agenttesla | hxxps://files[.]this[.]ovh/XWorm%20V5[.]3[.]7z

Analysis

max time kernel
597s
max time network
450s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
25-08-2024 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://files.this.ovh/XWorm%20V5.3.7z

Score

10^/10

agenttesla stormkitty xworm agilenet discovery evasion keylogger persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:7000

Mutex

9BF6bCCON3pEOHij

Attributes

install_file
USB.exe

aes.plain

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/files/0x000100000002aae7-676.dat	disable_win_def

Detect Xworm Payload 7 IoCs

resource	yara_rule
behavioral1/files/0x000200000002ab02-640.dat	family_xworm
behavioral1/files/0x000100000002ab09-650.dat	family_xworm
behavioral1/memory/5096-652-0x0000000000FF0000-0x0000000000FFE000-memory.dmp	family_xworm
behavioral1/files/0x000700000002aa4c-698.dat	family_xworm
behavioral1/files/0x000400000002aab1-712.dat	family_xworm
behavioral1/files/0x000300000002ab07-726.dat	family_xworm
behavioral1/memory/2220-728-0x00000000009C0000-0x00000000009D0000-memory.dmp	family_xworm

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	XClienft.exe

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000100000002aaed-682.dat	family_stormkitty

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

AgentTesla payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000100000002aad1-614.dat	family_agenttesla
behavioral1/memory/1884-615-0x0000020D2F6B0000-0x0000020D2F8A4000-memory.dmp	family_agenttesla

Executes dropped EXE 3 IoCs

pid	Process
1884	XWorm V5.3.exe
5096	XClient.exe
2220	XClienft.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/files/0x000100000002aafc-562.dat	agile_net
behavioral1/memory/1884-563-0x0000020D11A20000-0x0000020D14C98000-memory.dmp	agile_net

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2236	netsh.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
696	timeout.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	XClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWorm V5.3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWorm V5.3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWorm V5.3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	XClient.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	XWorm V5.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	XWorm V5.3.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	XWorm V5.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 60003100000000006658158c100058574f524d567e312e330000460009000400efbe6658098c1959e5222e00000044aa020000000b0000000000000000000000000000008536f900580057006f0072006d002000560035002e00330000001a000000	XWorm V5.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	XWorm V5.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = ffffffff	XWorm V5.3.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	XWorm V5.3.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	XWorm V5.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	XWorm V5.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	XWorm V5.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	XWorm V5.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	XWorm V5.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	XWorm V5.3.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	XWorm V5.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	XWorm V5.3.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	XWorm V5.3.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	XWorm V5.3.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	XWorm V5.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 60003100000000001959e122100058574f524d567e312e330000460009000400efbe1959e1221959e3222e000000daa502000000020000000000000000000000000000004726b400580057006f0072006d002000560035002e00330000001a000000	XWorm V5.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	XWorm V5.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	XWorm V5.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	XWorm V5.3.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	XWorm V5.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	XWorm V5.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	XWorm V5.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	XWorm V5.3.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	XWorm V5.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	XWorm V5.3.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	XWorm V5.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	XWorm V5.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	XWorm V5.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\NodeSlot = "4"	XWorm V5.3.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	XWorm V5.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	XWorm V5.3.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	XWorm V5.3.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	XWorm V5.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	XWorm V5.3.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\XWorm V5.3.7z:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1884	XWorm V5.3.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	firefox.exe
Token: SeDebugPrivilege	4116	firefox.exe
Token: SeDebugPrivilege	4116	firefox.exe
Token: SeRestorePrivilege	3940	7zG.exe
Token: 35	3940	7zG.exe
Token: SeSecurityPrivilege	3940	7zG.exe
Token: SeSecurityPrivilege	3940	7zG.exe
Token: 33	3216	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3216	AUDIODG.EXE
Token: SeDebugPrivilege	5096	XClient.exe
Token: SeDebugPrivilege	2220	XClienft.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
3940	7zG.exe
1884	XWorm V5.3.exe
5096	XClient.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1884	XWorm V5.3.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
4116	firefox.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe
1884	XWorm V5.3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 4116	2628	firefox.exe	81
PID 2628 wrote to memory of 4116	2628	firefox.exe	81
PID 2628 wrote to memory of 4116	2628	firefox.exe	81
PID 2628 wrote to memory of 4116	2628	firefox.exe	81
PID 2628 wrote to memory of 4116	2628	firefox.exe	81
PID 2628 wrote to memory of 4116	2628	firefox.exe	81
PID 2628 wrote to memory of 4116	2628	firefox.exe	81
PID 2628 wrote to memory of 4116	2628	firefox.exe	81
PID 2628 wrote to memory of 4116	2628	firefox.exe	81
PID 2628 wrote to memory of 4116	2628	firefox.exe	81
PID 2628 wrote to memory of 4116	2628	firefox.exe	81
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 3956	4116	firefox.exe	82
PID 4116 wrote to memory of 2876	4116	firefox.exe	83
PID 4116 wrote to memory of 2876	4116	firefox.exe	83
PID 4116 wrote to memory of 2876	4116	firefox.exe	83
PID 4116 wrote to memory of 2876	4116	firefox.exe	83
PID 4116 wrote to memory of 2876	4116	firefox.exe	83
PID 4116 wrote to memory of 2876	4116	firefox.exe	83
PID 4116 wrote to memory of 2876	4116	firefox.exe	83
PID 4116 wrote to memory of 2876	4116	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://files.this.ovh/XWorm%20V5.3.7z"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://files.this.ovh/XWorm%20V5.3.7z
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a198c62-d6fc-4399-a1e3-e69d28c269fb} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" gpu
    3⤵
    PID:3956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2428 -parentBuildID 20240401114208 -prefsHandle 2420 -prefMapHandle 2416 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59ee1452-fce2-4ce7-9d57-99ca75075c1d} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" socket
    3⤵
    - Checks processor information in registry
    PID:2876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2996 -childID 1 -isForBrowser -prefsHandle 2872 -prefMapHandle 3080 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed94fc1b-80bf-4614-a1a1-6180cb250ff6} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" tab
    3⤵
    PID:1380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3412 -childID 2 -isForBrowser -prefsHandle 3424 -prefMapHandle 2728 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b66a3c2-832b-4427-b468-9f38ceb7b640} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" tab
    3⤵
    PID:3672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4496 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4604 -prefMapHandle 2756 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {90389b52-6f56-4836-b635-9a840d85d0cf} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" utility
    3⤵
    - Checks processor information in registry
    PID:3408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5756 -childID 3 -isForBrowser -prefsHandle 5740 -prefMapHandle 5748 -prefsLen 27172 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c977e9ff-bb78-4dfd-afcb-894faf01403e} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" tab
    3⤵
    PID:2440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5976 -childID 4 -isForBrowser -prefsHandle 5896 -prefMapHandle 5900 -prefsLen 27172 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b41fd976-a743-4a4c-8e92-1e9ee957de79} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" tab
    3⤵
    PID:2300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6080 -childID 5 -isForBrowser -prefsHandle 6088 -prefMapHandle 6092 -prefsLen 27172 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c252f2c7-d5c3-4b0e-8608-c8ed4e459c72} 4116 "\\.\pipe\gecko-crash-server-pipe.4116" tab
    3⤵
    PID:2100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3900

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\XWorm V5.3\" -spe -an -ai#7zMap530:80:7zEvent23623
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3940

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\XWorm V5.3\README.txt
1⤵
PID:3544

C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\XWorm V5.3.exe
"C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\XWorm V5.3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1884
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n0wu25un\n0wu25un.cmdline"
  2⤵
  PID:1760
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC838.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc96F43836FD6747788842AB580C97FB8.TMP"
    3⤵
    PID:2200
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\odjippnh\odjippnh.cmdline"
  2⤵
  PID:2168
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5382.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA62D2A6B52CF4CAAAEB09EF6BF68BD4.TMP"
    3⤵
    PID:3124
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rbnjotq2\rbnjotq2.cmdline"
  2⤵
  PID:2912
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6842.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc17E3F56FAD0E4E219C6613C388E5BFBA.TMP"
    3⤵
    PID:1320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Fixer.bat" "
1⤵
PID:1892

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4792

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\XClient.exe
"C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\XClient.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8436.tmp.bat""
  2⤵
  PID:4732
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:696

C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\XClienft.exe
"C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\XClienft.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2220
- C:\Windows\SYSTEM32\CMD.EXE
  "CMD.EXE"
  2⤵
  PID:1376
- C:\Windows\SYSTEM32\cmd.exe
  "cmd"
  2⤵
  PID:2732
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\activity-stream.discovery_stream.json

Filesize
45KB

MD5
403c3becdaf528f4941547a229316596

SHA1
8d4ebd2d3e33d9d134835c49da6cff5f61cbeeb8

SHA256
b2e9c2b6e3f5c837f8afb68d0a20bc23f543c7bb39ab4c394c12abdb0505baed

SHA512
5017ca137f29378400cb18099b3c125096651bfa9ad964c92684ed999887196771daecd4a5819e305967ffe82f344538ddacb9a5e9fdd0a63adfbdc8933c1adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5382.tmp

Filesize
1KB

MD5
722ff1fc0d438d3eb2252e92d4c8aa7e

SHA1
c7a45ebaf4d1f18971239d1c8ffbf31ca79978f8

SHA256
0cd428bda4b290e1ba5ea9994d51c4db44ca9387cfbcff6825c779dbabf6cb16

SHA512
a4142bd42590ba7fcb52c2a4bb37793a4a79ca0f5fb8b920a627ae7ddb7e565496d2f25a68720c49717665b10582f6bb0d7c6e71f9d909dc01b101cf9447bb6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6842.tmp

Filesize
1KB

MD5
6230e7079803cdf2bf9150bf44ed24c8

SHA1
7467a7903c0fc74ebb07c84475f9f517dc30b315

SHA256
449318f7c3075d1c3fffd178b10bb1b06b9f559f5c4d7fb9927ab973b6b1cebf

SHA512
742f0aafd6f936dfd10ca8e8831d138eda5bd6ddb2b9e912543971e04569c343def4f0313974bc6d356b93d997d282d13835862b7b40d366d0ad6f5b86c6165a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC838.tmp

Filesize
1KB

MD5
26eb5277c925d3892403bca969edfdc6

SHA1
e4cfc54cc710813aad62a6bbdae19c2b036cf477

SHA256
ed1fbe0e02aaca484216d31190ac7e07a85ff6229bf6c9e92f67f399c0a87fdc

SHA512
0d6088cec7ad9e671611f6a1ae8e849638930476abba1b38a59482c063a1f08cfd245df4a7e7d6c2d2bbb39e4bdcb444afd4c3c9570593573eabd67c161d3b74

Download Submit
C:\Users\Admin\AppData\Local\Temp\n0wu25un\n0wu25un.0.vb

Filesize
78KB

MD5
d07c94d9ec6a24afc042325b411f8273

SHA1
4f858975db7ec4d7b13b0192045c7ea302bce8de

SHA256
c767f5cf94e253708227a09aaf4587a71262bfd19c105bf73b7638523c4af1e0

SHA512
3297a549411e3382f56ddc3e258c179b0f135d3802a7775ae449f6930960bcc8d822ec563e48c7ca1517ba32ca85f77756dac06070429685b97cff8ae665c751

Download Submit
C:\Users\Admin\AppData\Local\Temp\n0wu25un\n0wu25un.cmdline

Filesize
314B

MD5
394c846b0fa12378b775712893b2565c

SHA1
8b739b7431f21381c7d15cefd73968706842c286

SHA256
1b63ea222e66a2f3a1e499e9d0ce04a22996578c5ec01a19d5f9f66c383cc057

SHA512
b713e2b26e64bb957b1e8c365006494f1f2d400efd92b78e16a7fadc5f73e9b1d70d71f023c6475a0579b41611e79aa3f64cd6e024bb59e6cf25621a9fdb6a50

Download Submit
C:\Users\Admin\AppData\Local\Temp\odjippnh\odjippnh.0.vb

Filesize
78KB

MD5
ffa117874b5e6d60ae80d853be266854

SHA1
a7fd58217e096b571a50476a56974aac24813a2e

SHA256
992be5c54af52131a3e63f50bacdcc9d72fa519e9bf5e75ce99807218cbb868d

SHA512
ec3dbd3e3c1df0db0fde8f1ce01b36fd8d4caf1dd30a5664fc093d413a0fcb3f3fa5292da0b97ed1e33f3902e79c46d9d710240f055f0d3c686b680bbe8181dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\odjippnh\odjippnh.cmdline

Filesize
314B

MD5
632dfbb87c201422cf913aac4c0a17b7

SHA1
826d231e1481c4c3e73cd498d0e80aeda8b7d9f0

SHA256
214e24870286e9395c25437344f1e901af3288652ebc9c25917ee9eb6a3f3b3e

SHA512
6497d9785ab8e25cd379d631c1efdff28eecb295a999ac9e1d05d3393c68419595e0dbdb74c1cc7d5cd107aeac4830809739d8a2d793b0090cfa2759647aab1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\rbnjotq2\rbnjotq2.0.vb

Filesize
78KB

MD5
7316388dea5bd41a238239d10079947d

SHA1
8908092b0d91069295278ccf300230ef8c87a89f

SHA256
97dadd815acf8b367602a7eaa7c943ff76ef6cd46c46e02590d86df0b20bc28e

SHA512
1cc7e927b14680e87703860b45a672b3557982eae69f5ce8f57fa8a611d6e7d34ce060edb12190d1ec1234758db61a8794edf3038fd653db15ba5201556f22b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\rbnjotq2\rbnjotq2.cmdline

Filesize
315B

MD5
12f7a099fde5aedcfb0897e9ef39c299

SHA1
59453bf35b5a59db3ff1718ff7911492414c92df

SHA256
572bff322d85bc58c9e077ba260452c30bae9ba90386b76651864c93ffe09e4e

SHA512
0f74838ef8319b45cdbea1771214ca4a169649e7499985e3cf9bf83ba6747ea1d726a93b6d42897ae1be57180df1358d599249fa25f3d9a973f61122eccce5f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8436.tmp.bat

Filesize
172B

MD5
5cd4ccdd0d3591a6e24f9ca1a38a0962

SHA1
6fdfce0e5389716a29fc1cd3da105d8120b82fbd

SHA256
bd180f2a68cda71d45a535f98875a283413735d23543cbdf5c4757e7c0310af2

SHA512
5d3830a8ba05b184995bc8bd16228b13dc060a84f6994dc8903b01a4747f36f4414eb3b8be948a6e50e7c77bcf297d8c881420dd1f6ec57e524f908754bbf739

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc17E3F56FAD0E4E219C6613C388E5BFBA.TMP

Filesize
1KB

MD5
a4618f580e2add19bf9ff36f3db89b2a

SHA1
12d173972c2d2f488858a023277bc349c12ded85

SHA256
69b8bcb1974a03cc2a96248f0d68e1464ba0d29b20463c7e12f57ec2d14ef1f8

SHA512
46750647efe09ec767f2c5d283099a007203e9b88c262a558259045c2ab09a2b293c39d43e225e461e5971e5ac8425740024c8f9d5116d904ce08c496189c0a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc96F43836FD6747788842AB580C97FB8.TMP

Filesize
1KB

MD5
d40c58bd46211e4ffcbfbdfac7c2bb69

SHA1
c5cf88224acc284a4e81bd612369f0e39f3ac604

SHA256
01902f1903d080c6632ae2209136e8e713e9fd408db4621ae21246b65bfea2ca

SHA512
48b14748e86b7d92a3ea18f29caf1d7b4b2e1de75377012378d146575048a2531d2e5aaeae1abf2d322d06146177cdbf0c2940ac023efae007b9f235f18e2c68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\AlternateServices.bin

Filesize
10KB

MD5
d1d54b623d4cd65cba4499bb23c62423

SHA1
3c3761beb4f74d95a3f011a083c6993f0424d69a

SHA256
e5d191b1b6315876c5bd052b59bb8ce4e7491b969f2db015a9cb474a9e2c9ef0

SHA512
cf3d600a334b59da2b5b6bd6c6e3877be15b33ad1172c276f02f3ed19bc9b5f4decce00c85a1a3a94602284a8af28ee83dadda1cf280d88f86fa85abd09b2cfa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
ffc8a1b72567889bf5a4dfe31b8c2794

SHA1
1f7032d2d4bc1594cabe87b215adefd250a81d64

SHA256
ac2a5a6f364a6dcd477e3325a1f0250049c1196eda4f947af14564290726f281

SHA512
691c556312eaf299d72ee7009ceb235a94d772fab5d87af2640c651c8364edbd0edf26c47e707606253cd065f500f5e37d422e8ba9e8443217d0fdeaf576a484

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
7c9ac9e5f248b18a782edc0ae47248df

SHA1
a0e3337b7406b2f6969ce74722074cba63dc8d96

SHA256
9b411065264c2e4e44372ec8c932602e42379319e05bb8fb6ad145ad28b5ae57

SHA512
da92126657e8d89d9b50754c7d119acf7e71130478722062902787141f94cd7304830070dcfeb51dd3e8fa6af85229bacc898ed0ef610f26f289fee0537195ef

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\2c1f9ffb-bf8d-40ee-83f1-c70781df317a

Filesize
982B

MD5
7c4ee0e49fd92a8c1ee0ce611a5b7988

SHA1
8b2e4592fc0459650124b9f188368d0db268d478

SHA256
18cb0af793a64543607c6717896d54d683dc1852ee8e2f66da831d60e599202c

SHA512
efea37f7cba5318e8265d7c56e71f7558fa5705acc4358907519c7007ff40121611b8e0f3ed8bb9da9a1df5b7a3c5ea7e8de48c3a322eec38cae6b1fc8453f98

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\4aa9c3bc-cbef-4c18-af4b-6cb8ff0b1275

Filesize
671B

MD5
1319037e8d98392b59de5d377a61a96f

SHA1
6908f6177056d49ad178f2882eae22730dd8ae62

SHA256
075707b46b75439bd48fc8c5a4dc50b708f40d9f5030dd85303828cd8ea0e457

SHA512
36406d4388595edc4f8ab7a4fd388833a9cfc29166973ad0da02cc21acdb8af5d0a872c57e4624f573271ddf0c5006aff74cd8051d9fc363096534a382df655e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\b072baa8-7d4c-4f3e-b65d-342f4e932f4f

Filesize
25KB

MD5
ee1d4f037f80ca482e91c1e7aca042af

SHA1
c4d3a97d998b0d6ce9c8d30f71b4da534614daa8

SHA256
5a4564966bf3b3a0667b3c19f2f20417630c8ff34fa8fafe9b44f0888b69bda3

SHA512
560ad72b58a7ba5a5ac5a0b5af6f17d3722d82180adcd5bf936011bfcdbb01078d6377951086530a7a51a62d47e66c75de5efa21fa9a92a1574e1b86ddb85755

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs-1.js

Filesize
12KB

MD5
6cabcfa1a8ba8b40233cd0d671e66938

SHA1
4b02e55bfd924a1abad9477249f486af3b3ef1e9

SHA256
0656717f9f96d61ce28eb800c9e0f3929a134c162ec18e32947942ace0aa0410

SHA512
57e7dd14301b8a19d51dfbf2b68b2401a6c5d2ffaf1726c86852effb3a4bd06b36f547d35618b911d541edae57b8406c9ed244590565b51a5997ef25c9ce8b6f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs.js

Filesize
10KB

MD5
de11b9976d482a690d6f8f1b499d35e7

SHA1
539cc677d5379c2ef979a046a6906a151362e416

SHA256
115ee5d12bce738b79c744173cd355570015ed087a9789208162891b6b266ba8

SHA512
7b5ca0c1d3915f238559f100b2434bf66b67020a9006e36fb1b16dec95242e002a20ccb26d989d5c6b5d7175457d004d5270e6a53411707fed3596f4aad6d19f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs.js

Filesize
11KB

MD5
f6ea9009146d847afa12cd70f46e3d2b

SHA1
c942fee137fbca81f9521de440823a0b1b66c54a

SHA256
dd2998920b0e774f84a628d75f2deac6093b3ce32c39534ef8abeac5458b4691

SHA512
1b9294e98be9261d00da784d6f9e82370efd5d9b3488eaaa02ebdae08b23687e1b8211c0d0b7c198d4e53067065f53853094dcbffb3b2fc8ee9161c20f9712ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\sessionCheckpoints.json

Filesize
228B

MD5
66bdbb6de2094027600e5df8fbbf28f4

SHA1
ce033f719ebce89ac8e5c6f0c9fed58c52eca985

SHA256
df49028535e3efe4ed524570624866cca8152de6b0069ebb25580fce27dccebc

SHA512
18782069ef647653df0b91cb13ba13174a09ce2a201e8f4adfb7b145baf6c3a9246ef74bdad0774a3023ec5b8b67aba320641e11dd4b8a195e1c2b448202a660

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\README.txt

Filesize
257B

MD5
432355e07e5399ff85ee44dcca189dda

SHA1
189f4a720b7288a13ba84be02e3c9d19a14092c3

SHA256
1c1995a3eaaf9e9e2a177b21541737231b33abcfdcf9b866495b19029cc52121

SHA512
646918e701aacc9decdbf4676ae5df5b0e6d920d67fed95fd621160804dbfcbdb4722f9171e828465e166116748dd2e53bc12c3b90d265af4b216b2602db0241

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\FastColoredTextBox.dll

Filesize
333KB

MD5
b746707265772b362c0ba18d8d630061

SHA1
4b185e5f68c00bef441adb737d0955646d4e569a

SHA256
3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519

SHA512
fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Fixer.bat

Filesize
122B

MD5
2dabc46ce85aaff29f22cd74ec074f86

SHA1
208ae3e48d67b94cc8be7bbfd9341d373fa8a730

SHA256
a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55

SHA512
6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\GMap.NET.Core.dll

Filesize
2.9MB

MD5
819352ea9e832d24fc4cebb2757a462b

SHA1
aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11

SHA256
58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86

SHA512
6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\GMap.NET.WindowsForms.dll

Filesize
147KB

MD5
32a8742009ffdfd68b46fe8fd4794386

SHA1
de18190d77ae094b03d357abfa4a465058cd54e3

SHA256
741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365

SHA512
22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\GeoIP.dat

Filesize
1.2MB

MD5
8ef41798df108ce9bd41382c9721b1c9

SHA1
1e6227635a12039f4d380531b032bf773f0e6de0

SHA256
bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

SHA512
4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Guna.UI2.dll

Filesize
1.9MB

MD5
bcc0fe2b28edd2da651388f84599059b

SHA1
44d7756708aafa08730ca9dbdc01091790940a4f

SHA256
c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

SHA512
3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\IconExtractor.dll

Filesize
10KB

MD5
640d8ffa779c6dd5252a262e440c66c0

SHA1
3252d8a70a18d5d4e0cc84791d587dd12a394c2a

SHA256
440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2

SHA512
e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\NAudio.dll

Filesize
502KB

MD5
3b87d1363a45ce9368e9baec32c69466

SHA1
70a9f4df01d17060ec17df9528fca7026cc42935

SHA256
81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451

SHA512
1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\ActiveWindows.dll

Filesize
14KB

MD5
5387af40ea982dee1bbb2f7e73567a7f

SHA1
3fca1ee729d17b7027e5f5be71d620cd1e2d38c0

SHA256
496066318072fddf12e050d7104e055fb11422411710964c5f5b840910097d47

SHA512
09494b451c31198a8e3b36ef3dacb58f0d738294d09ee1a9446357c27308a17211cad2e79d0d9010dd63d40f598e206acd0080bfe976eae35960e1682d5f7afd

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\All-In-One.dll

Filesize
4.8MB

MD5
3b0f07340712e81b0b14af24e73c0268

SHA1
2b85188945cde10376f22e77b98b091a07f9d26f

SHA256
50d19e520d854b4bd84decd3bb352f149a1529408eb7f01ded86bde5eaec9aed

SHA512
76d91a8d8b94c986d615ac6a12314059f31da2e501bb92d582968f487612ed7080c074a181065a64799979bb3987bd1e3698fbb647dd942a827249159655d2a6

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Chat.dll

Filesize
18KB

MD5
4b94fc08b95156d4b9475b215cda92b4

SHA1
3f2eda3ab4a3a21e1470aaeb28473c219921250c

SHA256
2f6207e9f6e8fa28a82e5f9e1a384fa762b1344522ec6feb15e20751c91f52e6

SHA512
cd1a58f6b4be9a1ae4c8cb3e088709d74614d9566e20c876a409e501f5af25a09520c7dff0c10116e5f7e1a6deb99ced1bed45ebcba629748e925a51805da7c6

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Clipboard.dll

Filesize
14KB

MD5
04f98015d20f7d4881b8c8c8a27d0f98

SHA1
9183169b98f73ee697df0d65c3d0d3fd8fcc03d8

SHA256
3851f8b0d7ee5cc44909ca275f19b0dc0c6fbe571de1eb95f912c71a2b3db1a0

SHA512
0ba6567f754f4ee514ce2076e935769e7b1851c823d8bec280b5b3160d07794809676d282616eadc2e622611d0ae325f1a87beba7ddcdde00a4ac88a0329d67a

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Cmstp-Bypass.dll

Filesize
11KB

MD5
cf15259e22b58a0dfd1156ab71cbd690

SHA1
3614f4e469d28d6e65471099e2d45c8e28a7a49e

SHA256
fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b

SHA512
7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\FileManager.dll

Filesize
679KB

MD5
a7103c32512241abef49e11aabec554c

SHA1
b2ca76a6f3541a3a27713e5f6b7f70ec6fc7cb60

SHA256
307b0e613e8e7b61c64287790ab42f5c4e7c2d199d783e987c1a6a8eaa8c17f1

SHA512
b8e5de01df5bb25133e8a1d6fa23bc04b6a462ad77ff70f920d119041a322e368ad4a7d5d1d99de518d3ba53133ad000976e2f710159ecdffbb30021e18a0d9d

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\FileSeacher.dll

Filesize
478KB

MD5
a1213775f91e5df436ea77795c34abb7

SHA1
c1d925587b500ea21e3f952ae5558678a5c4ba56

SHA256
d39dc7b128cf80028c6707db1c2a70b9d857b2415779d4f9c8ce6378129b671d

SHA512
377c89c44d13b3912a04fda986594001a6e3b9a9c0e0544e7d81b1f48d9b7f60b6c809a08061c8926005adaa1db2fc7a9f9c916b6e7cc438ee27657de682007c

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\HBrowser.dll

Filesize
25KB

MD5
79f13be3582c42df73033819d093e1f8

SHA1
45c25633bfd0ab3c4f95b7137eb9671b911ea595

SHA256
f38e74a4bee2cf29d710d7c58eb83e548d92604621a8fb076bdc1e79714b9938

SHA512
e6e4331d26f35ac52d3524da0c6cdbb4bb36af54b57c61bce564bfec8663245bc7e5ff192c44a3c731e9ce7b83fdff40f274347a5241f6322833a92df944adb5

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\HRDP.dll

Filesize
1.7MB

MD5
e22910ace59c1207f6b2dd48e3a828c3

SHA1
3e00b75ae8fa1cb6e45eb45403908191a36b7e31

SHA256
41770e6bbc7f32b46237e6d2388ebf62b8f4dac40a19f024cead38f040ba139f

SHA512
dcc966489ad094d97a4689eddb13398445964e48543c832dea138f7eb1c5ec71984f12c6a789225e940f47d138fd9cd886c8e1693c30d92b054e3f7f2a401ad4

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\HVNC.dll

Filesize
59KB

MD5
00185e83cb7d4ae3be2d6c6b6a593c09

SHA1
a5ee25f87e2269968ea36447c4715545908931f9

SHA256
d747520cfbf096033d9dbdb684d84bc349555c4b33850b2e3763d22248595a84

SHA512
be9686be7c8d2ca12aec27cd14ec7c25b9f8b6be69cb70a95a1b19e5ef683e5e57b0a559bb8433df7eb0d009ec4ce77b436c12189a259e73880069fa5fa25bea

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\HVNCMemory.dll

Filesize
40KB

MD5
c6c82e028f324ae74a06b87083c3060a

SHA1
c3f1e9db7c4df64fa0a9c6738d0808eb89909e00

SHA256
604feb4b3d6504984f1b5d26c7fe666b0203139b24142d38d6ca8592a07d165b

SHA512
58705e91e16920c236ae8c0ab1c4d5edf3824cdf8fda4d6b7d55c96b506dc9893eba2864751693304e4dcf5d1e3992958ab1db48b227c94150adb00ade753088

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\HiddenApps.dll

Filesize
45KB

MD5
c5efa70a04a026b9a2fa97b1ea43e840

SHA1
aab2de0ab74c12e04256ff2b113b062dc93179e6

SHA256
f9ef7709f34e944d99ca5bef6af1524d7cf3889894084b7ae61e9202f267a728

SHA512
1348d4ebd3ac5b56eb32820ee14f9aee20a43b7dc3d06dd7fd62c8f227b12a27d0c0376c7d858e78315cd92d17e588bc2e37648c04d146530db706e8b3c4ff1d

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Informations.dll

Filesize
22KB

MD5
43f97998b054cb248d3ef542f3d2a35c

SHA1
5910d4bef19e86f2e2bcafac5ef05f35919b90c1

SHA256
79644e42a221cfd23fb739cfff8ac733eae42bff5193be1027776658c7b8af01

SHA512
8a9186897a94e5f5e07f65e8f7f37053e0f8d6f50dd4df1552e043ec69ebf992dc8221a3e1cfafed7a52cdfa1b4f3a00056634387859e4ee9dd9db80e7b9052a

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Keylogger.dll

Filesize
17KB

MD5
51f7650a8e5c4ed1b2c87632217a8cbb

SHA1
472f062b4cb066ed43fd7e04a7f4ef199f3b0faa

SHA256
cf7f8e7a469ec590e4ab1b93bed0e3dcbb57976b9fcb5ce506adc258981210a3

SHA512
6465336daa8014ef4214d92d6eb6312603b82eab8b43ce4ba3eade36424f4bae93bca30a9d5e07ec6c0a71f6f6438b8fd8a0dab9f8d721ab882df0b167141084

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Maps.dll

Filesize
15KB

MD5
5f014f5068dccbeeee7f17d4c11b23fe

SHA1
a481d85b8f002d83c3b682b9881e297705a0caac

SHA256
66970870826f8fd29ddeda63d21a65b4b5a51e08a733ec1f79e28eb84053ab0d

SHA512
980f7fa8b379cfd95e717b1fc4fd0c0d89c881c94a6de98c914f6b163b4cddd67d0fd87d76964eee5c523d5054cc0b8043b899af6d3e3f326c77c3a68b9ad703

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\MessageBox.dll

Filesize
15KB

MD5
90aa613d71db75f163dc663fa4aab426

SHA1
be5a9cbed1bc4aac0d26b175171886d9fca8b867

SHA256
04b8372d5bafef3ee5e977916e3fce06b56a9a0b80bdc46b82b024debce243bf

SHA512
7b06a09f58c80fc6148eec29679f1f32a9dcef5058a91ef01d77e8ba9e548fb40bc871283130ec920bab24d2280164d225d529fa199cd7a0e0ec547bc0724155

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Microphone.dll

Filesize
540KB

MD5
37c46c880fb24e2be87166931abc47dd

SHA1
feec96c09eefb4bf4845a5c59e2325168ab752c0

SHA256
1558e9689479a91a15462668286907e5f9637028e91efeac73c236db38031ba0

SHA512
f207cebad91bf0c91ca71e33d4dbd47b16414037ad2e19f46f5780d94690a56b26347135a952f22697bcb08c3931ad2f4a3e9c42cec8f60e0eb2e163edf02c28

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Ngrok-Disk.dll

Filesize
7.0MB

MD5
fa5cd4ac08d473affa2b9c52679bc3bd

SHA1
884ece01f33fc850bc658fc891a4bb7f12e834aa

SHA256
6f669364bd077024b5afb1f3ac3d5d4c08ec594d71160559b6ffe8c6e1a6f57c

SHA512
667d79e7884b36c415beb2895adb088d3850a007c757d3252791709216ac678e7a79389300647e6baa5bfd688fbcceca9215806063c7cf74089fd4500ebe4362

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Options.dll

Filesize
30KB

MD5
adad703b79ec134788beb2887e96fea4

SHA1
0f1bd6a021351526480656bb2bc3fb41bf9fce35

SHA256
bf3ba1b0c2e90a0d7fb10f5d6a556818c09768e215e4d714fd7e562ec5a9792a

SHA512
e995201ffa6990f55c0e6e3cb253355ac258426a0fe0bd5ea53d41d6b63388dc608277887c0747e243e32d6d2fc2dc3e0ab31174c9fb3f78c0535fdd860694fd

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Pastime.dll

Filesize
17KB

MD5
8462b1c10b7ad3afd919412b12d81ed3

SHA1
81c05b3eea17b660f0a825f97d2e394ad12b1521

SHA256
b1fbf33f07534254fcc924fbc29babb8d692d345cf586edb9cb85478083eaec7

SHA512
ed2fd57737f75f254b748d9733047d687c83be2340bfb499cf1efe48a5b7d8860abbe755dbe9e03c100b0cabbb3405499ea8fac20e2feb0b99b57adc2408f5d7

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Performance.dll

Filesize
16KB

MD5
8918228ea5c81374f2e67ff087fe820b

SHA1
a185e646666a01b992ea328bb1803e49e73dbc8c

SHA256
724243fc6b442165cd6b55349a50581c82dcee8f4c759f3ad6a102477856aea8

SHA512
60950f538997ede082d2ad60490aa66adbd8a68b0704e523decd0c01dbc430350e401e83dc1c9bd5524c9980fc255cd979529da4a1245ae64cf1a11c03c97591

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\ProcessManager.dll

Filesize
19KB

MD5
15c466320595be3e669625f8f6f4c132

SHA1
45ef0a4b59e0cae3e4242252d03d603262fd2963

SHA256
9af2dac715892e7e553117a181c9ccc562009d6c997dff70d85c576fd580656e

SHA512
eb678c1e4875f7a87521ef2d124b46567212a93edc91e32df52e5e286224f85ea0cf04dc731cc556d90f6ca83d599699fe04d58219f3a92cd758f905652c87c2

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Programs.dll

Filesize
13KB

MD5
04f39107fe53d0abd30ffcaf22fc159f

SHA1
ddecf2b59db9e692f8ba19046dd0e6a95347a924

SHA256
70d73ebf66abe92684639c6b0847a71e30ddf8d1741ae8926363081ecf4eaf1f

SHA512
6647a37f4674a9a5dca8f3d68d511aea42f1b4d838efae2587e006aa9f0aba81c9a160c8ba946e6e9ba2c7f99dabadee0ce84abdda578457e1953399ac8dfa57

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Ransomware.dll

Filesize
20KB

MD5
b8baf5a88b94e6d08b34fab62a1fd7a0

SHA1
8399e05c99cbbc81d4f02c0dcab02544013b370e

SHA256
1a2b4a364c179d422bf18dc65d951938d7f68f6e2626fd2e647cfaa9e89fbf78

SHA512
3098a564630304e6c4943796ab24f670ebd6707d8582647d5854408739f579752724229fcb338327a5b651e8d0aa3dec2ff5ab302ccd53e62a5650da46da3e7c

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Recovery.dll

Filesize
1.1MB

MD5
c0a8690cacc12f0e893792e5bc8ea8ae

SHA1
d1d85298b50a117b3546f173934840d3f196352d

SHA256
436ace6829f875fec7cfdc9cae0283849c6021af7ae44c96e35989b0ff7e6b20

SHA512
68c989e9a27f968f5deefd83c8a7c298ce036c8920260dac5ab2bc27e84801fc1411066085defbbd7d170d8c8403fa75b0ba5d95cc66bd697877421d0e5f278f

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Regedit.dll

Filesize
15KB

MD5
60d310feae8566fca9d4e30e182a14bf

SHA1
1c6243a5009733d190f72a28a9d92c67830d9f36

SHA256
b6c9f44ece3d513de7df1875b0ffa1f9dc30a27612416e5f02a912546ec040c0

SHA512
e07f47afbad78e2638fe1879dff305737054e1e73adef34e8c590bde63a50066c76cfe3c85ac89af9aaece1cfd01d62ff983308170d89268ecf37ca9070ab9ce

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\RemoteDesktop.dll

Filesize
18KB

MD5
684c5da85fa75a8ba0a3679cbcab139f

SHA1
232ebe442cc4010a93421dd7ba3dc64bc01b40f5

SHA256
2b68aa9f0fb6b49adc1a2ecfdcfeace1787dfd06cd6d1cf17df3884137fe32e8

SHA512
fd40bc458d8d6128542d297160b4bdf5e2218cd7bcc47ab3fe724f9a0e288eedcc8658107d162374a90e8289f8cce6bfb11772a874ee9490d4453f71c21d38a7

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\ReverseProxy.dll

Filesize
16KB

MD5
1ad14702e2007f98fc6d9a7e6bd6668a

SHA1
88b3209da608825d9f8d7be12d3d1422eededae6

SHA256
b396fc8ab3b92bcbccdd758960ee83c6aeb94ac521504db6df404959cc1cb149

SHA512
ccaeb9951939990db1836c1a866b7137b210fe31ca60bf98fe97e1a10137e40faaf1abf3547b5eae298287273017575498a175be046170c463deac57004a6f0b

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\RunPE.dll

Filesize
11KB

MD5
ea08494d7e36b34a9af2c00ab016beef

SHA1
47eee9142b75c30f24594e536b5b724877ac7370

SHA256
204193f899f26854e0531c020f0e21b65de7a3d5806b1a69b83729f1ac117256

SHA512
0e45427f27ec4e6b5a832f548c42cd8607f8a41330c030cc51f54be109ec1efd647bfe733bdefdcff051890350edcfc2725b9a449067618d8cf10c99d0b8a2f2

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\ServiceManager.dll

Filesize
14KB

MD5
52533a6737d873546a90c146afb28949

SHA1
291a0f0871d47e3255a19f7732d6597644ce802d

SHA256
beac8279d8bac5f1fa9dafbe8c009b3c0221cdab217275dd468b713af5db8b0b

SHA512
3cfae1230c84d516272e25f438ad79749b2f390a964750761e501cf4a149ea42d87705dab7a055f149faa198e522000d345358e931efc84a74d4b20ef695ab89

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\Shell.dll

Filesize
15KB

MD5
25dfa7c5a7376c23614ce5e106434d23

SHA1
b5f9c3b2a63f756ea867c6dbed7c6fcc68c20a16

SHA256
3809f1dfdc5b5ae8b2ce82c566f45864f7fc409fa46a2e0d3f2207f94c120bb5

SHA512
aafd8a5a8da1b3bd12845d403dad67231f047252a24c074593dc719a8ef8f5ced9e857c0f6a81b98c641cd4439a87317999a961474f51fdd0225b9bfcff70980

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Plugins\StartupManager.dll

Filesize
189KB

MD5
05f42912052743664b3d6f4079dbfa40

SHA1
5d985638c149f8ebaa5c8eded335c56584ba2a0f

SHA256
fa86dc95effecf54fb1fdfd631be5e59266b865090850772a1a54e35e2ecb053

SHA512
975f47527076f9db718ee8b109ac29658ad53a5321d30d92ec9445767d0a5b820f41cd9fed7db79bf2c1bc42c5b15cf58e98c8d47ebabb18274f93363468df96

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\SimpleObfuscator.dll

Filesize
1.4MB

MD5
9043d712208178c33ba8e942834ce457

SHA1
e0fa5c730bf127a33348f5d2a5673260ae3719d1

SHA256
b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c

SHA512
dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\Sounds\Intro.wav

Filesize
238KB

MD5
ad3b4fae17bcabc254df49f5e76b87a6

SHA1
1683ff029eebaffdc7a4827827da7bb361c8747e

SHA256
e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf

SHA512
3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\XClienft.exe

Filesize
37KB

MD5
35af5d11ef810769c86b762fd56c2272

SHA1
ab622e71a6467346902ceb51809afe00790d10c8

SHA256
f008f9918e9e7a2175db9c30a115cb862db35b3b0b9bbd5b29511390e0643495

SHA512
a3d22f67e0cf2aac85f794ec591df80d7e7f0c8f99ab242b8982bd5f2eb29012fc13ec6ee3c2f86fddc54ae6f25ef9019aee758ae74df2185a05b076221bee17

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\XClient.exe

Filesize
33KB

MD5
2b4ed9f9f97134ee68de0389484b9dbf

SHA1
feeb945db6c0c0fbe408ae7a4c67d588523250be

SHA256
9fff4a772ff5da4bfe64d2892d993d3107e5f1e7f4f87b05c388ab72866b1fbe

SHA512
ddecca4efd8f461a620395e7b39c09d42aae169fbd4a667538fef05db564fca1f241f15a6e1566fabb1c24cbca1bc50a3badc85c2a344efd75b0ce6b906794a1

Download Submit
C:\Users\Admin\Downloads\XWorm V5.3\XWorm V5.3\XWorm V5.3.exe

Filesize
25.0MB

MD5
c0b4c6349df031081dd6aee3f25a1c9b

SHA1
82f164fdff783d2a02ae6db9e6d71d4c40a8acf7

SHA256
f13c9eb085bec9239557753ab617404e60a035422194550fb56c2df96bf00670

SHA512
63a18a2d0d894946d32a97f2e2112509b0ad54b4d5e4c04123c1c278f35669a909588d0d3036a054d544eedc6aa3025b8edd1560950e45749ee9f2db2277f69b

Download Submit
C:\Users\Admin\Downloads\XWorm V5.WqQiVs7a.3.7z.part

Filesize
43.4MB

MD5
d06bfd3b8385b6da7d7cefa963ea7288

SHA1
f97c1cd79b033be1b3487eb25a18a23839c06fcc

SHA256
4d274a49cb04b5de876fd1c22ef6a42dd1625a33b4c045c207fd1fbc0a8f3b6c

SHA512
32738af730ba3f25637cbe3256f1090bd797eefadf29ff6a09e6d75c90a64f35a5078895fa8b297b85cfaed219904c74d6b9d6ae5ddfe94299be1ebe46ca66a9

Download Submit
memory/1884-619-0x0000020D2FBA0000-0x0000020D2FE82000-memory.dmp

Filesize
2.9MB

Download
memory/1884-617-0x0000020D15100000-0x0000020D1512C000-memory.dmp

Filesize
176KB

Download
memory/1884-623-0x0000020D151C0000-0x0000020D1521A000-memory.dmp

Filesize
360KB

Download
memory/1884-613-0x0000020D150A0000-0x0000020D150A1000-memory.dmp

Filesize
4KB

Download
memory/1884-615-0x0000020D2F6B0000-0x0000020D2F8A4000-memory.dmp

Filesize
2.0MB

Download
memory/1884-563-0x0000020D11A20000-0x0000020D14C98000-memory.dmp

Filesize
50.5MB

Download
memory/1884-627-0x0000020D2F8B0000-0x0000020D2FA18000-memory.dmp

Filesize
1.4MB

Download
memory/1884-625-0x0000020D150E0000-0x0000020D150E8000-memory.dmp

Filesize
32KB

Download
memory/1884-629-0x0000020D2F4B0000-0x0000020D2F562000-memory.dmp

Filesize
712KB

Download
memory/1884-630-0x0000020D2FE90000-0x0000020D307C6000-memory.dmp

Filesize
9.2MB

Download
memory/1884-631-0x0000020D307D0000-0x0000020D313BC000-memory.dmp

Filesize
11.9MB

Download
memory/1884-621-0x0000020D2F3A0000-0x0000020D2F422000-memory.dmp

Filesize
520KB

Download
memory/2220-729-0x0000000001380000-0x000000000138A000-memory.dmp

Filesize
40KB

Download
memory/2220-730-0x000000001CAE0000-0x000000001CE30000-memory.dmp

Filesize
3.3MB

Download
memory/2220-728-0x00000000009C0000-0x00000000009D0000-memory.dmp

Filesize
64KB

Download
memory/2220-731-0x0000000002CB0000-0x0000000002CBA000-memory.dmp

Filesize
40KB

Download
memory/2220-732-0x0000000002CC0000-0x0000000002CCC000-memory.dmp

Filesize
48KB

Download
memory/5096-684-0x000000001BC80000-0x000000001BC8C000-memory.dmp

Filesize
48KB

Download
memory/5096-669-0x000000001FE30000-0x0000000020358000-memory.dmp

Filesize
5.2MB

Download
memory/5096-652-0x0000000000FF0000-0x0000000000FFE000-memory.dmp

Filesize
56KB

Download
memory/5096-656-0x0000000001840000-0x000000000184C000-memory.dmp

Filesize
48KB

Download
memory/5096-668-0x000000001BC70000-0x000000001BC7C000-memory.dmp

Filesize
48KB

Download
memory/5096-693-0x000000001C9A0000-0x000000001C9D6000-memory.dmp

Filesize
216KB

Download
memory/5096-687-0x000000001BCB0000-0x000000001BCBA000-memory.dmp

Filesize
40KB

Download
memory/5096-686-0x000000001BCA0000-0x000000001BCAA000-memory.dmp

Filesize
40KB

Download
memory/5096-685-0x000000001C2E0000-0x000000001C390000-memory.dmp

Filesize
704KB

Download