xworm | 6d02f6dd58e131cad086c3366a6e75bec7dc4a18c1caeb509c14f5b6e5a175b6

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
01/03/2025, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

t.exe
Size

28.2MB
MD5

32537fc4fb43f3e452ebc55efa9c009c
SHA1

106ae40680c3776de02ab2af413f6514d72c600f
SHA256

6d02f6dd58e131cad086c3366a6e75bec7dc4a18c1caeb509c14f5b6e5a175b6
SHA512

4769bce8d9605ca45611d0cab7ac9df257e677b6c70c1610a8a0bd85393dff80fd3e9c78b72654e6b316e4e5885694e62812fd3bf14b8a5908b791ab46005745
SSDEEP

786432:Ntu0coshxWHVn6s6b64G71jaoCo1Ha2XykT9nCnx89f:bu0jyC6Fb6V71JCo1RjSG

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

thetest.selfhost.co:1339

Mutex

PQkNYlnsnnFAImsR

Attributes

Install_directory
%AppData%
install_file
DirectOutputService.exe

aes.plain

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2312-279-0x0000000000360000-0x000000000039E000-memory.dmp	family_xworm
behavioral1/files/0x000f000000015650-457.dat	family_xworm
behavioral1/memory/608-458-0x00000000003C0000-0x00000000003FE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2332	powershell.exe
1700	powershell.exe
2044	powershell.exe
2036	powershell.exe
3064	powershell.exe
288	powershell.exe
484	powershell.exe
836	powershell.exe
2568	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Roblox.lnk	qZBkgHziko.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Roblox.lnk	qZBkgHziko.exe

Executes dropped EXE 2 IoCs

pid	Process
2312	qZBkgHziko.exe
608	Roblox

Loads dropped DLL 38 IoCs

pid	Process
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
2628	t.exe
344	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\Roblox = "C:\\Users\\Admin\\AppData\\Roaming\\Roblox"	qZBkgHziko.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2900	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1692	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2312	qZBkgHziko.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2332	powershell.exe
1700	powershell.exe
2044	powershell.exe
2036	powershell.exe
2568	powershell.exe
3064	powershell.exe
288	powershell.exe
484	powershell.exe
836	powershell.exe
2312	qZBkgHziko.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: 35	2628	t.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	2312	qZBkgHziko.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	288	powershell.exe
Token: SeDebugPrivilege	484	powershell.exe
Token: SeDebugPrivilege	836	powershell.exe
Token: SeDebugPrivilege	2312	qZBkgHziko.exe
Token: SeDebugPrivilege	608	Roblox

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2312	qZBkgHziko.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2628	2444	t.exe	30
PID 2444 wrote to memory of 2628	2444	t.exe	30
PID 2444 wrote to memory of 2628	2444	t.exe	30
PID 2444 wrote to memory of 2628	2444	t.exe	30
PID 2628 wrote to memory of 1668	2628	t.exe	31
PID 2628 wrote to memory of 1668	2628	t.exe	31
PID 2628 wrote to memory of 1668	2628	t.exe	31
PID 2628 wrote to memory of 1668	2628	t.exe	31
PID 1668 wrote to memory of 2332	1668	cmd.exe	33
PID 1668 wrote to memory of 2332	1668	cmd.exe	33
PID 1668 wrote to memory of 2332	1668	cmd.exe	33
PID 1668 wrote to memory of 2332	1668	cmd.exe	33
PID 2628 wrote to memory of 1600	2628	t.exe	34
PID 2628 wrote to memory of 1600	2628	t.exe	34
PID 2628 wrote to memory of 1600	2628	t.exe	34
PID 2628 wrote to memory of 1600	2628	t.exe	34
PID 1600 wrote to memory of 1700	1600	cmd.exe	36
PID 1600 wrote to memory of 1700	1600	cmd.exe	36
PID 1600 wrote to memory of 1700	1600	cmd.exe	36
PID 1600 wrote to memory of 1700	1600	cmd.exe	36
PID 2628 wrote to memory of 2596	2628	t.exe	37
PID 2628 wrote to memory of 2596	2628	t.exe	37
PID 2628 wrote to memory of 2596	2628	t.exe	37
PID 2628 wrote to memory of 2596	2628	t.exe	37
PID 2596 wrote to memory of 2044	2596	cmd.exe	39
PID 2596 wrote to memory of 2044	2596	cmd.exe	39
PID 2596 wrote to memory of 2044	2596	cmd.exe	39
PID 2596 wrote to memory of 2044	2596	cmd.exe	39
PID 2628 wrote to memory of 2592	2628	t.exe	40
PID 2628 wrote to memory of 2592	2628	t.exe	40
PID 2628 wrote to memory of 2592	2628	t.exe	40
PID 2628 wrote to memory of 2592	2628	t.exe	40
PID 2592 wrote to memory of 2036	2592	cmd.exe	42
PID 2592 wrote to memory of 2036	2592	cmd.exe	42
PID 2592 wrote to memory of 2036	2592	cmd.exe	42
PID 2592 wrote to memory of 2036	2592	cmd.exe	42
PID 2628 wrote to memory of 344	2628	t.exe	43
PID 2628 wrote to memory of 344	2628	t.exe	43
PID 2628 wrote to memory of 344	2628	t.exe	43
PID 2628 wrote to memory of 344	2628	t.exe	43
PID 2628 wrote to memory of 764	2628	t.exe	44
PID 2628 wrote to memory of 764	2628	t.exe	44
PID 2628 wrote to memory of 764	2628	t.exe	44
PID 2628 wrote to memory of 764	2628	t.exe	44
PID 764 wrote to memory of 2568	764	cmd.exe	47
PID 764 wrote to memory of 2568	764	cmd.exe	47
PID 764 wrote to memory of 2568	764	cmd.exe	47
PID 764 wrote to memory of 2568	764	cmd.exe	47
PID 344 wrote to memory of 2312	344	cmd.exe	48
PID 344 wrote to memory of 2312	344	cmd.exe	48
PID 344 wrote to memory of 2312	344	cmd.exe	48
PID 344 wrote to memory of 2312	344	cmd.exe	48
PID 2312 wrote to memory of 3064	2312	qZBkgHziko.exe	49
PID 2312 wrote to memory of 3064	2312	qZBkgHziko.exe	49
PID 2312 wrote to memory of 3064	2312	qZBkgHziko.exe	49
PID 2312 wrote to memory of 288	2312	qZBkgHziko.exe	51
PID 2312 wrote to memory of 288	2312	qZBkgHziko.exe	51
PID 2312 wrote to memory of 288	2312	qZBkgHziko.exe	51
PID 2312 wrote to memory of 484	2312	qZBkgHziko.exe	53
PID 2312 wrote to memory of 484	2312	qZBkgHziko.exe	53
PID 2312 wrote to memory of 484	2312	qZBkgHziko.exe	53
PID 2312 wrote to memory of 836	2312	qZBkgHziko.exe	55
PID 2312 wrote to memory of 836	2312	qZBkgHziko.exe	55
PID 2312 wrote to memory of 836	2312	qZBkgHziko.exe	55

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\t.exe
"C:\Users\Admin\AppData\Local\Temp\t.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\t.exe
  "C:\Users\Admin\AppData\Local\Temp\t.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableTamperProtection $true""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableTamperProtection $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\qZBkgHziko.exe"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:344
  - - C:\Users\Admin\AppData\Local\Temp\qZBkgHziko.exe
      C:\Users\Admin\AppData\Local\Temp\qZBkgHziko.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2312
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\qZBkgHziko.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'qZBkgHziko.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:288
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Roblox'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Roblox'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:836
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Roblox" /tr "C:\Users\Admin\AppData\Roaming\Roblox"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1692
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /delete /f /tn "Roblox"
        5⤵
        
        PID:2564
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp385F.tmp.bat""
        5⤵
        
        PID:2988
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:2900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\' -Name Hidden -Value $true""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\' -Name Hidden -Value $true"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2568

C:\Windows\system32\taskeng.exe
taskeng.exe {34EB9AFD-565E-4738-8D10-6D80179A4A08} S-1-5-21-677481364-2238709445-1347953534-1000:JXXXDSWS\Admin:Interactive:[1]
1⤵
PID:688
- C:\Users\Admin\AppData\Roaming\Roblox
  C:\Users\Admin\AppData\Roaming\Roblox
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Cipher\_raw_cbc.pyd

Filesize
9KB

MD5
d372a4eec83ab1384c242edea93e58bb

SHA1
51265eddb22890d6069a70aaca8ce6c8f0733b49

SHA256
b5c57f458dce223ecc6eca92cdc438f89d80936c1fd28f3ded3c34e7b5b9c808

SHA512
09535302fd60193dd965b01d7e6119788215ac062406d1f09969c9d8aa751c8823d8478a5cb9a10d62212dd82ce84eda138f9a1f3ffa42d1c3faa093eb891a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Cipher\_raw_ctr.pyd

Filesize
11KB

MD5
b792871f15b2539a0c4836247fde0412

SHA1
31e57808630b6985757595939e48bf8c55a2de3e

SHA256
6212ca9152bf469cb33eb258acdc2e98e2b426ed8f9baaa9361bc7bed842b98f

SHA512
10057d6b08e26e052e420d1a8d0b3f96ccc75170394420120135541e5901404cc4fb04415850077db80a85ddf74bec8e0462ce2f41ddf66c3a3a8a7a0291893c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Cipher\_raw_ofb.pyd

Filesize
9KB

MD5
87e0c9f18a698468498410420ecf67e0

SHA1
5767641069ea527341bb87956ef68a65ab90d2ff

SHA256
e39b2b750f5fe0c9a66f31a7b9db8037f2d3cad54e5f3f44d470eef9d50e340a

SHA512
cd56d8381010189a0995df58b183d5dbef51ada2ffbdbdbd57e90a1d102119c066e3334dc4e1ec3c236becc80e1dbd7f988d97bd3d85b807fb3c57fe7ff398b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Hash\_BLAKE2s.pyd

Filesize
11KB

MD5
cc6306e4c4db9845654286d38e0f815a

SHA1
cb5af219a58e65897a6f633024a87cf55e5020cf

SHA256
daf65596e41c180af748d66e467f401d84cca0efd6cdcee14270f2f33cd2ddc7

SHA512
1aa15ab2efa0ff39d34df06fdec539ba3722f2ce720c7425fd34e1ba408141bdeb21267bb23c95033b275e5b7b4867cc92ac404c2e61b8d9cddfc5ecd52815c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Hash\_SHA1.pyd

Filesize
14KB

MD5
b1aa5268ee7d193d045dfb40a5d02638

SHA1
42e0d32f29600031b01f36297c0176e436680f57

SHA256
6f6c4a49b610845d640f1dc81e237532a80f8bb1ea6a885f170b8e6b816bffaa

SHA512
1b3c01f42e6692f87c881eb35ffe9c6d8d9d1cf7a28ceee594814904197a74666227a0bdcebaeebee96217bed9662d384ef629279314ff8f705872981b5ac58c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Hash\_SHA256.pyd

Filesize
18KB

MD5
9bd12aeee4836d3c933662df2a5e513e

SHA1
fd4ad3956ef5585fe36933c1764a41d2bb79361e

SHA256
6f35db5e531e1f7a29c9cad0a9510a090d7b351ab3ad940c908ab60d9aa2e97f

SHA512
ebb8937b7e08d02f360eb5dacc0ea5abcfa8bda5c3ff1b67c151428722524677c78ec7266fd4231fcc4dec1cd7e1d5787fc346b4a21135cebf5969252225d00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Protocol\_scrypt.pyd

Filesize
9KB

MD5
9375c663174c142e7e98e4fcb8ed1264

SHA1
a55b73e35388b2d9e61478c64a3d0a121c729349

SHA256
e3499b32c2b73e9e91fe1550ad4dda25ca519c66e9df72d2b04a43cb392decbb

SHA512
e86f239928a9cfdd89ee81061904f3b3a0f6dd91151775df8cdec02a991ace2356f474f640479f46b69f2ea78bdb697d00daf58e375c74f61199ff9d57d5b72c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Util\_cpuid_c.pyd

Filesize
8KB

MD5
e055db9c94395688edbfa66215447600

SHA1
a8d7136b7dd2ff8201049936d15f70875dca83ae

SHA256
a7535f09d14a6dc1ec21a58832792a4dd211b2fb061645b724fd6a4140b7464c

SHA512
460dc8391f5fe31b238be4f79c6c5e65df84daad06d302d4223ab85ab498b2c96d9d173ebb578f005db39d7e295b092320174802fa022c1de7d93074bfe25143

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Util\_strxor.pyd

Filesize
8KB

MD5
764b5bf2abc0d28e6b3774882a0b98c8

SHA1
d29280d41fc08a7719f93ab6c8c7e90c6a679a16

SHA256
b2527a19119f77368273d1e58f24ac502115e55c9f2a5a679bc7a0b90fa3bf4d

SHA512
ddddff788f460a320bcd27f4b8e4838273f9ac95b53d2c47e6112f7cce8e882008cf477b34c06cc60b8873d73dfaab00d289c346d15759885b156b82050c7988

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\VCRUNTIME140.dll

Filesize
84KB

MD5
ae96651cfbd18991d186a029cbecb30c

SHA1
18df8af1022b5cb188e3ee98ac5b4da24ac9c526

SHA256
1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1

SHA512
42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_bz2.pyd

Filesize
71KB

MD5
055cfc5297933c338d8c04fd4e2462a2

SHA1
bf8f97ee8136bfe3f93485e946f2069b7ce504e0

SHA256
befc81440bbc001bd7647aca42962ee0b45b08435ee9f7140bf570af636b7dd5

SHA512
308ebb33c47b73ecd9c4e4e54ffd09aae5a96019559ef7b2a37a45bd89c42d0d5bdd21da1835fffd84a138b03662c3d68bd72725a22f1b0ddf0329438819ead7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_cffi_backend.cp37-win32.pyd

Filesize
152KB

MD5
0c6f3ae411e82b37ab4d6fbc22a3ef7c

SHA1
8ac797b5a703a1f10ec10e1ecc8c04d6aaebcafd

SHA256
33a5ab6c627527887b82058c4dbfbfd5d88bbf187302e73aa3169b81e12cba40

SHA512
48385d18cc1ef13a9b68c3e9450d1980f0bd9ef466c44c94350e418f7daea86f97e60ab5de8a43d2efc34ab49c47cbe87c6ef35679473528a1840e940e3cdad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_ctypes.pyd

Filesize
105KB

MD5
06c45d47af92a68ea6da0cc861992034

SHA1
0e8814b489e2c50e4481b69d532ca51e53274747

SHA256
b016e7ce9744a0e8fea473f1982e5d2fc355a98682054f470f4189d5fc00b8bf

SHA512
397ae19e69bdfb8bb4ec8197e5ac718d409930c6ff9e6cff979cef665ffe19aa197cca9b5a03ce7d30529d27a489b15e2a813bce1428e8dec8eb63f2148408d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_hashlib.pyd

Filesize
31KB

MD5
1280a084744ef726a673b757b9364335

SHA1
203a83aee00f6dca7b5cf16f5d140ff5fb888bbe

SHA256
c2b3dc92abd96485032d1287941e405d56df05fb5ba68199497d8594400163e5

SHA512
637aa79bcfe2ac3f75319a4be3ee4e32769a52cf939a26564a73807b40e96328fd1e9b58e70abb0b4c204c77baeb61a5150f5ebc47a7262a9c520867f69f6075

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_lzma.pyd

Filesize
181KB

MD5
d72665ea18965f103200ccc7ad072f85

SHA1
2b89543cd8bd1aa20e0d3150a3c394b90be0d204

SHA256
ab20e63d14259a7deca85a068796476c0efcc236a11d53b1816fc6f8956424a8

SHA512
aad0bcbeabaa50b1fdba4cf70fe281f58b62a81b680cc16ef7f238263625fc7bed9ae9321a7bf7010fe7b5bb28708bdfaa0138c4f35a52be6aaba71d03aaa3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_queue.pyd

Filesize
23KB

MD5
2188964211b458221a65043820799ceb

SHA1
3155f1ade1556702eb7ffbc498b95d75f6b165c4

SHA256
cf8d872886f9c85d5705d40e9d602db33b66aa1d2d43f0e70482ecf91cf8610a

SHA512
943b42ed14fbfd91019f0c2c29ee149ef79efcdd710e68516afaff8387f98f5fa33e881f2f388c1acf0093c457826af226ad863fcce2324667b581068d589838

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_socket.pyd

Filesize
65KB

MD5
51a38a6bf4c7e3d71b21a88b7a1dd555

SHA1
7c10b8dbe3972e1df92393b01523a9f843c24ed3

SHA256
b7829ec5c6de17b30037e1b50f43e26b40fcd9acdabce0011d623f5c0cebd70e

SHA512
6d068e2418da43581e0cd3cbed606b89d9a095fdddd348c72e9dbbd9f2dc580ea445c6c972616620ad444268e1e489efff6b528395e27c4a98ecca953258e7a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\_ssl.pyd

Filesize
101KB

MD5
e577403078daf63ce6ddc07f195c45ce

SHA1
b4f8c0a6466efe7f1919b6f9332ff8db55d6d6d1

SHA256
49559f96f659917c1c0e0d7ccb4fcf915bc1a00e51a5b25fe417262ef0f47774

SHA512
d4015b716516f9f24b913f6bab9d9826b25efa57576b377aded57dde9dd83d95e451aa05378b909723af4b2a3bfaf5af6d4bd2a06858dce582f002e917bccbb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\base_library.zip

Filesize
994KB

MD5
cbdbeb44a8cc3eee4baf2e7337a1daee

SHA1
9fe5ba2ea1782a92c74fa0c738a7e1fafe259ab6

SHA256
b6f8ca01c3d0f1595a730d2f8e608bafe5c8c920e2f09a0a97955169a01a2171

SHA512
ad95d8c122710519ea07ce0d0e510d51e3c49a1e31e32bfc4c83f6f4b334aa80f8ee9cb809477eb91e8ceacc057ac14d788f7749319d4466607a8a623238956f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\charset_normalizer\md.cp37-win32.pyd

Filesize
9KB

MD5
27cc5f8716ce37c834be9d61233a2685

SHA1
f6083f9737f7dec59d7a6063e52b8af53fe05550

SHA256
52a5c53f1505a252854c1c7ab13c635118bffa1b555261002bc587f6e3d42850

SHA512
8a29a6b3d6ba5b5ef16c6db82d57c2f4ee6b7c25bd8c593e0d5160c8f66b44f7da0560421fdac88b8879b76f4da4f412aea1c98bcfb0ea62e07f1f2d4abc9b9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\charset_normalizer\md__mypyc.cp37-win32.pyd

Filesize
100KB

MD5
e2fa4e72aefd808f0b99d0df625e547d

SHA1
b4a0fe36732d9a9d2aadbfaf3fcf59b9da0f0a6b

SHA256
c2ddbc95e4160914b3460af68dae3c131a42142acb74ddd3c03af23c75ce27a3

SHA512
dee70cae8096b931889545bb51fba650a1f6890fc67dc8f8980c5423fc798a117622bdaa00e5099c5ae77e7163b6a34788221bcb1fe33e1e01912e0b5ad7550a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\libcrypto-1_1.dll

Filesize
1.8MB

MD5
25c9d6fa8bf1222e82a37ef982f418d2

SHA1
e4bed3d1e76a58fc0119b7a2e70a998ca9ea7202

SHA256
3f70a63aacc024c4cd599ff1e12bf5b685719cf2b92c4420fd20ab032c9c898c

SHA512
2d6daf0e16971f9a6c1153bd67ff7fe2b1dbdeb5d05ea743cae231b85c9a27c4ee365f9c2141ea30a1edc9ebb32aa8a103b4949b5a0d9d031ad30acb2e9c60e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\libssl-1_1.dll

Filesize
398KB

MD5
d07120c4a7f7fa74d9c774d81663d685

SHA1
b5edb8821bd5b9184d55c8b16c805e4be966c7e5

SHA256
96fecbea2f57b69326eb2e0dcba7c32a8ae1d281d85f52c32fc39d5d4cca479b

SHA512
3b56595da7c83385266dd563275f44f0b3834c07ed268231043af1568dfdb5b370c4a76a880db7a203a727183bf867eb0ad2c792b5bf590ca42ca32c664dcea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\pyexpat.pyd

Filesize
164KB

MD5
ea5e7e997193098c2259119a37c7e4c4

SHA1
76e68dc830b8c0170916fbfcf84e26e74905f292

SHA256
40b17f3dff41e29492c8519372d435cd973f0a67597663fb12ad6756eaaa9077

SHA512
114eaf17bd29a7c1c9c17a8518f9bc5f215fe363e389ee84b3dbb87ff3f0418ebc435cee7b35f4d5ee48614381ef2e1eb8a67108e0b9816d4409d8b30a941d37

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\python37.dll

Filesize
3.5MB

MD5
198dc945fa3a7215c2aa90bd296025b4

SHA1
ce991e920755d775d99ab91f40124f0aad92863d

SHA256
20cd780cf1e90778799e749812b00b1865938ef8990cd9bf2c1630787c6181c9

SHA512
a880aa55740e635e3fbd32b8128572b92f379913d405f3baf4e9ec67891ac3dd77dbed85074a958c89093ca378dac95733287a45ca89c75029a61ecde058c955

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\pywin32_system32\pythoncom37.dll

Filesize
525KB

MD5
322f19eae6d535537c674c15a4df7821

SHA1
1a08c40604696fd083e1a7c84e64bd0a627fe9bd

SHA256
ab88387e20f73da15e099423eca7e6b4956da1f3dc1fb673778de7bbebcfd32c

SHA512
cd13ef99374c618ee35b0b54d548baee5281718acf43da77277988ec973f6f4c8f06bd69f3f72fccaa93fc63a04895d337111e77b7cfcec305b5e8599fa224f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\pywin32_system32\pywintypes37.dll

Filesize
107KB

MD5
65e7b0a8336eea1355403d6e2abd2cc8

SHA1
f57bc8e5e6e30998c68068f22d35162d9266b465

SHA256
71a346d3f4a17a5f8922d720e696ea966b3a4efc0aaf51a859040a6084c839aa

SHA512
e1f1b13d71e1ba4e12c979951b7fb5442b9224412241545acc7518fe6c3f8c69abe20a863717be4a7fbcdac90bf6665667eeced929c1033d7e7136a34ab870e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\select.pyd

Filesize
22KB

MD5
cefff42d83a7dafe76d22589978aa085

SHA1
6cb9b60804a8b8fd19fe23612b4018cf1fd76854

SHA256
f8bf0c9909ee65038f5bfdb47c7ee037bf55c97d5be259aa904d4e53a9b5cd34

SHA512
1b2dbb98b543acc49db3647edabc32f5fba8880ee631b146a2078e1c7ebd867682245f4bf177252e92f0c297352b5ae734764154ed5e4c5878687b4f502cf35b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\unicodedata.pyd

Filesize
1.0MB

MD5
1d96ba2fc295ce9725e1949b266a980c

SHA1
1b7dd35c9d6b1046e04c70b49e40270901d1ed7f

SHA256
830359b3cf5719a5ee26a36b3968086aa21e46a067b8c2557ae8f433eef2c747

SHA512
7f501fe628773eff27e07bf85ef2bc3fa127fd653bbc54ee47e8ca59ce98a7cfc7ef4402c9e84c2433e5cc816656fd77d62a590fa5c57ae76066147140d619bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24442\win32\win32api.pyd

Filesize
100KB

MD5
8f407afed8a947db4cf05efb1dd9d854

SHA1
b2955589f732526836e0877603b51934593b310f

SHA256
c1a829c1887f00d62c4882c0187908bb9346706a300537e295c87fc803c593cb

SHA512
25eb23c8b0f05db8c295de69005eba38c854656c18e642ffa6e97ee97130bd98fdf1040446a4d9e389b097e0db235197fa6c44901b10f7fa75060e6a8f9cdbaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp385F.tmp.bat

Filesize
162B

MD5
086afa57c302027133b9efa109e63313

SHA1
21a2712bb46d1c05d3053957a148709cba76aa78

SHA256
7cd0a1461620429b62e0a0202fbb4caf5ca27266ac63c73dc05fd34c396edf7f

SHA512
3e98a05f4aaa124777c59b9c6607b31c4b4e1a31fb663b3fdfdae03aca53bcc95e1a5033ae9b68036a33653e3d6d5cef9f9f2939324e73f3a465435b8591966f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\732KKEYZ6AZ8KSZ045OU.temp

Filesize
7KB

MD5
f6fb136b491d323ba636b2ff6552e957

SHA1
99fecfd1afbaef5670cd946669357d3042692010

SHA256
ef0784cbd15c6adcdec0e41ac8330ee7853ea78ef36c606822719f8532cbd6b6

SHA512
b4a2045a7848e7cde61d04c28acec7c32eb0bf9c8f559a7d75fd9d77d7e89574579bc23e753d8f9ed6412bfa4eff838613d2eca594977e19e6645ecee21d12d6

Download Submit
C:\Users\Admin\AppData\Roaming\Roblox

Filesize
229KB

MD5
04da3eba6492478169349b664bf8f695

SHA1
29915738bcb9581a85688928627981a703f5b0ef

SHA256
f8de0c27dbd0e2dd55cdbd81a41f020fed428b4e7188e926cdf5b5fd419b9e7b

SHA512
7078e54e18ec45a563becaff1ef1f769f4336a15d2e45c36b2d0821c95b599283455daae70c47628df042bb470c760b8e527899cf50a3553c3a79e9ddbd183bb

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Cipher\_Salsa20.pyd

Filesize
11KB

MD5
67eff3114d1b45b18c87bd439311e993

SHA1
73ea8f13af119fb64a17cee5798282a4815e7381

SHA256
dab447710f7dd595c7311ed7921ba4b291666d7231118bc6b01a95d897a9a14b

SHA512
9de9612bd80c8d3b2cd34b4695bf555b4b98020c4b64d581388aad2ef1eb99140b0b37b784f8564bad2032c275835c20f28e550ddf18d139d063ef87b0423501

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Cipher\_raw_cfb.pyd

Filesize
10KB

MD5
75d76df25c45abf5e5aff19df6e519ee

SHA1
bec2fb0fa9103f5f00a96c171e6cc22f30c67423

SHA256
d7af81a9f1be932339d8f38978c6a89ddeb279d75cf22f18d664ec6e605adba9

SHA512
80b85386f39364fef3f088d0711fc24a480363f859b88a62e1e81346b9951b78b15d32b0aa5e6f86fca080f559dcac108197b242c8deb7c33d8302b83e991749

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI24442\Crypto\Cipher\_raw_ecb.pyd

Filesize
8KB

MD5
fd623f81f725431b18d7f54442a7d407

SHA1
ee9c771e26e43c1d9fbcb1074f0dd3163f16b0b0

SHA256
da10fc7f4d2b60e1ddf5ce3ed86434cdbfd2dfb8f6967ac6d7a55634b82483bb

SHA512
22cd400dbf50ee81e234d1b7fc5b5e6176640c91038325245ad2a22e2ee465740ee0f30ab4a1150e4a58b06415d1175a54631a6edc5496d2bf75431a8ce7f440

Download Submit
memory/288-444-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/288-445-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/608-458-0x00000000003C0000-0x00000000003FE000-memory.dmp

Filesize
248KB

Download
memory/2312-459-0x0000000001FE0000-0x0000000001FEC000-memory.dmp

Filesize
48KB

Download
memory/2312-279-0x0000000000360000-0x000000000039E000-memory.dmp

Filesize
248KB

Download
memory/3064-439-0x0000000002870000-0x0000000002878000-memory.dmp

Filesize
32KB

Download
memory/3064-438-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download