Overview

overview

10

Static

static

1

Maple.rar

windows7-x64

1

Maple.rar

windows10-2004-x64

10

Resubmissions

24/03/2025, 18:02

250324-wmm8kaxlv4 10

24/03/2025, 17:57

250324-wjy6naxls2 1

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/03/2025, 18:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Maple.rar

  • Size

    49.7MB

  • MD5

    e0ffd622fa80e49f7c40f9fb03a749e2

  • SHA1

    21261fdf6837f935beb71ca5a0f72cec9902404e

  • SHA256

    3186f991efb096c60c567f8ec7457be13cf0b1dfe9776a56c5896020c5dbc87a

  • SHA512

    8e70ac56d8dca798044d21d47e669759f9351323bde52e512a01885e057e14442b8fa6bde8ff03f04de9044b8a4a98184f1fdb11dc1955f7a798749b8a03e581

  • SSDEEP

    1572864:lXU+c5XnpSG/YNNBmwfS25zVO3BE1As+dK:lU1nEAYNNowfS25zIxEAK

Score
10/10
njratumbralxwormdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratstealertrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

testarosa.duckdns.org:7110

Mutex

5ZpeoOe6AtQfr6wU

Attributes
  • Install_directory

    %AppData%

  • install_file

    Ondrive.exe

aes.plain

Signatures

  • Detect Umbral payload 2 IoCs
  • Detect Xworm Payload 2 IoCs
  • Njrat family
    njrat
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Umbral family
    umbral
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Maple.rar"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:5908
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:5336
    • C:\Users\Admin\Desktop\Maple\maple.exe
      "C:\Users\Admin\Desktop\Maple\maple.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1456
      • C:\Users\Admin\AppData\Local\Temp\onefile_1456_133873129804236421\main.exe
        "C:\Users\Admin\Desktop\Maple\maple.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4320
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c
          3⤵
            PID:5252
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            3⤵
              PID:2004
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c mode 100, 20
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2908
              • C:\Windows\system32\mode.com
                mode 100, 20
                4⤵
                  PID:756
          • C:\Users\Admin\Desktop\Maple\loader.exe
            "C:\Users\Admin\Desktop\Maple\loader.exe"
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5796
            • C:\Users\Admin\AppData\Local\Temp\Server.exe
              "C:\Users\Admin\AppData\Local\Temp\Server.exe"
              2⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3548
              • C:\Users\Admin\AppData\Roaming\Server.exe
                "C:\Users\Admin\AppData\Roaming\Server.exe"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1420
                • C:\Users\Admin\AppData\Local\Temp\server.exe
                  "C:\Users\Admin\AppData\Local\Temp\server.exe"
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2300
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
                    5⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:1428
              • C:\Users\Admin\AppData\Roaming\conhost.exe
                "C:\Users\Admin\AppData\Roaming\conhost.exe"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2404
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\conhost.exe'
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:712
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'conhost.exe'
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2180
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Ondrive.exe'
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2868
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Ondrive.exe'
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3996
                • C:\Windows\System32\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Ondrive" /tr "C:\Users\Admin\AppData\Roaming\Ondrive.exe"
                  4⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:1588
            • C:\Users\Admin\AppData\Local\Temp\Maple.exe
              "C:\Users\Admin\AppData\Local\Temp\Maple.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:5792
              • C:\Windows\System32\Wbem\wmic.exe
                "wmic.exe" csproduct get uuid
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:5124
            • C:\Users\Admin\AppData\Local\Temp\loader.exe
              "C:\Users\Admin\AppData\Local\Temp\loader.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:632
              • C:\Users\Admin\AppData\Local\Temp\onefile_632_133873129958069362\loader.exe
                "C:\Users\Admin\AppData\Local\Temp\loader.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4084
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "start maple.exe"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1640
                  • C:\Users\Admin\Desktop\Maple\maple.exe
                    maple.exe
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3760
                    • C:\Users\Admin\AppData\Local\Temp\onefile_3760_133873129964955109\main.exe
                      maple.exe
                      6⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Suspicious use of WriteProcessMemory
                      PID:1012
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c
                        7⤵
                          PID:4936
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "ver"
                          7⤵
                            PID:2560
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c mode 100, 20
                            7⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3096
                            • C:\Windows\system32\mode.com
                              mode 100, 20
                              8⤵
                                PID:1640
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c cls
                              7⤵
                                PID:4288
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c cls
                                7⤵
                                  PID:5248
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c cls
                                  7⤵
                                    PID:4964
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c cls
                                    7⤵
                                      PID:968
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c cls
                                      7⤵
                                        PID:5760
                          • C:\Users\Admin\AppData\Roaming\Ondrive.exe
                            C:\Users\Admin\AppData\Roaming\Ondrive.exe
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4532
                          • C:\Users\Admin\AppData\Roaming\Ondrive.exe
                            C:\Users\Admin\AppData\Roaming\Ondrive.exe
                            1⤵
                            • Executes dropped EXE
                            PID:3472

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Command and Scripting Interpreter

                          1
                          T1059

                          PowerShell

                          1
                          T1059.001

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Event Triggered Execution

                          1
                          T1546

                          Netsh Helper DLL

                          1
                          T1546.007

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Event Triggered Execution

                          1
                          T1546

                          Netsh Helper DLL

                          1
                          T1546.007

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Defense Evasion

                          Impair Defenses

                          1
                          T1562

                          Disable or Modify System Firewall

                          1
                          T1562.004

                          Modify Registry

                          1
                          T1112

                          Virtualization/Sandbox Evasion

                          1
                          T1497

                          Credential Access

                          Discovery

                          Query Registry

                          4
                          T1012

                          System Information Discovery

                          4
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          Virtualization/Sandbox Evasion

                          1
                          T1497

                          Lateral Movement

                          Collection

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\Maple.exe
                            Filesize

                            227KB

                            MD5

                            550b445ad1a44d1f23f7155fae400db6

                            SHA1

                            cb006a53156285fdef3a0b33a4a08f534cd3bab7

                            SHA256

                            d223b3918e8bc3bab1d23fdc2e306be1c6587d3ab8f324fc377e37585387884e

                            SHA512

                            909f31f24672ffc5542ac42f344eb6020bcdfdfac9ac13d5672fe7ed22e686b06385d15709f1f83b576b1dade591ad40eb429ef076d07f4597235cd95a679fa5

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PIL\_imaging.pyd
                            Filesize

                            2.3MB

                            MD5

                            66dfb3fc790a5c300bbff1ba50b664f0

                            SHA1

                            b4c1fd1459e2b58a2eb04ae78d3cf17d1291ec60

                            SHA256

                            a25e90a4ea75a77a21f1c25d456b20c1220ec453894a0fde427afd351f093696

                            SHA512

                            d6181ab99036c9bba57ed6ec666dab89c184077740186ec0b0f02c0ea1210d0911eb7c10dd7c4ab8d128b49606311858db871794ba0926a3030e527e977c0f63

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_brotli.pyd
                            Filesize

                            801KB

                            MD5

                            ee3d454883556a68920caaedefbc1f83

                            SHA1

                            45b4d62a6e7db022e52c6159eef17e9d58bec858

                            SHA256

                            791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1

                            SHA512

                            e404adf831076d27680cc38d3879af660a96afc8b8e22ffd01647248c601f3c6c4585d7d7dc6bbd187660595f6a48f504792106869d329aa1a0f3707d7f777c6

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
                            Filesize

                            81KB

                            MD5

                            86d1b2a9070cd7d52124126a357ff067

                            SHA1

                            18e30446fe51ced706f62c3544a8c8fdc08de503

                            SHA256

                            62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e

                            SHA512

                            7db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
                            Filesize

                            120KB

                            MD5

                            1635a0c5a72df5ae64072cbb0065aebe

                            SHA1

                            c975865208b3369e71e3464bbcc87b65718b2b1f

                            SHA256

                            1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177

                            SHA512

                            6e34346ea8a0aacc29ccd480035da66e280830a7f3d220fd2f12d4cfa3e1c03955d58c0b95c2674aea698a36a1b674325d3588483505874c2ce018135320ff99

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd
                            Filesize

                            63KB

                            MD5

                            d4674750c732f0db4c4dd6a83a9124fe

                            SHA1

                            fd8d76817abc847bb8359a7c268acada9d26bfd5

                            SHA256

                            caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9

                            SHA512

                            97d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd
                            Filesize

                            154KB

                            MD5

                            7447efd8d71e8a1929be0fac722b42dc

                            SHA1

                            6080c1b84c2dcbf03dcc2d95306615ff5fce49a6

                            SHA256

                            60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be

                            SHA512

                            c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd
                            Filesize

                            30KB

                            MD5

                            d8c1b81bbc125b6ad1f48a172181336e

                            SHA1

                            3ff1d8dcec04ce16e97e12263b9233fbf982340c

                            SHA256

                            925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14

                            SHA512

                            ccc9f0d3aca66729832f26be12f8e7021834bbee1f4a45da9451b1aa5c2e63126c0031d223af57cf71fad2c85860782a56d78d8339b35720194df139076e0772

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
                            Filesize

                            77KB

                            MD5

                            819166054fec07efcd1062f13c2147ee

                            SHA1

                            93868ebcd6e013fda9cd96d8065a1d70a66a2a26

                            SHA256

                            e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f

                            SHA512

                            da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
                            Filesize

                            156KB

                            MD5

                            7910fb2af40e81bee211182cffec0a06

                            SHA1

                            251482ed44840b3c75426dd8e3280059d2ca06c6

                            SHA256

                            d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f

                            SHA512

                            bfe6506feb27a592fe9cf1db7d567d0d07f148ef1a2c969f1e4f7f29740c6bb8ccf946131e65fe5aa8ede371686c272b0860bd4c0c223195aaa1a44f59301b27

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_tkinter.pyd
                            Filesize

                            64KB

                            MD5

                            8da8e5348d9f9572ce9216ac8a628c2b

                            SHA1

                            35a23ea241d004a45399d69ca038042936d8288d

                            SHA256

                            06b96357f5dd83d0d8105127e7aaeacb834ddf1ae03fa46aaffdc1e5fd0a7621

                            SHA512

                            ca7a05cb49c8af6ebfa3cd5d415352bfd0c2abdbbf05d539e296042bbde075d29ddc8c2a2e5d46c9e736dcc848bc633686029784883f855167875972fb607f42

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-1_1.dll
                            Filesize

                            3.3MB

                            MD5

                            9d7a0c99256c50afd5b0560ba2548930

                            SHA1

                            76bd9f13597a46f5283aa35c30b53c21976d0824

                            SHA256

                            9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939

                            SHA512

                            cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll
                            Filesize

                            688KB

                            MD5

                            bec0f86f9da765e2a02c9237259a7898

                            SHA1

                            3caa604c3fff88e71f489977e4293a488fb5671c

                            SHA256

                            d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd

                            SHA512

                            ffbc4e5ffdb49704e7aa6d74533e5af76bbe5db297713d8e59bd296143fe5f145fbb616b343eed3c48eceaccccc2431630470d8975a4a17c37eafcc12edd19f4

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy.libs\libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll
                            Filesize

                            36.4MB

                            MD5

                            5e46c3d334c90c3029eb6ae2a3fe58f2

                            SHA1

                            ad3d806f720289ccb90ce8bfd0da49fa99e7777b

                            SHA256

                            57b87772bf676b5c2d718c79dddc9f039d79ec3319fee1398cc305adff7b69e5

                            SHA512

                            4bd29d19b619076a64a928f3871edcce8416bcf100c1aa1250932479d6536d9497f2f9a2668c90b3479d0d4ab4234ffa06f81bc6b107fad1be5097fa2b60ab28

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\core\_multiarray_umath.pyd
                            Filesize

                            2.7MB

                            MD5

                            a5cac70c51ec912d2f9536f23003d72a

                            SHA1

                            a0c0f3a4a21615889210ec560ca963af7cc9b98c

                            SHA256

                            18cfaaff3a73ae7972b8a3707cf20fa58c36641bad0ad3406195c091d54b80fe

                            SHA512

                            b4e59b0b80a896c2d35f3f4d1caaebdb1f764e4d8df815edb87eb1c2e21b92a93bacec217c4feb3202bf2fe01604da66081b0cf52e16ec40c239c77bd80bbb16

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\fft\_pocketfft_internal.pyd
                            Filesize

                            107KB

                            MD5

                            01c5e6e689de8213c842574ac5475075

                            SHA1

                            df0103638bf041fbff2aefa525cba8b0d40db71a

                            SHA256

                            f427bda65498f685dbc073af03900c35231c5b9f472f310eb03e7f156ffbb9e9

                            SHA512

                            145d9bbbfc4fbfd5f246b0ce45fc4757c2e88732e68dc9a985bf6a936420e9800448ae27c0aa2c338ded72fd017e88634f41eee9e73bdbf6ab97ac8169ecf247

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
                            Filesize

                            29KB

                            MD5

                            a653f35d05d2f6debc5d34daddd3dfa1

                            SHA1

                            1a2ceec28ea44388f412420425665c3781af2435

                            SHA256

                            db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9

                            SHA512

                            5aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\tcl86t.dll
                            Filesize

                            1.8MB

                            MD5

                            75909678c6a79ca2ca780a1ceb00232e

                            SHA1

                            39ddbeb1c288335abe910a5011d7034345425f7d

                            SHA256

                            fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860

                            SHA512

                            91689413826d3b2e13fc7f579a71b676547bc4c06d2bb100b4168def12ab09b65359d1612b31a15d21cb55147bbab4934e6711351a0440c1533fb94fe53313bf

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\tls_client\dependencies\tls-client-64.dll
                            Filesize

                            17.8MB

                            MD5

                            181458ffd109573a1cde903e187b0b46

                            SHA1

                            6822c8b9cad8f13f3c0921205ada08efd693d93e

                            SHA256

                            b177778656455f6b8482154238d323a3de4d74f2a8b7a62bd973251a259edb87

                            SHA512

                            0f771e01e5f89dd83a8e46d129a7975b6ca395369d82411c9864805f1efa9ab7051e6caa24a5fad121391a25cb84dc991845da976265f3d67f8528aa01a280a8

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\zstandard\backend_c.pyd
                            Filesize

                            512KB

                            MD5

                            4652c4087b148d08adefedf55719308b

                            SHA1

                            30e06026fea94e5777c529b479470809025ffbe2

                            SHA256

                            003f439c27a532d6f3443706ccefac6be4152bebc1aa8bdf1c4adfc095d33795

                            SHA512

                            d4972c51ffbce63d2888ddfead2f616166b6f21a0c186ccf97a41c447c1fac6e848f464e4acde05bea5b24c73c5a03b834731f8807a54ee46ca8619b1d0c465d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\Server.exe
                            Filesize

                            71KB

                            MD5

                            f9b08bd21b40a938122b479095b7c70c

                            SHA1

                            eb925e3927b83c20d8d24bdab2e587c10d6ac8cd

                            SHA256

                            c96cde2e96021c266a202286d644ceb28543d6347e21006d72b29b8a72c505e8

                            SHA512

                            fcc5784936b7f85a550883c472b99b5edfa7e5c6fd3872fd806b81c2ce1f195ca34342b230a89456066885579fe55aea46d91074ac08af192fbd04ea158473ee

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3vlou4sr.dr1.ps1
                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\loader.exe
                            Filesize

                            5.3MB

                            MD5

                            e630d72436e3dc1be7763de7f75b7adf

                            SHA1

                            40e07b22ab8b69e6827f90e20aeac35757899a23

                            SHA256

                            59818142f41895d3cadf7bee0124b392af3473060f00b9548daa3a224223993e

                            SHA512

                            82f0be15e2736447fae7d9a313a8a81a2c6e6ca617539ff8bf3fa0d2fe93d96e68afea6964e96e9dd671ba4090ddbc8a759c9b68f10e24a7fb847fe2c9825a83

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\onefile_1456_133873129804236421\VCRUNTIME140.dll
                            Filesize

                            95KB

                            MD5

                            f34eb034aa4a9735218686590cba2e8b

                            SHA1

                            2bc20acdcb201676b77a66fa7ec6b53fa2644713

                            SHA256

                            9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

                            SHA512

                            d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\onefile_1456_133873129804236421\_uuid.pyd
                            Filesize

                            24KB

                            MD5

                            b68c98113c8e7e83af56ba98ff3ac84a

                            SHA1

                            448938564559570b269e05e745d9c52ecda37154

                            SHA256

                            990586f2a2ba00d48b59bdd03d3c223b8e9fb7d7fab6d414bac2833eb1241ca2

                            SHA512

                            33c69199cba8e58e235b96684346e748a17cc7f03fc068cfa8a7ec7b5f9f6fa90d90b5cdb43285abf8b4108e71098d4e87fb0d06b28e2132357964b3eea3a4f8

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\onefile_1456_133873129804236421\charset_normalizer\md.pyd
                            Filesize

                            10KB

                            MD5

                            f33ca57d413e6b5313272fa54dbc8baa

                            SHA1

                            4e0cabe7d38fe8d649a0a497ed18d4d1ca5f4c44

                            SHA256

                            9b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664

                            SHA512

                            f17c06f4202b6edbb66660d68ff938d4f75b411f9fab48636c3575e42abaab6464d66cb57bce7f84e8e2b5755b6ef757a820a50c13dd5f85faa63cd553d3ff32

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\onefile_1456_133873129804236421\charset_normalizer\md__mypyc.pyd
                            Filesize

                            117KB

                            MD5

                            494f5b9adc1cfb7fdb919c9b1af346e1

                            SHA1

                            4a5fddd47812d19948585390f76d5435c4220e6b

                            SHA256

                            ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051

                            SHA512

                            2c0d68da196075ea30d97b5fd853c673e28949df2b6bf005ae72fd8b60a0c036f18103c5de662cac63baaef740b65b4ed2394fcd2e6da4dfcfbeef5b64dab794

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\onefile_1456_133873129804236421\libffi-7.dll
                            Filesize

                            32KB

                            MD5

                            eef7981412be8ea459064d3090f4b3aa

                            SHA1

                            c60da4830ce27afc234b3c3014c583f7f0a5a925

                            SHA256

                            f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

                            SHA512

                            dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\onefile_1456_133873129804236421\numpy\core\_multiarray_tests.pyd
                            Filesize

                            63KB

                            MD5

                            9d30dfac3c3155022022635acfc36ca8

                            SHA1

                            259ee4dae88278daff28c6fe03b310cd267d0940

                            SHA256

                            03ad7f7642ff3e63686c64f4e82bfb20459feda8f0f8a209bbb443567edd0a18

                            SHA512

                            71856e3b3d6b917108046036dd51a57356552863171fe5e5e1c57d939c491058ade69affa830f36ebb6bebe426fe53d1921791397ddbbfeba2db257fe6c5a190

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\onefile_1456_133873129804236421\numpy\linalg\_umath_linalg.pyd
                            Filesize

                            104KB

                            MD5

                            e9910fa0e40764e8889c3cd0ac57822d

                            SHA1

                            466b13f1fc59f6c45650d7cad8ecdd14bf25ba03

                            SHA256

                            7699acfd30754298e74b4c5fa4a0b3eb273259620adfe79697c267479c7064b9

                            SHA512

                            7a050e74376affcd09f807f7f23ccd54f03e6c85c90c2dc0553ca9f1c7c3d2a594599d9a868e5e7059211c3bfe47834a83c477e206bb07c1dfb52628f1a01764

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\onefile_1456_133873129804236421\python310.dll
                            Filesize

                            4.3MB

                            MD5

                            63a1fa9259a35eaeac04174cecb90048

                            SHA1

                            0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

                            SHA256

                            14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

                            SHA512

                            896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\onefile_1456_133873129804236421\tcl\encoding\cp1252.enc
                            Filesize

                            1KB

                            MD5

                            e9117326c06fee02c478027cb625c7d8

                            SHA1

                            2ed4092d573289925a5b71625cf43cc82b901daf

                            SHA256

                            741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e

                            SHA512

                            d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\onefile_1456_133873129804236421\tk86t.dll
                            Filesize

                            1.5MB

                            MD5

                            4b6270a72579b38c1cc83f240fb08360

                            SHA1

                            1a161a014f57fe8aa2fadaab7bc4f9faaac368de

                            SHA256

                            cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08

                            SHA512

                            0c81434d8c205892bba8a4c93ff8fc011fb8cfb72cfec172cf69093651b86fd9837050bd0636315840290b28af83e557f2205a03e5c344239356874fce0c72b9

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\onefile_1456_133873129804236421\unicodedata.pyd
                            Filesize

                            1.1MB

                            MD5

                            81d62ad36cbddb4e57a91018f3c0816e

                            SHA1

                            fe4a4fc35df240b50db22b35824e4826059a807b

                            SHA256

                            1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e

                            SHA512

                            7d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\onefile_3760_133873129964955109\tcl\encoding\euc-cn.enc
                            Filesize

                            84KB

                            MD5

                            c5aa0d11439e0f7682dae39445f5dab4

                            SHA1

                            73a6d55b894e89a7d4cb1cd3ccff82665c303d5c

                            SHA256

                            1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00

                            SHA512

                            eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Server.exe
                            Filesize

                            23KB

                            MD5

                            32fe01ccb93b0233503d0aaaa451f7b2

                            SHA1

                            58e5a63142150e8fb175dbb4dedea2ce405d7db0

                            SHA256

                            6988ee719a54c93a89303dcff277c62ae4890274cc45f074bc7effde315fbf43

                            SHA512

                            76945f23a49d594e325d80ffc0570341044ac0b97bd889c92f90bc56d3cdff5c1b29178be4f157c8c1bb9ce7cc311765309f2e6f7b08b24e7acf983ea67635a6

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\conhost.exe
                            Filesize

                            37KB

                            MD5

                            b37dd1a1f0507baf993471ae1b7a314c

                            SHA1

                            9aff9d71492ffff8d51f8e8d67f5770755899882

                            SHA256

                            e58e8918a443c0061add029f8f211f6551a130202195cc2b9b529ea72553e0bc

                            SHA512

                            ac76d5b10540eb292341f30c7abfd81f03be65f6655c814aba6ac6a0ecf4f0f2c34c3b8e63ceef8c4579f98b7459e51b9fdd30d601c6d1930860ab7c154da460

                            Download Submit

                          • C:\Users\Admin\Desktop\Maple\maple.exe
                            Filesize

                            40.8MB

                            MD5

                            db7b4b030f0a44a2f51c957d949f8e1e

                            SHA1

                            7814eaffb9c68fb78f3f69380439aaf94d556828

                            SHA256

                            8f5f582788ce95ba51ca37dac8e45fff1674e0d36e4129731edded7e71a94c30

                            SHA512

                            be6f371423a0bee1b3d3f61640e1b6ca64290a4a864d4a1b3ad8ca6250650ca01d42b635f650138733b3817c491f64a8bc82622e7f1b565dc4cc8da37e43a63c

                            Download Submit

                          • memory/712-3139-0x000002B625C40000-0x000002B625C62000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/1012-3127-0x000000005CB50000-0x000000005D52F000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/1012-3126-0x000000005CB50000-0x000000005D52F000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/1012-3224-0x00007FF890580000-0x00007FF892636000-memory.dmp

                            Filesize

                            32.7MB

                            Download

                          • memory/1012-3223-0x00007FF892640000-0x00007FF8937CF000-memory.dmp

                            Filesize

                            17.6MB

                            Download

                          • memory/1012-3125-0x000000005CB50000-0x000000005D52F000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/1012-3128-0x000000005CB50000-0x000000005D52F000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/1012-3131-0x000000005CB50000-0x000000005D52F000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/1012-3130-0x000000005CB50000-0x000000005D52F000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/1012-3129-0x000000005CB50000-0x000000005D52F000-memory.dmp

                            Filesize

                            9.9MB

                            Download

                          • memory/2404-2113-0x0000000000C40000-0x0000000000C50000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3548-2044-0x0000000000690000-0x00000000006A8000-memory.dmp

                            Filesize

                            96KB

                            Download

                          • memory/4320-1084-0x00000190F9BE0000-0x00000190FBC96000-memory.dmp

                            Filesize

                            32.7MB

                            Download

                          • memory/4320-1083-0x00007FF898EA0000-0x00007FF89A02F000-memory.dmp

                            Filesize

                            17.6MB

                            Download

                          • memory/5792-2038-0x000002BA07F60000-0x000002BA07FA0000-memory.dmp

                            Filesize

                            256KB

                            Download

                          • memory/5796-2019-0x0000000000C70000-0x00000000011D0000-memory.dmp

                            Filesize

                            5.4MB

                            Download