

                              741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e

                              SHA512

                              d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\_tkinter.pyd

                              Filesize

                              64KB

                              MD5

                              e38a6b96f5cc200f21da22d49e321da3

                              SHA1

                              4ea69d2b021277ab0b473cfd44e4bfd17e3bac3b

                              SHA256

                              f0ebdf2ca7b33c26b8938efa59678068d3840957ee79d2b3c576437f8f913f20

                              SHA512

                              3df55cdd44ea4789fb2de9672f421b7ff9ad798917417dcb5b1d8575804306fb7636d436965598085d2e87256ecb476ed69df7af05986f05b9f4a18eed9629e2

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\base_library.zip

                              Filesize

                              1.3MB

                              MD5

                              b87e5800fc1d89323217c20b47bb3c06

                              SHA1

                              561f6540611a88fb9b4b2824d431f454d5e2b66d

                              SHA256

                              5fc06d7643743f494980821adc434631adcf60c0c7674432ca61d308a093e8db

                              SHA512

                              8cbef7efd8dd1ea0ab407c7cb84b352694698c109c7d330c765ba590bdb8019a09b576a8759ad522b6259c422f376faee9b8665dc83a86690b55b97df6f36c3c

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\charset_normalizer\md.cp312-win_amd64.pyd

                              Filesize

                              10KB

                              MD5

                              d9e0217a89d9b9d1d778f7e197e0c191

                              SHA1

                              ec692661fcc0b89e0c3bde1773a6168d285b4f0d

                              SHA256

                              ecf12e2c0a00c0ed4e2343ea956d78eed55e5a36ba49773633b2dfe7b04335c0

                              SHA512

                              3b788ac88c1f2d682c1721c61d223a529697c7e43280686b914467b3b39e7d6debaff4c0e2f42e9dddb28b522f37cb5a3011e91c66d911609c63509f9228133d

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

                              Filesize

                              120KB

                              MD5

                              bf9a9da1cf3c98346002648c3eae6dcf

                              SHA1

                              db16c09fdc1722631a7a9c465bfe173d94eb5d8b

                              SHA256

                              4107b1d6f11d842074a9f21323290bbe97e8eed4aa778fbc348ee09cc4fa4637

                              SHA512

                              7371407d12e632fc8fb031393838d36e6a1fe1e978ced36ff750d84e183cde6dd20f75074f4597742c9f8d6f87af12794c589d596a81b920c6c62ee2ba2e5654

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\libcrypto-3.dll

                              Filesize

                              5.0MB

                              MD5

                              e547cf6d296a88f5b1c352c116df7c0c

                              SHA1

                              cafa14e0367f7c13ad140fd556f10f320a039783

                              SHA256

                              05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

                              SHA512

                              9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\libssl-3.dll

                              Filesize

                              768KB

                              MD5

                              19a2aba25456181d5fb572d88ac0e73e

                              SHA1

                              656ca8cdfc9c3a6379536e2027e93408851483db

                              SHA256

                              2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

                              SHA512

                              df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\python3.dll

                              Filesize

                              66KB

                              MD5

                              8dbe9bbf7118f4862e02cd2aaf43f1ab

                              SHA1

                              935bc8c5cea4502d0facf0c49c5f2b9c138608ed

                              SHA256

                              29f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db

                              SHA512

                              938f8387dcc356012ac4a952d371664700b110f7111fcc24f5df7d79791ae95bad0dbaf77d2d6c86c820bfd48a6bdbe8858b7e7ae1a77df88e596556c7135ed4

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\python312.dll

                              Filesize

                              6.6MB

                              MD5

                              cae8fa4e7cb32da83acf655c2c39d9e1

                              SHA1

                              7a0055588a2d232be8c56791642cb0f5abbc71f8

                              SHA256

                              8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93

                              SHA512

                              db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\select.pyd

                              Filesize

                              30KB

                              MD5

                              79ce1ae3a23dff6ed5fc66e6416600cd

                              SHA1

                              6204374d99144b0a26fd1d61940ff4f0d17c2212

                              SHA256

                              678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0

                              SHA512

                              a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\tcl86t.dll

                              Filesize

                              1.7MB

                              MD5

                              3ae729942d15f4f48b1ea8c91880f1f4

                              SHA1

                              d27596d14af5adeb02edab74859b763bf6ac2853

                              SHA256

                              fe62ca2b01b0ec8a609b48f165ca9c6a91653d3966239243ad352dd4c8961760

                              SHA512

                              355800e9152daad675428421b867b6d48e2c8f8be9ca0284f221f27fae198c8f07d90980e04d807b50a88f92ffb946dc53b7564e080e2e0684f7f6ccc84ff245

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\tk86t.dll

                              Filesize

                              1.5MB

                              MD5

                              966580716c0d6b7eec217071a6df6796

                              SHA1

                              e3d2d4a7ec61d920130d7a745586ceb7aad4184d

                              SHA256

                              afc13fce0690c0a4b449ec7ed4fb0233a8359911c1c0ba26a285f32895dbb3d2

                              SHA512

                              cf0675ea888a6d1547842bcfb27d45815b164337b4a285253716917eb157c6df3cc97cba8ad2ab7096e8f5131889957e0555bae9b5a8b64745ac3d2f174e3224

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\unicodedata.pyd

                              Filesize

                              1.1MB

                              MD5

                              b848e259fabaf32b4b3c980a0a12488d

                              SHA1

                              da2e864e18521c86c7d8968db74bb2b28e4c23e2

                              SHA256

                              c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c

                              SHA512

                              4c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27

                            • C:\Users\Admin\AppData\Local\Temp\_MEI46442\zlib1.dll

                              Filesize

                              143KB

                              MD5

                              4fadeda3c1da95337b67d15c282d49d8

                              SHA1

                              f49ee3256f8f5746515194114f7ef73d6b6141c0

                              SHA256

                              28484bcea1e387c4a41564af8f62c040fe203fe2491e415ce90f3d7f5c7ab013

                              SHA512

                              45634caf9d9214f0e45e11a1539d8663b45527e1ae9282558b5fdb8465d90b0fabcf4c0e508504427a597ba390c029bc12068ac17d842fd0fcbb1886d252c6b1

                            • memory/4016-1000-0x00007FFE28C10000-0x00007FFE28C3A000-memory.dmp

                              Filesize

                              168KB