Overview

overview

10

Static

static

10

XWorm V5.2.exe

windows7-x64

10

XWorm V5.2.exe

windows10-2004-x64

10

XWorm.exe

windows7-x64

10

XWorm.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    300s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-09-2024 20:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XWorm V5.2.exe

  • Size

    9.1MB

  • MD5

    1c264a483f2f667410157dac2f067d66

  • SHA1

    4831f141b41802d06d6735b237c53f4d34e9d428

  • SHA256

    1c906ee702dadbc5ce1668754a488cbbc9838c63aaa6fb77fe5e848491b6f474

  • SHA512

    1b48506e8cd01b66e930b8bb70998a3e4f02a300ef1a97252e105013b7e455c021d014a4cf3b1ba77deadc94e1908c8314c2875900145760cc5c402f37d637a2

  • SSDEEP

    196608:6OdkWMB1TCCAaa/f+cUhBLHK1gzaFsKnULGZ3d/VRyDhwymXeexoAxG:6K2B1CkcDUDLHK18as0mcvow+Ax

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

uk1.localto.net:3725

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
        "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4988
          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:412
            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:884
              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                7⤵
                • Checks computer location settings
                • Suspicious use of WriteProcessMemory
                PID:3568
                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                  8⤵
                  • Checks computer location settings
                  • Suspicious use of WriteProcessMemory
                  PID:640
                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:840
                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2228
                      • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                        "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3656
                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4664
                          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2628
                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3280
                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                15⤵
                                  PID:4444
                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                    16⤵
                                    • Checks computer location settings
                                    PID:4032
                                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                      17⤵
                                      • Checks computer location settings
                                      PID:1488
                                      • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                        "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                        18⤵
                                          PID:4180
                                          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                            19⤵
                                              PID:3588
                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                20⤵
                                                • Checks computer location settings
                                                PID:1844
                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                  21⤵
                                                    PID:536
                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                      22⤵
                                                        PID:1108
                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                          23⤵
                                                          • Checks computer location settings
                                                          PID:1468
                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                            24⤵
                                                              PID:4692
                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                25⤵
                                                                • Checks computer location settings
                                                                PID:2880
                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                  26⤵
                                                                  • Checks computer location settings
                                                                  PID:3544
                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                    27⤵
                                                                    • Checks computer location settings
                                                                    PID:5096
                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                      28⤵
                                                                        PID:1864
                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                          29⤵
                                                                          • Checks computer location settings
                                                                          PID:1896
                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                            30⤵
                                                                            • Checks computer location settings
                                                                            PID:4292
                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                              31⤵
                                                                                PID:4728
                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                  32⤵
                                                                                  • Checks computer location settings
                                                                                  PID:1940
                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                    33⤵
                                                                                    • Checks computer location settings
                                                                                    PID:3232
                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                      34⤵
                                                                                        PID:4476
                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                          35⤵
                                                                                          • Checks computer location settings
                                                                                          PID:2624
                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                            36⤵
                                                                                            • Checks computer location settings
                                                                                            PID:1444
                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                              37⤵
                                                                                              • Checks computer location settings
                                                                                              PID:4912
                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                38⤵
                                                                                                  PID:2880
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                    39⤵
                                                                                                    • Checks computer location settings
                                                                                                    PID:736
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                      40⤵
                                                                                                        PID:4852
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                          41⤵
                                                                                                            PID:1228
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                              42⤵
                                                                                                              • Checks computer location settings
                                                                                                              PID:1756
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                43⤵
                                                                                                                  PID:540
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                    44⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    PID:3228
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                      45⤵
                                                                                                                        PID:4388
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                          46⤵
                                                                                                                            PID:1128
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                              47⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              PID:3232
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                48⤵
                                                                                                                                  PID:4780
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                    49⤵
                                                                                                                                      PID:4236
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                        50⤵
                                                                                                                                          PID:3716
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                            51⤵
                                                                                                                                              PID:4812
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                52⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                PID:3160
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                  53⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  PID:1888
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                    54⤵
                                                                                                                                                      PID:392
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                        55⤵
                                                                                                                                                          PID:3108
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                            56⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            PID:2556
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                              57⤵
                                                                                                                                                                PID:2492
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                  58⤵
                                                                                                                                                                    PID:3484
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                      59⤵
                                                                                                                                                                        PID:388
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                          60⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          PID:4352
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                            61⤵
                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                            PID:3652
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                              62⤵
                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                              PID:1040
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                63⤵
                                                                                                                                                                                  PID:3636
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                    64⤵
                                                                                                                                                                                      PID:1660
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                        65⤵
                                                                                                                                                                                          PID:4000
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                            66⤵
                                                                                                                                                                                              PID:624
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                67⤵
                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                PID:5044
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                  PID:3804
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                    69⤵
                                                                                                                                                                                                      PID:3132
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                        70⤵
                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                        PID:1756
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                          71⤵
                                                                                                                                                                                                            PID:2780
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                              72⤵
                                                                                                                                                                                                                PID:4652
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                    PID:3484
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                        PID:4548
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          PID:5056
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                              PID:4624
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                77⤵
                                                                                                                                                                                                                                  PID:4056
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                    78⤵
                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                    PID:2336
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                        PID:2280
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                            PID:4116
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                              81⤵
                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                              PID:1076
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                82⤵
                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                PID:4644
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                  PID:1988
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                      PID:2768
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                          PID:4276
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                            PID:3972
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                              PID:4980
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                PID:1552
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                  PID:3144
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                    PID:4824
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                      PID:4548
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                        PID:1316
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                                                                            PID:4632
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                PID:4056
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                  PID:4084
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                                                                                      PID:4344
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                                                                                          PID:4196
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                                                                                              PID:1096
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                PID:5064
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                  PID:4368
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                    PID:1616
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                                                                                        PID:720
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                                                                                            PID:4976
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                              104⤵
                                                                                                                                                                                                                                                                                                                PID:4060
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                  PID:3172
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                    PID:516
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                                                                                        PID:1372
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                                                                                                            PID:1968
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                              PID:5056
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                                  PID:3656
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                                                                                      PID:2736
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                                          PID:3792
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                            PID:3056
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                              PID:4984
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                PID:2468
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                  PID:5092
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                    PID:2880
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                      PID:2436
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                        PID:2568
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                          PID:1672
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                            PID:2896
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1492
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                  PID:4840
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                    PID:448
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2992
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2856
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                              PID:4056
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm V5.2.exe"
                                                                                                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3352
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1512
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1844
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4900
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2552
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4352
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:540
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4928
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2408
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4500
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4768
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2768
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:844
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4988
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3780
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3204
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3316
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1040
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3652
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4192
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4048
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3180
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3588
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4876
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2780
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4852
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2456
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4532
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  99⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4268
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2312
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3168
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4436
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:316
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1532
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2324
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2192
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4552
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2720
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4544
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4636
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:180
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4976
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:720
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1616
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4080
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3160
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  80⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2624
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  79⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1780
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  78⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1624
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  77⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4108
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1844
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1456
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  74⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1656
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3152
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2532
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  71⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4636
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1896
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  69⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  67⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5020
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  66⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3648
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3168
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  64⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:4564
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                  PID:3204
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                PID:4476
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                              61⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                              PID:3292
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                            PID:2284
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                          PID:5056
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                        PID:3136
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                      PID:732
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                    PID:2196
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                  PID:2396
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                PID:3924
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                              53⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                              PID:4948
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:3544
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                          PID:1988
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                        PID:3040
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                      49⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                      PID:2624
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                    48⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                    PID:3204
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                  47⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:2856
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                                46⤵
                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                              45⤵
                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                              PID:4232
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                            44⤵
                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                            PID:2124
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                          43⤵
                                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                          PID:3480
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                        42⤵
                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                        PID:1480
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                      41⤵
                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                      PID:720
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                    PID:4532
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                  39⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  PID:1924
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                                38⤵
                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                PID:432
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                              37⤵
                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                              PID:3348
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                            36⤵
                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                            PID:3040
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                          35⤵
                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                          PID:3268
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                        34⤵
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                        PID:2280
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                      33⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                      PID:2140
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                    32⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                    PID:4320
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                  31⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                  PID:2900
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                                30⤵
                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                PID:4976
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                              29⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                              PID:4308
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                            28⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                            PID:4460
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                          27⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:844
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                        PID:1496
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                      25⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                      PID:4892
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                    PID:3600
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                  23⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                  PID:2628
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                PID:2604
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                              PID:4548
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                            20⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                            PID:388
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                          19⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                          PID:2508
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                        18⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                        PID:5048
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                      PID:4268
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                  15⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                  PID:4312
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                PID:1904
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                              PID:2328
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                            PID:2624
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                          PID:4212
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                        PID:4844
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                      PID:5056
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                    PID:1608
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  PID:5096
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                PID:4280
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                              PID:1748
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                            PID:2084
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          PID:4780
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XWorm.exe"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                        PID:4736
                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XWorm.exe'
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          PID:4788
                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWorm.exe'
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          PID:4688
                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          PID:1720
                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          PID:3168
                                                                                                                                                                                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                          PID:1664
                                                                                                                                                                                                                                                    • C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                                      C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      PID:3000
                                                                                                                                                                                                                                                    • C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                                      C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      PID:4120
                                                                                                                                                                                                                                                    • C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                                      C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4248
                                                                                                                                                                                                                                                      • C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                                        C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:2404
                                                                                                                                                                                                                                                        • C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                                          C:\ProgramData\svchost.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:2024

                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XWorm V5.2.exe.log
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            654B

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            2ff39f6c7249774be85fd60a8f9a245e

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            2KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            944B

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            77d622bb1a5b250869a3238b9bc1402b

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            d47f4003c2554b9dfc4c16f22460b331886b191b

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            944B

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            fe09dfbed812c73731fbed5ea5f62725

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            aa85d262377932fae3d28f998a815d32ccc76bcc

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            e3828bd6068ce6522c8976da4a7c0c3710fe06dcab9f6101c0172f05e189ff49

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            9f1be4ddffd297e28aa34438132da3ce120cdd6adbc9460918d3adbcd2805c4895767726b1d787966e5c5caebb356690468235c7ebde224909cf849871a3f066

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            944B

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            34f595487e6bfd1d11c7de88ee50356a

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            4caad088c15766cc0fa1f42009260e9a02f953bb

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XWorm.exe
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            61KB

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            433b1bb16223dc6eac212edff6177362

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            f8e020d7066b0570c0b6030878f33bd83211046e

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            238db9b1b269432ad832a8a0d86471af730ee4afadc6b98e680c05d6395a6c3d

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            d285d522deda22eed55df4f8ad707ab4f760e072a4e8001bb7e42666f9845f0fe19827eedb15e6bf1573fdb15aa46101ca0da625ac6e74f8fc88b31b94c599b8

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0xr0iyr5.v0i.ps1
                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            60B

                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                          • memory/1824-1-0x00000000002F0000-0x0000000000C10000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            9.1MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1824-2-0x00007FFC50FD0000-0x00007FFC51A91000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1824-18-0x00007FFC50FD0000-0x00007FFC51A91000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/1824-0-0x00007FFC50FD3000-0x00007FFC50FD5000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2456-22-0x00007FFC50FD0000-0x00007FFC51A91000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2456-19-0x00007FFC50FD0000-0x00007FFC51A91000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/2456-15-0x00007FFC50FD0000-0x00007FFC51A91000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4736-23-0x00007FFC50FD0000-0x00007FFC51A91000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4736-17-0x00000000008C0000-0x00000000008D6000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            88KB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4736-16-0x00007FFC50FD0000-0x00007FFC51A91000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4736-78-0x00007FFC50FD0000-0x00007FFC51A91000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4736-81-0x00007FFC50FD0000-0x00007FFC51A91000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            10.8MB

                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                          • memory/4788-29-0x0000024D90AA0000-0x0000024D90AC2000-memory.dmp

                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                            136KB

                                                                                                                                                                                                                                                            Download