xworm | e8fd34b40b83391a855905620e4beeb153d256df196b063bc7845d747f1e7d67

Analysis

max time kernel
856s
max time network
839s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08-08-2024 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Steam.exe
Size

51KB
MD5

eb794f3819b32c9fbc747309bb04cd68
SHA1

a6c24bfb6c2ea4cdf10f0f54c0a4e8ac0380beb3
SHA256

e8fd34b40b83391a855905620e4beeb153d256df196b063bc7845d747f1e7d67
SHA512

0b6cf31c799513b4e0f5ac21180cc7a26451fc54504f03ace353a5a8c598885c594b3375e990ac442e08ffaa1f3e9692cbf6dfb8c035b4380497cefd57288aaf
SSDEEP

768:juMMmVn76G3rspEacCIQgttZX+2V2ltnq7oTmggkbm1t+tuXSWCalOIhu//t/:SMDnv7sKEIHLXyBqCmjkbmn/weOImF/

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

tree-cleaning.gl.at.ply.gg:33027

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1984-1-0x0000000000FB0000-0x0000000000FC4000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429274034"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000e98fdd5324d386079882ef68b953655c4ea380af16d54e824b62af791dcf44cd000000000e8000000002000020000000937893ccce30e1c5a587951b92dbd8830b908add8260b20ed7f5c39aa5167a0d200000001143ed24892a6a94e21e3a9f5638e7c7dc2e6c9115e3721b76d6538b76610db64000000086ffe13e425704f60cb53debe98ddd3cb860efbc7ad0167777478b24739ccdcec23c9bfd5f49a8ab56cc350904d6072ff1d50c9669adae3d97f694533e3afa83	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000009c303a46b145b36ff37f991b16d15fdc518c42dbc42e9845916726628cf4e5d000000000e80000000020000200000005dffd273709ff941d79f17d9415f08e23ae414d480464b91461f78226ae42ed2900000002bd41d956487f9c826f3ae705fa53637ddc3deee2f5ddf02e7f989855ea958a1abaf9b0315e2e55038a40bb908d127d26e217f2d2874b607945343409cc35f265b8c82639eb8944ea8d62b23cc8119fd707711803b2b67afb80291a4c4b8c34e862db8da39c25751e082daab6c59d047f7840b450f1ed32b22893c91487f936296a73632d1d4b36d76773196f26ccf1f40000000f3fe22dce939e2c5a6245e143d79812e6e201dbc5f352383ae1551816ebe4024333248f54172153d50a13a20d914f6375a8b72888d516f3cdba57488d4cb4bea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e3fe0f7ce9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37C561A1-556F-11EF-8A22-66D8C57E4E43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	Steam.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2248	1984	Steam.exe	33
PID 1984 wrote to memory of 2248	1984	Steam.exe	33
PID 1984 wrote to memory of 2248	1984	Steam.exe	33
PID 2248 wrote to memory of 2696	2248	iexplore.exe	34
PID 2248 wrote to memory of 2696	2248	iexplore.exe	34
PID 2248 wrote to memory of 2696	2248	iexplore.exe	34
PID 2248 wrote to memory of 2696	2248	iexplore.exe	34

C:\Users\Admin\AppData\Local\Temp\Steam.exe
"C:\Users\Admin\AppData\Local\Temp\Steam.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://guns.lol/tuesday.cs
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
11c0e8982a114c8a31b8664141b87d08

SHA1
40fcb8f3d8c1370d27adccedfa6e850132a46e7b

SHA256
bfea9b2a9967f1a4455bf82d5fbf477fa0b9b2b7e12a0ff14d36b13ab94f4d0b

SHA512
8cb6309a28302af8c6ea7347814da049fc1d153857306291bcd035418f16540de06c918224afd23da9c41055feb4b2d6eab8e09eb7f46ce0490105ac72de9d09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
792102fac02faa2cf96cec35f3119073

SHA1
eda72996f56936ec5394e9df297c57882ef37729

SHA256
c2f13f850e2936896592c4862467fa988969ca5ebb5c3d7255ba48e727f6104a

SHA512
5970d63e8d8bcf48596f6ad444a06757aa0fbefe053948a0734b98c2aa37514a44326c6436e26d349f14a4eea3e21bb61c2a886c132303c26260f932bfd07414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
88253dae1836d93cc0351b867ed66c21

SHA1
dab5c5f6fb767aff3f9469aba1a324966f687a9e

SHA256
6189bca265fb001612520d0a3409cdc437180aa4c2faaff25d3a88438ecd4b4d

SHA512
cb45cfb219a0fce98c453497c244e1f3a1744ccbaa9840408f5674cba7e1f4df12755e37430a73ee73d843102dd523c7fb9880397cd819581b037745a8770850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0defcd29d903243f81930dd522d7a15b

SHA1
bb405da3df1ed85827311a0087810c61f364ce17

SHA256
ceed6a86048a6ba2c28c0c832281063c7d64440b74db1dd65f98e88dda7c2d94

SHA512
d7fed15e1e24aeb12a1a954809e7e9a6652be3bcb89124df72f2b2597e22d62342f6d9beaf5b38017e88f8f23809bb6e18e3ced1bf730104503987ba9733b9e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f9a0fad8e845971340b058f8571b402

SHA1
eca0670ddb4d3ae062d7abbb24573825be007da0

SHA256
e6244fd8a3780935a69538970256f647d1e5c237f3172c00fa7fcf45e6fb2056

SHA512
6d0b4ba9195f09993a03ea13c34b7b7f6616f77224ed8a17a39f2a5933b00545dcedbf9e4e4a106802e6396a37cae8933e5036276f88ac62521280f62df5a715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba365d14d011f2c3734719a878a6c7f6

SHA1
ed597f9f9b648090c61a18dd3d99e7cf09e6f20e

SHA256
0b3b5048a6e736059404c9d2fd1362571a2b684e57965e5ea2f3ae375475eb58

SHA512
d6e594701586b7f92caefbed518654cb905d5f328b430a6a6125d5cee05c72bc543b4336fe73f3a082060a7b9e3af411f417765d468fda7c0915a800323e57bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5b6e9c5c1a47274daf50abc4a8f180f

SHA1
1ccb754df03ffa5dee9e52ce8c16fea3675cf72c

SHA256
3c73b63bfff9d74c2bc67171beae01ec2829fec5467ac777edfb2f84f8126f76

SHA512
ad0ab4c2164e09acab41ce2ab6fb6e2c27875c0c59bb761b48d8cb5573cc3bf8aaec618b1bef1e6ff58a6fec74f2affbf8d0223557437faa9091411459aca014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bac0b42272130568ea2ab178561bb2d8

SHA1
78eb826ac1aec60bad0b1cd9ef1bcb1cce186873

SHA256
daddcc089dd9aa650eebd27c9f625e586d2e9b67533fdcd0f5df063a22a7c0cd

SHA512
e34b91ea3ac56c8a78326b031de954d109335a8a21c2754ff85315be2be09750e16ca1af170faf81bb6f08fc4f333fa7a958dc4f92ca788889565fccf98e37a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05502537b1bd61f65336639e9eb3848a

SHA1
110c67935aff4a8788b0c23d7db697f81ed4406d

SHA256
1a3af40dd6f722eebc7a3dcfaa2d185c889d89252c7924d77134c59ad7fb69a8

SHA512
489eb5d2c86842d64be21edf7fa8e2e01b534611b59b1f8421ef0e57022062683f7c3c9ee080ca4472142576c3b1c7463c10981f36ba87eda0202f9956ee7b48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9f6b7ff410dbd2a73ebdab7b74aa67e

SHA1
d315b6ab28f7ae93310cf152cb1e7a6e4cf4f710

SHA256
0347348e01d0809d0f11ddca2af8afc35a82975f716bab30638619276bf29b51

SHA512
91df9681a45a03f2bca14eda8015a2612788f51499a3e7f2e65e94a61d2c3a2729e9d3e25f86cf89ee18948ada3f2f1ed1c11f7bb3cb46f8f0e42415860f74e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b797feb68ae439da060e7bd127f3d578

SHA1
36ad0fd2557e1ee2a3e3200c7b92cde2be270ab5

SHA256
90f0feb46fd8d5ff323c97c0e416601fe45e7600b5f26951f1d9a685b603b70a

SHA512
0401dbcebfa4e9748ebbedb879aceb6732c3df436637a48eb620a49c8941f1948bf905a90b62953178598516d31775717a2c267e43c1076e963e1daf2850f08d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a5eb4f059f5a8340717e6aa72ca47ad

SHA1
ca3ce86591b8e47500e952bf2b68069d4256c8c7

SHA256
339fb8a327c376ee93d7217b3e4491381ae9e84b7b06a0fef19a7197bc1d4e6d

SHA512
cca88bc201b6a43f2c2221d1bc829ab9d25dbc5efb738c8802fa526d57829572393df035d57f28a305824881b69a1cf521fc65f2c24be5552bef7c4bdf7077e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d55132c920dd8b6c92f5894eb137fb0

SHA1
506b40c35a45c8ed0529ba1759eb133d68c15b9a

SHA256
5668c8866c77dd8f44ea5e36ec7f5c77d315a3dcea0350957977a115450c22da

SHA512
ee9da8e852c71a29e08a2ae94f5943d01553328a1fc76841a65a8fbece90e054ec9db9efb2394eb5e02d13e290392fd2a074a4611f1b7518884abbbfc4e15956

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51d74bc805e058f96cd977709fe49bdd

SHA1
43ae9396c63a67fa14ad3a0ad281a8d8947678cd

SHA256
8abcbc73a47fbff2df613c814fb57cd56bc4479d3673948f92781ca0d1920159

SHA512
878cbeb4977d55234037ff298854a012c7e4e83e355ea1e8ee0cbd2c669babdd5805c94a99c0363ccd6c970a38baaf2c29325d6bdc2b7870790189b3f814c305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
100b083181618ffdca3233465105d7a2

SHA1
fdb9a339493b118abc71d0b4f9f038a10edc502a

SHA256
b7d573b85e7d147614265dfe51d7eda54a39cc9b172f18cd9f98d3437cad6852

SHA512
1415cff780d24d95b2363c72e5ca5e36124b4ce5a351c360f7d8af20bbaaefcff22606ecf16ccd46d9924dbb1b345d2133462a73034f6e2f9a2cdcab1a844664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b3c39da016f10d86671e907b3dfde0b

SHA1
f187a9c1ab5ecf5ec5a93aca4c99575024302b13

SHA256
51e89f76398a65a6d1bac724e471a03295821e89c64bdc18582e099c0c075a85

SHA512
cd1b8b9da41ee984051b952796a7655f246d7794ba568ccb2ca0a64b62f296dc2bb5bc96911b851784dac1536bca8e7321c06ceb83ff29eaa3dfa58dff4ffcf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcc9fa9fddad549b0190fcb13b824d32

SHA1
303fbd7ad5fe2b599db3fb7ed061467e2301cf10

SHA256
c0b3adccb187dd44593019a3f9182f9ed52ff034b609d4158ab590ec33ebc5de

SHA512
fe0529f7887518dc35286f8ca3dc29f8e749880250f97121b238dcb6dba7b9911a90b4d7afb8acf531a18b0a4146199b92cd66c057fc585a550f0b4fac2b2c0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48bc875db2ea40c7e266d77c26032b92

SHA1
9ca4f31dc57807444dc7035426db0f35198f567a

SHA256
f212ca2148c1c17ec0d4a696ee4fe97d8981fcd432d5c77196ca4545f25cc620

SHA512
a1e641b0253c56903b95158bf3a2a9cc0584192ead48b04418ada2378139040e8cabb45de6939819d2d2b5dcf49000c16340348bb86ebf24b3b7d66db7176218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0f1d882400b470eb636db9bd06f5008

SHA1
6d97f6837029b77a0f1a2c6fb42d6aa22c3d7098

SHA256
466caaaa174d4adc80e5fbac1d54074cb39981fa6a7e66024a45de2f95616cea

SHA512
cf3b08ed508fc75a823799ee1db9330a2b8c961dc830abef70a75eed1fb6ec4a77c851c2e482597078c8633330ef82e85236a11667cc48e0fe6ff75c3a85cf70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec610ac3fe7908aee3e2ab3a9456f88a

SHA1
ab44663ac42e20e70f0980693ac9df0cad0c538b

SHA256
a7f8cb55f16e95a6572f4e7fd8ce1192a1ba76ad1a41ea0f940fe082f23dc499

SHA512
c1a5ef3fbb66bbc1635454dc9df62e63cf5454569eac4b93f4cafe46009f07f5fd69386b575ff185e0dc7e30f2ec50e18511afb6aa1063da4e247c0739c5c504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
60aa949cf64e62a4372ab1e97180f02a

SHA1
85baacde9bfb9ae3a10887d848ff4e8369a7d451

SHA256
0ab220f6e946a9862eaa4280f621a283ca1c5f85683fb753fa4dba66ea059e3e

SHA512
508071b2848b98a57a9d661ad2afb701861bc7db338918b342a9c3ff98b11bbc1d280c9a1ea46942d688af75450d7e3f47d385ae8eeb360367ed75e71ea034dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HNGGU6NJ\guns-solid[1].svg

Filesize
732B

MD5
48817a08ba7e68c843c044f272f9f6f7

SHA1
ac3a03887ef169327cca4fed5632453611da39a8

SHA256
e07f17964bb0c49b975f385542abb2f6c55e67b3b0d3b77c4d743fe3416553c4

SHA512
a3d4296d8a408af9e412fdb60554f63bf2005bc0eb3a863f7a47f2bc9f311e0a5672b68e318c0600cb099b3c64f6037a02c97e875b9fd91808d336ca8a7e50ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBDF4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBEB3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/1984-4-0x000007FEF5640000-0x000007FEF602C000-memory.dmp

Filesize
9.9MB

Download
memory/1984-3-0x000007FEF5643000-0x000007FEF5644000-memory.dmp

Filesize
4KB

Download
memory/1984-0-0x000007FEF5643000-0x000007FEF5644000-memory.dmp

Filesize
4KB

Download
memory/1984-2-0x000007FEF5640000-0x000007FEF602C000-memory.dmp

Filesize
9.9MB

Download
memory/1984-1-0x0000000000FB0000-0x0000000000FC4000-memory.dmp

Filesize
80KB

Download
memory/1984-1521-0x000007FEF5640000-0x000007FEF602C000-memory.dmp

Filesize
9.9MB

Download