Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-12-2024 22:10

General

  • Target

    source_prepared.exe

  • Size

    80.7MB

  • MD5

    1f21f059c1eeed0d0dc44103fa9c58d4

  • SHA1

    fd42833b7f5f4a15b96141d807019caca68332d1

  • SHA256

    19e10e37a76ffbbd711bfc9af63c1ef0fdac4d0a5390e6f84db3f59f718d63b5

  • SHA512

    792ec5ab65cdf905dd2541ef558b66ac85b88fb20344274b57a9341aadae809f0fd470045501f1323af766c09e05e1494886199b41fa3bc6a21c201218b2feb1

  • SSDEEP

    1572864:JGKlDWjysmwSk8IpG7V+VPhqFiE7BbliEoiYgj+h58sMw/DBZB:AK51smwSkB05awFVwE65Dt

Score
9/10
upx

Malware Config

Signatures

  • Enumerates VirtualBox DLL files 2 TTPs 2 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
    "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Users\Admin\AppData\Local\Temp\source_prepared.exe
      "C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"
      2⤵
      • Enumerates VirtualBox DLL files
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4596
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:2116
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4c8 0x3c4
      1⤵
        PID:1720

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\SDL2.dll

        Filesize

        635KB

        MD5

        ec3c1d17b379968a4890be9eaab73548

        SHA1

        7dbc6acee3b9860b46c0290a9b94a344d1927578

        SHA256

        aaa11e97c3621ed680ff2388b91acb394173b96a6e8ffbf3b656079cd00a0b9f

        SHA512

        06a7880ec80174b48156acd6614ab42fb4422cd89c62d11a7723a3c872f213bfc6c1006df8bdc918bb79009943d2b65c6a5c5e89ad824d1a940ddd41b88a1edb

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\SDL2_image.dll

        Filesize

        58KB

        MD5

        25e2a737dcda9b99666da75e945227ea

        SHA1

        d38e086a6a0bacbce095db79411c50739f3acea4

        SHA256

        22b27380d4f1f217f0e5d5c767e5c244256386cd9d87f8ddf303baaf9239fc4c

        SHA512

        63de988387047c17fd028a894465286fd8f6f8bd3a1321b104c0ceb5473e3e0b923153b4999143efbdd28684329a33a5b468e43f25214037f6cddd4d1884adb8

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\SDL2_mixer.dll

        Filesize

        124KB

        MD5

        b7b45f61e3bb00ccd4ca92b2a003e3a3

        SHA1

        5018a7c95dc6d01ba6e3a7e77dd26c2c74fd69bc

        SHA256

        1327f84e3509f3ccefeef1c12578faf04e9921c145233687710253bf903ba095

        SHA512

        d3449019824124f3edbda57b3b578713e9c9915e173d31566cd8e4d18f307ac0f710250fe6a906dd53e748db14bfa76ec1b58a6aef7d074c913679a47c5fdbe7

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\SDL2_ttf.dll

        Filesize

        601KB

        MD5

        eb0ce62f775f8bd6209bde245a8d0b93

        SHA1

        5a5d039e0c2a9d763bb65082e09f64c8f3696a71

        SHA256

        74591aab94bb87fc9a2c45264930439bbc0d1525bf2571025cd9804e5a1cd11a

        SHA512

        34993240f14a89179ac95c461353b102ea74e4180f52c206250bb42c4c8427a019ea804b09a6903674ac00ab2a3c4c686a86334e483110e79733696aa17f4eb6

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\VCRUNTIME140.dll

        Filesize

        96KB

        MD5

        f12681a472b9dd04a812e16096514974

        SHA1

        6fd102eb3e0b0e6eef08118d71f28702d1a9067c

        SHA256

        d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

        SHA512

        7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\VCRUNTIME140_1.dll

        Filesize

        37KB

        MD5

        75e78e4bf561031d39f86143753400ff

        SHA1

        324c2a99e39f8992459495182677e91656a05206

        SHA256

        1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

        SHA512

        ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_asyncio.pyd

        Filesize

        34KB

        MD5

        e6307d02076151c6fc9b78b1f346068f

        SHA1

        336cb5b3fc88ff4d9cc021f858ff33b0eb96c881

        SHA256

        fdb2a227d646b420de9877bb569b96369b6175e322f6ef81bc3f372eed08c10b

        SHA512

        7a22e2c293a067502a0d1e4ccc9fcb81dd7bd7faf56a1fd4a6cebc56c5ce4e8bf6c7157e19fe779ed70722d559da61ab5ca1f9b1e1b3df8a2b83728fbac2564c

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_bz2.pyd

        Filesize

        46KB

        MD5

        0c13627f114f346604b0e8cbc03baf29

        SHA1

        bf77611d924df2c80aabcc3f70520d78408587a2

        SHA256

        df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861

        SHA512

        c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_cffi_backend.cp311-win_amd64.pyd

        Filesize

        71KB

        MD5

        c4a0ceacd79d2c06956d24bf1c028a35

        SHA1

        1dfc5c777435a46a69c984411d4dfb717b47c537

        SHA256

        1ec4cd20853191e91e36556c6fe1a8bb14d162ee9904acc897cd8f694089f0e7

        SHA512

        da57381043a500a5bc826215d9c253e22139dd3e9e28a870b03d2d7d486aa8eb1a78a45ba45ee9c86b3a9bb264f20a9a776e5e3ab1e921ea6d0747275410746d

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_ctypes.pyd

        Filesize

        57KB

        MD5

        38fb83bd4febed211bd25e19e1cae555

        SHA1

        4541df6b69d0d52687edb12a878ae2cd44f82db6

        SHA256

        cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65

        SHA512

        f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_decimal.pyd

        Filesize

        104KB

        MD5

        7ba541defe3739a888be466c999c9787

        SHA1

        ad0a4df9523eeeafc1e67b0e4e3d7a6cf9c4dfac

        SHA256

        f90efa10d90d940cde48aafe02c13a0fc0a1f0be7f3714856b7a1435f5decf29

        SHA512

        9194a527a17a505d049161935432fa25ba154e1aee6306dee9054071f249c891f0ca7839de3a21d09b57fdc3f29ee7c4f08237b0dfffafa8f0078cfe464bed3b

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_elementtree.pyd

        Filesize

        56KB

        MD5

        dda8f0cc660c5e8170e37f37394f53ad

        SHA1

        6fea7006e44d0ee320499034e61f0cd99247abda

        SHA256

        58fc4868d87f7e05a387fb39646110307b993757b3e23e52d4489e7cea653dcc

        SHA512

        13cda3936c3b7eace74aed66282a13aa3d63e9da9b761a7fc8d6d0f215b61fc44ef4c4d60bbb0cb8d52689ed1ac05993965f5498da41ee95d6299d4f9a4bf4f5

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_hashlib.pyd

        Filesize

        33KB

        MD5

        596df8ada4b8bc4ae2c2e5bbb41a6c2e

        SHA1

        e814c2e2e874961a18d420c49d34b03c2b87d068

        SHA256

        54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec

        SHA512

        e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_lzma.pyd

        Filesize

        84KB

        MD5

        8d9e1bb65a192c8446155a723c23d4c5

        SHA1

        ea02b1bf175b7ef89ba092720b3daa0c11bef0f0

        SHA256

        1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7

        SHA512

        4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_multiprocessing.pyd

        Filesize

        25KB

        MD5

        b5979368da73ffe9213dd49c0e5d6270

        SHA1

        5cf6ab2e801899cde24f3b356f8c1bff9d935528

        SHA256

        020602164b9891cb1c304d9f70dd8083c7e1a9a42caa9cfd67a5bbc0728029b9

        SHA512

        191823e56c4a3ea8bd211745111861d140899263ebed9b1988d2be37e1ba073195b55548266d6c536793edf49ef82b19064be96992b7bea9171424e789c83352

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_overlapped.pyd

        Filesize

        30KB

        MD5

        96d75944d280f39eb0f8e435511f3222

        SHA1

        0d74eefaf62c80c969bfe2f5e32fc269073527f3

        SHA256

        bfac2d1b1c5b948f6cd70de2e2edbe85f535ace879dbbaa04a71065ea11ef280

        SHA512

        724be702596604d173a542526b2049f268f611c204f03ef642ccf5e946441973704dca6e601bc5fd6dc3cc9a35b8cfd392571fe3228c59e277259097f53b2bf3

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_queue.pyd

        Filesize

        24KB

        MD5

        fbbbfbcdcf0a7c1611e27f4b3b71079e

        SHA1

        56888df9701f9faa86c03168adcd269192887b7b

        SHA256

        699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163

        SHA512

        0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_socket.pyd

        Filesize

        41KB

        MD5

        4351d7086e5221398b5b78906f4e84ac

        SHA1

        ba515a14ec1b076a6a3eab900df57f4f37be104d

        SHA256

        a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe

        SHA512

        a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_sqlite3.pyd

        Filesize

        54KB

        MD5

        d678600c8af1eeeaa5d8c1d668190608

        SHA1

        080404040afc8b6e5206729dd2b9ee7cf2cb70bc

        SHA256

        d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed

        SHA512

        8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_ssl.pyd

        Filesize

        60KB

        MD5

        156b1fa2f11c73ed25f63ee20e6e4b26

        SHA1

        36189a5cde36d31664acbd530575a793fc311384

        SHA256

        a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51

        SHA512

        a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_tkinter.pyd

        Filesize

        36KB

        MD5

        a7d7c6f515f5b49b1204d1376f7621cc

        SHA1

        42000eee9d23ac678103ad3067edfccd5043219f

        SHA256

        3b816042f0c47279b39a2d04347e115404fffbb01de35134fd7db279f55296bc

        SHA512

        f54a3d79ac6a1f0bf88562c7cd004055d29f6bc05beb408e856fc5305f59f061b7a17556e008a549dd12aa9399c99e7fe2321cd5ec7324ab7ce3151b0454e9b8

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\_uuid.pyd

        Filesize

        21KB

        MD5

        4c8ffc5c3b8bb6e969e8c80a132a1cf7

        SHA1

        fef1d1a9b17571fb885aa7f224cc9473b0b9adfe

        SHA256

        b73fd8206c709f352dd26850d181a8ba8b14bad3b3494f61038f45044a3a2d85

        SHA512

        6eca26f968f124f0bac60dd2a184be56cee4f8e74e4fef20c5f3e920d50651f7772d49ed43d4024da6aed11b25be0018ccdb87506ac96e3346ce2d72c4cb223e

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\base_library.zip

        Filesize

        1.4MB

        MD5

        2a138e2ee499d3ba2fc4afaef93b7caa

        SHA1

        508c733341845e94fce7c24b901fc683108df2a8

        SHA256

        130e506ead01b91b60d6d56072c468aeb5457dd0f2ecd6ce17dfcbb7d51a1f8c

        SHA512

        1f61a0fda5676e8ed8d10dfee78267f6d785f9c131f5caf2dd984e18ca9e5866b7658ab7edb2ffd74920a40ffea5cd55c0419f5e9ee57a043105e729e10d820b

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\charset_normalizer\md.cp311-win_amd64.pyd

        Filesize

        9KB

        MD5

        1efb3ad99429fb2d7446992b5542bf0c

        SHA1

        5a9f83bffe14d6a3c84b92774e3e7c812cb2035c

        SHA256

        ffae822ab3f0c8c21f626815e84c3f94023b0faa0ed7af9aa27e20b4fe8a87bc

        SHA512

        bb354ee806be5984998059c51c3868c3202bdce56b970f390d1217fa95088a96fcf01fc862c43f876395aeb556ebae70fad45d11bae7776476d377610000de42

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\crypto_clipper.json

        Filesize

        155B

        MD5

        8bff94a9573315a9d1820d9bb710d97f

        SHA1

        e69a43d343794524b771d0a07fd4cb263e5464d5

        SHA256

        3f7446866f42bcbeb8426324d3ea58f386f3171abe94279ea7ec773a4adde7d7

        SHA512

        d5ece1ea9630488245c578cb22d6d9d902839e53b4550c6232b4fb9389ef6c5d5392426ea4a9e3c461979d6d6aa94ddf3b2755f48e9988864788b530cdfcf80f

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\freetype.dll

        Filesize

        292KB

        MD5

        04a9825dc286549ee3fa29e2b06ca944

        SHA1

        5bed779bf591752bb7aa9428189ec7f3c1137461

        SHA256

        50249f68b4faf85e7cd8d1220b7626a86bc507af9ae400d08c8e365f9ab97cde

        SHA512

        0e937e4de6cbc9d40035b94c289c2798c77c44fc1dc7097201f9fab97c7ff9e56113c06c51693f09908283eda92945b36de67351f893d4e3162e67c078cff4ec

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\libcrypto-1_1.dll

        Filesize

        1.1MB

        MD5

        daa2eed9dceafaef826557ff8a754204

        SHA1

        27d668af7015843104aa5c20ec6bbd30f673e901

        SHA256

        4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

        SHA512

        7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\libffi-8.dll

        Filesize

        24KB

        MD5

        90a6b0264a81bb8436419517c9c232fa

        SHA1

        17b1047158287eb6471416c5df262b50d6fe1aed

        SHA256

        5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79

        SHA512

        1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\libjpeg-9.dll

        Filesize

        108KB

        MD5

        c22b781bb21bffbea478b76ad6ed1a28

        SHA1

        66cc6495ba5e531b0fe22731875250c720262db1

        SHA256

        1eed2385030348c84bbdb75d41d64891be910c27fab8d20fc9e85485fcb569dd

        SHA512

        9b42cad4a715680a27cd79f466fd2913649b80657ff042528cba2946631387ed9fb027014d215e1baf05839509ca5915d533b91aa958ae0525dea6e2a869b9e4

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\libmodplug-1.dll

        Filesize

        117KB

        MD5

        2bb2e7fa60884113f23dcb4fd266c4a6

        SHA1

        36bbd1e8f7ee1747c7007a3c297d429500183d73

        SHA256

        9319bf867ed6007f3c61da139c2ab8b74a4cb68bf56265a101e79396941f6d3b

        SHA512

        1ddd4b9b9238c1744e0a1fe403f136a1def8df94814b405e7b01dd871b3f22a2afe819a26e08752142f127c3efe4ebae8bfd1bd63563d5eb98b4644426f576b2

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\libogg-0.dll

        Filesize

        16KB

        MD5

        0d65168162287df89af79bb9be79f65b

        SHA1

        3e5af700b8c3e1a558105284ecd21b73b765a6dc

        SHA256

        2ec2322aec756b795c2e614dab467ef02c3d67d527ad117f905b3ab0968ccf24

        SHA512

        69af81fd2293c31f456b3c78588bb6a372fe4a449244d74bfe5bfaa3134a0709a685725fa05055cfd261c51a96df4b7ebd8b9e143f0e9312c374e54392f8a2c2

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\libopus-0.dll

        Filesize

        181KB

        MD5

        3fb9d9e8daa2326aad43a5fc5ddab689

        SHA1

        55523c665414233863356d14452146a760747165

        SHA256

        fd8de9169ccf53c5968eec0c90e9ff3a66fb451a5bf063868f3e82007106b491

        SHA512

        f263ea6e0fab84a65fe3a9b6c0fe860919eee828c84b888a5aa52dea540434248d1e810a883a2aff273cd9f22c607db966dd8776e965be6d2cfe1b50a1af1f57

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\libopus-0.x64.dll

        Filesize

        217KB

        MD5

        e56f1b8c782d39fd19b5c9ade735b51b

        SHA1

        3d1dc7e70a655ba9058958a17efabe76953a00b4

        SHA256

        fa8715dd0df84fdedbe4aa17763b2ab0db8941fa33421b6d42e25e59c4ae8732

        SHA512

        b7702e48b20a8991a5c537f5ba22834de8bb4ba55862b75024eace299263963b953606ee29e64d68b438bb0904273c4c20e71f22ccef3f93552c36fb2d1b2c46

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\libopusfile-0.dll

        Filesize

        26KB

        MD5

        2d5274bea7ef82f6158716d392b1be52

        SHA1

        ce2ff6e211450352eec7417a195b74fbd736eb24

        SHA256

        6dea07c27c0cc5763347357e10c3b17af318268f0f17c7b165325ce524a0e8d5

        SHA512

        9973d68b23396b3aa09d2079d18f2c463e807c9c1fdf4b1a5f29d561e8d5e62153e0c7be23b63975ad179b9599ff6b0cf08ebdbe843d194483e7ec3e7aeb232a

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\libpng16-16.dll

        Filesize

        98KB

        MD5

        55009dd953f500022c102cfb3f6a8a6c

        SHA1

        07af9f4d456ddf86a51da1e4e4c5b54b0cf06ddb

        SHA256

        20391787cba331cfbe32fbf22f328a0fd48924e944e80de20ba32886bf4b6fd2

        SHA512

        4423d3ec8fef29782f3d4a21feeac9ba24c9c765d770b2920d47b4fb847a96ff5c793b20373833b4ff8bc3d8fa422159c64beffb78ce5768ed22742740a8c6c6

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\libssl-1_1.dll

        Filesize

        203KB

        MD5

        eac369b3fde5c6e8955bd0b8e31d0830

        SHA1

        4bf77158c18fe3a290e44abd2ac1834675de66b4

        SHA256

        60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

        SHA512

        c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\libtiff-5.dll

        Filesize

        127KB

        MD5

        ebad1fa14342d14a6b30e01ebc6d23c1

        SHA1

        9c4718e98e90f176c57648fa4ed5476f438b80a7

        SHA256

        4f50820827ac76042752809479c357063fe5653188654a6ba4df639da2fbf3ca

        SHA512

        91872eaa1f3f45232ab2d753585e650ded24c6cc8cc1d2a476fa98a61210177bd83570c52594b5ad562fc27cb76e034122f16a922c6910e4ed486da1d3c45c24

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\libwebp-7.dll

        Filesize

        192KB

        MD5

        b0dd211ec05b441767ea7f65a6f87235

        SHA1

        280f45a676c40bd85ed5541ceb4bafc94d7895f3

        SHA256

        fc06b8f92e86b848a17eaf7ed93464f54ed1f129a869868a74a75105ff8ce56e

        SHA512

        eaeb83e46c8ca261e79b3432ec2199f163c44f180eb483d66a71ad530ba488eb4cdbd911633e34696a4ccc035e238bc250a8247f318aa2f0cd9759cad4f90fff

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\portmidi.dll

        Filesize

        18KB

        MD5

        0df0699727e9d2179f7fd85a61c58bdf

        SHA1

        82397ee85472c355725955257c0da207fa19bf59

        SHA256

        97a53e8de3f1b2512f0295b5de98fa7a23023a0e4c4008ae534acdba54110c61

        SHA512

        196e41a34a60de83cb24caa5fc95820fd36371719487350bc2768354edf39eeb6c7860ff3fd9ecf570abb4288523d7ab934e86e85202b9753b135d07180678cd

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\pyexpat.pyd

        Filesize

        86KB

        MD5

        a655fa42e31e30cf60f452b70c01a1a4

        SHA1

        e38b435347a65d39dd2ff8518b75070e6038fb47

        SHA256

        83feb05e74d002110bf8d032c3ad2ffb636ae0ba4300e1ba84ce4add8f0554ec

        SHA512

        e54b38011ea94565ddf88120b8a3718b9cfcb79ca4b4900da1f9338b59795162534dbd2d5bfd67a81d9a29a6675ffdb2dc8772f583ee5bf2de547136334c8831

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\python3.DLL

        Filesize

        64KB

        MD5

        34e49bb1dfddf6037f0001d9aefe7d61

        SHA1

        a25a39dca11cdc195c9ecd49e95657a3e4fe3215

        SHA256

        4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

        SHA512

        edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\python311.dll

        Filesize

        1.6MB

        MD5

        bb46b85029b543b70276ad8e4c238799

        SHA1

        123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

        SHA256

        72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

        SHA512

        5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\select.pyd

        Filesize

        24KB

        MD5

        abf7864db4445bbbd491c8cff0410ae0

        SHA1

        4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7

        SHA256

        ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e

        SHA512

        8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\sqlite3.dll

        Filesize

        608KB

        MD5

        ddd0dd698865a11b0c5077f6dd44a9d7

        SHA1

        46cd75111d2654910f776052cc30b5e1fceb5aee

        SHA256

        a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7

        SHA512

        b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\tcl86t.dll

        Filesize

        673KB

        MD5

        755bec8838059147b46f8e297d05fba2

        SHA1

        9ff0665cddcf1eb7ff8de015b10cc9fcceb49753

        SHA256

        744a13c384e136f373f9dc7f7c2eb2536591ec89304e3fa064cac0f0bf135130

        SHA512

        e61dc700975d28b2257da99b81d135aa7d284c6084877fe81b3cc7b42ac180728f79f4c1663e375680a26f5194ab641c4a40e09f8dbdeb99e1dfa1a57d6f9b34

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\tk86t.dll

        Filesize

        620KB

        MD5

        7d85f7480f2d8389f562723090be1370

        SHA1

        edfa05dc669a8486977e983173ec61cc5097bbb0

        SHA256

        aaeda7b65e1e33c74a807109360435a6b63a2994243c437e0cdaa69d2b8c6ac5

        SHA512

        a886475aeea6c4003dd35e518a0833574742b62cdbbbe5b098a5c0f74e89795ebddac31c4107dae6edee8fc476addaa34253af560d33bed8b9df9192c3e7f084

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\unicodedata.pyd

        Filesize

        293KB

        MD5

        bb3fca6f17c9510b6fb42101fe802e3c

        SHA1

        cb576f3dbb95dc5420d740fd6d7109ef2da8a99d

        SHA256

        5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87

        SHA512

        05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2

      • C:\Users\Admin\AppData\Local\Temp\_MEI42122\zlib1.dll

        Filesize

        52KB

        MD5

        ee06185c239216ad4c70f74e7c011aa6

        SHA1

        40e66b92ff38c9b1216511d5b1119fe9da6c2703

        SHA256

        0391066f3e6385a9c0fe7218c38f7bd0b3e0da0f15a98ebb07f1ac38d6175466

        SHA512

        baae562a53d491e19dbf7ee2cff4c13d42de6833036bfdaed9ed441bcbf004b68e4088bd453b7413d60faaf1b334aee71241ba468437d49050b8ccfa9232425d

      • memory/4596-1347-0x00007FFD0B480000-0x00007FFD0B7F5000-memory.dmp

        Filesize

        3.5MB

      • memory/4596-1389-0x00007FFD0CEF0000-0x00007FFD0CF1E000-memory.dmp

        Filesize

        184KB

      • memory/4596-1276-0x00007FFD1B920000-0x00007FFD1B944000-memory.dmp

        Filesize

        144KB

      • memory/4596-1282-0x00007FFD1B900000-0x00007FFD1B919000-memory.dmp

        Filesize

        100KB

      • memory/4596-1325-0x00007FFD1B3C0000-0x00007FFD1B3D4000-memory.dmp

        Filesize

        80KB

      • memory/4596-1327-0x00007FFD0B480000-0x00007FFD0B7F5000-memory.dmp

        Filesize

        3.5MB

      • memory/4596-1329-0x00007FFD1B3A0000-0x00007FFD1B3B9000-memory.dmp

        Filesize

        100KB

      • memory/4596-1331-0x00007FFD1BCC0000-0x00007FFD1BCCD000-memory.dmp

        Filesize

        52KB

      • memory/4596-1333-0x00007FFD1B370000-0x00007FFD1B39E000-memory.dmp

        Filesize

        184KB

      • memory/4596-1336-0x00007FFD0CAE0000-0x00007FFD0CB98000-memory.dmp

        Filesize

        736KB

      • memory/4596-1335-0x00007FFD0B800000-0x00007FFD0BDE8000-memory.dmp

        Filesize

        5.9MB

      • memory/4596-1339-0x00007FFD1B920000-0x00007FFD1B944000-memory.dmp

        Filesize

        144KB

      • memory/4596-1343-0x00007FFD1B340000-0x00007FFD1B367000-memory.dmp

        Filesize

        156KB

      • memory/4596-1342-0x00007FFD1BB20000-0x00007FFD1BB2B000-memory.dmp

        Filesize

        44KB

      • memory/4596-1344-0x00007FFD0C9C0000-0x00007FFD0CADC000-memory.dmp

        Filesize

        1.1MB

      • memory/4596-1323-0x00007FFD1B3E0000-0x00007FFD1B40D000-memory.dmp

        Filesize

        180KB

      • memory/4596-1340-0x00007FFD233F0000-0x00007FFD233FD000-memory.dmp

        Filesize

        52KB

      • memory/4596-1346-0x00007FFD1B300000-0x00007FFD1B337000-memory.dmp

        Filesize

        220KB

      • memory/4596-1345-0x00007FFD1B3C0000-0x00007FFD1B3D4000-memory.dmp

        Filesize

        80KB

      • memory/4596-1360-0x00007FFD1B080000-0x00007FFD1B08B000-memory.dmp

        Filesize

        44KB

      • memory/4596-1359-0x00007FFD1B090000-0x00007FFD1B09B000-memory.dmp

        Filesize

        44KB

      • memory/4596-1358-0x00007FFD1B3A0000-0x00007FFD1B3B9000-memory.dmp

        Filesize

        100KB

      • memory/4596-1357-0x00007FFD1B0B0000-0x00007FFD1B0BE000-memory.dmp

        Filesize

        56KB

      • memory/4596-1356-0x00007FFD1B0A0000-0x00007FFD1B0AC000-memory.dmp

        Filesize

        48KB

      • memory/4596-1355-0x00007FFD1B0C0000-0x00007FFD1B0CD000-memory.dmp

        Filesize

        52KB

      • memory/4596-1354-0x00007FFD1B0D0000-0x00007FFD1B0DC000-memory.dmp

        Filesize

        48KB

      • memory/4596-1353-0x00007FFD1B2C0000-0x00007FFD1B2CB000-memory.dmp

        Filesize

        44KB

      • memory/4596-1352-0x00007FFD1B2D0000-0x00007FFD1B2DC000-memory.dmp

        Filesize

        48KB

      • memory/4596-1351-0x00007FFD1B2E0000-0x00007FFD1B2EB000-memory.dmp

        Filesize

        44KB

      • memory/4596-1350-0x00007FFD1B2F0000-0x00007FFD1B2FC000-memory.dmp

        Filesize

        48KB

      • memory/4596-1349-0x00007FFD1B780000-0x00007FFD1B78B000-memory.dmp

        Filesize

        44KB

      • memory/4596-1348-0x00007FFD1B8D0000-0x00007FFD1B8DB000-memory.dmp

        Filesize

        44KB

      • memory/4596-1362-0x00007FFD0CAE0000-0x00007FFD0CB98000-memory.dmp

        Filesize

        736KB

      • memory/4596-1364-0x00007FFD1AFF0000-0x00007FFD1AFFB000-memory.dmp

        Filesize

        44KB

      • memory/4596-1363-0x00007FFD1B070000-0x00007FFD1B07C000-memory.dmp

        Filesize

        48KB

      • memory/4596-1361-0x00007FFD1B370000-0x00007FFD1B39E000-memory.dmp

        Filesize

        184KB

      • memory/4596-1268-0x00007FFD0B800000-0x00007FFD0BDE8000-memory.dmp

        Filesize

        5.9MB

      • memory/4596-1365-0x00007FFD1AFE0000-0x00007FFD1AFED000-memory.dmp

        Filesize

        52KB

      • memory/4596-1366-0x00007FFD19D20000-0x00007FFD19D32000-memory.dmp

        Filesize

        72KB

      • memory/4596-1369-0x00007FFD18C90000-0x00007FFD18C9C000-memory.dmp

        Filesize

        48KB

      • memory/4596-1368-0x00007FFD0C9C0000-0x00007FFD0CADC000-memory.dmp

        Filesize

        1.1MB

      • memory/4596-1367-0x00007FFD1B340000-0x00007FFD1B367000-memory.dmp

        Filesize

        156KB

      • memory/4596-1370-0x00007FFD18C70000-0x00007FFD18C85000-memory.dmp

        Filesize

        84KB

      • memory/4596-1372-0x00007FFD17FF0000-0x00007FFD18002000-memory.dmp

        Filesize

        72KB

      • memory/4596-1371-0x00007FFD1B300000-0x00007FFD1B337000-memory.dmp

        Filesize

        220KB

      • memory/4596-1376-0x00007FFD17F60000-0x00007FFD17F7B000-memory.dmp

        Filesize

        108KB

      • memory/4596-1375-0x00007FFD1B080000-0x00007FFD1B08B000-memory.dmp

        Filesize

        44KB

      • memory/4596-1374-0x00007FFD17F80000-0x00007FFD17FA2000-memory.dmp

        Filesize

        136KB

      • memory/4596-1373-0x00007FFD17FB0000-0x00007FFD17FC4000-memory.dmp

        Filesize

        80KB

      • memory/4596-1378-0x00007FFD13DE0000-0x00007FFD13DF9000-memory.dmp

        Filesize

        100KB

      • memory/4596-1377-0x00007FFD1AFF0000-0x00007FFD1AFFB000-memory.dmp

        Filesize

        44KB

      • memory/4596-1379-0x00007FFD13D90000-0x00007FFD13DDD000-memory.dmp

        Filesize

        308KB

      • memory/4596-1380-0x00007FFD13D70000-0x00007FFD13D81000-memory.dmp

        Filesize

        68KB

      • memory/4596-1382-0x00007FFD12A80000-0x00007FFD12AB2000-memory.dmp

        Filesize

        200KB

      • memory/4596-1381-0x00007FFD19D20000-0x00007FFD19D32000-memory.dmp

        Filesize

        72KB

      • memory/4596-1383-0x00007FFD18C60000-0x00007FFD18C6A000-memory.dmp

        Filesize

        40KB

      • memory/4596-1385-0x00007FFD17760000-0x00007FFD1777E000-memory.dmp

        Filesize

        120KB

      • memory/4596-1384-0x00007FFD18C70000-0x00007FFD18C85000-memory.dmp

        Filesize

        84KB

      • memory/4596-1386-0x00007FFD123A0000-0x00007FFD123FD000-memory.dmp

        Filesize

        372KB

      • memory/4596-1388-0x00007FFD12A50000-0x00007FFD12A79000-memory.dmp

        Filesize

        164KB

      • memory/4596-1387-0x00007FFD17F80000-0x00007FFD17FA2000-memory.dmp

        Filesize

        136KB

      • memory/4596-1279-0x00007FFD1BEA0000-0x00007FFD1BEAF000-memory.dmp

        Filesize

        60KB

      • memory/4596-1390-0x00007FFD17F60000-0x00007FFD17F7B000-memory.dmp

        Filesize

        108KB

      • memory/4596-1393-0x00007FFD0C810000-0x00007FFD0C983000-memory.dmp

        Filesize

        1.4MB

      • memory/4596-1392-0x00007FFD13DE0000-0x00007FFD13DF9000-memory.dmp

        Filesize

        100KB

      • memory/4596-1391-0x00007FFD0C990000-0x00007FFD0C9B3000-memory.dmp

        Filesize

        140KB

      • memory/4596-1395-0x00007FFD17740000-0x00007FFD17758000-memory.dmp

        Filesize

        96KB

      • memory/4596-1394-0x00007FFD13D90000-0x00007FFD13DDD000-memory.dmp

        Filesize

        308KB

      • memory/4596-1397-0x00007FFD186B0000-0x00007FFD186BB000-memory.dmp

        Filesize

        44KB

      • memory/4596-1396-0x00007FFD13D70000-0x00007FFD13D81000-memory.dmp

        Filesize

        68KB

      • memory/4596-1399-0x00007FFD17F50000-0x00007FFD17F5B000-memory.dmp

        Filesize

        44KB

      • memory/4596-1398-0x00007FFD12A80000-0x00007FFD12AB2000-memory.dmp

        Filesize

        200KB

      • memory/4596-1404-0x00007FFD0CEE0000-0x00007FFD0CEEC000-memory.dmp

        Filesize

        48KB

      • memory/4596-1405-0x00007FFD18C60000-0x00007FFD18C6A000-memory.dmp

        Filesize

        40KB

      • memory/4596-1417-0x00007FFD123A0000-0x00007FFD123FD000-memory.dmp

        Filesize

        372KB

      • memory/4596-1416-0x00007FFD0C780000-0x00007FFD0C78C000-memory.dmp

        Filesize

        48KB

      • memory/4596-1415-0x00007FFD0C790000-0x00007FFD0C7A2000-memory.dmp

        Filesize

        72KB

      • memory/4596-1414-0x00007FFD0C7B0000-0x00007FFD0C7BD000-memory.dmp

        Filesize

        52KB

      • memory/4596-1413-0x00007FFD0C7C0000-0x00007FFD0C7CB000-memory.dmp

        Filesize

        44KB

      • memory/4596-1412-0x00007FFD0C7D0000-0x00007FFD0C7DC000-memory.dmp

        Filesize

        48KB

      • memory/4596-1411-0x00007FFD0C7E0000-0x00007FFD0C7EB000-memory.dmp

        Filesize

        44KB

      • memory/4596-1410-0x00007FFD0C7F0000-0x00007FFD0C7FB000-memory.dmp

        Filesize

        44KB

      • memory/4596-1409-0x00007FFD0C800000-0x00007FFD0C80C000-memory.dmp

        Filesize

        48KB

      • memory/4596-1408-0x00007FFD0CDC0000-0x00007FFD0CDCE000-memory.dmp

        Filesize

        56KB

      • memory/4596-1407-0x00007FFD0CED0000-0x00007FFD0CEDD000-memory.dmp

        Filesize

        52KB

      • memory/4596-1406-0x00007FFD17760000-0x00007FFD1777E000-memory.dmp

        Filesize

        120KB

      • memory/4596-1403-0x00007FFD0D0A0000-0x00007FFD0D0AB000-memory.dmp

        Filesize

        44KB

      • memory/4596-1402-0x00007FFD12390000-0x00007FFD1239C000-memory.dmp

        Filesize

        48KB

      • memory/4596-1401-0x00007FFD12A40000-0x00007FFD12A4B000-memory.dmp

        Filesize

        44KB

      • memory/4596-1400-0x00007FFD14B80000-0x00007FFD14B8C000-memory.dmp

        Filesize

        48KB

      • memory/4596-1419-0x00007FFD0C740000-0x00007FFD0C775000-memory.dmp

        Filesize

        212KB

      • memory/4596-1418-0x00007FFD12A50000-0x00007FFD12A79000-memory.dmp

        Filesize

        164KB

      • memory/4596-1422-0x00007FFD0C680000-0x00007FFD0C73C000-memory.dmp

        Filesize

        752KB

      • memory/4596-1421-0x00007FFD0C990000-0x00007FFD0C9B3000-memory.dmp

        Filesize

        140KB

      • memory/4596-1420-0x00007FFD0CEF0000-0x00007FFD0CF1E000-memory.dmp

        Filesize

        184KB

      • memory/4596-1423-0x00007FFD0C570000-0x00007FFD0C59B000-memory.dmp

        Filesize

        172KB

      • memory/4596-1465-0x00007FFD1B370000-0x00007FFD1B39E000-memory.dmp

        Filesize

        184KB

      • memory/4596-1464-0x00007FFD1BCC0000-0x00007FFD1BCCD000-memory.dmp

        Filesize

        52KB

      • memory/4596-1456-0x00007FFD0B800000-0x00007FFD0BDE8000-memory.dmp

        Filesize

        5.9MB

      • memory/4596-1481-0x00007FFD0C990000-0x00007FFD0C9B3000-memory.dmp

        Filesize

        140KB

      • memory/4596-1480-0x00007FFD12A80000-0x00007FFD12AB2000-memory.dmp

        Filesize

        200KB

      • memory/4596-1479-0x00007FFD13D70000-0x00007FFD13D81000-memory.dmp

        Filesize

        68KB

      • memory/4596-1478-0x00007FFD13D90000-0x00007FFD13DDD000-memory.dmp

        Filesize

        308KB

      • memory/4596-1477-0x00007FFD13DE0000-0x00007FFD13DF9000-memory.dmp

        Filesize

        100KB

      • memory/4596-1476-0x00007FFD17F60000-0x00007FFD17F7B000-memory.dmp

        Filesize

        108KB

      • memory/4596-1475-0x00007FFD17F80000-0x00007FFD17FA2000-memory.dmp

        Filesize

        136KB

      • memory/4596-1474-0x00007FFD17FB0000-0x00007FFD17FC4000-memory.dmp

        Filesize

        80KB

      • memory/4596-1473-0x00007FFD17FF0000-0x00007FFD18002000-memory.dmp

        Filesize

        72KB

      • memory/4596-1472-0x00007FFD18C70000-0x00007FFD18C85000-memory.dmp

        Filesize

        84KB

      • memory/4596-1471-0x00007FFD1B300000-0x00007FFD1B337000-memory.dmp

        Filesize

        220KB

      • memory/4596-1470-0x00007FFD0C9C0000-0x00007FFD0CADC000-memory.dmp

        Filesize

        1.1MB

      • memory/4596-1469-0x00007FFD1B340000-0x00007FFD1B367000-memory.dmp

        Filesize

        156KB

      • memory/4596-1468-0x00007FFD1BB20000-0x00007FFD1BB2B000-memory.dmp

        Filesize

        44KB

      • memory/4596-1467-0x00007FFD233F0000-0x00007FFD233FD000-memory.dmp

        Filesize

        52KB

      • memory/4596-1466-0x00007FFD0CAE0000-0x00007FFD0CB98000-memory.dmp

        Filesize

        736KB

      • memory/4596-1463-0x00007FFD1B3A0000-0x00007FFD1B3B9000-memory.dmp

        Filesize

        100KB

      • memory/4596-1462-0x00007FFD0B480000-0x00007FFD0B7F5000-memory.dmp

        Filesize

        3.5MB

      • memory/4596-1461-0x00007FFD1B3C0000-0x00007FFD1B3D4000-memory.dmp

        Filesize

        80KB

      • memory/4596-1460-0x00007FFD1B3E0000-0x00007FFD1B40D000-memory.dmp

        Filesize

        180KB

      • memory/4596-1459-0x00007FFD1B900000-0x00007FFD1B919000-memory.dmp

        Filesize

        100KB

      • memory/4596-1458-0x00007FFD1BEA0000-0x00007FFD1BEAF000-memory.dmp

        Filesize

        60KB

      • memory/4596-1457-0x00007FFD1B920000-0x00007FFD1B944000-memory.dmp

        Filesize

        144KB