agenttesla | hxxps://github[.]com/d00mt3l/XWorm-5[.]6

Resubmissions

02-09-2024 02:32

240902-c1mz6szgjh 10

02-09-2024 02:27

240902-cxn33aygnj 10

Analysis

max time kernel
280s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2024 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/d00mt3l/XWorm-5.6

Score

10^/10

agenttesla xworm discovery evasion keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:8888

Mutex

VGq5pZcm29NgeKIu

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

xworm

127.0.0.1:8888

Attributes

install_file
USB.exe

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/6032-370-0x000000001C4C0000-0x000000001C4CE000-memory.dmp	disable_win_def

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000500000001e5aa-310.dat	family_xworm
behavioral1/files/0x0007000000023574-320.dat	family_xworm
behavioral1/files/0x0007000000023574-322.dat	family_xworm
behavioral1/memory/6032-324-0x00000000008D0000-0x00000000008E4000-memory.dmp	family_xworm

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5"	XClient.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/872-250-0x00000228B77D0000-0x00000228B79C4000-memory.dmp	family_agenttesla

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
6032	XClient.exe

Loads dropped DLL 4 IoCs

pid	Process
6032	XClient.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
34	camo.githubusercontent.com
35	camo.githubusercontent.com
36	camo.githubusercontent.com
31	camo.githubusercontent.com
32	camo.githubusercontent.com
33	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Xworm V5.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\TypedURLs	Xworm V5.6.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Xworm V5.6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Xworm V5.6.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2436	msedge.exe
2436	msedge.exe
3732	msedge.exe
3732	msedge.exe
2036	identity_helper.exe
2036	identity_helper.exe
4380	msedge.exe
4380	msedge.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
872	Xworm V5.6.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	5540	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5540	AUDIODG.EXE
Token: SeDebugPrivilege	6032	XClient.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
872	Xworm V5.6.exe
872	Xworm V5.6.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
872	Xworm V5.6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
872	Xworm V5.6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 1564	3732	msedge.exe	84
PID 3732 wrote to memory of 1564	3732	msedge.exe	84
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2168	3732	msedge.exe	85
PID 3732 wrote to memory of 2436	3732	msedge.exe	86
PID 3732 wrote to memory of 2436	3732	msedge.exe	86
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87
PID 3732 wrote to memory of 3068	3732	msedge.exe	87

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system	XClient.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5"	XClient.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/d00mt3l/XWorm-5.6
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa112f46f8,0x7ffa112f4708,0x7ffa112f4718
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,13361642732724315543,15337946429108217605,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3624 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3196

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1616

C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\Xworm V5.6.exe
"C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\Xworm V5.6.exe"
1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kxvtxk10\kxvtxk10.cmdline"
  2⤵
  PID:5876
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE8F4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6D4A84DBA7A14D969091A2A6454A4C.TMP"
    3⤵
    PID:5952

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5420

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x41c 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5540

C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\XClient.exe
"C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\XClient.exe"
1⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:6032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\GMap.NET\DllCache\SQLite_v98_NET4_x64\System.Data.SQLite.DLL

Filesize
1.6MB

MD5
1b1a6d076bbde5e2ac079ef6dbc9d5f8

SHA1
6aa070d07379847f58adcab6b5739fc97b487a28

SHA256
eaadfbcafd981ec51c9c039e3adb4963b5a9d85637e27fd4c8cfca5f07ff8471

SHA512
05b0cb3d343a5706434390fe863e41852019aa27797fe5d1b80d13b8e24e0de0c2cb6e23d15e89a0f427aaeaf04bf0239f90feb95bfc6913ca4dc59007e6659e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b6d9357ff791eb018e0e26460651306c

SHA1
1c83bca515f1ff75bb8d4e4a348cb254b4b9254f

SHA256
52fad291717473c10960bf75b6af4a4d141b10848551ac8507cd0ffc454d1c3e

SHA512
cf7c5a78974fbabc6d5e4b2ab4c7d0ac4964ad7bc85face8230bdace422b056e28ca6c7958e456396278a67b06d811c06d619000f60c75e140cee585937c9923

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
657B

MD5
cee71c2501fbf3f7c793fb1537f39362

SHA1
68449c1322a773b9be344f66bdc02cf6247d7df7

SHA256
9829a6b4586d5689c023784f94fa6df2baf22c209d779b4866c50cbc288860fd

SHA512
c932268f9a1eda03f7d62f9b36c1d716ad0984fde2176613d0b2124e76de6c1bac7152201068277ba64d42e707b061ef9bae5758c79defdf0438c41bf314df5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2de9119043b2be88fa15fda76bc570ac

SHA1
9b7fa1cbc370aa93d4965f901f274c56502f17c2

SHA256
07c158551cff586ad04a59df5a81ea5386ff6103f7a6d8cfa8a16fcaa7cff48e

SHA512
85da5241838a6b301194cd885db974ab8ab5145267868076ef41c22000d6e391d3de6935405d4cd69164eff7c2fa1f143d0268e11e870b724c2dfd5ca41550d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
460f8b8a3cb197a1b570778983caf338

SHA1
ba1d38a306126523c4749980398dca0ab0b6525a

SHA256
b7dd46255119aadc00dbea4ff47e8d232e122fe2d84683a596e661f25aad134c

SHA512
127641bb629ed0bdacb39f647e2e426bde2b86c33cd6e52189c93ccd30724ea1664dc0db0dbac41139e48872e08214ecedea120953cebed1c6f7134bb6dac40f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6059931b96d919d06b83628d5216c648

SHA1
2c097418ac6f1ae853482b6c8d150d8f5621a72a

SHA256
37288ccce79dc54105788ff9a471a30dd9635a1d1247bcea25d30d0025962fb2

SHA512
459b34f6fbc871983c5427231ebace6523a1290a2da234fec1d4bcb2027067d81f18ef8b93b2216d16cc746909eb411c8aabf7964a09cf08ec629bb11b3fa5b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5f172738c4ff45c2ad9f5eeb02fdfc48

SHA1
6829b29e31c0dac79e9e9ad77d934436c093cb72

SHA256
38d1a81072389c90a7f2a241f55eba318e7826b840c293383468e1aabc2902a7

SHA512
355582d15679aafb056a9c70ac47548159eda34f5a098c1a3e970989ebcd16cf67cfaced096ffd921141467f3e27422a2d92d450bfe9ff813e4a1621f0de4d07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58077d.TMP

Filesize
1KB

MD5
e456ef01c47facea086a644388b85d67

SHA1
344eb27d9ac54435a3bf1c166e6b6cd7b3a99180

SHA256
f3ed7b5b8b8c25101e8bdd1921efc350b39e20c7cebc8c55d4d58f72e19ec0cb

SHA512
8f5aac3e03e40b561b6fe1d4eac69470baef3ef6af1931d39bd39767f558bd66723d3a15fb2be67f21c69b124e1da730055c241de4dd889fa8a2e7688eb5be73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
eac098870b0dc8cbac93cad25e97f529

SHA1
d2a46c96dbbbb1830a9c7395a14134d57d8c1359

SHA256
d0bf1aef0ac84c5c59cd03bfb3d53358205f79f7a35c245d99344e94560ac5ce

SHA512
f2d437b037562764d3d3f355963a71ba6f632d07781c83287cb41f4c94f672eaddd2cd1fc8ceafdb551718aa3c49cf516d4f685e21811ffcfe838771d64db9b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5fca1e220943d965a95773692a2308b9

SHA1
03f17c527cbd4d435a5f75a67114378e0a2eaac6

SHA256
443c92cdfc276ead0d29985797d76effd48377cbb630d6278418927edf728f46

SHA512
db8b97800a503460076d4aeca8211f87162a93f8ba34c2693f11cb90c50e5448daf297e135c6fe623020101e4a51cec1d1f11361bfef8b832a25c2074d3a6eb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d277474ee8891133a5c424bc170d32a1

SHA1
4fca05fc57d131287dec0870ccebccc163a0eac0

SHA256
9407205db2b8b7cbe6a69ba47d4eba57ad66d7d7ff210a1a5ab8c823cbf932a3

SHA512
4805f484db65a090da509ae42ce100b5a9c25d8a5da568d5768fa841f524001170bb12e5eafc8e936eca77eff0d267943274a706660e3dd91c62a2b35d1e3f14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7396b564bb9f26f4143d6351b0f452b8

SHA1
aa898dd96738b8946e9836b9c852426a6e5cdc73

SHA256
fa5515e2f56ede90058cc774ee863e957d1fabb1b22fbc014486b48b9b7e4546

SHA512
8e7670a2c2f6da60cb8fd86dbefbfa57a4ccb74557cde4352ff9336bdcf543b7f23c034e386f99101249b3fa246464b54698bf881112175c980f6f52c733030f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4feee88567bba45f0d5fda9d34a90778

SHA1
e5389c19de2f2f92cd6818acda849b314f75c376

SHA256
21537086eca43a8488d9b7e0137e1367dd3dd9ef3a12e3ccea48320288c2a750

SHA512
01535a51387654ac5aae89168f4b54bd010fdd985eeaf01165d0ca7d216d936b4d720750625c7b65509c61b39715d4833620b46bba8882fbbb9b2164f857fb33

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESE8F4.tmp

Filesize
1KB

MD5
c53ec5bf47ea9ebe696b3b27ef90678b

SHA1
760281b5bcf4e2210145f778accd66969f9df144

SHA256
1b078ae28989847764c190676bb26ab8e0e096b58121d35e02f57179fc93416e

SHA512
fc142249f49ee4bcd622d6698df43871e1ab94249817f09e948e92b9e0fc6559a5335151c82f602ba9f80bf680601b7f1a454d5654052d6a0b0bb23abef54d13

Download Submit
C:\Users\Admin\AppData\Local\Temp\kxvtxk10\kxvtxk10.0.vb

Filesize
78KB

MD5
c3bed98af1070199d5f12a886338f7b0

SHA1
2bcf1d79566cf29faeda58fe7c5123214b972ce3

SHA256
9b788fb4fa36310da49cc8d2acb0301727e53a4b6bdce2dfb2927b040bb0c19e

SHA512
9d331255380b23a112fe18766cd10d8b35575d32cada0d3271499714e723efbe9e02a1d985ce80763c18284cfb4511a1a4580a3d8cc93f2d5cb7ee42cc4d2df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\kxvtxk10\kxvtxk10.cmdline

Filesize
322B

MD5
b34454540e0b5c301d45ec3bdc3e73aa

SHA1
1394e3d0407c28861a62b9df243e2bba3658ca9f

SHA256
647f1d380cb49c74ca7532819e25c9ed41b9eb5456a48dc98f06d7966ce93750

SHA512
0deea6040391baeb98518f880fa54288472eaabc1001a30f5fec75f531af4d514e9c8eb08f2adb728b20f504ccf78dcfd86b9a5c651c49c18a2d084066bc7e61

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5932.tmp

Filesize
100KB

MD5
1b942faa8e8b1008a8c3c1004ba57349

SHA1
cd99977f6c1819b12b33240b784ca816dfe2cb91

SHA256
555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc

SHA512
5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc6D4A84DBA7A14D969091A2A6454A4C.TMP

Filesize
1KB

MD5
d40c58bd46211e4ffcbfbdfac7c2bb69

SHA1
c5cf88224acc284a4e81bd612369f0e39f3ac604

SHA256
01902f1903d080c6632ae2209136e8e713e9fd408db4621ae21246b65bfea2ca

SHA512
48b14748e86b7d92a3ea18f29caf1d7b4b2e1de75377012378d146575048a2531d2e5aaeae1abf2d322d06146177cdbf0c2940ac023efae007b9f235f18e2c68

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 930626.crdownload

Filesize
25.1MB

MD5
95c1c4a3673071e05814af8b2a138be4

SHA1
4c08b79195e0ff13b63cfb0e815a09dc426ac340

SHA256
7c270da2506ba3354531e0934096315422ee719ad9ea16cb1ee86a7004a9ce27

SHA512
339a47ecfc6d403beb55d51128164a520c4bea63733be3cfd47aec47953fbf2792aa4e150f4122994a7620122b0e0fc20c1eeb2f9697cf5578df08426820fecd

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\XClient.exe

Filesize
32KB

MD5
0e1904bb3443c4ff4471fd07c4fc2d6b

SHA1
c779ba33109033ea5c9f08ad284f92205819c081

SHA256
9efde632f2132a02b60c10b134c390f2d3bbdfd0dceef488a7ae38918176f4d4

SHA512
d7361e60e4c7cfd5ee4b2e68d1ab62f65884a03a654d8c6242b5ffc2d6003c2f23bec1fc1ea1c4043c4117604dbd4a2189155778f393aaeb848ee8ebf8e9109a

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\XClient.exe

Filesize
51KB

MD5
a2052198305a491cb41eb7888ec8e1d4

SHA1
f056f89ccd079766a6a1500b9dd84955b667f902

SHA256
aeb9c2dc4e31f9efb3ee88e3db4b37425925042386b9f1f021c3837efeb8c82f

SHA512
b4aba5b4eb7d43eee61de16c97e0dcc517819eac4bf7098d320023fb16f02fbfd29f0ba178a33f3ca5eaf6663395de2dbf30a02b393ff51371201c43e160eda7

Download Submit
memory/872-347-0x00000228BE440000-0x00000228BE4F2000-memory.dmp

Filesize
712KB

Download
memory/872-250-0x00000228B77D0000-0x00000228B79C4000-memory.dmp

Filesize
2.0MB

Download
memory/872-344-0x00000228B68F0000-0x00000228B6972000-memory.dmp

Filesize
520KB

Download
memory/872-345-0x00000228B5BD0000-0x00000228B5BFC000-memory.dmp

Filesize
176KB

Download
memory/872-346-0x00000228BEE30000-0x00000228BF112000-memory.dmp

Filesize
2.9MB

Download
memory/872-305-0x00000228BE5C0000-0x00000228BE728000-memory.dmp

Filesize
1.4MB

Download
memory/872-378-0x00000228BF120000-0x00000228BF2BB000-memory.dmp

Filesize
1.6MB

Download
memory/872-240-0x000002289A060000-0x000002289AF48000-memory.dmp

Filesize
14.9MB

Download
memory/6032-360-0x00000000012D0000-0x00000000012DC000-memory.dmp

Filesize
48KB

Download
memory/6032-324-0x00000000008D0000-0x00000000008E4000-memory.dmp

Filesize
80KB

Download
memory/6032-370-0x000000001C4C0000-0x000000001C4CE000-memory.dmp

Filesize
56KB

Download
memory/6032-371-0x000000001BEC0000-0x000000001BECA000-memory.dmp

Filesize
40KB

Download
memory/6032-372-0x000000001BF10000-0x000000001BF1A000-memory.dmp

Filesize
40KB

Download
memory/6032-373-0x000000001BF20000-0x000000001BF2A000-memory.dmp

Filesize
40KB

Download
memory/6032-354-0x000000001B5E0000-0x000000001B5EC000-memory.dmp

Filesize
48KB

Download
memory/6032-348-0x000000001B590000-0x000000001B5CA000-memory.dmp

Filesize
232KB

Download
memory/6032-390-0x000000001C050000-0x000000001C062000-memory.dmp

Filesize
72KB

Download