xworm | 6d02f6dd58e131cad086c3366a6e75bec7dc4a18c1caeb509c14f5b6e5a175b6

Analysis

max time kernel
125s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20250217-de
resource tags

arch:x64arch:x86image:win10v2004-20250217-delocale:de-deos:windows10-2004-x64systemwindows
submitted
01/03/2025, 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

t.exe
Size

28.2MB
MD5

32537fc4fb43f3e452ebc55efa9c009c
SHA1

106ae40680c3776de02ab2af413f6514d72c600f
SHA256

6d02f6dd58e131cad086c3366a6e75bec7dc4a18c1caeb509c14f5b6e5a175b6
SHA512

4769bce8d9605ca45611d0cab7ac9df257e677b6c70c1610a8a0bd85393dff80fd3e9c78b72654e6b316e4e5885694e62812fd3bf14b8a5908b791ab46005745
SSDEEP

786432:Ntu0coshxWHVn6s6b64G71jaoCo1Ha2XykT9nCnx89f:bu0jyC6Fb6V71JCo1RjSG

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

thetest.selfhost.co:1339

Mutex

PQkNYlnsnnFAImsR

Attributes

Install_directory
%AppData%
install_file
DirectOutputService.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2036-374-0x0000000000E50000-0x0000000000E8E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2084	powershell.exe
1424	powershell.exe
1560	powershell.exe
752	powershell.exe
4756	powershell.exe
1624	powershell.exe
4132	powershell.exe
4128	powershell.exe
1508	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation	oZNInEIXMZ.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Roblox.lnk	oZNInEIXMZ.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Roblox.lnk	oZNInEIXMZ.exe

Executes dropped EXE 2 IoCs

pid	Process
2036	oZNInEIXMZ.exe
2332	Roblox

Loads dropped DLL 37 IoCs

pid	Process
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe
1064	t.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Roblox = "C:\\Users\\Admin\\AppData\\Roaming\\Roblox"	oZNInEIXMZ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4520	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2036	oZNInEIXMZ.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2084	powershell.exe
2084	powershell.exe
1424	powershell.exe
1424	powershell.exe
1560	powershell.exe
1560	powershell.exe
752	powershell.exe
752	powershell.exe
752	powershell.exe
1508	powershell.exe
1508	powershell.exe
1508	powershell.exe
4756	powershell.exe
4756	powershell.exe
4756	powershell.exe
1624	powershell.exe
1624	powershell.exe
1624	powershell.exe
4132	powershell.exe
4132	powershell.exe
4132	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
2036	oZNInEIXMZ.exe
2984	msedge.exe
2984	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: 35	1064	t.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	2036	oZNInEIXMZ.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	4756	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	2036	oZNInEIXMZ.exe
Token: SeDebugPrivilege	2332	Roblox

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe
3900	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2036	oZNInEIXMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1064	3540	t.exe	88
PID 3540 wrote to memory of 1064	3540	t.exe	88
PID 3540 wrote to memory of 1064	3540	t.exe	88
PID 1064 wrote to memory of 4764	1064	t.exe	93
PID 1064 wrote to memory of 4764	1064	t.exe	93
PID 1064 wrote to memory of 4764	1064	t.exe	93
PID 4764 wrote to memory of 2084	4764	cmd.exe	95
PID 4764 wrote to memory of 2084	4764	cmd.exe	95
PID 4764 wrote to memory of 2084	4764	cmd.exe	95
PID 1064 wrote to memory of 1532	1064	t.exe	98
PID 1064 wrote to memory of 1532	1064	t.exe	98
PID 1064 wrote to memory of 1532	1064	t.exe	98
PID 1532 wrote to memory of 1424	1532	cmd.exe	100
PID 1532 wrote to memory of 1424	1532	cmd.exe	100
PID 1532 wrote to memory of 1424	1532	cmd.exe	100
PID 1064 wrote to memory of 3452	1064	t.exe	101
PID 1064 wrote to memory of 3452	1064	t.exe	101
PID 1064 wrote to memory of 3452	1064	t.exe	101
PID 3452 wrote to memory of 1560	3452	cmd.exe	103
PID 3452 wrote to memory of 1560	3452	cmd.exe	103
PID 3452 wrote to memory of 1560	3452	cmd.exe	103
PID 1064 wrote to memory of 924	1064	t.exe	105
PID 1064 wrote to memory of 924	1064	t.exe	105
PID 1064 wrote to memory of 924	1064	t.exe	105
PID 924 wrote to memory of 752	924	cmd.exe	107
PID 924 wrote to memory of 752	924	cmd.exe	107
PID 924 wrote to memory of 752	924	cmd.exe	107
PID 1064 wrote to memory of 1632	1064	t.exe	108
PID 1064 wrote to memory of 1632	1064	t.exe	108
PID 1064 wrote to memory of 1632	1064	t.exe	108
PID 1064 wrote to memory of 1680	1064	t.exe	109
PID 1064 wrote to memory of 1680	1064	t.exe	109
PID 1064 wrote to memory of 1680	1064	t.exe	109
PID 1680 wrote to memory of 1508	1680	cmd.exe	112
PID 1680 wrote to memory of 1508	1680	cmd.exe	112
PID 1680 wrote to memory of 1508	1680	cmd.exe	112
PID 1632 wrote to memory of 2036	1632	cmd.exe	113
PID 1632 wrote to memory of 2036	1632	cmd.exe	113
PID 2036 wrote to memory of 4756	2036	oZNInEIXMZ.exe	114
PID 2036 wrote to memory of 4756	2036	oZNInEIXMZ.exe	114
PID 2036 wrote to memory of 1624	2036	oZNInEIXMZ.exe	116
PID 2036 wrote to memory of 1624	2036	oZNInEIXMZ.exe	116
PID 2036 wrote to memory of 4132	2036	oZNInEIXMZ.exe	118
PID 2036 wrote to memory of 4132	2036	oZNInEIXMZ.exe	118
PID 2036 wrote to memory of 4128	2036	oZNInEIXMZ.exe	120
PID 2036 wrote to memory of 4128	2036	oZNInEIXMZ.exe	120
PID 2036 wrote to memory of 4520	2036	oZNInEIXMZ.exe	122
PID 2036 wrote to memory of 4520	2036	oZNInEIXMZ.exe	122
PID 3900 wrote to memory of 4580	3900	msedge.exe	141
PID 3900 wrote to memory of 4580	3900	msedge.exe	141
PID 3900 wrote to memory of 704	3900	msedge.exe	142
PID 3900 wrote to memory of 704	3900	msedge.exe	142
PID 3900 wrote to memory of 704	3900	msedge.exe	142
PID 3900 wrote to memory of 704	3900	msedge.exe	142
PID 3900 wrote to memory of 704	3900	msedge.exe	142
PID 3900 wrote to memory of 704	3900	msedge.exe	142
PID 3900 wrote to memory of 704	3900	msedge.exe	142
PID 3900 wrote to memory of 704	3900	msedge.exe	142
PID 3900 wrote to memory of 704	3900	msedge.exe	142
PID 3900 wrote to memory of 704	3900	msedge.exe	142
PID 3900 wrote to memory of 704	3900	msedge.exe	142
PID 3900 wrote to memory of 704	3900	msedge.exe	142
PID 3900 wrote to memory of 704	3900	msedge.exe	142
PID 3900 wrote to memory of 704	3900	msedge.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\t.exe
"C:\Users\Admin\AppData\Local\Temp\t.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Local\Temp\t.exe
  "C:\Users\Admin\AppData\Local\Temp\t.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableTamperProtection $true""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableTamperProtection $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\oZNInEIXMZ.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\oZNInEIXMZ.exe
      C:\Users\Admin\AppData\Local\Temp\oZNInEIXMZ.exe
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\oZNInEIXMZ.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'oZNInEIXMZ.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Roblox'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4132
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Roblox'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Roblox" /tr "C:\Users\Admin\AppData\Roaming\Roblox"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\' -Name Hidden -Value $true""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\' -Name Hidden -Value $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x78,0x80,0x124,0x100,0x128,0x7fff0f8546f8,0x7fff0f854708,0x7fff0f854718
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,6991167589105656265,7099397106553913157,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,6991167589105656265,7099397106553913157,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,6991167589105656265,7099397106553913157,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6991167589105656265,7099397106553913157,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6991167589105656265,7099397106553913157,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1416

C:\Users\Admin\AppData\Roaming\Roblox
C:\Users\Admin\AppData\Roaming\Roblox
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
530542a18a6a8ed6ee368e1ef7dc5b6c

SHA1
dbe2ed90dc289b52318ab71c4e1afd4761458a2b

SHA256
d82bae18f65b2d3bfba38ea5eaada2191503fb0d723b8788eb4f664ac553a718

SHA512
50d2ab00f22e942d3fc7293ba30dc7cb91bff5faf91c16b970d99f59865d5f1f7c58b4e886658779cb4b15bc21cc998d04d20fe3043cf5a2379f9a6befb37571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d47548749f21064e18eeb2a53583399

SHA1
6c4623c7977090ccde01d48745b02d9485de838e

SHA256
2cfa2f680e7a0b94fe69e1cf5415effa1bc7982754a4adb806c04b5666f1ac45

SHA512
148ad4ea174563b4effcf6f4a0fdf5f0c86f9637c21a11407974ab603e0867b3a0dcfd9f53b57bfec7fdf1767edd74d09fb58cb806cde17fad50158ba5cc8f40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
07a12ff25e4ffb3b08a7db4f03ce4ff7

SHA1
25d21ff767e757d153ec5a1d7f252c1dc44469fe

SHA256
8278b16254b02925b5aa28e1e11b04bfc2cb4c5640f23433b592aedc0b7d6b66

SHA512
08034413bc0e57e77b21a79ff2483629b86af15a78238a14246e395412c1349fbd07069d5539fe41c088fe11c8c2bce0b0cca89ad8455a4ee3c7c70be8e1469a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d065a0f45db8d69e6cdbfd0f03f1ea5

SHA1
95d3e6c316341bea4ea878ccb0de2f22a2a2a58d

SHA256
fa0de6b88e5f7ff4f1ab061bdb6ac43b5b15744548e6fd70aeeb2924bd711c94

SHA512
f0ad9fbaf611dd53ad49ba95b3eedac7e7f38c0411e18567868ebb9f49cbf524168b02c0b32bbe187d2c621217db85d3156f68acd4cc08ad426ea3ca88b1581b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7b706f81ccfddbd2defe1dae334468b0

SHA1
8eaee7ac615073c268177d2938f08c1d72c9dd92

SHA256
fc464dd3dfc999d09fa7bb9c66eecb61dd942e386382027383dd7c8cc71a0221

SHA512
7c3a0dd7258c8ae1516e7b3f469c61d53161ee3ae8a3e82050dc70b56be2875eac8e3411636baec9a4e2a9d5cff6a552117d946f39fd9fcea4ad682d6412d995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7413d09408688cea46b06b0a0f3c6678

SHA1
b6902cf534188053b99714be0544bf731e330c4b

SHA256
96052c79f80d377fb16ac3be5e456f920198a71d908634536e8b1f73697e08f3

SHA512
4900a742af9904678e47a175a780256085b026859a79de7ae0be28b23d49e288ada19f54a24d963891c07693d20e099e867f7de5f6546833207fc064b61f943b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\Crypto\Cipher\_Salsa20.pyd

Filesize
11KB

MD5
67eff3114d1b45b18c87bd439311e993

SHA1
73ea8f13af119fb64a17cee5798282a4815e7381

SHA256
dab447710f7dd595c7311ed7921ba4b291666d7231118bc6b01a95d897a9a14b

SHA512
9de9612bd80c8d3b2cd34b4695bf555b4b98020c4b64d581388aad2ef1eb99140b0b37b784f8564bad2032c275835c20f28e550ddf18d139d063ef87b0423501

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\Crypto\Cipher\_raw_cbc.pyd

Filesize
9KB

MD5
d372a4eec83ab1384c242edea93e58bb

SHA1
51265eddb22890d6069a70aaca8ce6c8f0733b49

SHA256
b5c57f458dce223ecc6eca92cdc438f89d80936c1fd28f3ded3c34e7b5b9c808

SHA512
09535302fd60193dd965b01d7e6119788215ac062406d1f09969c9d8aa751c8823d8478a5cb9a10d62212dd82ce84eda138f9a1f3ffa42d1c3faa093eb891a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\Crypto\Cipher\_raw_cfb.pyd

Filesize
10KB

MD5
75d76df25c45abf5e5aff19df6e519ee

SHA1
bec2fb0fa9103f5f00a96c171e6cc22f30c67423

SHA256
d7af81a9f1be932339d8f38978c6a89ddeb279d75cf22f18d664ec6e605adba9

SHA512
80b85386f39364fef3f088d0711fc24a480363f859b88a62e1e81346b9951b78b15d32b0aa5e6f86fca080f559dcac108197b242c8deb7c33d8302b83e991749

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\Crypto\Cipher\_raw_ctr.pyd

Filesize
11KB

MD5
b792871f15b2539a0c4836247fde0412

SHA1
31e57808630b6985757595939e48bf8c55a2de3e

SHA256
6212ca9152bf469cb33eb258acdc2e98e2b426ed8f9baaa9361bc7bed842b98f

SHA512
10057d6b08e26e052e420d1a8d0b3f96ccc75170394420120135541e5901404cc4fb04415850077db80a85ddf74bec8e0462ce2f41ddf66c3a3a8a7a0291893c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\Crypto\Cipher\_raw_ecb.pyd

Filesize
8KB

MD5
fd623f81f725431b18d7f54442a7d407

SHA1
ee9c771e26e43c1d9fbcb1074f0dd3163f16b0b0

SHA256
da10fc7f4d2b60e1ddf5ce3ed86434cdbfd2dfb8f6967ac6d7a55634b82483bb

SHA512
22cd400dbf50ee81e234d1b7fc5b5e6176640c91038325245ad2a22e2ee465740ee0f30ab4a1150e4a58b06415d1175a54631a6edc5496d2bf75431a8ce7f440

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\Crypto\Cipher\_raw_ofb.pyd

Filesize
9KB

MD5
87e0c9f18a698468498410420ecf67e0

SHA1
5767641069ea527341bb87956ef68a65ab90d2ff

SHA256
e39b2b750f5fe0c9a66f31a7b9db8037f2d3cad54e5f3f44d470eef9d50e340a

SHA512
cd56d8381010189a0995df58b183d5dbef51ada2ffbdbdbd57e90a1d102119c066e3334dc4e1ec3c236becc80e1dbd7f988d97bd3d85b807fb3c57fe7ff398b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\Crypto\Hash\_BLAKE2s.pyd

Filesize
11KB

MD5
cc6306e4c4db9845654286d38e0f815a

SHA1
cb5af219a58e65897a6f633024a87cf55e5020cf

SHA256
daf65596e41c180af748d66e467f401d84cca0efd6cdcee14270f2f33cd2ddc7

SHA512
1aa15ab2efa0ff39d34df06fdec539ba3722f2ce720c7425fd34e1ba408141bdeb21267bb23c95033b275e5b7b4867cc92ac404c2e61b8d9cddfc5ecd52815c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\Crypto\Hash\_SHA1.pyd

Filesize
14KB

MD5
b1aa5268ee7d193d045dfb40a5d02638

SHA1
42e0d32f29600031b01f36297c0176e436680f57

SHA256
6f6c4a49b610845d640f1dc81e237532a80f8bb1ea6a885f170b8e6b816bffaa

SHA512
1b3c01f42e6692f87c881eb35ffe9c6d8d9d1cf7a28ceee594814904197a74666227a0bdcebaeebee96217bed9662d384ef629279314ff8f705872981b5ac58c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\Crypto\Hash\_SHA256.pyd

Filesize
18KB

MD5
9bd12aeee4836d3c933662df2a5e513e

SHA1
fd4ad3956ef5585fe36933c1764a41d2bb79361e

SHA256
6f35db5e531e1f7a29c9cad0a9510a090d7b351ab3ad940c908ab60d9aa2e97f

SHA512
ebb8937b7e08d02f360eb5dacc0ea5abcfa8bda5c3ff1b67c151428722524677c78ec7266fd4231fcc4dec1cd7e1d5787fc346b4a21135cebf5969252225d00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\Crypto\Protocol\_scrypt.pyd

Filesize
9KB

MD5
9375c663174c142e7e98e4fcb8ed1264

SHA1
a55b73e35388b2d9e61478c64a3d0a121c729349

SHA256
e3499b32c2b73e9e91fe1550ad4dda25ca519c66e9df72d2b04a43cb392decbb

SHA512
e86f239928a9cfdd89ee81061904f3b3a0f6dd91151775df8cdec02a991ace2356f474f640479f46b69f2ea78bdb697d00daf58e375c74f61199ff9d57d5b72c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\Crypto\Util\_cpuid_c.pyd

Filesize
8KB

MD5
e055db9c94395688edbfa66215447600

SHA1
a8d7136b7dd2ff8201049936d15f70875dca83ae

SHA256
a7535f09d14a6dc1ec21a58832792a4dd211b2fb061645b724fd6a4140b7464c

SHA512
460dc8391f5fe31b238be4f79c6c5e65df84daad06d302d4223ab85ab498b2c96d9d173ebb578f005db39d7e295b092320174802fa022c1de7d93074bfe25143

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\Crypto\Util\_strxor.pyd

Filesize
8KB

MD5
764b5bf2abc0d28e6b3774882a0b98c8

SHA1
d29280d41fc08a7719f93ab6c8c7e90c6a679a16

SHA256
b2527a19119f77368273d1e58f24ac502115e55c9f2a5a679bc7a0b90fa3bf4d

SHA512
ddddff788f460a320bcd27f4b8e4838273f9ac95b53d2c47e6112f7cce8e882008cf477b34c06cc60b8873d73dfaab00d289c346d15759885b156b82050c7988

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\VCRUNTIME140.dll

Filesize
84KB

MD5
ae96651cfbd18991d186a029cbecb30c

SHA1
18df8af1022b5cb188e3ee98ac5b4da24ac9c526

SHA256
1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1

SHA512
42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\_bz2.pyd

Filesize
71KB

MD5
055cfc5297933c338d8c04fd4e2462a2

SHA1
bf8f97ee8136bfe3f93485e946f2069b7ce504e0

SHA256
befc81440bbc001bd7647aca42962ee0b45b08435ee9f7140bf570af636b7dd5

SHA512
308ebb33c47b73ecd9c4e4e54ffd09aae5a96019559ef7b2a37a45bd89c42d0d5bdd21da1835fffd84a138b03662c3d68bd72725a22f1b0ddf0329438819ead7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\_cffi_backend.cp37-win32.pyd

Filesize
152KB

MD5
0c6f3ae411e82b37ab4d6fbc22a3ef7c

SHA1
8ac797b5a703a1f10ec10e1ecc8c04d6aaebcafd

SHA256
33a5ab6c627527887b82058c4dbfbfd5d88bbf187302e73aa3169b81e12cba40

SHA512
48385d18cc1ef13a9b68c3e9450d1980f0bd9ef466c44c94350e418f7daea86f97e60ab5de8a43d2efc34ab49c47cbe87c6ef35679473528a1840e940e3cdad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\_ctypes.pyd

Filesize
105KB

MD5
06c45d47af92a68ea6da0cc861992034

SHA1
0e8814b489e2c50e4481b69d532ca51e53274747

SHA256
b016e7ce9744a0e8fea473f1982e5d2fc355a98682054f470f4189d5fc00b8bf

SHA512
397ae19e69bdfb8bb4ec8197e5ac718d409930c6ff9e6cff979cef665ffe19aa197cca9b5a03ce7d30529d27a489b15e2a813bce1428e8dec8eb63f2148408d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\_hashlib.pyd

Filesize
31KB

MD5
1280a084744ef726a673b757b9364335

SHA1
203a83aee00f6dca7b5cf16f5d140ff5fb888bbe

SHA256
c2b3dc92abd96485032d1287941e405d56df05fb5ba68199497d8594400163e5

SHA512
637aa79bcfe2ac3f75319a4be3ee4e32769a52cf939a26564a73807b40e96328fd1e9b58e70abb0b4c204c77baeb61a5150f5ebc47a7262a9c520867f69f6075

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\_lzma.pyd

Filesize
181KB

MD5
d72665ea18965f103200ccc7ad072f85

SHA1
2b89543cd8bd1aa20e0d3150a3c394b90be0d204

SHA256
ab20e63d14259a7deca85a068796476c0efcc236a11d53b1816fc6f8956424a8

SHA512
aad0bcbeabaa50b1fdba4cf70fe281f58b62a81b680cc16ef7f238263625fc7bed9ae9321a7bf7010fe7b5bb28708bdfaa0138c4f35a52be6aaba71d03aaa3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\_queue.pyd

Filesize
23KB

MD5
2188964211b458221a65043820799ceb

SHA1
3155f1ade1556702eb7ffbc498b95d75f6b165c4

SHA256
cf8d872886f9c85d5705d40e9d602db33b66aa1d2d43f0e70482ecf91cf8610a

SHA512
943b42ed14fbfd91019f0c2c29ee149ef79efcdd710e68516afaff8387f98f5fa33e881f2f388c1acf0093c457826af226ad863fcce2324667b581068d589838

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\_socket.pyd

Filesize
65KB

MD5
51a38a6bf4c7e3d71b21a88b7a1dd555

SHA1
7c10b8dbe3972e1df92393b01523a9f843c24ed3

SHA256
b7829ec5c6de17b30037e1b50f43e26b40fcd9acdabce0011d623f5c0cebd70e

SHA512
6d068e2418da43581e0cd3cbed606b89d9a095fdddd348c72e9dbbd9f2dc580ea445c6c972616620ad444268e1e489efff6b528395e27c4a98ecca953258e7a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\_ssl.pyd

Filesize
101KB

MD5
e577403078daf63ce6ddc07f195c45ce

SHA1
b4f8c0a6466efe7f1919b6f9332ff8db55d6d6d1

SHA256
49559f96f659917c1c0e0d7ccb4fcf915bc1a00e51a5b25fe417262ef0f47774

SHA512
d4015b716516f9f24b913f6bab9d9826b25efa57576b377aded57dde9dd83d95e451aa05378b909723af4b2a3bfaf5af6d4bd2a06858dce582f002e917bccbb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\base_library.zip

Filesize
994KB

MD5
cbdbeb44a8cc3eee4baf2e7337a1daee

SHA1
9fe5ba2ea1782a92c74fa0c738a7e1fafe259ab6

SHA256
b6f8ca01c3d0f1595a730d2f8e608bafe5c8c920e2f09a0a97955169a01a2171

SHA512
ad95d8c122710519ea07ce0d0e510d51e3c49a1e31e32bfc4c83f6f4b334aa80f8ee9cb809477eb91e8ceacc057ac14d788f7749319d4466607a8a623238956f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\charset_normalizer\md.cp37-win32.pyd

Filesize
9KB

MD5
27cc5f8716ce37c834be9d61233a2685

SHA1
f6083f9737f7dec59d7a6063e52b8af53fe05550

SHA256
52a5c53f1505a252854c1c7ab13c635118bffa1b555261002bc587f6e3d42850

SHA512
8a29a6b3d6ba5b5ef16c6db82d57c2f4ee6b7c25bd8c593e0d5160c8f66b44f7da0560421fdac88b8879b76f4da4f412aea1c98bcfb0ea62e07f1f2d4abc9b9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\charset_normalizer\md__mypyc.cp37-win32.pyd

Filesize
100KB

MD5
e2fa4e72aefd808f0b99d0df625e547d

SHA1
b4a0fe36732d9a9d2aadbfaf3fcf59b9da0f0a6b

SHA256
c2ddbc95e4160914b3460af68dae3c131a42142acb74ddd3c03af23c75ce27a3

SHA512
dee70cae8096b931889545bb51fba650a1f6890fc67dc8f8980c5423fc798a117622bdaa00e5099c5ae77e7163b6a34788221bcb1fe33e1e01912e0b5ad7550a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\libcrypto-1_1.dll

Filesize
1.8MB

MD5
25c9d6fa8bf1222e82a37ef982f418d2

SHA1
e4bed3d1e76a58fc0119b7a2e70a998ca9ea7202

SHA256
3f70a63aacc024c4cd599ff1e12bf5b685719cf2b92c4420fd20ab032c9c898c

SHA512
2d6daf0e16971f9a6c1153bd67ff7fe2b1dbdeb5d05ea743cae231b85c9a27c4ee365f9c2141ea30a1edc9ebb32aa8a103b4949b5a0d9d031ad30acb2e9c60e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\libssl-1_1.dll

Filesize
398KB

MD5
d07120c4a7f7fa74d9c774d81663d685

SHA1
b5edb8821bd5b9184d55c8b16c805e4be966c7e5

SHA256
96fecbea2f57b69326eb2e0dcba7c32a8ae1d281d85f52c32fc39d5d4cca479b

SHA512
3b56595da7c83385266dd563275f44f0b3834c07ed268231043af1568dfdb5b370c4a76a880db7a203a727183bf867eb0ad2c792b5bf590ca42ca32c664dcea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\pyexpat.pyd

Filesize
164KB

MD5
ea5e7e997193098c2259119a37c7e4c4

SHA1
76e68dc830b8c0170916fbfcf84e26e74905f292

SHA256
40b17f3dff41e29492c8519372d435cd973f0a67597663fb12ad6756eaaa9077

SHA512
114eaf17bd29a7c1c9c17a8518f9bc5f215fe363e389ee84b3dbb87ff3f0418ebc435cee7b35f4d5ee48614381ef2e1eb8a67108e0b9816d4409d8b30a941d37

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\python37.dll

Filesize
3.5MB

MD5
198dc945fa3a7215c2aa90bd296025b4

SHA1
ce991e920755d775d99ab91f40124f0aad92863d

SHA256
20cd780cf1e90778799e749812b00b1865938ef8990cd9bf2c1630787c6181c9

SHA512
a880aa55740e635e3fbd32b8128572b92f379913d405f3baf4e9ec67891ac3dd77dbed85074a958c89093ca378dac95733287a45ca89c75029a61ecde058c955

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\pywin32_system32\pythoncom37.dll

Filesize
525KB

MD5
322f19eae6d535537c674c15a4df7821

SHA1
1a08c40604696fd083e1a7c84e64bd0a627fe9bd

SHA256
ab88387e20f73da15e099423eca7e6b4956da1f3dc1fb673778de7bbebcfd32c

SHA512
cd13ef99374c618ee35b0b54d548baee5281718acf43da77277988ec973f6f4c8f06bd69f3f72fccaa93fc63a04895d337111e77b7cfcec305b5e8599fa224f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\pywin32_system32\pywintypes37.dll

Filesize
107KB

MD5
65e7b0a8336eea1355403d6e2abd2cc8

SHA1
f57bc8e5e6e30998c68068f22d35162d9266b465

SHA256
71a346d3f4a17a5f8922d720e696ea966b3a4efc0aaf51a859040a6084c839aa

SHA512
e1f1b13d71e1ba4e12c979951b7fb5442b9224412241545acc7518fe6c3f8c69abe20a863717be4a7fbcdac90bf6665667eeced929c1033d7e7136a34ab870e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\select.pyd

Filesize
22KB

MD5
cefff42d83a7dafe76d22589978aa085

SHA1
6cb9b60804a8b8fd19fe23612b4018cf1fd76854

SHA256
f8bf0c9909ee65038f5bfdb47c7ee037bf55c97d5be259aa904d4e53a9b5cd34

SHA512
1b2dbb98b543acc49db3647edabc32f5fba8880ee631b146a2078e1c7ebd867682245f4bf177252e92f0c297352b5ae734764154ed5e4c5878687b4f502cf35b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\unicodedata.pyd

Filesize
1.0MB

MD5
1d96ba2fc295ce9725e1949b266a980c

SHA1
1b7dd35c9d6b1046e04c70b49e40270901d1ed7f

SHA256
830359b3cf5719a5ee26a36b3968086aa21e46a067b8c2557ae8f433eef2c747

SHA512
7f501fe628773eff27e07bf85ef2bc3fa127fd653bbc54ee47e8ca59ce98a7cfc7ef4402c9e84c2433e5cc816656fd77d62a590fa5c57ae76066147140d619bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35402\win32\win32api.pyd

Filesize
100KB

MD5
8f407afed8a947db4cf05efb1dd9d854

SHA1
b2955589f732526836e0877603b51934593b310f

SHA256
c1a829c1887f00d62c4882c0187908bb9346706a300537e295c87fc803c593cb

SHA512
25eb23c8b0f05db8c295de69005eba38c854656c18e642ffa6e97ee97130bd98fdf1040446a4d9e389b097e0db235197fa6c44901b10f7fa75060e6a8f9cdbaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lbv3tqdi.k0q.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/752-361-0x000000006F880000-0x000000006F8CC000-memory.dmp

Filesize
304KB

Download
memory/1424-320-0x0000000005C00000-0x0000000005F54000-memory.dmp

Filesize
3.3MB

Download
memory/1424-321-0x000000006F880000-0x000000006F8CC000-memory.dmp

Filesize
304KB

Download
memory/1508-387-0x0000000007D90000-0x0000000008334000-memory.dmp

Filesize
5.6MB

Download
memory/1508-386-0x0000000006C30000-0x0000000006C52000-memory.dmp

Filesize
136KB

Download
memory/1508-385-0x0000000006A70000-0x0000000006ABC000-memory.dmp

Filesize
304KB

Download
memory/1508-384-0x0000000006140000-0x0000000006494000-memory.dmp

Filesize
3.3MB

Download
memory/1560-341-0x000000006F880000-0x000000006F8CC000-memory.dmp

Filesize
304KB

Download
memory/2036-374-0x0000000000E50000-0x0000000000E8E000-memory.dmp

Filesize
248KB

Download
memory/2036-591-0x000000001D890000-0x000000001D89C000-memory.dmp

Filesize
48KB

Download
memory/2084-267-0x0000000005780000-0x00000000057E6000-memory.dmp

Filesize
408KB

Download
memory/2084-282-0x00000000066F0000-0x0000000006722000-memory.dmp

Filesize
200KB

Download
memory/2084-296-0x00000000735F0000-0x0000000073DA0000-memory.dmp

Filesize
7.7MB

Download
memory/2084-297-0x00000000735F0000-0x0000000073DA0000-memory.dmp

Filesize
7.7MB

Download
memory/2084-299-0x0000000007440000-0x000000000745A000-memory.dmp

Filesize
104KB

Download
memory/2084-298-0x0000000007AA0000-0x000000000811A000-memory.dmp

Filesize
6.5MB

Download
memory/2084-300-0x00000000074A0000-0x00000000074AA000-memory.dmp

Filesize
40KB

Download
memory/2084-301-0x00000000076B0000-0x00000000076FA000-memory.dmp

Filesize
296KB

Download
memory/2084-302-0x00000000077A0000-0x0000000007836000-memory.dmp

Filesize
600KB

Download
memory/2084-303-0x0000000007660000-0x0000000007671000-memory.dmp

Filesize
68KB

Download
memory/2084-304-0x0000000007690000-0x000000000769E000-memory.dmp

Filesize
56KB

Download
memory/2084-305-0x0000000007700000-0x0000000007714000-memory.dmp

Filesize
80KB

Download
memory/2084-306-0x0000000007750000-0x000000000776A000-memory.dmp

Filesize
104KB

Download
memory/2084-307-0x0000000007730000-0x0000000007738000-memory.dmp

Filesize
32KB

Download
memory/2084-310-0x00000000735F0000-0x0000000073DA0000-memory.dmp

Filesize
7.7MB

Download
memory/2084-294-0x00000000735F0000-0x0000000073DA0000-memory.dmp

Filesize
7.7MB

Download
memory/2084-293-0x0000000006730000-0x000000000674E000-memory.dmp

Filesize
120KB

Download
memory/2084-295-0x0000000007110000-0x00000000071B3000-memory.dmp

Filesize
652KB

Download
memory/2084-283-0x000000006F880000-0x000000006F8CC000-memory.dmp

Filesize
304KB

Download
memory/2084-281-0x0000000006120000-0x000000000616C000-memory.dmp

Filesize
304KB

Download
memory/2084-280-0x00000000060E0000-0x00000000060FE000-memory.dmp

Filesize
120KB

Download
memory/2084-279-0x0000000005F60000-0x0000000006064000-memory.dmp

Filesize
1.0MB

Download
memory/2084-278-0x0000000005E40000-0x0000000005E50000-memory.dmp

Filesize
64KB

Download
memory/2084-277-0x00000000059B0000-0x0000000005D04000-memory.dmp

Filesize
3.3MB

Download
memory/2084-259-0x00000000735FE000-0x00000000735FF000-memory.dmp

Filesize
4KB

Download
memory/2084-260-0x0000000004970000-0x00000000049A6000-memory.dmp

Filesize
216KB

Download
memory/2084-261-0x00000000735F0000-0x0000000073DA0000-memory.dmp

Filesize
7.7MB

Download
memory/2084-262-0x00000000050E0000-0x0000000005708000-memory.dmp

Filesize
6.2MB

Download
memory/2084-266-0x0000000005710000-0x0000000005776000-memory.dmp

Filesize
408KB

Download
memory/2084-265-0x0000000005020000-0x0000000005042000-memory.dmp

Filesize
136KB

Download
memory/2084-264-0x0000000004E90000-0x0000000004F16000-memory.dmp

Filesize
536KB

Download
memory/2084-263-0x00000000735F0000-0x0000000073DA0000-memory.dmp

Filesize
7.7MB

Download
memory/4756-555-0x0000013BC5200000-0x0000013BC5304000-memory.dmp

Filesize
1.0MB

Download
memory/4756-554-0x0000013BAA8C0000-0x0000013BAA8D0000-memory.dmp

Filesize
64KB

Download
memory/4756-543-0x0000013BC4F60000-0x0000013BC4FE6000-memory.dmp

Filesize
536KB

Download
memory/4756-544-0x0000013BAA900000-0x0000013BAA922000-memory.dmp

Filesize
136KB

Download