Overview

overview

10

Static

static

10

XWorm V5.2.zip

windows7-x64

1

XWorm V5.2.zip

windows10-2004-x64

10

Analysis

  • max time kernel
    629s
  • max time network
    626s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-08-2024 23:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XWorm V5.2.zip

  • Size

    52.0MB

  • MD5

    2bad9510e5b0bf509912c52aaabef753

  • SHA1

    1b1c5fca58bd9f935972ae02d6cc063334d65da7

  • SHA256

    3cb0728db93f2c80aaf137a7016bd7f7fc04164c9516adf8f3e298016a44c559

  • SHA512

    1308d15044067914e9f339ac5fab3faa30c61175d9bf6db114d7306e3bf6dcc219e65c64e6fadfa8739a77013d6d869dc9d12aed76a6ebebd09046fbb035c352

  • SSDEEP

    1572864:cXjrCTvb2VU8IrNhMXLe2KoZQ0/4H+b+LwbgUSiaG2FB:cn9ReNSBZJ/4bT9Gq

Score
10/10
agentteslaxwormagilenetexecutionkeyloggerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

Mutex

JYj1EIwWwj45bGVr

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

aes.plain

Extracted

Family

xworm

C2

127.0.0.1:53435

10.127.1.38:53435
Attributes
  • Install_directory

    %ProgramData%

  • install_file

    XClient.exe

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Detect Xworm Payload 4 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • AgentTesla payload 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 3 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 24 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 40 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.zip"
    1⤵
      PID:5028
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2376
      • C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\XClient.exe
        "C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\XClient.exe"
        1⤵
        • Drops startup file
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:492
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\XClient.exe'
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:468
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3384
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2408
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5004
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
          2⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4356
      • C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\Icons\XCsssslient.exe
        "C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\Icons\XCsssslient.exe"
        1⤵
        • Drops startup file
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2348
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\Icons\XCsssslient.exe'
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2360
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XCsssslient.exe'
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4008
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2860
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:756
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\ProgramData\XClient.exe"
          2⤵
          • Scheduled Task/Job: Scheduled Task
          PID:800
      • C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\XCsssslient.exe
        "C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\XCsssslient.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4296
      • C:\ProgramData\XClient.exe
        C:\ProgramData\XClient.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3528
      • C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\XCsssslient.exe
        "C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\XCsssslient.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4300
      • C:\ProgramData\XClient.exe
        "C:\ProgramData\XClient.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3832
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /0
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4360
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4064
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4456
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1072
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2484
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4344
      • C:\ProgramData\XClient.exe
        C:\ProgramData\XClient.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:560
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:3212
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:748
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1612
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:3868
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          PID:4264
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:184
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4548
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:2428
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            PID:4788
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Suspicious use of SetWindowsHookEx
            PID:564
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3916
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:3232
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4996
              • C:\Windows\system32\taskmgr.exe
                "C:\Windows\system32\taskmgr.exe" /0
                2⤵
                • Checks SCSI registry key(s)
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                PID:1464
              • C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\XWorm V5.2.exe
                "C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\XWorm V5.2.exe"
                2⤵
                • Loads dropped DLL
                • Enumerates system info in registry
                PID:3032
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\Fixer.bat" "
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:384
                • C:\Windows\system32\lodctr.exe
                  lodctr /r
                  3⤵
                  • Drops file in System32 directory
                  PID:3756
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\Fixer.bat"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:4700
                • C:\Windows\system32\lodctr.exe
                  lodctr /r
                  3⤵
                  • Drops file in System32 directory
                  PID:4176
              • C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\XCsssslient.exe
                "C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\XCsssslient.exe"
                2⤵
                  PID:3088
                • C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\XCsssslient.exe
                  "C:\Users\Admin\Desktop\XWorm V5.2\XWorm V5.2\XCsssslient.exe"
                  2⤵
                    PID:3424
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2756
                    • C:\Windows\system32\NETSTAT.EXE
                      "C:\Windows\system32\NETSTAT.EXE" -a
                      3⤵
                      • Gathers network information
                      PID:3876
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:3592
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:4484
                • C:\Windows\System32\rundll32.exe
                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                  1⤵
                    PID:4500
                  • C:\ProgramData\XClient.exe
                    C:\ProgramData\XClient.exe
                    1⤵
                    • Executes dropped EXE
                    PID:4448
                  • C:\ProgramData\XClient.exe
                    C:\ProgramData\XClient.exe
                    1⤵
                    • Executes dropped EXE
                    PID:4240
                  • C:\ProgramData\XClient.exe
                    C:\ProgramData\XClient.exe
                    1⤵
                    • Executes dropped EXE
                    PID:4072
                  • C:\ProgramData\XClient.exe
                    C:\ProgramData\XClient.exe
                    1⤵
                    • Executes dropped EXE
                    PID:184
                  • C:\ProgramData\XClient.exe
                    C:\ProgramData\XClient.exe
                    1⤵
                    • Executes dropped EXE
                    PID:4952
                  • C:\ProgramData\XClient.exe
                    C:\ProgramData\XClient.exe
                    1⤵
                    • Executes dropped EXE
                    PID:876
                  • C:\ProgramData\XClient.exe
                    C:\ProgramData\XClient.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1632
                  • C:\ProgramData\XClient.exe
                    C:\ProgramData\XClient.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1260

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\XClient.exe
                    Filesize

                    85KB

                    MD5

                    0bdc10075591678b2834a183599e1934

                    SHA1

                    51ee9be786746c2462595e0fdb3d6629f1fbdba5

                    SHA256

                    770def897a3e3ea3e8f5fdc26d07e50e52b8c9aac18ce5372baf07696e98835c

                    SHA512

                    6782d0aba2329edaad1b243bd9da2c77404e19371777146c1ac6c143cb5215dfa4255548eab5cb73429fcbb6bd09ffc2fd0aba0d258c441fe4fada6c4d701ab1

                    Download Submit

                  • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                    Filesize

                    64KB

                    MD5

                    d2fb266b97caff2086bf0fa74eddb6b2

                    SHA1

                    2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                    SHA256

                    b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                    SHA512

                    c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                    Download Submit

                  • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                    Filesize

                    4B

                    MD5

                    f49655f856acb8884cc0ace29216f511

                    SHA1

                    cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                    SHA256

                    7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                    SHA512

                    599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                    Download Submit

                  • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                    Filesize

                    944B

                    MD5

                    6bd369f7c74a28194c991ed1404da30f

                    SHA1

                    0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                    SHA256

                    878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                    SHA512

                    8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XCsssslient.exe.log
                    Filesize

                    654B

                    MD5

                    2ff39f6c7249774be85fd60a8f9a245e

                    SHA1

                    684ff36b31aedc1e587c8496c02722c6698c1c4e

                    SHA256

                    e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                    SHA512

                    1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    944B

                    MD5

                    6d42b6da621e8df5674e26b799c8e2aa

                    SHA1

                    ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                    SHA256

                    5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                    SHA512

                    53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    944B

                    MD5

                    dbb22d95851b93abf2afe8fb96a8e544

                    SHA1

                    920ec5fdb323537bcf78f7e29a4fc274e657f7a4

                    SHA256

                    e1ee9af6b9e3bfd41b7d2c980580bb7427883f1169ed3df4be11293ce7895465

                    SHA512

                    16031134458bf312509044a3028be46034c544163c4ca956aee74d2075fbeb5873754d2254dc1d0b573ce1a644336ac4c8bd7147aba100bfdac8c504900ef3fc

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    944B

                    MD5

                    5cfe303e798d1cc6c1dab341e7265c15

                    SHA1

                    cd2834e05191a24e28a100f3f8114d5a7708dc7c

                    SHA256

                    c4d16552769ca1762f6867bce85589c645ac3dc490b650083d74f853f898cfab

                    SHA512

                    ef151bbe0033a2caf2d40aff74855a3f42c8171e05a11c8ce93c7039d9430482c43fe93d9164ee94839aff253cad774dbf619dde9a8af38773ca66d59ac3400e

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    944B

                    MD5

                    da5c82b0e070047f7377042d08093ff4

                    SHA1

                    89d05987cd60828cca516c5c40c18935c35e8bd3

                    SHA256

                    77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5

                    SHA512

                    7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    944B

                    MD5

                    10890cda4b6eab618e926c4118ab0647

                    SHA1

                    1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

                    SHA256

                    00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

                    SHA512

                    a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    944B

                    MD5

                    d8cb3e9459807e35f02130fad3f9860d

                    SHA1

                    5af7f32cb8a30e850892b15e9164030a041f4bd6

                    SHA256

                    2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68

                    SHA512

                    045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    944B

                    MD5

                    eb1ad317bd25b55b2bbdce8a28a74a94

                    SHA1

                    98a3978be4d10d62e7411946474579ee5bdc5ea6

                    SHA256

                    9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98

                    SHA512

                    d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                    Filesize

                    2KB

                    MD5

                    f410f60519ba2f5c356a13cf18682cfb

                    SHA1

                    9275261a340f424a28ebf78856fc35c9869d145d

                    SHA256

                    444221f9302539edea6abe636655f4c231b50e8544c43f400a7d2ebd25969250

                    SHA512

                    c3a0ef46df9f62dfb006ddd6002cd6d6a772dbd873bca71b4f770e029ce12a77676e873f3416bbeead2cc13057031ec507e1c3541df9888a59f000f7c8fa1d29

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133671165592766663.txt
                    Filesize

                    75KB

                    MD5

                    307af05829f26d624f53bd2547340b07

                    SHA1

                    d06d91b2b2b8191b0215abdf6b18818e5508f7c9

                    SHA256

                    fb38890c74b32ad04ae18a59f6c532ca4d35c169dd0bea4a4f6d71530cb0a12d

                    SHA512

                    ab3b59c18fed6f8759ab332a8579e31d7ea44c611bb0cbd73798fe3f456150d9f3c2e369de4fb0e8bc9db114c8cc0c7f26a88e877b7887f9f4f5ca971d05b9b1

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Y25IPP08\microsoft.windows[1].xml
                    Filesize

                    97B

                    MD5

                    d07a8eeeb6da833c3c127ff207daead9

                    SHA1

                    cc8a12f7c600ac6ad8211f50045ca376f88f3cb6

                    SHA256

                    113038e3d15cda4a50c0980cb7075456d00b0770a1c436b68cea36b435363392

                    SHA512

                    84bac1ea9a2bac093a6356933b08c841d1ef922937d05db05b388b6b107d77a7edcf6431db083a89e611c86c2ed9e8e83207e798edb08e3e056045780a432800

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                    Filesize

                    88B

                    MD5

                    a01d8268f03db43311c1c4b906a664d9

                    SHA1

                    817edad3ffaa387272309da917eaf52bed2df614

                    SHA256

                    ae595f46be079dba07e84a1c0ba51c4909c9a8ed20ebede1793faac3bbd8f3c7

                    SHA512

                    e01f145f13ebbcce9921161e05262ab6333a655f867a22306e05332321a9fd6a0cef4b8cad39a82d24a314465cd3d83f5758d269ae54d75d1e3cf9dd660cce5b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                    Filesize

                    95B

                    MD5

                    6c4b2cda04bab3d6b59da8420c085785

                    SHA1

                    2263bb72c645eb90eb03d865dcd0a564a2766ef6

                    SHA256

                    aff1c794bd71b927e643f7b6fbd9c0791d5a00b444ea0c3cce98eeb884e513a3

                    SHA512

                    10088d511ea8e5deb9eb6653c9319e892a08ecbb4eb474ebb47055150d1b4237a59030e898d34c66514a8c76a3ad84f8a665d4f266b19245ee77ecc92a6f496c

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                    Filesize

                    102B

                    MD5

                    331041a66430289592cfa66ee3dbca97

                    SHA1

                    ea8954bf8eaabaaa9d7c8fc667a5cec4567f0f68

                    SHA256

                    5c1ee5b41d62088e540b1bf151e24b219115fde9b4b9616aaa198f5d8c296341

                    SHA512

                    b6752adec1e32a6e7add96701b8c54c8869aee722330223eb2b10f4c7cd5bc4326bc52663fd0a8d45928fd9737d8313f87d0b4651e577d6a2eee12f34e617c87

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                    Filesize

                    116B

                    MD5

                    f3263e1ca14fc3a00d548008a294a45b

                    SHA1

                    6bcdffe76487d52a6a4f12dd5af3f10360b3f45a

                    SHA256

                    4d75b2c24ce9efda171fb78c5886b4e7dcbfeb1e389366e5a6c54b8eb4c20d16

                    SHA512

                    59b6d903d800b9bd5b81fa06f9d8618846bc0c2fe6c6afa1180218034883e250b9473f2348c0130147e77640126af396e7ccd77fe52c097d549dc4929261fafc

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                    Filesize

                    171B

                    MD5

                    9bab232bd37d0c0eb7256bd4123869fa

                    SHA1

                    62ca0081e02a3b08542482ed03b2479418e2da01

                    SHA256

                    e7c1358ba7dd63c585f2a7edf31817579380f94c7c625c4eb1e41134f5723fbb

                    SHA512

                    04b3b5fdf3bad57b36947065d8dda652c28559ebe9eb502c4ea45eed1eee6dc1f7bf097be8afe567b5dd5af8cbc0cab06e50adeb275411bc0bd21e38aef71529

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                    Filesize

                    226B

                    MD5

                    9cc5425919d9061e8a0dfa93af7112f9

                    SHA1

                    f0cc1d1c0116dbd9cff23a36dbdb598eb9a65b15

                    SHA256

                    be8306b7e9a99c0f14e5bca883a2168f4ad9e0a28f5fffb66d55f7f5f376be9d

                    SHA512

                    6d1f3172611e202a3a3a9bb8172085d0409af0938404953267bed3f39769ff7d62f41f5515e9c6b72026b50b17dd1730fbd138a4796642cd77b06bb6c55734aa

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                    Filesize

                    232B

                    MD5

                    9c4556be441e1913cd12778dd55043b5

                    SHA1

                    df8f0536a7e76c17e75c1cb10c1d76526d1dc895

                    SHA256

                    fdc654e6cb53460a060519cd25026a69c148b8d245c3b4faa550e32c2abb4530

                    SHA512

                    af595bf166526be3e2dbe35c57ad4e5abec0667afb9ab453bc75b8e791c9f0bbd70f6a59851ceb382cd5b8225d5ed7a6ce4535c60a64f4293be000b7bff4fb65

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                    Filesize

                    238B

                    MD5

                    c6ae279c7708cd310037eba4cef06c1c

                    SHA1

                    67959517c4c599c6b6a13c0fefd15dee5d3dc89d

                    SHA256

                    fc1b14922aca355125e14c0600ee6fc0b6c0fad3f9be1d30dbea3ea9b9523997

                    SHA512

                    4527f0eac77b0941efe8dcf006bc12c33a4f4b5f43cacfecaa29696602e78f6c8a0b75f8a55e4ae6fb3ba8e04c1b04bfe12e71d6a9e2ca1e266e8335f49cbe8c

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                    Filesize

                    239B

                    MD5

                    c87d8e848a92f3d170f2d6b88002beb1

                    SHA1

                    95abec8defc7e8835510436c273c1d8bb464b16e

                    SHA256

                    eb3ac1063c55cdb5caf241de3c8195de29213a9f262314cce375667e7f33e022

                    SHA512

                    4c6627635ebd5f6a1f1aecae27b88571d42f612cdb5fe30df7891cbbdbd525e82831684b84563cb92a403a0035c5f403e52ef54aa903c25595332a481929da09

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                    Filesize

                    240B

                    MD5

                    4b9d3ae2522676fc4407800bdc4459a6

                    SHA1

                    b50b3f802b8f8dcdfc9bd82b0c7d1f40961f711e

                    SHA256

                    83e00b1ea7639a9605935641bdd2b9a16a4f9541ab35b88e51b5dce1203e8458

                    SHA512

                    c97dede8510a6f3dd9ba0aeeaef75ef485bc08c5697d6003915a9ee2900c86e0921acc44849a03d033820761ecb4115c6b766a610231931fc269a872744a7c87

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Log.tmp
                    Filesize

                    44B

                    MD5

                    81cf5b2500131d952a08f927c83a52cd

                    SHA1

                    9ccc0cf182baee39a5a90f2293e5c3ddb0424f04

                    SHA256

                    9bd42b4a454faecc136653ccdc94cbd4ba10ea44d6fa9e5cf825b92b448b4311

                    SHA512

                    8b211187b05658ca12b33fb8e723e18ad792c6da8893a45e913bd31cc3d0161169f3e4ea0fed98bdd2ef4d47ff6bb9c9485acaa43df18504007825e78b6e9cd5

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\TMzpx\TMzpx.dll
                    Filesize

                    112KB

                    MD5

                    2f1a50031dcf5c87d92e8b2491fdcea6

                    SHA1

                    71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f

                    SHA256

                    47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed

                    SHA512

                    1c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o0331uf3.22e.ps1
                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk
                    Filesize

                    771B

                    MD5

                    90535e0450c3f4228037f7272c1ee8bb

                    SHA1

                    d64a9038afb5a17db3ce8e4f23c46b3494c6e900

                    SHA256

                    946c9211bbc42b912f5e58d9349a68853f0766528715dc81f4f80ff117d678d7

                    SHA512

                    9e26e59819cb4db494009d799858b446415d83ff79fdde2a6fe3d35f674f10a9a0bd216a0050af9a4fbfe112fdc8e21b96e9a174da8f6276c13e66e2a1c9fd45

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\XClient.exe
                    Filesize

                    41KB

                    MD5

                    f065a5f352973e89b2e8d3efd79b98f8

                    SHA1

                    6a9a84e0a11010262ea35790fcdf824193805c76

                    SHA256

                    7b75950ae4eeabfdedafe9e3b14acee160a6ad932cbad66f71fe5bca32cc6405

                    SHA512

                    b920e46653ec87748767e71e88593db3c6d25fcde1b63504a1718d438e383c15578fd9e5bae5665b040e0f3512566ec99322eb8f3b5a0fa2112934ad486a2006

                    Download Submit

                  • C:\Windows\System32\perfc007.dat
                    Filesize

                    44KB

                    MD5

                    bc3d1639f16cb93350a76b95cd59108b

                    SHA1

                    47f1067b694967d71af236d5e33d31cb99741f4c

                    SHA256

                    004818827ecc581f75674919f4605d28eed27e3f2229ae051d6849129eef40e9

                    SHA512

                    fe44f3dbd009d932491af26c3615e616bc0042741dc3815ffb4d2b8d201efd8ab89f7cdd747406609393f005a596a6e9ea8e3f231bc150dc406c2adb8f806249

                    Download Submit

                  • C:\Windows\System32\perfc00A.dat
                    Filesize

                    47KB

                    MD5

                    69c02ba10f3f430568e00bcb54ddf5a9

                    SHA1

                    8b95d298633e37c42ea5f96ac08d950973d6ee9d

                    SHA256

                    62e5660f9018da67d3c6727c39e9690650beb62749df0b4c00e6085f36c8e94e

                    SHA512

                    16e4d29324c2b50e1347532cd0982a149a7c67c4f27a743bbad8609ac662c3e00fa1be645b1b5f23adca3abd60c812f3f87d669f5ffb42b90ca5026dcbf2824e

                    Download Submit

                  • C:\Windows\System32\perfc00C.dat
                    Filesize

                    43KB

                    MD5

                    8b4b53cf469919a32481ce37bcce203a

                    SHA1

                    58ee96630adf29e79771bfc39a400a486b4efbb0

                    SHA256

                    a7b3a2b6c67e98cf2b13684c8774113c4ed4f60cd6fc673d4c9dcb360c60ce42

                    SHA512

                    62217e68c9e4c7b077e127040318c603e2f2cbcc5517ce0cfc6189e43023f8d8a05b8e694b2a35d4b409241136a1067749b7b6e2049d6910246d8c0fa6e9e575

                    Download Submit

                  • C:\Windows\System32\perfc010.dat
                    Filesize

                    42KB

                    MD5

                    bea0a3b9b4dc8d06303d3d2f65f78b82

                    SHA1

                    361df606ee1c66a0b394716ba7253d9785a87024

                    SHA256

                    e88439ae381e57e207ce09bbf369859c34b239b08124339534dcc935a89ac927

                    SHA512

                    341132d443cd41acf0a7eaee0d6883c40d8a4db8c59e056211e898c817c2847377f0208ed3a40e0fd6f73f0196ffcc680c55754e160edafd97036739861a6c88

                    Download Submit

                  • C:\Windows\System32\perfc011.dat
                    Filesize

                    32KB

                    MD5

                    50681b748a019d0096b5df4ebe1eab74

                    SHA1

                    0fa741b445f16f05a1984813c7b07cc66097e180

                    SHA256

                    33295c7ee1b56a41e809432bc25dd745ba55b2dc91bfa97aa1f55156880cd71a

                    SHA512

                    568439b3547dcbcce28499d45663fdd0e2222f6c5c90053769ce2585f65721f679c071393328bde72c9a3f03da4c17abb84b8303897688b59598887ceb31438e

                    Download Submit

                  • C:\Windows\System32\perfh007.dat
                    Filesize

                    307KB

                    MD5

                    312d855b1d95ae830e067657cffdd28c

                    SHA1

                    8133c02adeae24916fa9c53e52b3bfe66ac3d5a3

                    SHA256

                    ca3f8056e3e2378509ab24f8b8471e5fccac403a5413be518ac35bbb42a2e2cf

                    SHA512

                    f25c1a81a582a2a5e3142bd97f425c6ee5c26f878b1155232002fff1e4a3528bc371fb962da256c281e05c6c537160a4f48e00ea1fcf3e9887097f8ca6ec2b14

                    Download Submit

                  • C:\Windows\System32\perfh009.dat
                    Filesize

                    297KB

                    MD5

                    50362589add3f92e63c918a06d664416

                    SHA1

                    e1f96e10fb0f9d3bec9ea89f07f97811ccc78182

                    SHA256

                    9a60acb9d0cb67b40154feb3ff45119f122301ee059798c87a02cc0c23e2ffce

                    SHA512

                    e21404bc7a5708ab1f4bd1df5baff4302bc31ac894d0940a38b8967b40aac46c2b3e51566d6410e66c4e867e1d8a88489adccf8bdcaec682e9ddabc0dac64468

                    Download Submit

                  • C:\Windows\System32\perfh00A.dat
                    Filesize

                    347KB

                    MD5

                    49032045f6bcb9f676c7437df76c7ffa

                    SHA1

                    f1bf3ba149cd1e581fe12fb06e93d512fe3a241b

                    SHA256

                    089f30c1e60f038627531d486659fab66a8b927d65e4eca18f104d6ae4c7f641

                    SHA512

                    55b459b7787e6efacdcc17adb830dc3172a316ff8dd3b14a51bf4496a9479f513ae279a839674b472c1424170ee4aa63a5d45fc7fbd38a533a885282858c74f1

                    Download Submit

                  • C:\Windows\System32\perfh00C.dat
                    Filesize

                    350KB

                    MD5

                    518020fbecea70e8fecaa0afe298a79e

                    SHA1

                    c16d691c479a05958958bd19d1cb449769602976

                    SHA256

                    9a139a16fe741593e50fa5e1e2a0c706c0eba7f4d1e1a7a91035428185fde125

                    SHA512

                    ff910efee092c2b4a3fa1114f745feb7d01a38b55b0345e0118cdc601a056f79035bd92c76b49559480b515da4cd66d2fbe789baacdde67485cab989ff009b2e

                    Download Submit

                  • C:\Windows\System32\perfh010.dat
                    Filesize

                    353KB

                    MD5

                    a5389200f9bbc7be1276d74ccd2939b4

                    SHA1

                    8d6f17c7d36f686e727b6e7b3a62812297228943

                    SHA256

                    494db162e2ccd95e69404a34170b6e59847f444881834f3c175c6bc70d783087

                    SHA512

                    fc1d1e81362d186410b4af3d6add3c8b32fdd75ea79b7e868cc16615358264af04f47170229d32dffcbf7e1ba2b841ccd2d4f27b0f8d82a0685806c22d3d0a92

                    Download Submit

                  • C:\Windows\System32\perfh011.dat
                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    Download Submit

                  • C:\Windows\system32\perfc007.dat
                    Filesize

                    39KB

                    MD5

                    c6a00700213a4cdfac7b02faabc2fa10

                    SHA1

                    d1fab1803050a67c59dfce442c1f1dacb166d0dc

                    SHA256

                    987d276742eba82260ac1509adc8678651d30103162b44d4e62fbde1b2f28559

                    SHA512

                    e3c879502f91b7e4ccbd300372108ffe0cfd2e49070c54f1b27fb83d3c0a7344ea7393b619f1fd6b21314915e32c50fb93f5a1511a383098107c57f1a14faf1d

                    Download Submit

                  • C:\Windows\system32\perfc009.dat
                    Filesize

                    32KB

                    MD5

                    1e60bc5e525063b96078df17fbd3c4e1

                    SHA1

                    bae8eda409cb3e016ddd420c6354aeaac2d267b9

                    SHA256

                    a0894847ca6208cf7e519d8e825458596bbcd78156a453e32872de7592ea20d8

                    SHA512

                    5758d535e4ce20cc30b9b57fea1811feffb2655ecc6eec69c942defb4b4f8c06e8e37860f85ec7cad26df9d7635ecaf131a68ec4ee291aa36e448c7ef2339652

                    Download Submit

                  • C:\Windows\system32\perfc00A.dat
                    Filesize

                    42KB

                    MD5

                    08728aef33bbac5884423c1597e74a29

                    SHA1

                    64d28ea3dc5c4392a0210b4d26db146b26e40f0b

                    SHA256

                    fbd64fca18300003ddcdddf3b25ad501cf224035ef5975dedc64c7d139eb69e6

                    SHA512

                    001cc1ef7a69ce59a9e37133a8cdf14cc8e7a09bc74d4678d9af25da3eaa9d99efc6fdf64fd2e301acb796cef4a988d502b63a61dcce14511568130bb1551a0c

                    Download Submit

                  • C:\Windows\system32\perfc00C.dat
                    Filesize

                    39KB

                    MD5

                    9f9af8517189b0d61b2615007e071084

                    SHA1

                    a33753ca07f370b7d99f6658b32abb97eed7bbc4

                    SHA256

                    b6dc84d6c21f558e69174d3b62e13fbb8aecd5e49de0fb737f56445a9b883034

                    SHA512

                    640f51590a6f5d61e9dcb9a463a6b7aae6d88749843d1ec62f30a00c95b4a449b442281ac61058db4da464bee03e62a1f43a91b0a05914d4dbda2bce007d745d

                    Download Submit

                  • C:\Windows\system32\perfc010.dat
                    Filesize

                    38KB

                    MD5

                    4f32511bd6124c1b65c8f7fcd244a82b

                    SHA1

                    6d840ddec80ee4f6ab99a1d0b55c50a568edd722

                    SHA256

                    8ceaa2e1a9cc8b7f76e6a2551bb1dfbcc64896c8c3fd5901e417f41ddff35e6d

                    SHA512

                    ca8c8103a4ec3b8f1a070ee2a3301f8af64e08cfd40b21022e5d9f54e3decfc55b7571112d186aba9d7b4c7b5720f7eb0ff3847b39366dd04b912dde386a73e3

                    Download Submit

                  • C:\Windows\system32\perfc011.dat
                    Filesize

                    64KB

                    MD5

                    14b237936517d3cf9c34392a1ea38f5c

                    SHA1

                    80109e4318fbd238c84f43383d027306dbe26e37

                    SHA256

                    57ba118125b7d69f0b46f3134c9b8065f05e7f36d546629c4d0d9b18d995f73e

                    SHA512

                    e34b2f181eb298e63c990a8876df50e45cb828d6b39faf7ea236c8b7911105ea3d98aaa04a8a8bf58e7e18299040461ff0204a7ed93975bb748cb0b8c9bd1779

                    Download Submit

                  • C:\Windows\system32\perfh007.dat
                    Filesize

                    320KB

                    MD5

                    b9a5000ea316ac348cf77beb0e5bc379

                    SHA1

                    4e666af14169eb10a0a08ac2f5ed5ecf4764df46

                    SHA256

                    1b25a6879c667258cdb900683004ef007c6b3a1a933d823b124d9a6acf9de608

                    SHA512

                    9fd911586a0aebec11c48e9f78de3b3f6e41c98a2770f5ac10d0a3947b4b3f326a8c5028c478c8634fb84a071186606e69a7aff83b1cf972d4728e3923503118

                    Download Submit

                  • C:\Windows\system32\perfh009.dat
                    Filesize

                    310KB

                    MD5

                    1ad05e460c6fbb5f7b96e059a4ab6cef

                    SHA1

                    1c3e4e455fa0630aaa78a1d19537d5ff787960cf

                    SHA256

                    0ae16c72ca5301b0f817e69a4bac29157369ecfbadc6c13a5a37db5901238c71

                    SHA512

                    c608aa10b547003b25ff63bb1999a5fff0256aadd8b005fdd26569a9828d3591129a0f21c11ec8e5d5f390b11c49f2ef8a6e36375c9e13d547415e0ec97a398f

                    Download Submit

                  • C:\Windows\system32\perfh00A.dat
                    Filesize

                    362KB

                    MD5

                    b701d4dff8a3132705cc8966c4c8e377

                    SHA1

                    a16ccf40aa9aacef13a951938729d46edddbf137

                    SHA256

                    3b8354787a54849ca53a5727497183dd78359864f814ce9f51e8b9a9265079f8

                    SHA512

                    47a6044f99e6b5698ada4b7049497096d035a2e2d0e3bd06aac5a86759697e6c5ef5745a71da8e644533c02f1390d38a0954497098d8054be900073d0f00e369

                    Download Submit

                  • C:\Windows\system32\perfh00C.dat
                    Filesize

                    363KB

                    MD5

                    d0a8d13996333367f0e1721ca8658e00

                    SHA1

                    f48f432c5a0d3c425961e6ed6291ddb0f4b5a116

                    SHA256

                    68a7924621a0fbc13d0ea151617d13732a991cef944aae67d44fc030740a82e9

                    SHA512

                    8a68c62b5fc983975d010ae6504a1cbfdf34d5656e3277d9a09eb92929e201e27ca7bd2030740c8240a4afd56af57c223b4fd6de193bedf84ac7238777310de4

                    Download Submit

                  • C:\Windows\system32\perfh010.dat
                    Filesize

                    356KB

                    MD5

                    4e277d7a9304103e3b68291044c7db6b

                    SHA1

                    b23864c76259c674ac2bc0210dab181bfc04dedf

                    SHA256

                    5dc2192236274fda886a0c0f396646f9292000ba33bd0e2061a65bc06639be16

                    SHA512

                    094477571cb17d7b19f6e81ef237c579f03c944745499b2e537d77972da89f8f4baa0825c3f79993d96116aa071bbc776a96f55cf8ab3f60698c2c4e03e36957

                    Download Submit

                  • C:\Windows\system32\perfh011.dat
                    Filesize

                    158KB

                    MD5

                    b80ff435d9aee22369f6246d7a2d9478

                    SHA1

                    05a278e903c2dfdd689418c8fb3bc432581b8a82

                    SHA256

                    4e14ba5f6e55a50ea95256ca14b35f0e70def0ad3505a84c593e48e9de0914a5

                    SHA512

                    c63d06d1f7247a8164923d1ae4e6d457324dde2edcd31a910e5e685c10d3cf79160a9e476d521eb559dcdfdbc167e461b6d04867772b8c7f6b23556eb303ea97

                    Download Submit

                  • memory/468-12-0x00000242541F0000-0x0000024254212000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/492-1-0x00007FFA9D993000-0x00007FFA9D995000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/492-101-0x00007FFA9D990000-0x00007FFA9E451000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/492-100-0x00007FFA9D993000-0x00007FFA9D995000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/492-2-0x00007FFA9D990000-0x00007FFA9E451000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/492-0-0x0000000000710000-0x0000000000720000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1072-128-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1464-876-0x000001BC812E0000-0x000001BC812E1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1464-872-0x000001BC812E0000-0x000001BC812E1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1464-867-0x000001BC812E0000-0x000001BC812E1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1464-866-0x000001BC812E0000-0x000001BC812E1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1464-865-0x000001BC812E0000-0x000001BC812E1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1464-873-0x000001BC812E0000-0x000001BC812E1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1464-874-0x000001BC812E0000-0x000001BC812E1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1464-875-0x000001BC812E0000-0x000001BC812E1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1464-877-0x000001BC812E0000-0x000001BC812E1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1612-279-0x0000025CB0400000-0x0000025CB0500000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/1612-316-0x0000025CB18A0000-0x0000025CB18C0000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/1612-281-0x0000025CB0400000-0x0000025CB0500000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/1612-280-0x0000025CB0400000-0x0000025CB0500000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/1612-296-0x0000025CB1290000-0x0000025CB12B0000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/1612-284-0x0000025CB12D0000-0x0000025CB12F0000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/2348-51-0x0000000000390000-0x00000000003AC000-memory.dmp

                    Filesize

                    112KB

                    Download

                  • memory/2756-3834-0x000001F8B6B40000-0x000001F8B6B84000-memory.dmp

                    Filesize

                    272KB

                    Download

                  • memory/2756-3835-0x000001F8B7080000-0x000001F8B70F6000-memory.dmp

                    Filesize

                    472KB

                    Download

                  • memory/3032-882-0x00000257CD010000-0x00000257CDC48000-memory.dmp

                    Filesize

                    12.2MB

                    Download

                  • memory/3032-890-0x00000257E9260000-0x00000257E9E4C000-memory.dmp

                    Filesize

                    11.9MB

                    Download

                  • memory/3032-891-0x00000257EA050000-0x00000257EA244000-memory.dmp

                    Filesize

                    2.0MB

                    Download

                  • memory/3212-277-0x0000000004500000-0x0000000004501000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3916-549-0x000001AA915A0000-0x000001AA915C0000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/3916-545-0x000001AA90440000-0x000001AA90540000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/3916-544-0x000001AA90440000-0x000001AA90540000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/3916-546-0x000001AA90440000-0x000001AA90540000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/3916-560-0x000001AA91560000-0x000001AA91580000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/3916-581-0x000001AA91970000-0x000001AA91990000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/4264-421-0x00000000037E0000-0x00000000037E1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4344-130-0x0000026285900000-0x0000026285A00000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/4344-146-0x0000026286670000-0x0000026286690000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/4344-129-0x0000026285900000-0x0000026285A00000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/4344-134-0x00000262866B0000-0x00000262866D0000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/4344-160-0x0000026286C80000-0x0000026286CA0000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/4360-119-0x00000242EB250000-0x00000242EB251000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4360-121-0x00000242EB250000-0x00000242EB251000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4360-111-0x00000242EB250000-0x00000242EB251000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4360-112-0x00000242EB250000-0x00000242EB251000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4360-113-0x00000242EB250000-0x00000242EB251000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4360-117-0x00000242EB250000-0x00000242EB251000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4360-123-0x00000242EB250000-0x00000242EB251000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4360-118-0x00000242EB250000-0x00000242EB251000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4360-122-0x00000242EB250000-0x00000242EB251000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4360-120-0x00000242EB250000-0x00000242EB251000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4484-704-0x0000020AA8E60000-0x0000020AA8E80000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/4484-694-0x0000020AA8EA0000-0x0000020AA8EC0000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/4484-690-0x0000020AA7F40000-0x0000020AA8040000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/4484-689-0x0000020AA7F40000-0x0000020AA8040000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/4484-720-0x0000020AA9480000-0x0000020AA94A0000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/4548-427-0x0000023DD98B0000-0x0000023DD98D0000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/4548-433-0x0000023DD9E80000-0x0000023DD9EA0000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/4548-431-0x0000023DD9870000-0x0000023DD9890000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/4788-542-0x0000000003850000-0x0000000003851000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4996-687-0x0000000003400000-0x0000000003401000-memory.dmp

                    Filesize

                    4KB

                    Download