agenttesla | hxxps://gofile[.]io/d/JM0OFA

Analysis

max time kernel
300s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/JM0OFA

Score

10^/10

agenttesla xworm discovery keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:4444

10.127.1.131:4444

Mutex

3AXJX1Ehlf3b5hx2

Attributes

install_file
USB.exe

aes.plain

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x00030000000226a8-701.dat	family_xworm
behavioral1/files/0x00020000000226c2-720.dat	family_xworm
behavioral1/memory/2860-722-0x0000000000310000-0x000000000031E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

AgentTesla payload 2 IoCs

resource	yara_rule
behavioral1/memory/5568-421-0x000002586DAF0000-0x000002586DCE4000-memory.dmp	family_agenttesla
behavioral1/files/0x000700000002365e-638.dat	family_agenttesla

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	CefSharp.cfg
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	CefSharp.cfg

Executes dropped EXE 11 IoCs

pid	Process
5748	Xworm-V5.6.exe
5888	vshost.exe
5900	CefSharp.cfg
5964	winst.exe
6052	evbB5D0.tmp
5568	xwormv5.exe
5672	Xworm-V5.6.exe
1104	CefSharp.cfg
3772	evb3BCF.tmp
5848	xwormv5.exe
2860	XClient.exe

Loads dropped DLL 2 IoCs

pid	Process
5900	CefSharp.cfg
1104	CefSharp.cfg

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
92	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5900 set thread context of 6052	5900	CefSharp.cfg	125
PID 1104 set thread context of 3772	1104	CefSharp.cfg	139

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xworm-V5.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xworm-V5.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vshost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winst.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	xwormv5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	xwormv5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	xwormv5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	xwormv5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	xwormv5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	xwormv5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6036	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Internet Explorer\TypedURLs	xwormv5.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133696781801330716"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	xwormv5.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	xwormv5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	xwormv5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "2"	xwormv5.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	xwormv5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	xwormv5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	xwormv5.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	xwormv5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	xwormv5.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	xwormv5.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	xwormv5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	xwormv5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	CefSharp.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	xwormv5.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	xwormv5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	xwormv5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	xwormv5.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	xwormv5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	xwormv5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	xwormv5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 92003100000000002159c17b100058574f524d2d7e312e362d4c0000760009000400efbe2159ba7b2159c17b2e0000005536020000000700000000000000000000000000000012b33001580057006f0072006d002d00760035002e0036002d004c00690066006500740069006d0065002d0045006400690074006f006e002d0043007200610063006b006500640000001c000000	xwormv5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	xwormv5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	xwormv5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	xwormv5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	xwormv5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	CefSharp.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	xwormv5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	xwormv5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	xwormv5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	xwormv5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	xwormv5.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	xwormv5.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	xwormv5.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff	xwormv5.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	xwormv5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	xwormv5.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	xwormv5.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	xwormv5.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2684	chrome.exe
2684	chrome.exe
6052	evbB5D0.tmp
6052	evbB5D0.tmp
6052	evbB5D0.tmp
6052	evbB5D0.tmp
6052	evbB5D0.tmp
6052	evbB5D0.tmp
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5568	xwormv5.exe
5848	xwormv5.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeRestorePrivilege	5568	7zG.exe
Token: 35	5568	7zG.exe
Token: SeSecurityPrivilege	5568	7zG.exe
Token: SeSecurityPrivilege	5568	7zG.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe
Token: SeShutdownPrivilege	2684	chrome.exe
Token: SeCreatePagefilePrivilege	2684	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
5568	7zG.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe
5568	xwormv5.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
2684	chrome.exe
5568	xwormv5.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe
5588	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5848	xwormv5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 4292	2684	chrome.exe	91
PID 2684 wrote to memory of 4292	2684	chrome.exe	91
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 4528	2684	chrome.exe	92
PID 2684 wrote to memory of 3932	2684	chrome.exe	93
PID 2684 wrote to memory of 3932	2684	chrome.exe	93
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94
PID 2684 wrote to memory of 1168	2684	chrome.exe	94

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/JM0OFA
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9742ccc40,0x7ff9742ccc4c,0x7ff9742ccc58
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1968,i,10162336261170569562,1237064149644425831,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1936,i,10162336261170569562,1237064149644425831,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2012 /prefetch:3
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,10162336261170569562,1237064149644425831,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2240 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,10162336261170569562,1237064149644425831,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,10162336261170569562,1237064149644425831,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4496,i,10162336261170569562,1237064149644425831,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4644,i,10162336261170569562,1237064149644425831,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4776,i,10162336261170569562,1237064149644425831,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4828,i,10162336261170569562,1237064149644425831,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4668,i,10162336261170569562,1237064149644425831,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5172,i,10162336261170569562,1237064149644425831,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Drops file in System32 directory
  PID:6112

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4396,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
1⤵
PID:4140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4668

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap1958:126:7zEvent8154
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5696

C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Xworm-V5.6.exe
"C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Xworm-V5.6.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5748
- C:\ProgramData\vshost\vshost.exe
  C:\ProgramData\\vshost\\vshost.exe ,.
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5888
- C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\CefSharp.cfg
  CefSharp.cfg
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies registry class
  PID:5900
- - C:\Users\Admin\AppData\Local\Temp\evbB5D0.tmp
    "C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\xwormbin.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:6052
- - C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\xwormv5.exe
    "C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\xwormv5.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates system info in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5568
- C:\ProgramData\winst\winst.exe
  C:\ProgramData\\winst\\winst.exe lGhRcSwEghXoHWTfisZB05xI97EG9rJpS7QvIjjfvdlqmAubh743VM8A9Q8mUOnr
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5964

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5160

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x2f8
1⤵
PID:5096

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:5588

C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Xworm-V5.6.exe
"C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Xworm-V5.6.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5672
- C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\CefSharp.cfg
  CefSharp.cfg
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies registry class
  PID:1104
- - C:\Users\Admin\AppData\Local\Temp\evb3BCF.tmp
    "C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\xwormbin.exe"
    3⤵
    - Executes dropped EXE
    PID:3772
- - C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\xwormv5.exe
    "C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\xwormv5.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5848
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2u4ra25n\2u4ra25n.cmdline"
      4⤵
      PID:396
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8787.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC31B78A8845B4193A1DA35A8A4F2DDC8.TMP"
        5⤵
        
        PID:5344

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5256
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:6036

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4352

C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\XClient.exe
"C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\XClient.exe"
1⤵
- Executes dropped EXE
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vshost.lnk

Filesize
493B

MD5
29a978468ca21adf7a2306fed4c085d1

SHA1
192d0a23292eeae8e9c625d0cde7197887cf795a

SHA256
566bde2411a128b5ef5983e576fc297508df8bf41d1bb2a301a23723e6f77b0c

SHA512
fdcacb5d123f1df6655e96b76a49b16fe69e54933960bf545dc8555fbf4f063a01663067d754c8413e25359c191a60960286f0d3f88fdea2c85fc795e76c3380

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\winst.lnk

Filesize
603B

MD5
e078cf08a30d319447712aa16c677b4b

SHA1
aabd32cd9f94565cab0a1985f6b31cea32b1af48

SHA256
7074984ef6d6e87396a0ee464820936da5f9d716a3bb6aca4daf9751ad69aede

SHA512
3ac3212264d11b70494a55532c2d3b3b55705a79e336288508c7334831cec02209060f804e9f7667d8d53a7ae89aa89b2cd8e624636cbf1254247e4f76a590f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
7aac22dd78a63830dcae362073c7676e

SHA1
937f683f7a09b0d103d4830147bff53b80f3d901

SHA256
033fc837b5c871389f4a623164ffb289e1bce7cdd212ae69a7e6a9d12b9de2c4

SHA512
4a68e3a4750b3463b88c0d37c6e4abb0f4dd0846ecb5f0a0ad009a2ec45de7a02dbdd4b37a1131b8809d96dca56e1d3fd3b262fb9dab54121ad86897105a7b09

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
c75900d245e1967c7fef7a0c2cf42805

SHA1
2ed7d7eca14c958c4168922472825cb0a2fb47c7

SHA256
3e17d9a92a98b51d396289c95ebaff9f7591664e4fd4e2beeaf209bde4776b1e

SHA512
1ff1059dcfc5e11aff3ed43d8a386028a9768a36fa1a51ab3beb48c02ed041aa00c8ff7b74c4d70aac9966fc18520b562ad4d92012abd01dd42805f8b28ea0fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
cfe8902f21a740ddeefe1518bbf19bdb

SHA1
e823bb936521a27b169c865b5b90379402f9f93b

SHA256
112a5d9b1b1048fff69f3a6ce71b43dd25044077a9263bdf2cc9e9f71e4f3c9e

SHA512
86752ca4fce8c105acfce093a7401367e3ccc1cf91b005dcb93cc32dd8b0ea87ea80fe93c3d97b27cfbf7a23dcb954f3a704109025f67f24536d234d25ce00f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
c154f0facd8179e40d9eaa10552b0715

SHA1
6d0d9ce28732dce56e77b2688ef71f3eee975955

SHA256
a59eedd5920ae44e5a5771f234129eaeea62ab25636f19777d908573cd0be0ab

SHA512
5c6ee53d21b61983957748bd4c84ed6acda76b2f398ecb857e04fe7bd4fb1721a5d1fe3e1fb993d75c3a34bc85051a02c9d9838b3b4df1ea4ba2de3cde40970a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
e2bc7365a7b938bdfc535439bb1570da

SHA1
f67d49dd6e89898487d0033b4db498a44aa75294

SHA256
cf73b9d35e71a13660a06cf8e158f64ab5f6881969d9ee90c335ac41346a8c15

SHA512
06824b82f6fcd4c2b0e7325117757845be59fc6303c916c9c5e52ddf964bb2bf2c4c9ac5689cd5dda60b522dcb190d17e4f32e45aaf4b584bb3b3ff54856a9e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4665a1e5187600e57dca94b5a850a7d3

SHA1
5d6d0fbab58ed6d05d86c79305be627a93e23a35

SHA256
b426ba8e20a6c2965277c39d40454906fa5607c3d06aac50e804dc6b1da9f847

SHA512
0e118ad4ff705ec623eb1e32cb221b4d1e58ae6d6f00a0a1cd08f1a7651d73be8da3658227a0dbb26dea75f4d40c4e6b310170c775b5b17822844aef7210cab0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ab10e4fa696260bc1920dae9783fe414

SHA1
c03b840d480840656b097fd562ead2c4e391e23c

SHA256
adedff0bac8e095bf3fc6800a56d00961e45a0b8c4da0c6ddc9b50872c96b498

SHA512
ed4fde8c304d1a265ef4f83d9e67dc742204a4037bf1cecbcf5dff05ed88395ae0bebd4026fb7b13f1e473c4a2ca75cea4091fd7776a1370c8f6d8c2c0e8cf4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f6989240b722d47d43b85a438472f29c

SHA1
63e647c6917b95bd3bada3a39d6353c88357119e

SHA256
6d072119cb8d4f264f487215419c0643cb3cb4908e5e6ce30766d02862cdecbe

SHA512
85e495f6aed911c60625554ad13802226f2ac6f3bfb59d939cf396350d31df426dcd065d419ba963bf507df3dd6fcd08102b115d1f61da784cac1e5763c55309

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d4296d27f61599f403e5fb001f249b9b

SHA1
eef7cbdb01960384a9774744728caf5ed93fbacb

SHA256
affd037e566198a267cee6aaca0a09c75d0f2fd3b5049c46c66e2b4adf0bc871

SHA512
1bbd1d02fe6f33c39aec97adb2d7df9f18f9569d809628c6a83a02aba4409b5cb5c97ee8b3726985d20c7a9ef601c776f6b4a8a082af3e50caec597a83489d8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fde448da2eab266cb468ddaa8446b74c

SHA1
49995a1d8f6ab41b4da7dd399b79d5ca22aa5288

SHA256
a0575e29c20b44256c6df9e97449b093dec75a31f291c58d7e73daa0611d073c

SHA512
c2106b5cd721395380a7cc24d99c54e3dede569d8d27e0a3bc72f3bd28969e87389e8767b7204bb321c6dadb54d691167851e3c26fc49db9af48dc78130cdb6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
61a2f707c7fb2b776a9fa0facca86c32

SHA1
27d2aa65f2cf30a221a76dea6204bae9ecbc9db8

SHA256
78e6e32420fdd660353c56a1a5c7a1c087be3e07a7cde13a0c8cb5958b7642a8

SHA512
795ee948f7be14dae9244aecfffa78a071375f4251dcac558a30091544ccb1c6b3fbcffc3881a90f2b61fcd3cb21318d8e43177854fc5c21c5967884d098e33a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4b5f3e333c607b051c154b65441e4c13

SHA1
51528f342afa0cd752b615594e0bc6814a00d4e9

SHA256
68ca87cadc9b32f84b65507e344cfc6d5500ee603665afb85e0158d936c14303

SHA512
a5e20815d18fe3fa737fb837634add66bbd5fa8cd68403ed9563dd6f71ed2888774f6f0b83d7e3163e310ce2f99266f0e3038e42f464e6ea4f6ac73195cf6914

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
29838358e70521fa673090c6a8171113

SHA1
6f52053b871a26f5bca0ace425a405dd7e65ffbb

SHA256
c6c84cd9c07c4274d71896cf1ca2aa7b6c195f9d023d30b8b05f75504afd40cd

SHA512
b1dd83ba006eaa33a606732bcf6df39e07948e478eef55abb6912caef93a09c9b61ac1e708f849753845773fa3c91906873411876e7233a74894997b80db7aa6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7527f2fec87fc821f478691e734bb617

SHA1
bfae1bc6095822780eb48df748dde559bdab58e5

SHA256
2e3e8471e7a00b8cbfd16a4f5e078b27c2ba4cb836748534d817fe97f9d5644b

SHA512
9f8583872c2b36df00639daadecf67c574d74f776d6cb7bda1e313481ad8d7ad24ecc0503024ca1590b99d15b6410e6fbb13781812192b464a29ff6ee16701d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c64631f8959e6b908df6a4054e23d4f6

SHA1
6060651c575d6ac9db3e4959c9a72acf31725329

SHA256
1f3b1a92678bc50d3fddcfef1afd21790cf1ad1d7f86537ca683692db59140de

SHA512
0270a3047d50f7ca4ebd01ad9fb90cd73912802d4e4b4b09c5ed38e76becd915007abc72f980cc989667a7e6074178054df40108fa701c7bcb11f1b7b4b09bc5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f24501d1149a48f24f166604b95f06ed

SHA1
61aa776769c7e3076c87642e1372c6293a82a50a

SHA256
c879987d069caa2a2bd24e52f4452f72ad01a1084d3c98891dc5bba0ade3ddcc

SHA512
dd7fba61abbbe19201b91a13cd60be897b28902cf9f5ac63c9ff82d640648c046d41ecad664cb426894b37f354c89ba150ee6db87695fa76618e012ebc744019

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ea596d8037d6419ebccf0f1f1a7c57aa

SHA1
adb17addf9075888400b244df2b75624e8495a14

SHA256
0a4db0135f50fbc0a2d901a4939b2a8c3803f0e42d0915dec4ee47c78cb8ecb1

SHA512
f2374fb907abc7ee5589b240c41e369fd855da0516f17293438b086b1214d489dbc57864f7384a45fc070fec12a46c9d430ef29499d9b2c8066f5e0e8f233f3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5aec86a6ca770601a0060dffd02f6fc0

SHA1
28f2d69c59d1599e43dc1f41bf697a923732b1af

SHA256
df1a493c0c3690ce68a8626075e3b09a481b1890de5654880cd58ec2b46b7105

SHA512
afee99d82c9a7d5a0515876b0a82d78a38cc456b8bb611420627c6095e187bd57d269da9fbe06edebf36aab9f4fc0df287e7c64001fb653a59b73e251b7cb35d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d58cde0ad7c6410f3b60bd6ecf68cd09

SHA1
1cfc49263e181df3775b48cd9fddb72d34b523df

SHA256
654373510dc3fb7b4425fca34e8df81064d9fe6f2225723d52dace7f78f04e42

SHA512
5a867155df6602d04a5051db0bfd810bff5125aadb15c5d8e03a10fd2b1d158e9d184999c1c5190e2b5843e3213e97936e299abcec54fca5dab4409adb2f6a38

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d6b9e5be2d2a83a8d47ef67a76456632

SHA1
1bd06d2a86f89d21f202299f586111b5ce90a3db

SHA256
bfded87805aabfbb48ff2b6a788b3f39620317b4d911e145f6aae5942d28fddb

SHA512
794e86187dbe11e3c9317a9dfde66000eff00541630f190feb4b4b4f486550990f18725280f1077f8916922f866331c521d1407829e8e4412701c0d56ec46772

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
88dd03e4af73a85a3bfce1dafdc6dcef

SHA1
91631601e6e2c406437506aa0a210ce504bed4b7

SHA256
9b3aaebb26c8ff1de97a8d0eccc43c49d82f9d6e076d7b9d085642a96abd00ae

SHA512
54dabebcde845293770f331c34023f063a88b18a96343bb96e5ab2b91a3b7a99526090cd9b5efef8a851d082d53576c71f6537f2d67627456f72389d89a2952a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
82581f4e4cb87d133b170cc7904addb3

SHA1
6faed5acbb51b9a93c93f05bdc5a425fc1a2feb4

SHA256
7609ec8bfbd7223eefa2af827a7ec86022df997d9236221b871d5042a6c8091a

SHA512
364132c62c8315ab1bef429a62ef03640e6889826c7a41fe41729447a838d9f08227d16361f2477026adbac7e0eefe607e39957060d44f8412fd7084a7590c78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
173db17d871cd942d4e4cb2548b985fc

SHA1
40b00ab1df767f1748a2e0ce0fa5c39a7d2721af

SHA256
cdb3009aedba2540ca83d62e21edea9c80209138401449fb65ca09823b91d929

SHA512
8e4161d2f5c67e9f7a37739ff5bb82cac752039d55a54b0227378579da21b013185a4d5b1718a77faf5fa926f8a5aba3ddfe4b7bd1e3e4ac45568da845a1ffb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
85d9c4dd02473db3162cc7dad4f488f2

SHA1
4fef84b406cccf3e69df6629548a94f283030656

SHA256
25ad8652d75b827cdc2b1782ac2aa5c2976e3a09e9677968be6038bd569c7572

SHA512
e935f1eb93982b5ae26a396aec4c5a3d7392ec289a804822bacdee96dafa76f2714de63991c0f3167c8072ddcf9b76cd5488b15a5f406da21820a05fccbaaee5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
cac1431f111cb6752f2c01d67420f372

SHA1
918be76813ee3cf92efe35466a8c7e90c016cb51

SHA256
d7c7171e0e449f2211536f1dec40b9adb02a4ad6cb0c5a1229806daa4b06baf5

SHA512
9616d244c5c810671d2d78e548b452cfde5e9f5c4dad52c39fa0fdc34d2b50d9de71b6798be076a38cd13062a6443097229e08ba47308cc96037977dc3a30a06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
26463786d449a20406a6886bde6cf87b

SHA1
fc04ae4d14743f0cd62fab6c8bad46d52236429a

SHA256
be2ae9374733613281c6488685a12382ff6bc0ac4cfbf0171bea93df263f953f

SHA512
7e9610d291ee66b1e1cbf27d187d05438e208e0b7dc128850712238e0f6941d0db8a5794b6f1316280836af5b55ae2322a2a390babfea8ad5cb2c57fed5f0e05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xwormv5.exe.log

Filesize
1KB

MD5
2d2a235f1b0f4b608c5910673735494b

SHA1
23a63f6529bfdf917886ab8347092238db0423a0

SHA256
c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884

SHA512
10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086

Download Submit
C:\Users\Admin\AppData\Local\Temp\2u4ra25n\2u4ra25n.0.vb

Filesize
78KB

MD5
2105fd6d912265778d3e328deeae293b

SHA1
1db774599ee82589be34acf80ecb319681a35009

SHA256
1136febb18c762f4911a4c9b9ad38589eac48fcf89fb719d63415d2b843d7f17

SHA512
e3fba3e540751785c48af80772d18e543c5b2378af79039b695f1fd4cee40039ace2bcc03506a393c1925e26c97d69927e37569ec4462eae116fffb3359418f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\2u4ra25n\2u4ra25n.cmdline

Filesize
325B

MD5
213b15e04e4de390e87b1296185d2d8a

SHA1
c2d62122176fda177faaa9012dd1d16b654a21f8

SHA256
fdf9d5af4bc3d08e879889f5f5e523871e0bb2824c1d7ebd7809b8021b2d15d8

SHA512
ecf526ed42340231fe24695657326431e3af0de625d560bb2c2d3ca44e2581099da12e9973355079bae5ead915131158ad5750df2145a406fccaf20421531d2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8787.tmp

Filesize
1KB

MD5
1f4dea425762796e1f38bd52ffa4ff3c

SHA1
5ee7302dc55b89493a7c164e885d7ae89619a7cd

SHA256
e5da45d09a57e9c31941a31a010939ad237a3c391b74a32cd7602d43908da2a7

SHA512
c3f08093afca125134041be93cbb831c08b0924e61add35a2f5d8b21abc9ee34679234c33165be113e7e0d7667f349ea32bb8ff79caa3204cad7841c8e61fcc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\evbB562.tmp

Filesize
1KB

MD5
8fd1d495b09695f4fb95638213559464

SHA1
8525bec9fcc14bfb53145f339b5498c7d5948563

SHA256
21e178a283f66f767540ca84c2f2fe46bfe18add60a41f49a65ac4bdaae1f7a2

SHA512
80239f149715fccd6e0d615ace999b483315ec9451664352aea5953a321435964757721e5694e4dfbb3b8aab001621112332617b99eb95994d616160838a82a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\evbB5D0.tmp

Filesize
1KB

MD5
86d23632843c402a3a34828bb99317c9

SHA1
ee7082dcee56cb61d0cae037078efb2a4b32eaae

SHA256
eef04cd51ee4cffc01ea5b13e1bf7a174cc4f093aef143471a31d16e20f9e280

SHA512
9a5fcf3158c96be1a48dff04d58ec15471d69f44a6a06ea5f2fcd2c858bd974bbfbfe31028cc85a321ae55f5d621038c5234dcf01757682c399b91dc007cb223

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcC31B78A8845B4193A1DA35A8A4F2DDC8.TMP

Filesize
1KB

MD5
d40c58bd46211e4ffcbfbdfac7c2bb69

SHA1
c5cf88224acc284a4e81bd612369f0e39f3ac604

SHA256
01902f1903d080c6632ae2209136e8e713e9fd408db4621ae21246b65bfea2ca

SHA512
48b14748e86b7d92a3ea18f29caf1d7b4b2e1de75377012378d146575048a2531d2e5aaeae1abf2d322d06146177cdbf0c2940ac023efae007b9f235f18e2c68

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\CefSharp.cfg

Filesize
10.8MB

MD5
acff16b9fae109888d772998b91ccca4

SHA1
b580c68d4d2bf3cc26393728337278f190d405f1

SHA256
5cae75e6d6a6b249b2d977158998aaa514b8c917c313b5a0609c7b90b075ae50

SHA512
557aadc06ca2a961ca44b6e4f46cbe412d605dab2092bee16118baaa8a4a02eecbd746ba615d0af9eddd38ed67d81ef44dd1313956a32a4798a4018d24377962

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\GMap.NET.Core.dll

Filesize
2.9MB

MD5
819352ea9e832d24fc4cebb2757a462b

SHA1
aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11

SHA256
58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86

SHA512
6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\GMap.NET.WindowsForms.dll

Filesize
147KB

MD5
32a8742009ffdfd68b46fe8fd4794386

SHA1
de18190d77ae094b03d357abfa4a465058cd54e3

SHA256
741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365

SHA512
22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\GeoIP.dat

Filesize
1.2MB

MD5
8ef41798df108ce9bd41382c9721b1c9

SHA1
1e6227635a12039f4d380531b032bf773f0e6de0

SHA256
bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

SHA512
4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Guna.UI2.dll

Filesize
1.9MB

MD5
bcc0fe2b28edd2da651388f84599059b

SHA1
44d7756708aafa08730ca9dbdc01091790940a4f

SHA256
c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

SHA512
3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\NAudio.dll

Filesize
502KB

MD5
3b87d1363a45ce9368e9baec32c69466

SHA1
70a9f4df01d17060ec17df9528fca7026cc42935

SHA256
81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451

SHA512
1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Plugins\ActiveWindows.dll

Filesize
14KB

MD5
5a766a4991515011983ceddf7714b70b

SHA1
4eb00ae7fe780fa4fe94cedbf6052983f5fd138b

SHA256
567b9861026a0dbc5947e7515dc7ab3f496153f6b3db57c27238129ec207fc52

SHA512
4bd6b24e236387ff58631207ea42cd09293c3664468e72cd887de3b3b912d3795a22a98dcf4548fb339444337722a81f8877abb22177606d765d78e48ec01fd8

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Plugins\Chat.dll

Filesize
18KB

MD5
59f75c7ffaccf9878a9d39e224a65adf

SHA1
46b0f61a07e85e3b54b728d9d7142ddc73c9d74b

SHA256
aab20f465955d77d6ec3b5c1c5f64402a925fb565dda5c8e38c296cb7406e492

SHA512
80056163b96ce7a8877874eaae559f75217c0a04b3e3d4c1283fe23badfc95fe4d587fd27127db4be459b8a3adf41900135ea12b0eeb4187adbcf796d9505cb8

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Plugins\Chromium.dll

Filesize
32KB

MD5
edb2f0d0eb08dcd78b3ddf87a847de01

SHA1
cc23d101f917cad3664f8c1fa0788a89e03a669c

SHA256
b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982

SHA512
8f87da834649a21a908c95a9ea8e2d94726bd9f33d4b7786348f6371dfae983cc2b5b5d4f80a17a60ded17d4eb71771ec25a7c82e4f3a90273c46c8ee3b8f2c3

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Plugins\Clipboard.dll

Filesize
14KB

MD5
831eb0de839fc13de0abab64fe1e06e7

SHA1
53aad63a8b6fc9e35c814c55be9992abc92a1b54

SHA256
e31a1c2b1baa2aa2c36cabe3da17cd767c8fec4c206bd506e889341e5e0fa959

SHA512
2f61bcf972671d96e036b3c99546cd01e067bef15751a87c00ba6d656decb6b69a628415e5363e650b55610cf9f237585ada7ce51523e6efc0e27d7338966bee

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Plugins\Cmstp-Bypass.dll

Filesize
11KB

MD5
cf15259e22b58a0dfd1156ab71cbd690

SHA1
3614f4e469d28d6e65471099e2d45c8e28a7a49e

SHA256
fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b

SHA512
7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Plugins\FileManager.dll

Filesize
679KB

MD5
641a8b61cb468359b1346a0891d65b59

SHA1
2cdc49bcd7428fe778a94cdcd19cabf5ece8c9c0

SHA256
b58ed3ebbcd27c7f4b173819528ff4db562b90475a5e304521ed5c564d39fffd

SHA512
042702d34664ea6288e891c9f7aa10a5b4b07317f25f82d6c9fa9ba9b98645c14073d0f66637060b416a30c58dec907d9383530320a318523c51f19ebd0a4fee

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Plugins\FilesSearcher.dll

Filesize
478KB

MD5
6f8f1621c16ac0976600146d2217e9d2

SHA1
b6aa233b93aae0a17ee8787576bf0fbc05cedde4

SHA256
e66e1273dc59ee9e05ce3e02f1b760b18dd296a47d92b3ce5b24efb48e5fb21b

SHA512
eb55acdea8648c8cdefee892758d9585ff81502fc7037d5814e1bd01fee0431f4dde0a4b04ccb2b0917e1b11588f2dc9f0bfe750117137a01bbd0c508f43ef6a

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Plugins\HBrowser.dll

Filesize
25KB

MD5
f0e921f2f850b7ec094036d20ff9be9b

SHA1
3b2d76d06470580858cc572257491e32d4b021c0

SHA256
75e8ff57fa6d95cf4d8405bffebb2b9b1c55a0abba0fe345f55b8f0e88be6f3c

SHA512
16028ae56cd1d78d5cb63c554155ae02804aac3f15c0d91a771b0dcd5c8df710f39481f6545ca6410b7cd9240ec77090f65e3379dcfe09f161a3dff6aec649f3

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Plugins\HRDP.dll

Filesize
1.7MB

MD5
f27b6e8cf5afa8771c679b7a79e11a08

SHA1
6c3fcf45e35aaf6b747f29a06108093c284100da

SHA256
4aa18745a5fddf7ec14adaff3ad1b4df1b910f4b6710bf55eb27fb3942bb67de

SHA512
0d84966bbc9290b04d2148082563675ec023906d58f5ba6861c20542271bf11be196d6ab24e48372f339438204bd5c198297da98a19fddb25a3df727b5aafa33

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Plugins\HiddenApps.dll

Filesize
45KB

MD5
ba2141a7aefa1a80e2091bf7c2ca72db

SHA1
9047b546ce9c0ea2c36d24a10eb31516a24a047d

SHA256
6a098f5a7f9328b35d73ee232846b13e2d587d47f473cbc9b3f1d74def7086ea

SHA512
91e43620e5717b699e34e658d6af49bba200dcf91ac0c9a0f237ec44666b57117a13bc8674895b7a9cac5a17b2f91cdc3daa5bcc52c43edbabd19bc1ed63038c

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Plugins\RemoteDesktop.dll

Filesize
18KB

MD5
e6367d31cf5d16b1439b86ae6b7b31c3

SHA1
f52f1e73614f2cec66dab6af862bdcb5d4d9cf35

SHA256
cc52384910cee944ddbcc575a8e0177bfa6b16e3032438b207797164d5c94b34

SHA512
8bc78a9b62f4226be146144684dc7fcd085bcf4d3d0558cb662aacc143d1438b7454e8ac70ca83ebeedc2a0fcea38ad8e77a5d926a85254b5a7d420a5605538a

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\SimpleObfuscator.dll

Filesize
1.4MB

MD5
9043d712208178c33ba8e942834ce457

SHA1
e0fa5c730bf127a33348f5d2a5673260ae3719d1

SHA256
b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c

SHA512
dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Sounds\Intro.wav

Filesize
238KB

MD5
ad3b4fae17bcabc254df49f5e76b87a6

SHA1
1683ff029eebaffdc7a4827827da7bb361c8747e

SHA256
e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf

SHA512
3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\XClient.exe

Filesize
32KB

MD5
cbe8ea0de81e466d132d9e2f2b2991b0

SHA1
4970a4260190ecbea7cb35d1ad439a5547a81f45

SHA256
03d2efe6da4908c97c01e1b15db919d46fecd7774f33d85027fc4eacdc582a2f

SHA512
41e2452e847efafbc9b690d1f3e4bea31d765d48f7a98c2d37134ef8abad2b8732cb6503199fe20f8dab08016df2d6f97a43b35ed2174f4a54721f4acbbd3fd0

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\Xworm-V5.6.exe

Filesize
422KB

MD5
ea50d404071ce22f1225abd04d38b1b2

SHA1
0f4a4a60f7f25c913ea55ef6fa0b77dbb84c2bee

SHA256
709c4a8af81385171b7f3f71e4dbc550ee14267b939fedc1fae54c40b78a0938

SHA512
5aae592477f8293922c5d1c49efb476821427cc40bb9e9fcf54cb82e9717ea0c47631f2776ddacb7a384625c4a1d064894e9d027bf2448a96103f1ccdfef291a

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\d3dcompiler_47.bin

Filesize
211KB

MD5
59238144771807b1cbc407b250d6b2c3

SHA1
6c9f87cca7e857e888cb19ea45cf82d2e2d29695

SHA256
8baa5811836c0b4a64810f6a7d6e1d31d7f80350c69643dc9594f58fd0233a7b

SHA512
cf2f8b84526ae8a1445a2d8a2b9099b164f80a7b7290f68058583b0b235395d749ad0b726c4e36d5e901c18d6946fd9b0dd76c20016b65dc7a3977f68ee4a220

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\libGLESV2.lib

Filesize
238KB

MD5
4e6a7ee0e286ab61d36c26bd38996821

SHA1
820674b4c75290f8f667764bfb474ca8c1242732

SHA256
f67daf4bf2ad0e774bbd53f243e66806397036e5fde694f3856b27bc0463c0a3

SHA512
f9d99d960afce980421e654d1d541c1fdb81252615c48eed5c4a5c962cb20123d06dbdf383a37a476aa41e4ffabca30e95a8735739c35f66efbaa1dee8a9ba8a

Download Submit
C:\Users\Admin\Desktop\XWorm-v5.6-Lifetime-Editon-Cracked\xwormv5.exe

Filesize
14.9MB

MD5
6c59ff494f131d6e12eec38f2b0c4c55

SHA1
555c547cf314c867a71464b5b761c7f1d296df15

SHA256
19f9f28a04878d8a958835f5add563c1db48498309982afea1c2fd8a7ed8cc05

SHA512
f7a2d52aeea60d8d934bf042709bc3d00e224d0761480475609044dcd339e5927b546d51b2b23144074a70c76b64468a7b94246c254c63b5e5b1b44276cfd24f

Download Submit
memory/1104-564-0x0000000004840000-0x0000000004E81000-memory.dmp

Filesize
6.3MB

Download
memory/1104-637-0x0000000140000000-0x00000001400DE000-memory.dmp

Filesize
888KB

Download
memory/1104-552-0x0000000140000000-0x00000001400DE000-memory.dmp

Filesize
888KB

Download
memory/2860-752-0x0000000000B90000-0x0000000000B9C000-memory.dmp

Filesize
48KB

Download
memory/2860-722-0x0000000000310000-0x000000000031E000-memory.dmp

Filesize
56KB

Download
memory/3772-632-0x0000000140000000-0x0000000140641000-memory.dmp

Filesize
6.3MB

Download
memory/5568-421-0x000002586DAF0000-0x000002586DCE4000-memory.dmp

Filesize
2.0MB

Download
memory/5568-419-0x000002586A1D0000-0x000002586B0B8000-memory.dmp

Filesize
14.9MB

Download
memory/5588-459-0x000001CA8FDE0000-0x000001CA8FDE1000-memory.dmp

Filesize
4KB

Download
memory/5588-464-0x000001CA8FDE0000-0x000001CA8FDE1000-memory.dmp

Filesize
4KB

Download
memory/5588-461-0x000001CA8FDE0000-0x000001CA8FDE1000-memory.dmp

Filesize
4KB

Download
memory/5588-460-0x000001CA8FDE0000-0x000001CA8FDE1000-memory.dmp

Filesize
4KB

Download
memory/5588-462-0x000001CA8FDE0000-0x000001CA8FDE1000-memory.dmp

Filesize
4KB

Download
memory/5588-463-0x000001CA8FDE0000-0x000001CA8FDE1000-memory.dmp

Filesize
4KB

Download
memory/5588-465-0x000001CA8FDE0000-0x000001CA8FDE1000-memory.dmp

Filesize
4KB

Download
memory/5588-454-0x000001CA8FDE0000-0x000001CA8FDE1000-memory.dmp

Filesize
4KB

Download
memory/5588-455-0x000001CA8FDE0000-0x000001CA8FDE1000-memory.dmp

Filesize
4KB

Download
memory/5588-453-0x000001CA8FDE0000-0x000001CA8FDE1000-memory.dmp

Filesize
4KB

Download
memory/5848-725-0x0000022332220000-0x00000223322A2000-memory.dmp

Filesize
520KB

Download
memory/5848-696-0x000002233A5F0000-0x000002233A758000-memory.dmp

Filesize
1.4MB

Download
memory/5848-731-0x000002233A760000-0x000002233A812000-memory.dmp

Filesize
712KB

Download
memory/5848-727-0x00000223321C0000-0x00000223321EC000-memory.dmp

Filesize
176KB

Download
memory/5848-729-0x000002233AA50000-0x000002233AD32000-memory.dmp

Filesize
2.9MB

Download
memory/5900-343-0x0000000004890000-0x0000000004ED1000-memory.dmp

Filesize
6.3MB

Download
memory/5900-417-0x0000000140000000-0x00000001400DE000-memory.dmp

Filesize
888KB

Download
memory/5900-331-0x0000000140000000-0x00000001400DE000-memory.dmp

Filesize
888KB

Download
memory/6052-354-0x0000000140000000-0x0000000140641000-memory.dmp

Filesize
6.3MB

Download
memory/6052-346-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/6052-415-0x0000000140000000-0x0000000140641000-memory.dmp

Filesize
6.3MB

Download