gurcu | hxxps://github[.]com/DannyTheSloth/VanillaRAT

Analysis

max time kernel
907s
max time network
815s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/DannyTheSloth/VanillaRAT

Score

10^/10

gurcu lumma vanillarat xworm agilenet discovery persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

3.1

full-wet.at.ply.gg:38848

Attributes

Install_directory
%AppData%
install_file
chrome.exe

Extracted

Family

lumma

https://pillowbrocccolipe.shop/api

https://communicationgenerwo.shop/api

https://diskretainvigorousiw.shop/api

https://affordcharmcropwo.shop/api

https://dismissalcylinderhostw.shop/api

https://enthusiasimtitleow.shop/api

https://worryfillvolcawoi.shop/api

https://cleartotalfisherwo.shop/api

Extracted

Family

xworm

127.0.0.1:7000

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Extracted

Family

gurcu

https://api.telegram.org/bot6840643388:AAFx-w02hvJE3j8QWzCipTXQ-j2gGH45m_Y/sendDocument?chat_id=2024893777&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0%20kb)%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%84%20-%20BrowserDownloads.txt%20(0.8%20kb

https://api.telegram.org/bot6840643388:AAFx-w02hvJE3j8QWzCipTXQ-j2gGH45m_Y/sendMessage?chat_id=2024893777

https://api.telegram.org/bot6840643388:AAFx-w02hvJE3j8QWzCipTXQ-j2gGH45m_Y/getUpdates?offset=-

https://api.telegram.org/bot6840643388:AAFx-w02hvJE3j8QWzCipTXQ-j2gGH45m_Y/sendDocument?chat_id=2024893777&caption=%F0%9F%93%B8Screenshot%20take

Signatures

Detect Xworm Payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\svchost.exe	family_xworm
behavioral1/memory/5068-1018-0x0000000000FE0000-0x0000000000FF8000-memory.dmp	family_xworm
behavioral1/memory/1964-6654-0x0000000000E60000-0x0000000000E78000-memory.dmp	family_xworm

Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
rat vanillarat
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Vanilla Rat payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/876-254-0x0000000000700000-0x0000000000722000-memory.dmp	vanillarat
C:\Users\Admin\Downloads\Release\Clients\my.exe	vanillarat
behavioral1/memory/3232-301-0x0000000000D20000-0x0000000000D42000-memory.dmp	vanillarat

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Command Reciever.exeCommand Reciever.exeUpdate.exeCommand Reciever.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Command Reciever.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Command Reciever.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	Command Reciever.exe

Executes dropped EXE 13 IoCs

Processes:

my.exeXWorm V3.1.exesvchost.exeXWorm V3.1.exesvchost.exeCommand Reciever.exeUpdate.exeCommand Reciever.exeUpdate.exeCommand Reciever.exeUpdate.exeXClient.exeXClient.exe

pid	process
3232	my.exe
3744	XWorm V3.1.exe
5068	svchost.exe
5916	XWorm V3.1.exe
5972	svchost.exe
2912	Command Reciever.exe
6032	Update.exe
2196	Command Reciever.exe
4780	Update.exe
6096	Command Reciever.exe
4640	Update.exe
1964	XClient.exe
2340	XClient.exe

Loads dropped DLL 8 IoCs

Processes:

Command Reciever.exeUpdate.exeCommand Reciever.exeXHVNC.exeUpdate.exeXHVNC.exeCommand Reciever.exeUpdate.exe

pid	process
2912	Command Reciever.exe
6032	Update.exe
2196	Command Reciever.exe
2864	XHVNC.exe
4780	Update.exe
5528	XHVNC.exe
6096	Command Reciever.exe
4640	Update.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/2864-4863-0x0000000005F20000-0x0000000006144000-memory.dmp	agile_net

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OperaUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleChromeLogs\\Update.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

Processes:

flow	ioc
507	raw.githubusercontent.com
514	raw.githubusercontent.com
536	raw.githubusercontent.com
542	raw.githubusercontent.com
33	raw.githubusercontent.com
36	raw.githubusercontent.com
506	raw.githubusercontent.com
53	camo.githubusercontent.com
499	raw.githubusercontent.com
500	raw.githubusercontent.com

Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

167 ipinfo.io
168 ipinfo.io
229 ip-api.com
422 ip-api.com
497 ip-api.com
533 ip-api.com
649 ip-api.com

flow	ioc
167	ipinfo.io
168	ipinfo.io
229	ip-api.com
422	ip-api.com
497	ip-api.com
533	ip-api.com
649	ip-api.com

Drops file in System32 directory 36 IoCs

Processes:

lodctr.exelodctr.exelodctr.exe

description	ioc	process
File created	C:\Windows\system32\perfc00C.dat	lodctr.exe
File created	C:\Windows\system32\perfc011.dat	lodctr.exe
File created	C:\Windows\system32\perfh00C.dat	lodctr.exe
File created	C:\Windows\system32\perfc011.dat	lodctr.exe
File created	C:\Windows\system32\perfc007.dat	lodctr.exe
File created	C:\Windows\system32\perfc00A.dat	lodctr.exe
File created	C:\Windows\system32\perfc007.dat	lodctr.exe
File created	C:\Windows\system32\perfc009.dat	lodctr.exe
File created	C:\Windows\system32\perfc010.dat	lodctr.exe
File created	C:\Windows\system32\perfc009.dat	lodctr.exe
File created	C:\Windows\system32\perfh011.dat	lodctr.exe
File created	C:\Windows\system32\perfh011.dat	lodctr.exe
File created	C:\Windows\system32\perfc00C.dat	lodctr.exe
File created	C:\Windows\system32\perfh00C.dat	lodctr.exe
File created	C:\Windows\system32\perfc010.dat	lodctr.exe
File created	C:\Windows\system32\perfh007.dat	lodctr.exe
File created	C:\Windows\system32\perfh009.dat	lodctr.exe
File created	C:\Windows\system32\perfh00C.dat	lodctr.exe
File created	C:\Windows\system32\perfc009.dat	lodctr.exe
File created	C:\Windows\system32\perfc00A.dat	lodctr.exe
File created	C:\Windows\system32\perfh00A.dat	lodctr.exe
File created	C:\Windows\system32\perfh010.dat	lodctr.exe
File created	C:\Windows\system32\perfh00A.dat	lodctr.exe
File created	C:\Windows\system32\perfh011.dat	lodctr.exe
File created	C:\Windows\system32\perfc010.dat	lodctr.exe
File created	C:\Windows\system32\perfh007.dat	lodctr.exe
File created	C:\Windows\system32\perfc00C.dat	lodctr.exe
File created	C:\Windows\system32\perfh009.dat	lodctr.exe
File created	C:\Windows\system32\perfh010.dat	lodctr.exe
File created	C:\Windows\system32\perfh007.dat	lodctr.exe
File created	C:\Windows\system32\perfc011.dat	lodctr.exe
File created	C:\Windows\system32\perfh00A.dat	lodctr.exe
File created	C:\Windows\system32\perfh009.dat	lodctr.exe
File created	C:\Windows\system32\perfh010.dat	lodctr.exe
File created	C:\Windows\system32\perfc007.dat	lodctr.exe
File created	C:\Windows\system32\perfc00A.dat	lodctr.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exe

pid process

2716 tasklist.exe
1968 tasklist.exe
760 tasklist.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3512 4048 WerFault.exe XWorm V5.2 Resou‮nls..scr

pid	process
2716	tasklist.exe
1968	tasklist.exe
760	tasklist.exe

pid	pid_target	process	target process
3512	4048	WerFault.exe	XWorm V5.2 Resou‮nls..scr

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

explorer.exeXWorm V5.2 Resou‮nls..scrXWorm RAT V2.1.exeXHVNC.exeXHVNC.exeXWorm RAT V2.1.exeVanillaRat.exemy.exeXWorm RAT V2.1.exeXwormLoader.exeXwormLoader.exeVanillaStub.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWorm V5.2 Resou‮nls..scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWorm RAT V2.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XHVNC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XHVNC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWorm RAT V2.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VanillaRat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	my.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWorm RAT V2.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XwormLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XwormLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VanillaStub.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exetaskmgr.exedwm.exetaskmgr.exetaskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Update.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Update.exe

Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

6028 timeout.exe
3000 timeout.exe
1436 timeout.exe

pid	process
6028	timeout.exe
3000	timeout.exe
1436	timeout.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Xworm V5.6.exedwm.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Xworm V5.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Xworm V5.6.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

dwm.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Modifies registry class 64 IoCs

Processes:

explorer.exeXworm V5.6.exemsedge.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).x = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).left = "276"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\7	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0700000006000000040000000500000003000000020000000100000000000000ffffffff	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\NodeSlot = "2"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1280x720x96(1).x = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0 = 56003100000000003c5979511000436c69656e747300400009000400efbe3c5979513c5979512e0000002b070000000004000000000000000000000000000000cd1fab0043006c00690065006e0074007300000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).bottom = "676"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 84003100000000003c5966511100444f574e4c4f7e3100006c0009000400efbe025987633c5966512e00000073e101000000010000000000000000004200000000002029bb0044006f0077006e006c006f00610064007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370039003800000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\7\0	Xworm V5.6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1280x720x96(1).y = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1280x720x96(1).right = "1076"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202020202020202020202	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\19\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0	explorer.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1696 reg.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

1960 explorer.exe

pid	process
1696	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exetaskmgr.exemsedge.exeXWorm V3.1.exe

pid	process
4724	msedge.exe
4724	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
744	identity_helper.exe
744	identity_helper.exe
4688	msedge.exe
4688	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
3160	msedge.exe
3160	msedge.exe
3848	msedge.exe
3848	msedge.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
3728	msedge.exe
3728	msedge.exe
3744	XWorm V3.1.exe
3744	XWorm V3.1.exe
3744	XWorm V3.1.exe
3744	XWorm V3.1.exe
3744	XWorm V3.1.exe
3744	XWorm V3.1.exe
3744	XWorm V3.1.exe
3744	XWorm V3.1.exe
3744	XWorm V3.1.exe
3744	XWorm V3.1.exe
3744	XWorm V3.1.exe
3744	XWorm V3.1.exe
3744	XWorm V3.1.exe
3744	XWorm V3.1.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

Processes:

VanillaRat.exeXHVNC.exeXworm V5.6.exetaskmgr.exetaskmgr.exe

pid process

2252 VanillaRat.exe
2864 XHVNC.exe
4152 Xworm V5.6.exe
1976 taskmgr.exe
1272 taskmgr.exe

pid	process
2252	VanillaRat.exe
2864	XHVNC.exe
4152	Xworm V5.6.exe
1976	taskmgr.exe
1272	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs

Processes:

msedge.exe

pid	process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

XWorm V5.2 Resou‮nls..scrtaskmgr.exesvchost.exeXWorm V3.1.exeAUDIODG.EXEsvchost.exeXWorm V3.1.exeCommand Reciever.exetasklist.exeUpdate.exeCommand Reciever.exetasklist.exeUpdate.exeCommand Reciever.exetasklist.exeUpdate.exetaskmgr.exeXClient.exeXClient.exetaskmgr.exetaskmgr.exedwm.exe

description	pid	process
Token: SeDebugPrivilege	4048	XWorm V5.2 Resou‮nls..scr
Token: SeDebugPrivilege	1600	taskmgr.exe
Token: SeSystemProfilePrivilege	1600	taskmgr.exe
Token: SeCreateGlobalPrivilege	1600	taskmgr.exe
Token: SeSecurityPrivilege	1600	taskmgr.exe
Token: SeTakeOwnershipPrivilege	1600	taskmgr.exe
Token: 33	1600	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1600	taskmgr.exe
Token: SeDebugPrivilege	5068	svchost.exe
Token: SeDebugPrivilege	3744	XWorm V3.1.exe
Token: 33	3732	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3732	AUDIODG.EXE
Token: SeDebugPrivilege	5972	svchost.exe
Token: SeDebugPrivilege	5916	XWorm V3.1.exe
Token: SeDebugPrivilege	2912	Command Reciever.exe
Token: SeDebugPrivilege	2716	tasklist.exe
Token: SeDebugPrivilege	6032	Update.exe
Token: SeDebugPrivilege	2196	Command Reciever.exe
Token: SeDebugPrivilege	1968	tasklist.exe
Token: SeDebugPrivilege	4780	Update.exe
Token: SeDebugPrivilege	6096	Command Reciever.exe
Token: SeDebugPrivilege	760	tasklist.exe
Token: SeDebugPrivilege	4640	Update.exe
Token: SeDebugPrivilege	2332	taskmgr.exe
Token: SeSystemProfilePrivilege	2332	taskmgr.exe
Token: SeCreateGlobalPrivilege	2332	taskmgr.exe
Token: SeSecurityPrivilege	2332	taskmgr.exe
Token: SeTakeOwnershipPrivilege	2332	taskmgr.exe
Token: SeSecurityPrivilege	2332	taskmgr.exe
Token: SeTakeOwnershipPrivilege	2332	taskmgr.exe
Token: 33	2332	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2332	taskmgr.exe
Token: SeDebugPrivilege	1964	XClient.exe
Token: SeDebugPrivilege	2340	XClient.exe
Token: SeDebugPrivilege	1976	taskmgr.exe
Token: SeSystemProfilePrivilege	1976	taskmgr.exe
Token: SeCreateGlobalPrivilege	1976	taskmgr.exe
Token: SeSecurityPrivilege	1976	taskmgr.exe
Token: SeTakeOwnershipPrivilege	1976	taskmgr.exe
Token: 33	1976	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1976	taskmgr.exe
Token: SeDebugPrivilege	1272	taskmgr.exe
Token: SeSystemProfilePrivilege	1272	taskmgr.exe
Token: SeCreateGlobalPrivilege	1272	taskmgr.exe
Token: SeCreateGlobalPrivilege	228	dwm.exe
Token: SeChangeNotifyPrivilege	228	dwm.exe
Token: 33	228	dwm.exe
Token: SeIncBasePriorityPrivilege	228	dwm.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exeVanillaRat.exeexplorer.exetaskmgr.exe

pid	process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
2252	VanillaRat.exe
1960	explorer.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe
1600	taskmgr.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

explorer.exeXHVNC.exeUpdate.exeXHVNC.exeXworm V5.6.exe

pid	process
1960	explorer.exe
1960	explorer.exe
2864	XHVNC.exe
2864	XHVNC.exe
6032	Update.exe
5528	XHVNC.exe
5528	XHVNC.exe
4152	Xworm V5.6.exe
4152	Xworm V5.6.exe
4152	Xworm V5.6.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5116 wrote to memory of 932	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 932	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4772	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4724	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 4724	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe
PID 5116 wrote to memory of 3968	5116	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/DannyTheSloth/VanillaRAT
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc0da46f8,0x7ffcc0da4708,0x7ffcc0da4718
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1888 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4180 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,17087249377011485153,11440107791801607366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:1516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:536

C:\Users\Admin\Downloads\Release\VanillaRat.exe
"C:\Users\Admin\Downloads\Release\VanillaRat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2252
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\Downloads\Release\Clients\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2080

C:\Users\Admin\Downloads\Release\VanillaStub.exe
"C:\Users\Admin\Downloads\Release\VanillaStub.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:876

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1960
- C:\Users\Admin\Downloads\Release\Clients\my.exe
  "C:\Users\Admin\Downloads\Release\Clients\my.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3232

C:\Users\Admin\Downloads\XWorm-V5.2-main\XWorm-V5.2-main\XWorm V5.2 SRC\XWorm V5.2 Resou‮nls..scr
"C:\Users\Admin\Downloads\XWorm-V5.2-main\XWorm-V5.2-main\XWorm V5.2 SRC\XWorm V5.2 Resou‮nls..scr" /S
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 1968
  2⤵
  - Program crash
  PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4048 -ip 4048
1⤵
PID:3284

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1600

C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\XWorm V3.1.exe
"C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\XWorm V3.1.exe"
1⤵
PID:1076
- C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe
  "C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3744
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5068

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:976

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x490
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\Fixer.bat" "
1⤵
PID:636
- C:\Windows\system32\lodctr.exe
  lodctr /r
  2⤵
  - Drops file in System32 directory
  PID:2620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\Fixer.bat"
1⤵
PID:392
- C:\Windows\system32\lodctr.exe
  lodctr /r
  2⤵
  - Drops file in System32 directory
  PID:4528

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\fixing.txt
1⤵
PID:5756

C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\XWorm V3.1.exe
"C:\Users\Admin\Downloads\XWorm-3.1-main\XWorm-3.1-main\XWorm V3.1.exe"
1⤵
PID:5844
- C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe
  "C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5916
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5972

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4744

C:\Users\Admin\Downloads\XWorm-RAT-main\XWorm-RAT-main\XWorm RAT V2.1\XWorm RAT V2.1.exe
"C:\Users\Admin\Downloads\XWorm-RAT-main\XWorm-RAT-main\XWorm RAT V2.1\XWorm RAT V2.1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2064
- C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe
  "C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp1E3F.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp1E3F.tmp.bat
    3⤵
    PID:2760
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5080
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2912"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2716
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:5032
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6028
  - - C:\Users\Admin\AppData\Roaming\GoogleChromeLogs\Update.exe
      "C:\Users\Admin\AppData\Roaming\GoogleChromeLogs\Update.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:6032
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OperaUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeLogs\Update.exe /f
        5⤵
        
        PID:5364
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v OperaUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeLogs\Update.exe /f
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1696

C:\Users\Admin\Downloads\XWorm-RAT-main\XWorm-RAT-main\XWorm RAT V2.1\XWorm RAT V2.1.exe
"C:\Users\Admin\Downloads\XWorm-RAT-main\XWorm-RAT-main\XWorm RAT V2.1\XWorm RAT V2.1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5288
- C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe
  "C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp3707.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp3707.tmp.bat
    3⤵
    PID:3692
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3564
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 2196"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1968
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2208
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3000
  - - C:\Users\Admin\AppData\Roaming\GoogleChromeLogs\Update.exe
      "C:\Users\Admin\AppData\Roaming\GoogleChromeLogs\Update.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:4780

C:\Users\Admin\Downloads\XWorm-RAT-main\XWorm-RAT-main\XWorm RAT V2.1\XHVNC.exe
"C:\Users\Admin\Downloads\XWorm-RAT-main\XWorm-RAT-main\XWorm RAT V2.1\XHVNC.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2864

C:\Users\Admin\Downloads\XWorm-RAT-main\XWorm-RAT-main\XWorm RAT V2.1\XHVNC.exe
"C:\Users\Admin\Downloads\XWorm-RAT-main\XWorm-RAT-main\XWorm RAT V2.1\XHVNC.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5528

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\XWorm-RAT-main\XWorm-RAT-main\XWorm RAT V2.1\Fixer.bat"
1⤵
PID:3388
- C:\Windows\system32\lodctr.exe
  lodctr /r
  2⤵
  - Drops file in System32 directory
  PID:3436

C:\Users\Admin\Downloads\XWorm-RAT-main\XWorm-RAT-main\XWorm RAT V2.1\XWorm RAT V2.1.exe
"C:\Users\Admin\Downloads\XWorm-RAT-main\XWorm-RAT-main\XWorm RAT V2.1\XWorm RAT V2.1.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2476
- C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe
  "C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:6096
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpB157.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpB157.tmp.bat
    3⤵
    PID:5716
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4364
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 6096"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:760
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:2616
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1436
  - - C:\Users\Admin\AppData\Roaming\GoogleChromeLogs\Update.exe
      "C:\Users\Admin\AppData\Roaming\GoogleChromeLogs\Update.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:4640

C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\XwormLoader.exe
"C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\XwormLoader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5212

C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\XwormLoader.exe
"C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\XwormLoader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5372

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\Xworm V5.6.exe
"C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\Xworm V5.6.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4152
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vwlnzb1s\vwlnzb1s.cmdline"
  2⤵
  PID:1516
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES75D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5E1843E8FC5041359BB540851360E260.TMP"
    3⤵
    PID:6116

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3760

C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\XClient.exe
"C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\XClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\XClient.exe
"C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\XClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:6020

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XWorm V3.1.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
21KB

MD5
be89131819117173abec1e1a375f1ac4

SHA1
94537cc74677b671d9cf475b57ea11518f4c84bd

SHA256
e85deb52f4f7aafd50e84d48f26c6fd65dd58c42adfc0c6f7cd043d93fba2e93

SHA512
e2f033b4df28a245d3fe023db83ee4c3f9c64904ddbaf3880a0b429548ff6d7074f2bcaa0396042d361780c7f93a51e1f8a0de4154dbdf721cc6078ad9f29e5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
37KB

MD5
695326042c5f3f6819562cd3123eeda8

SHA1
0305834bc65caf015c62d4b17238706312f7293c

SHA256
f0af287767a533c614c49efd4bfcbd02e61d1ece42a3060c8bcbbc99247cf357

SHA512
2975344a91b2f3d560004eef87d091964dc58aedbdd3a6b69e67f04ebe4d226ba28320d5e274283301fe3a623545a8305355b12b9a8d69fef54c78cce9f3ea3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
37KB

MD5
1b6703b594119e2ef0f09a829876ae73

SHA1
d324911ee56f7b031f0375192e4124b0b450395e

SHA256
0a8d23eceec4035c56dcfea9505de12a3b222bac422d3de5c15148952fec38a0

SHA512
62b38dd0c1cfb92daffd30d2961994aef66decf55a5c286f2274b725e72e990fa05cae0494dc6ad1565e4fbc88a6ddd9685bd6bc4da9100763ef268305f3afe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
16KB

MD5
907488c70e575c67194838c6b7fab4a4

SHA1
f300e084a6ad7474c874185cd4a0226904b0bff6

SHA256
c56a3aa2693571a5c455fbe1fc638ab3a92b07e2ecf6b4393add5c4eba00c67a

SHA512
6f429bedfa353e2db9eaac40aaf108f9dd03d749deee9a35e0441c8bf1d010912dc334cc9add7f36c5e1b54d82db715ccf0433f0404cd2177f2d793bd5d7f2df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
23KB

MD5
a2301faceacbaecb48b46c464377b0a5

SHA1
d028d28e5ee22ab895bea1e91552249d134b1732

SHA256
0b7165cf226585412603c4d6713b70aad3dae4b7c1de3b3deccbefecbbe6d2a5

SHA512
a9427004dc66046091e74c304f17a7a1ddbb4ae7b372705480907ae9229f19718ed42dda998a1f5d00f586c90b10f4052b14a4c0f4abba0614f94384b4fe498e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
24KB

MD5
e9085bbce2730ad18477a5e6b2a053e5

SHA1
81b04f132e7c01d796d1730cace6a922eed47c5f

SHA256
0d3da8c2f0f202ed280cfc0ce71a43264f3793e1f7d5a837822ebed5ee1af188

SHA512
80f905992a6be57b31da4e63f69674a2c9a3c3f0e8c182103afd12d60d689936c5ac76a32bc809b672c564b9b65f1608960be800e72ce058842c698d1bea9fe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
59KB

MD5
d5da1cc03ddee197a316010d5c41df05

SHA1
39a2021e9daacf3c6f1f8146dc788a7968a3442b

SHA256
a114702bef93ef5d0518d242f5ea247ff4072ceb7eea451e5681e4b4e7387ae9

SHA512
5cc05a34e9eec5e901402477e41a7263f0f02a8f31fdc06b08e0453e7ad50f55717f230a5c992bd1dbef8168c8b69daa2d2982a29449329a0cb207d14bc8fad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
17KB

MD5
4859fe9009aa573b872b59deb7b4b71a

SHA1
77c61cbe43af355b89e81ecc18567f32acf8e770

SHA256
902bb25ea8a4d552bc99dea857df6518eb54f14ffa694f2618300212a8ce0baa

SHA512
6f12570d2db894f08321fdb71b076f0a1abe2dba9dca6c2fbe5b1275de09d0a5e199992cc722d5fc28dad49082ee46ea32a5a4c9b62ad045d8c51f2b339348be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
53KB

MD5
cfff8fc00d16fc868cf319409948c243

SHA1
b7e2e2a6656c77a19d9819a7d782a981d9e16d44

SHA256
51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a

SHA512
9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
144KB

MD5
521af33c55174ecf75a05833f8109ff6

SHA1
897f21eaffb962d3c805576d06f07c820acd18b5

SHA256
a3c75bd51b37662153258f638dee394ec4f7be139bf3844e9166f937aedd6324

SHA512
88b44345081129b9c9a4b81a6a83fdadf93f4ce9fa236f8befbc172fecb649ade758466e2c44be30f987915477a9f4abfcdbd1baa67932821b861dfc6f83e682

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
20KB

MD5
babc647deb39b98406ff27d971b71f05

SHA1
fcb43685cd12fb447020eff89f1987c1bab9786a

SHA256
3a02d769507cd721b3c38da2c5e522ce87960c709d2acb60053a68e9bac62b66

SHA512
3a5f5efaad7594abcbdb1c4f7c816691b4015b3f17ccd6dadaac51da9fa80525d14cdc41afbdb3b5d1140756bee7f4692027343e84b5316ae117aa92026489df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
47KB

MD5
4b1647dd21eac6a5a8ef08d042e9681a

SHA1
7d6a36c4e891344ddaac735176e179b32114d4ca

SHA256
6e391709a16f41b0a2ac4f8bcf9125d9cd25ee9e7589e875e2f97042b442d6bd

SHA512
c24a7b95914ab257c9d14ccacebe3fa6ceba79b113e15e9d7703566fa70d28bbed6d54c8990b787126f268234f446c12f4b6f5f398542efd541f8b274a1bfe92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
70KB

MD5
4308671e9d218f479c8810d2c04ea6c6

SHA1
dd3686818bc62f93c6ab0190ed611031f97fdfcf

SHA256
5addbdd4fe74ff8afc4ca92f35eb60778af623e4f8b5911323ab58a9beed6a9a

SHA512
5936b6465140968acb7ad7f7486c50980081482766002c35d493f0bdd1cc648712eebf30225b6b7e29f6f3123458451d71e62d9328f7e0d9889028bff66e2ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
41KB

MD5
3fa3fda65e1e29312e0a0eb8a939d0e8

SHA1
8d98d28790074ad68d2715d0c323e985b9f3240e

SHA256
ee5d25df51e5903841b499f56845b2860e848f9551bb1e9499d71b2719312c1b

SHA512
4e63a0659d891b55952b427444c243cb2cb6339de91e60eb133ca783499261e333eaf3d04fb24886c718b1a15b79e52f50ef9e3920d6cfa0b9e6185693372cac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
1.2MB

MD5
17bf4b3c532587c9c50ebd420e6b590c

SHA1
1308ef925676ac60ae09a19a7fd0b337ff40bfe8

SHA256
697c3ab1a8d1e613eafed8873fa29f0d02d8f638e3428da2c9ac83e5d227ce3d

SHA512
e93f85f738a95a6f852860c4e42ac8fe90694a5474d22f7fecf66174987e5086c83ee19c555f300be50fa99a7665a1dc286d7f6add5ff78de868abc9744ed0bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
27KB

MD5
4aa91eccee3d15287b8f2a01e4254255

SHA1
d89f8203934a66b5741256aee086c04f966cc6d7

SHA256
79c601189597c9c5691b763f0ec6fdc9ec8339eea80e49713f76e9fe9199a7d7

SHA512
46424f50d444aebf1dc3a93607b3a374d3e7e988137e291cd8ec28211d05a687d0b6214b45d6dbfd27608728df6b34138504e3343e6bbfd6e1c0af98199179e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0273b70afca21ad1_0

Filesize
2KB

MD5
3829364bc966fcacfedf730216d5f52b

SHA1
ecd3f01d2a77041ec1a9a4e3e29259eaf226fb10

SHA256
ef421015ad1be5f77974f03137e8c2a0e2e67344c452657e75d5e265b927a4d4

SHA512
f2f486183bf91a8c96000e024803e86ad5d8bfc46a2712168bd3ec3b471dc974af4e8d5b8cbbec231a585149a866ef6e90e9b59af99ee3340e3f3857ce7509d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ee4296198224a06_0

Filesize
1KB

MD5
77476afe8f3830950528644deb97c64e

SHA1
89098f04f9733220ac0f95c978aebffd0ce784ef

SHA256
b621a38d2b0effc3bbb79466e6af9fbb655f5e1828a7c0aef67ab87558a75038

SHA512
1a0184174df2b529bb5757730556facb917873de4aea9a43f77c2e7ef3435c783032116005f4b0ca75cccd1db18ee455484aab943cb08428c651ed20a769feb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\44c6a2a38add6160_0

Filesize
1KB

MD5
6fa353aac1848d6e4e846c0e3ecb8a5b

SHA1
3a3645e55dd3ec5462cb596b43a583661b89cae1

SHA256
d6fbe65a8dd8703c626c60430fa81de19656989f860d903b2e93688b57e31aa2

SHA512
68b8ba496b1fe8abc23cf634176bb5e04261fd8064ee3869815df9b68d50b3e0409e6107edc448d8a3a4c9a661a86affab0f7f8d0fb85944dc96839ff6e9187d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\65029c17e720c1c5_0

Filesize
1022B

MD5
96959dd387149dad0544b7fcc53adc81

SHA1
94e3e9ca84c285013385a7ae1677ccd25f7a3462

SHA256
e7d6e5f0dbcce5c2ef6aecf6fa9924aebd0afa132a514df72eef4c2b2887c443

SHA512
bc7b10a751e96cb609de7454be17d9033245a02f5689b081835046c6c671d15b0c44ab433866500054ad2a8a7f12def2db42c0dade8a82389c488b5b44c28989

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8153d8e547308945_0

Filesize
2KB

MD5
db5a01e05ac78e27cf0df4a34ce8860c

SHA1
2f1ed9eb7d4d215916316932f9c0574259295467

SHA256
3e322c5121e172f2ed71ae825114962c5651ded7364479e5e0cd2ade00f63935

SHA512
68e14abafb6ba765d52fe69093de578a96899bc8ce81f49bf16f9618d35c2031f6092112f0fb577be1191ff18afef0e56ec685e654fd26fa15a7672e7db64e89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8c4847857ec206a1_0

Filesize
2KB

MD5
9755c6923c751f9888ae83ae42c7f7ea

SHA1
d928ca327bd72625b041e3e3880a038891e7e632

SHA256
844fbe6db558f89d93cbb7793206ed091bd1d82d62ef29668988dead5f955827

SHA512
c3c9adbd6441c6600f09e006ecee7ec7d3b07c18dab36e54bef8436c7eb743e347777831de867a35ac6a9925b3fd511f3a7d94d6891dbae486e53b591abfaf43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e2bac456fe5a76e_0

Filesize
360B

MD5
9bf5dc6326f0645d599344df62b5a800

SHA1
55938c3945942d3ae2da90b679b10194e436285a

SHA256
7ad3ec91ae210e0994bbe4d7a9e7bed75365e1ed32beb7dbadb71cf0bc865a3e

SHA512
b8d25b6d4ca2d798bdee9875843cb2d7092231f5afd741dc8ba3e3507695e5e7fd6e01f49a4abc65d0a78e3207e59dcd310d7ec85e9bd34479122c2b453fab43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a02df7c313f59d27_0

Filesize
2KB

MD5
f26a6b25cbf207793a89a792cd8bbe30

SHA1
d5e1d098b37442c80374d3ac9be19d2607dfb7e0

SHA256
bf62a19a78406c275e8da98c02ba1808a24664d97df6de2d2e42066d1902dedf

SHA512
40127d8eab849d3f0ae36b9891e62e58e8a8cbe4d631eed28e937e4b4074524cd938a5f17d490780df913bbb66581bbdf80a7f6f26087995f686b9078f569719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a44a69ca1c78479f_0

Filesize
1KB

MD5
6a254534e266127ab833ec3d324ea906

SHA1
11b7e718a24b937580556bfce7b97328bd10ea38

SHA256
38bbd16691ad52b832990b4b0cab1a116097fd36c3bd20c1e56ccf0698296a7d

SHA512
1910d224d5d5208ecc5d8c35cfe07da9067a571795c87a429ee9ee21bb143fa3b8c297d2042146a8755e6af23d651558453d436c163aa39e713817d871658238

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a8b14dbde4e97f40_0

Filesize
1KB

MD5
9b02cc8f6c2d1c19a1d3f9857b188e53

SHA1
d699a628071ded762337ad9495937947508371ba

SHA256
9420bf24e2b49e2b1a241b6f0f85d688715edcdff2d2751f82ee78f3d30067f1

SHA512
c2889bc3a96706da4e154b09b06dff7bdd27f7975d2bc0fdf24681426a7343b778e9b6b4efefbe58493586b1d782d8829986e4a62d570dfd5f16d42902a5e27a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b3dda3009dd3c510_0

Filesize
1KB

MD5
cbf5970c0bd18aad8782fb9edb82f37e

SHA1
e2551398a13e25e5f9dae986730dce4765f2bf18

SHA256
7837511124256667e7e03d5d9cc46b5c3d4e5a61c03d65e916db7613467ec626

SHA512
c4851b3e806ce0b17a858d31c760ee04c7b471efda9a4a7a80c3f0c4e6f9d302044f94267b25aa6ae04709e57560264b9ad6a0b0d4e42a1a88617ab1f9c35ed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c7d0238ae271605f_0

Filesize
2KB

MD5
792b27bd234e57b63645e4c64c9bc83a

SHA1
162bee42896eaa0241501530e386da404b8b41e1

SHA256
822368b07004183fb1b71e6a0d5acb704b006c6b52f501c701880d5caded6df4

SHA512
74ed3ecf831288caedcea0c32137673eb906fbc02b5965be26f45212a149e8f962e3921c6bbca8fb9f5242e45677c96dc099ff8aced441e15e1bb742270fdfd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d33d780294522727_0

Filesize
1KB

MD5
530e5ac698c6fb2186f7481ef1c31235

SHA1
65215bb5c216fc6a21c92304d8f2a3fe952acab9

SHA256
5500468da7f9b8e8bfa609e7cdb44585e3916bf46f3186db2530e9cc25011781

SHA512
220d381fe51a04bbe7f3b8fa301939f6af0f9a879522a247222e24b2bedb24a3587ce95a3792778eb33c67fc024f44166f0da3959936a77d97bb2426f4617df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e09489aa4bb59ed8_0

Filesize
1KB

MD5
7440ff2e4028ce8a14530f8821e29824

SHA1
a33cab25ecc73754fcffc4b04de54364899c5cbc

SHA256
8dc947b89ba984ce4e5bad2f8b9f1d9b245d58477a102e1ac342cbd400cd003c

SHA512
5b4e98b29026baf0f7bee96ab99af17c5e9a17dabf4fe9dc9db38e5bc902c6782488aece742c8c2d97ac685b46416aea7736b0abada39905f687b15da30e86a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e3dccc2ab399a5ed_0

Filesize
757KB

MD5
ea897a16c7f2b2a6ae88520548b83d03

SHA1
97dfda663a6b5f40fd6a34a711a4b1b8d3636cde

SHA256
e5b2c6b7964dd726a6ad72da14d0ecc5ee64074219b26021851b7c37dd9cd76d

SHA512
86dcb38ec614fe0a379fb2cd0de41c351065e2b4bc2c7b80983fe755a843275d05dfce54c58ed040df4951cc48662f534b323bb97e011c3fed56afa252a675ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
30c742108f9d764f1bd848792b3231d4

SHA1
e61f10daba7e5c684c32bebbab36ff236c7d9c5a

SHA256
d2549dc7d3188a78f4f75f5e6251ddb98adaeb2d68c2827c018cedd7762d78ef

SHA512
6f667c023f73b6f65386331b46c87631d7a64b8e836e3aab0122d984b6c431312793ed2190ac1b220cab5adeccf3d2cc8b49a43ed338897487dcf436a71f1e8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
4249e0386bf325a3f3ddd181a334b37c

SHA1
71a594b3d3ebc3c83a4471fb2cc204803d5375ee

SHA256
8df60c33f9e1c669e3ed44eab20cf7036b96058ae2512cd8ba2b6a9a126a8714

SHA512
635ac2c5ca146d88205674ab058a0c9460471341a9a233ad06d7c94ef5764a09e468ab6e66798c5827e94249a2293ee4eaee5e62f34907422424cb33045681ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
4080f3306f41de29e14ad3195047cb8e

SHA1
c5a3dc34a93756985e97c06e2b0d022d87a716e7

SHA256
0a31e7ee39ffd558a449121ecce0336b740b4e9233b9913087c781fd0112b948

SHA512
79486824d0d9d218d296ec858936cd8519abeb3a22555b6f6dd87da3d3480708a7ffd6e5974bdd02e5252ddfdb459620d0791a2060cacdfa553c43e9c95dc362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
4305ee1ed23cfcbd74641d2d9f22f25a

SHA1
983350bf1edd4a2b017babb92abf3e4cc95c891a

SHA256
635a68b5c0307adaeaa070ecaf6f883dbbbe766d217b6375fbda481e9b524f6e

SHA512
6c9071c79f9a35ee23ab5c8c179bf3d19bac959e65d5078729281fee10960ab2904426c2f0288e9723c7c3d8a76a7a4fdc933c996bc66d38af86582a3a8a4ac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e763a5aab3bdbae6c1e84baa1f4034d3

SHA1
58ffd84a9fe047df146e7d7b7803b1e2b4e22325

SHA256
85c2b6906f1a2cf09f185cee50b794ddc47c93c363c8ee09df479b507c9ee3e4

SHA512
d3ea13100e42910844032fca618a3c1e2808957bf1c14fb8c834e629a216fca3ddf87cdc96d50b86a2c566efd251b085bf991a5f4ab177d17747ac125ec0ea47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
c1a85084369654bdc716833e5533dea4

SHA1
9ec62e5fd502980cadcf90a34338c2886e70b486

SHA256
6bab6f0fb96de12f94bc08c3cfdc9445e7abec5de2735ea503b74043356491f9

SHA512
ee624f2236c6e866d78470c395fb8d48ccfdc3c4a7e43c4b8745a10f95f7b46483209bd790c008dbc1e74afda489c0425d472d6bae76c2669c9764d1a7c9dc38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
65f4fced01fb1336e4466b8e0262e59a

SHA1
e83d26532978e01b9a233ea21798acc3400bbba2

SHA256
0008732af47508d0bf803f3779e50bcdc9eb4adb8a0d092c3a169c2432f21128

SHA512
28318ce913065a8bb3fa5d399d18a7c433700bcabdcefd8da23835055e526cf15f510bf8af41bb54b188d788d8f495929a599bd1ff9432fd05dff5d93ece43fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
420b9932f74dd4e873b7a041dbdfe6a9

SHA1
db38c625323828e6ea5b008b2bd1d38af2fb10c1

SHA256
1d38eeb652ce15d127556cc0a743f6e596365cfbbfb66407691fcfb83d27742e

SHA512
311235fb77a827dc694f50d16b67067c337162fdeb9b8e7b1d2001bc52a04da18ae6dc67b8c2bb86c440ecfb62d78390d88d2b7451c5823441a8f6e284c91431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
ffd4c3b311fb4196cb6c92a7ca4bf3ba

SHA1
3d4d2ae32f899bca73d1e9d2884efeefb8e23df1

SHA256
e1ccd4a369f3d22ced901ae32258365bf38eb3b8d0c373c66eabf8647973d55e

SHA512
ed73f512bff1cbb52e66a606a7dc73bacebdf16beb7befddfb75c93c77342a49fbeac040fcf03263aaf78244d503b77ce9052b5eb449bfb3b5722d7539013cbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
acde1a4d19305f378fa1839b624d0dad

SHA1
e5a1847d47be51cb8d0533280bb6838ff72999cb

SHA256
15ccca802f88aa6b7fb81f15e7faf1642a159b518acb555cec81dc96670527db

SHA512
01018b62c6e390538d25943ae1fd4641e0d4a1ffcbd793b5ea26266812df3790a4f96962dc74e569bfcafef2ad2395e04e64ca2202b9f5610f2211026c3e2bcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e5ff0991f4e3035764c05b3e8d326b68

SHA1
0c230b8082f795b786390c19bd183ba4a1e8cf19

SHA256
c714ccba3eb1e30cbfa3f8f96c1914590200fc2cd959ed0a770ba7e0983911a7

SHA512
153c988a5d6e0487d0e057ce2a60f9bc2212253613c93c495f96009d8b1a1b241e684fbbd1042847c6438fb95220d0761f5efb200a9e243e43ca2a9f1c884539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
345d10f0ff9a11cfacde3e4012dee589

SHA1
3dab7de6eeed8f250a675ccc9fede4ccd0b4bb4c

SHA256
ece4a74c22bf877d832ff7419bbeed4ed44637387ee400577ba70dd0fff88942

SHA512
b879a2dcfabb05d97ad5bb032bb118f2ed3bd61046b305c61328a6e31e685eef7d2bca986697166e9f2d5f5fcf06c3becc5f33d50aa07b23875934adc0fc66db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0f1e5ea5afa6d6598038fd5aea2961a8

SHA1
b38ff5ed26e201b7c15b2cb5aeee350410f3e752

SHA256
46fcc6f923461e1aa32d16440e28b98bb68a459f84ab7df11f9ca5cddf5145f3

SHA512
000eeb0301e33d00d9e5c550546e5562b2070b22898ec58edb833994a48e35c45a131261700568f831d654eb4fdc848bdc51cc435f3a8d1adbf50d47dcd5d4a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4d51a67f1b0bfd49dbb63eb63af4a42e

SHA1
c52f4d33c4cec20b420f8e2326c0f543797c9fa3

SHA256
5ed4fda4d8b6040445e2679aa1c1d997214ccaadfdc14fbe62b15ba585003fb0

SHA512
a0a70ea24842e2d6fc23bf4eb9ac1f9f3191e79e3495d781b2239b2a658232190f64dbf19bb288099e1f11f0df8ac31180e5ba134c530883a0a50030f695dd5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ab94ec51b95743f8abb7eb4156c98525

SHA1
822231024cfb589a25712e00ea66dde2cbf84277

SHA256
568232b5ad76b4b1cc14088f1a570262c57ce86e6cc326f94b4891bf5b35c35c

SHA512
6fcf62e13fb641d3dac03b6766931f5a9fa0a2fe65f9479a0f735d5f7d098d50c6142645ca65400d0c7598cb5cecb73309368874f9312b6d356ab3daf86fd711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
440621cbfab55aacfbe7ff85974866a2

SHA1
467eb898055e81cd3b46c0609bbdb321fb362b5b

SHA256
95d14d75bc183e82ff0f312081417d78717c68ff2f6d94f3880e6d197e99a1c4

SHA512
fa802da76726acef9b0ff63e539d493c79ec327410f610bcf0035c41deaa0b56499e4069a5279b251c7b56cd3c70d735377632645dc7c803e9c505f52f1fff6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85d7847490027e6914358af6d4b91479

SHA1
fe484f1b6a3178ab2650d4622341648e4e4b9b4a

SHA256
2ae5f38d6db25388f15df14cf8bb6c58dfbf554d31a48cb12f86da1313367e9a

SHA512
b6a1f72c723bbdb5a0a0ba5208a3a81a8075781ee95295b0e18e73fc6fa4ef81ac620c2c8e0eb3b52021b64241c7cfdb897d2cb636e9d5abc77d40b164c54f60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0e1db130128d3bfc235d89fee08e1885

SHA1
85e7cb560efa36fdcd25094af466181c4fb3aa3d

SHA256
437b89905493aa071f58b15e5e9c7b273eddf1cbefed0edc1122eec848e4dd65

SHA512
ca2e382bd5bc9393294531d6d7aa79e19e2808a01f9edf67a47d95ed35d94303aee9aa6684eef1dbd687ea11570d9b41b840e3e4e25c68647d6a50e1a5d3a958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
6eb5a02b5dd3b70b380e7be64bf80fc8

SHA1
a125a52f04af0e0ddab75174595e39fa01a1b175

SHA256
665ef35e4e0f815a46b7ee0d0c01525cdafcfac2d42da9c3f2d7fb2dc150e993

SHA512
96bdcd3e154939352bb739bd1e4d69160e47ac6cfd762b1f0f3bd7be7c5b218373088c03c0efa4ca018f88fe99afa0181c4b9a4a9736718ca365b1a52b88e532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f18193e66174bfe576cb14c78b81556c

SHA1
3825b537121cceed71dad8b8d8150dfce3ef54b0

SHA256
9a9dcbf00736c85fe37f63cbfb059ee28d391765b735c5ad68f9064f84f0ee2e

SHA512
66cd3109e59b618603034d583e1194dd1a5df4b7ce74854ac7e14feeebfaf9b2dbf2eb02386814d2d8cf27bebd06a88eab05fd5ef837bff43dbb3a8b799d483f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8ec2dcae47b4841a45a4343c0684118a

SHA1
db7495700e68f198e7a2c2eeee23a508b7f835eb

SHA256
921e4c49005bc0f634893a2a4f1bb16639cd2f0517acfaaddb64cbc5994eb383

SHA512
2fa8ca82d9b1cb1c8915d2e70b46b02714e26efc1545c0c6a919236871e45ede0ded14f685b12c9a245eb8d20fb48e425c504a6824f2123e1129bad2ef0581a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
e4f9065c0c607390f0272f0713068da0

SHA1
3edc97a9af31d1fca382616a2cc0ea00aaf526fe

SHA256
f4427b67396522482336970d448eca6fa77d767ec3f7c418a4b75dbf61dcf0d3

SHA512
48b6190bdb0c3ae12aab6e42f5a890f1a523cd49ff21517cd4306f0fe25696b3a12d331ca149de015251cceb6ba031fd43989c5bb2bc78c5cc034809fc45e2f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
3ff2abee94afcd83399f951a7b0e9f1d

SHA1
aa4e9ef18747cfd414f76ca7c4e33ab392b9480a

SHA256
3462869ca009d3012fea78553699667d6a1dd323f08bf0720788092d356e7848

SHA512
4f9941c931450bd9d37340918f032e254b3a7eb8257efe6503f422fb65eb54c5a23c24e257a726694c1765758248f8351c4c34cb1b0385a1e901490ee2984435

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
eb11c610a84d858ad2cfeca986e3b5dd

SHA1
7ba7c9871c1d23c5d9bc095b7b0851c63e72b0aa

SHA256
18874c222e8d48ca3b771d144237f554157b66fd1b448cee3831c407b37fc7da

SHA512
60611c63b4c3e66b4cd808c5e5b6f13cc8f28114a7eb9287a8287406b2fc3c417642ab909054486b9feec4b61a000a5eab5023d70a0dc2a454ab9f7743715a6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
cdce3baa74ba6919205d34a51c2caad7

SHA1
6fd5f3370091067919bba47955efd1a347ef2ece

SHA256
e1fecafd2299a145b9416c57daa3ce30bb527629ce395f61aacccc0066fb8208

SHA512
b087f87ea0eb878ac87c47130ce8eaff4e853ae4e6597e0e04c1b690ce166387ad539be97220f8e055429e7f0f115fe371607e1ed66568ebe50778f00b907bed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6ad132e62a18a5fa2850cbc0337ba2b3

SHA1
bba521dbd58574db1e71c413a30a66f2ed5cdbf1

SHA256
2348264664fd9c2940263380dbbb383dec593778e1455cb5f207f3c24c0c41ab

SHA512
16f9ffb5e7eb1926c8fd43512637bbdccb6af4352c941733b45b8d5e2542a6ad6e14639d53b7a32bdcd60b84c808bb0f64a97b2aef95dadb50e63e3a47dd2654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ae3c5cb2a59abcec142c3179a67a9a9a

SHA1
8097d79c46f9f72270d2ad67923f0677264daa08

SHA256
c9b5a967e9b524001fb7a78c37d8d11ac233275ec471498d45f7e10a044b196a

SHA512
17b537785a6dc0375f6f6ebc05ed32180fb7563660334bb9fe2fd3e6b9c251bab115f489c17e3e6dc3c630a20f5e2c555fe1cbe9074a7e4d7005f926dab72b17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0dcf99b7758cae6c4feb3f9642f78dfc

SHA1
d9631e1266599f6ae64219e450cdb745cff925ee

SHA256
2c72841cd4f06f4bfb5d37b7ccbfe912cdd175f76c1d4e8d9c9e80071d5ccd1e

SHA512
301c49974350bd112e9a29a0808c438e3ddb1f231dd8b67b223b8c713426a999c4f0d459b245586a4592b9486311be0b6056e55fa8b0b118c8b532ce5052ed35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7a309ce42f5cb0d2dcb66125951adc75

SHA1
24981e0912e337bea7ce8b84e457cd41378b65f8

SHA256
eb056346e4b7998088ce28201f07b954fb76f69b1fccc960258351dd5b14c32f

SHA512
92bbf2b75022142c7726dc980ce2c5d630d043e86e4fd033db76cd4a3e50509d57669f7b45746d7820a2296da99f0994526f17082c5ac4eddc35bdfd3d69008c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ba7350d62c0123ff0e5624843246e2d6

SHA1
8d76ed4bb231503cb4b95e596876dbd978dca536

SHA256
38f8e32cf1a21569bbda959baab3d97909df8efcef4eb3a9714d5d19301d9dd9

SHA512
dfc6b1eb0a7ca4141aa1210fae110c2c3c073b71a0b9efcb7bbde2bb03e0a4455028d3995c6fd347dfcba42430e0ecf50d676ef249b503cb2ce85404e6358dc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b9a5e73049ac1998d2a0221310b4158c

SHA1
b30295fd10c3e149b083a16314a0cbf9790f3c89

SHA256
60722c1aa0b3bcf064b07a3ae22bdb491d567a537f112df4dfffdc159bf2e5dc

SHA512
d89d564a9837b24be7c8a070b99fd4a690663416b5ee9b356b7b4b37240e0adfacc4505ca029ef5c2097b566ef811596ed0d05188dcb4f6502c6b67f62c34211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5973f62ab9c8f2bceb0e6d81783258d0

SHA1
d450610b3405582383e6165caa7ff5b5c88c293a

SHA256
79245358aee7eb72d50fa1fbe9f9ae9ef363811af45e12ca4f20124ef44cc01e

SHA512
a57ab5425d31d405ad1402acc82c16eb6fc25d24b6e0a9bb1ca9f449ce25454ffab2b107bec19d36dd19e391013fd1eace67a88f93126ad429329da357599b41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
099a7b44da12eee706d938842ceac02c

SHA1
2966bf03e52cf45036c2cd6176480c5637660514

SHA256
b2715c68ca32170a521bb92d18a284e1684f826d29c7499dc4320a4ad7e1550a

SHA512
a8d3af8bcd4240ea3cb569f874c0e624c41db09d08a61fcfa9cb6e26f749431905b9baa73e535e2ed07e7ef178fafc749b20a66a45c10f0658ede124f345eacd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4994b21b381872638e2ded9f9e7a151a

SHA1
5378bbd2c6d873f4abcedd44b7681423cc4850ea

SHA256
c4d387fe14c94a23f92ea676f1956eb24fbea7bd1e547be972be6ce0575887e1

SHA512
7ce4708ae3d3bb95b3864c5798ed44a61764faf4c6f68c319ad7f2be7a16f460852430d4debcdf71396fcd99f643ff023fecce1183f02b884102b84ccfcf80f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
582dfdd56a5e1255f280bb2d5fac37b5

SHA1
28ceb447a80051933f2b9c8de6f557bd70b801f0

SHA256
37d7805ea58e89987f46496838f0c3df4756c9e2bf13e6ff357ec01105383a8b

SHA512
448549a89c235589eb575a9a591c454c7f030663ac5a3a2d60dd2a511b8560a76a73d885abc3c77f71f0b384d6a246d07fd6f5ba2556e31eca906d3e6ba26727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6466af5274162fbc993d5c14358623f3

SHA1
5315e7cdee346044b4b9b87e6bc14ee97b8431dd

SHA256
04ad37ed61a3edc71d216df5b5ff9bcb866032536e84b31fb37795850d9611b3

SHA512
743d2a7037e69b4425a6c58f5a7652e6c6070849d8ea94d0bf33aa0d15d40171c5bbe1df89fdc3aa8adea40e84e7df5b9b0574fbe08d52f0a87e456aae5b4f43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
730a89dab788d51d17d747f4736dbdb5

SHA1
7fbd505fc6af83ec9c77f418a6d21d51d91feac7

SHA256
603414a7ed99b3d1f03f392f9f0188152f56bee7190642265604bf1c64a90e60

SHA512
3d1b325214357c2df39ee8f1c580de1ad0bd1d40f3ced364cd472501fd449d70295ca33350cd1a3408a0f8a7ff7e8645c0f4cec58f1aa10f0d82aeb13511f8ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c043.TMP

Filesize
1KB

MD5
d5891d3a9532f9581a070be92f31a738

SHA1
582942f90bb6996d98ab22e8ccb2f69e8feeba6f

SHA256
6cd1dd9219cd9a11206de2a1fc8f746d23b3ed735af25c12682371fb911f42b8

SHA512
b8491a91fff7f7fdcf40baefad0933912538950a87a8eb7e1135cf6766b941d18c4c103f3b5cd288024df50830b4e6c7fac1d6edf229f1ec70083b339dafbaa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f68d723c9489ac1e227566438b05ed0e

SHA1
61daeae4b6298d7a3c4a4980598d7d038df9f62a

SHA256
6e4f7367cafdda72f14adedc08549e35f712ef847ecd41071f96c5f0c4290c0d

SHA512
55983fc3bc9d011eb78bd2f68a03ab0224a0b658146a3437911613b2e662d4018da59bf1a7a608b0e3f375498018cac46264b1718447b546a58fdee93bbd2abf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8d8b3c750c9e9691c7408e9a1b24d6b5

SHA1
1065a38ec13435d01f028f349796616b0b3a55b8

SHA256
cee886780dad335d9d87c835935c75a2b7f030f44399240d5f70c60ecd67c1a1

SHA512
a891c3a56e37308e9379e327d852078d06436f7e4b592516d2ca00d6a3ca46902698c7b82d78f6785e8b81788414d7f276513dc6179b0209840eb04b0f1e0017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ccb97a6f5e9f5d32e7840d3954487344

SHA1
914134abe9a602570bbe156efc056e4dcfed3cbd

SHA256
b8b39ce2f2d1af7001093cf7175aabe88146014b81ae1302dbfbe66f7d5edaa9

SHA512
1731e08edec5fbe096fbe805bd5eadf3f17df82a87a2c889b41c7cf7009941f4ae0eb7c22f78c2a0e597d4efc0020f7d12fdbdaa3ae5fe81f8b109f645225dc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7e920728399640e5f4a9eb4ebad51f5b

SHA1
0761cfb91ac7d7023fd0087d427cade3994e3455

SHA256
66d19e4d5368f1e13a8be0399a742692d2289f99c3188d6ff5a1118f0b8e38bb

SHA512
79a3a61a0a08906356b9efa7d87a2baaa2707ce4a2f99a537e235d19517dea9a5fe817b216ccdf8de4a0a08ba2045f600b93d63964ab10e93647554100e1a295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8c53ea16bc9cc7867fe8b7dc7786c17f

SHA1
b0448037be75b4b48a0ac46446b3a2d2c5c554c3

SHA256
523e5c691fb7b3cfaeec018af3d3f08fd847f4c0754dad11880f41200b3f854c

SHA512
35b4ccc46ca618b4154e9ed685667bd41976a1213402835094ff7813ae45f76cbf1f845f4955ae4efec1b7bb9ef9e93dcbbbc1162f3b8914e2db1cfa86d88923

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
97e07ee5a7d65533104bd36de0c2cc0b

SHA1
6ed653f5eda48a664705d240d50bd5a9710fe4bf

SHA256
efbdaf1fa41826a0bae5960dc0427914ba631ab3f18e6a3ffd44746a40da44a8

SHA512
0d1cd9ec6e9991a3ac5596bd3d49bb01416a0824dd18cd883de401e27b36ec3e99c9eb24ee3580e656a257d2a65520dc13e52b349c176428b2813fecc6ce6a18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
57cbddae53fc050592a7dc191dcecb56

SHA1
1d7d4da0e01b35fc72ef0d44e7eb971a936b5013

SHA256
fa53038b6950fdea68d9279b5d7e2bca9e09552d3525ba88e91210cadc8e0679

SHA512
f63494d4f7531eeadce78e11060bbdefec7fbf77f2a191309ba9be3dfba0edfd9c9c02b89eb5d1f46c351d141ed88e33f4ad0d03c145d8467b101962b2a1421f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9993c8afe8fc2b78231483312c79cb74

SHA1
64f95a98c80d5a4c402276d1bf5a399ed40cdacb

SHA256
e57ca72f8f7d97bf35558b06387f6df647d9e1304bdecf3d3305ac5d07a271f9

SHA512
c506031a7dcc8ff97163a940f66dbb6da2c5a2f428e6fbd9fb6bce08ed2f2de9efb350c2a0880762c87ca53e0b1673acb480f107b6d543d31ccd4dde9022e8c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8113a5346366b21aae63c80bab128bcb

SHA1
e78230a787be0894afe4de959484868dde86e8cb

SHA256
3c2ac74f0a49b081e3d88b09e33ad6f1698482d76e4f8b294aef82e19acca952

SHA512
3d7377bc549e7340aa4b7137702085d5666fb44f75aa60eded925fbdc57d05f7272e02c45fd74bfc4b06664b6060c35921ad496ebd929b844586f6874e8eeee7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9c0252fa0f34d5c703b3cbd4e25e0fac

SHA1
11f4aa5618b4a3bb9ab8deee6d4f42a9e21bf7c7

SHA256
caabf2e71b42940cefb9cd98af33fc64e46337f6efdb1c9313ed8c9be25bed51

SHA512
2594a698dde87818273b3be20f93e3b0c5c2348f591a6bb0dbfdcc09d6bc374688544a4a025786bb8747ac58ee33dba9bc8d483aff13d092e66790f76c8c3c9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8129d95228fb7ca4762e9dd44a006924

SHA1
03345a66f5f5fb9bd908d9d449abece08e183e28

SHA256
16326f27078e6981fb2fe3c7284b9fe65a75d44381c56f938188f79d18a80d17

SHA512
ba19bffbdbe47de1d59cfd68018a63bc8808b21c2b8201986f80ce3f2f5581fa7449c9d04afc1a1546aad786f38cd9a8df6de821214cf2284c5812a2b9f26321

Download Submit
C:\Users\Admin\AppData\Local\Temp\1a5fdae6-8f46-4b8b-a738-d6572f690d43\AgileDotNetRT.dll

Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe

Filesize
5.6MB

MD5
dde005fec1d43ca1e694fe0c5592a0ca

SHA1
7d688514e8df9a3c301b9c1fcacff24df64a8cb1

SHA256
4cb110c774f237af6ca4154041aa948489200ce4c3e36b68d0a144988d5a51a7

SHA512
80a08ab5c23164375c0269f50c2c22d88d1d5181c8889e8e8bca106f69d1feaa61b909e5f244d54a318bc69f649c3fe63d35c6f5ea8df384c0b26b966c2c6fb2

Download Submit
C:\Users\Admin\AppData\Roaming\Intro.wav

Filesize
1.7MB

MD5
dc28d546b643c5a33c292ae32d7cf43b

SHA1
b1f891265914eea6926df765bce0f73f8d9d6741

SHA256
20dcc4f50eb47cafda7926735df9ef8241598b83e233066ea495d4b8aa818851

SHA512
9d8c1bb61b6f564044aad931e685387df9bc00a92ab5efe7191b94a3d45c7d98a6f71d8ae5668252d6a7b5b44ab6704464d688772aedac8bdb2773d5765d4d56

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
c6635058fd999512584973884893973f

SHA1
3f299ee6b1485cfa3f10c87d6227dac134fa83e8

SHA256
b01a4a735495a081055629c82a3b76cc2c7a29aece0280763cdeea9e6f2a860f

SHA512
dd21fbab7820868d30011ad4b326b17db8bc59cce447ae9ff8df0dd5b216a84fbcc21cb01a8d39254031b0a7d5b4fd3b8a63adbb4e1dcf48bb12bdb1945f4bcf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
870517980c90001a972855aacde14221

SHA1
19a73f0fb7ecf52df989b74d3ff0a8183bbc5a53

SHA256
3220a5f44b45ef374f40baef37c67a69074c9b68cdcec9eb06f5295b40d0b4e5

SHA512
b5c596f6f709ffb4ce84e52b09458cef53390b180b39fc8df3bb913b01940e0dd6503f08201a701c39361711f515ce13133a90edadfa1cf8f7771b506cfaeee3

Download Submit
C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe

Filesize
6.9MB

MD5
37a9fdc56e605d2342da88a6e6182b4b

SHA1
20bc3df33bbbb676d2a3c572cff4c1d58c79055d

SHA256
422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58

SHA512
f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
69KB

MD5
f23f6537464f47132cee7632b95daf28

SHA1
1981d5d8ee8e600c613b3c11fdff435172ca725e

SHA256
32824c331cc98500763e67b45e616d9b0f5a63f21b87439d18feaac7b35785cb

SHA512
d58575008b8358c6546f7605d5da27c2fd3578240d679a608c5d15950ce809c0af00dff0b989514a2f3a08e30c697684dcec7695ddbba659e2fa0811280a5a80

Download Submit
C:\Users\Admin\Downloads\Release.zip

Filesize
982KB

MD5
a4859bf05e31b3b29dd1da902c2ce6fe

SHA1
22b5baa098f85b9dcd944162888dd05a338d130b

SHA256
b10ec240860d0609b586f9ef4c2488651110e760872c5e5883c9d310c536e80f

SHA512
490b873e3b9e4e766f9202d2e73ffb08e50e207e0efa9ba5c02625e34abfe8001fa866d46bd4a1e1bcc93e0fd62cd45106701aa6053a97553ecfd27543b65b22

Download Submit
C:\Users\Admin\Downloads\Release\Clients\my.exe

Filesize
114KB

MD5
bef5e660f045fb9e9d5eb89ab2dba72e

SHA1
a60207c1fb3cbf8cccffcbe6e73daf1519cebd4b

SHA256
acd9ec4a14816197109c62f8443e44cdf36fc961167bb6e391f56ce19bdb5bbe

SHA512
53a9be9035cae0d02e49aa604bc47f0357e4e73bf94b2b7aab4a9987ae886cd09572bce3856c73ed75cda648ccd78db2723bd9dc77ba0657e63eebc6f7c83990

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 847677.crdownload

Filesize
25.1MB

MD5
95c1c4a3673071e05814af8b2a138be4

SHA1
4c08b79195e0ff13b63cfb0e815a09dc426ac340

SHA256
7c270da2506ba3354531e0934096315422ee719ad9ea16cb1ee86a7004a9ce27

SHA512
339a47ecfc6d403beb55d51128164a520c4bea63733be3cfd47aec47953fbf2792aa4e150f4122994a7620122b0e0fc20c1eeb2f9697cf5578df08426820fecd

Download Submit
C:\Users\Admin\Downloads\XWorm-RAT-main.zip

Filesize
31.7MB

MD5
aa5377015afbf16df9f2212c9d6b469c

SHA1
d2805be98d63b0c0a8dabea8fffcdb5b1642a5a7

SHA256
2f5f51b5f59a9d353ecd44b1b4552fdb8927c21d88982bfdc37b24c6e0d7c9ae

SHA512
8f2ceae0b974777570972d7946b571162865a0e3bf629510f52e8f178ae832f7e13a5546e858783aadfe6ba81431e028f24d3ba22c4cfba4748f819e1c156dfe

Download Submit
C:\Users\Admin\Downloads\XWorm-V5.2-main.zip

Filesize
752KB

MD5
06290bca26649b34c201fa1a6fabd232

SHA1
5ee6f669a49d57fb3669e4c404187f97afdb0d35

SHA256
338091b8fa272908857fee2d1ea3622a3147df78c1fd72f36328ccf16b51c87d

SHA512
b90c2f0e922b891400e30605362ff2cf588c0d072ce9263cc3d55ccf141d678803b39688ca18c2b36e85cb9c8dbb16745a471aa94610c98ef37d0dd8e1a4911d

Download Submit
C:\Windows\System32\perfc007.dat

Filesize
44KB

MD5
bc3d1639f16cb93350a76b95cd59108b

SHA1
47f1067b694967d71af236d5e33d31cb99741f4c

SHA256
004818827ecc581f75674919f4605d28eed27e3f2229ae051d6849129eef40e9

SHA512
fe44f3dbd009d932491af26c3615e616bc0042741dc3815ffb4d2b8d201efd8ab89f7cdd747406609393f005a596a6e9ea8e3f231bc150dc406c2adb8f806249

Download Submit
C:\Windows\System32\perfc00A.dat

Filesize
47KB

MD5
69c02ba10f3f430568e00bcb54ddf5a9

SHA1
8b95d298633e37c42ea5f96ac08d950973d6ee9d

SHA256
62e5660f9018da67d3c6727c39e9690650beb62749df0b4c00e6085f36c8e94e

SHA512
16e4d29324c2b50e1347532cd0982a149a7c67c4f27a743bbad8609ac662c3e00fa1be645b1b5f23adca3abd60c812f3f87d669f5ffb42b90ca5026dcbf2824e

Download Submit
C:\Windows\System32\perfc00C.dat

Filesize
43KB

MD5
8b4b53cf469919a32481ce37bcce203a

SHA1
58ee96630adf29e79771bfc39a400a486b4efbb0

SHA256
a7b3a2b6c67e98cf2b13684c8774113c4ed4f60cd6fc673d4c9dcb360c60ce42

SHA512
62217e68c9e4c7b077e127040318c603e2f2cbcc5517ce0cfc6189e43023f8d8a05b8e694b2a35d4b409241136a1067749b7b6e2049d6910246d8c0fa6e9e575

Download Submit
C:\Windows\System32\perfc010.dat

Filesize
42KB

MD5
bea0a3b9b4dc8d06303d3d2f65f78b82

SHA1
361df606ee1c66a0b394716ba7253d9785a87024

SHA256
e88439ae381e57e207ce09bbf369859c34b239b08124339534dcc935a89ac927

SHA512
341132d443cd41acf0a7eaee0d6883c40d8a4db8c59e056211e898c817c2847377f0208ed3a40e0fd6f73f0196ffcc680c55754e160edafd97036739861a6c88

Download Submit
C:\Windows\System32\perfc011.dat

Filesize
32KB

MD5
50681b748a019d0096b5df4ebe1eab74

SHA1
0fa741b445f16f05a1984813c7b07cc66097e180

SHA256
33295c7ee1b56a41e809432bc25dd745ba55b2dc91bfa97aa1f55156880cd71a

SHA512
568439b3547dcbcce28499d45663fdd0e2222f6c5c90053769ce2585f65721f679c071393328bde72c9a3f03da4c17abb84b8303897688b59598887ceb31438e

Download Submit
C:\Windows\System32\perfh007.dat

Filesize
307KB

MD5
312d855b1d95ae830e067657cffdd28c

SHA1
8133c02adeae24916fa9c53e52b3bfe66ac3d5a3

SHA256
ca3f8056e3e2378509ab24f8b8471e5fccac403a5413be518ac35bbb42a2e2cf

SHA512
f25c1a81a582a2a5e3142bd97f425c6ee5c26f878b1155232002fff1e4a3528bc371fb962da256c281e05c6c537160a4f48e00ea1fcf3e9887097f8ca6ec2b14

Download Submit
C:\Windows\System32\perfh009.dat

Filesize
297KB

MD5
50362589add3f92e63c918a06d664416

SHA1
e1f96e10fb0f9d3bec9ea89f07f97811ccc78182

SHA256
9a60acb9d0cb67b40154feb3ff45119f122301ee059798c87a02cc0c23e2ffce

SHA512
e21404bc7a5708ab1f4bd1df5baff4302bc31ac894d0940a38b8967b40aac46c2b3e51566d6410e66c4e867e1d8a88489adccf8bdcaec682e9ddabc0dac64468

Download Submit
C:\Windows\System32\perfh00A.dat

Filesize
347KB

MD5
49032045f6bcb9f676c7437df76c7ffa

SHA1
f1bf3ba149cd1e581fe12fb06e93d512fe3a241b

SHA256
089f30c1e60f038627531d486659fab66a8b927d65e4eca18f104d6ae4c7f641

SHA512
55b459b7787e6efacdcc17adb830dc3172a316ff8dd3b14a51bf4496a9479f513ae279a839674b472c1424170ee4aa63a5d45fc7fbd38a533a885282858c74f1

Download Submit
C:\Windows\System32\perfh00C.dat

Filesize
350KB

MD5
518020fbecea70e8fecaa0afe298a79e

SHA1
c16d691c479a05958958bd19d1cb449769602976

SHA256
9a139a16fe741593e50fa5e1e2a0c706c0eba7f4d1e1a7a91035428185fde125

SHA512
ff910efee092c2b4a3fa1114f745feb7d01a38b55b0345e0118cdc601a056f79035bd92c76b49559480b515da4cd66d2fbe789baacdde67485cab989ff009b2e

Download Submit
C:\Windows\System32\perfh010.dat

Filesize
340KB

MD5
f9fcefdf318c60de1e79166043b85ec4

SHA1
a99d480b322c9789c161ee3a46684f030ec9ad33

SHA256
9c92309f7a11b916d0e9b99f9083f58b1a2fa7a9aad283b064f01c11781160e7

SHA512
881e112fedccc8643d872396baf726ceb7a49c5cce09489ddcb88400b5a4578dd5ee62a4082d81a6c721c74edb00d84d225e08ab892cc094976149a1a2c486d8

Download Submit
C:\Windows\System32\perfh011.dat

Filesize
145KB

MD5
f4f62aa4c479d68f2b43f81261ffd4e3

SHA1
6fa9ff1dbb2c6983afc3d57b699bc1a9d9418daa

SHA256
c2f81f06c86bf118a97fba7772d20d2c4ba92944551cd14e9d9bab40bf22816c

SHA512
cbd94b41fc3136c05981e880e1f854a5847a18708459112ca7eb0bdcb04d0034c42af8c58501a21ae56e07a29751236af9735b0a4ded3a6b0ef57d717acd5ff3

Download Submit
C:\Windows\system32\perfc007.dat

Filesize
137KB

MD5
cacc87a7a4824d4fca6da760d909821d

SHA1
a1f2ccfa48a2d8877425f16e0723e3b3ce8f0f67

SHA256
1f431b499e240794a4f798579cdb642dcac1b271451291327404c98605e5ebf6

SHA512
7ac2c48b41a1b13af9c8a0097d913ff5c8fbe72456faf49d0dda213ffe6ed4d2373f16963d42c5d9d09cccbc8d70ede86eba03c815a4c9b2c6af8a5d739c76ee

Download Submit
C:\Windows\system32\perfc009.dat

Filesize
122KB

MD5
243bb32f23a8a2fa8113e879d73bfdf7

SHA1
2f9d0154d65d0b8979a1aeb95b6cf43384114f70

SHA256
69012c5b50e669fca5ad692dc405017da474a5a4ec876de70d9748a4f30c046c

SHA512
34f7663ef59412a12ce950eb5ab947b2fb6bb811d5cfd92d05b6a884bcb2fc31fdc880b8e152a383055ca0efee707eb23bbfe181ace8c1ca112262f2a75bf0a8

Download Submit
C:\Windows\system32\perfc00A.dat

Filesize
142KB

MD5
bf9f94add28d5e54272b9ec709011d4d

SHA1
7a4070535d0863aa55b59e7c874b47c18657ec50

SHA256
018b8f05912e9caeaff136227834ff2b6515aed2eb662741154230ce1d04b3d7

SHA512
3ebc69f34b9c6effbeffe5681b0555cd6b3a73ffc1ef30916525d7a89c7cb9dbf6b8bf5b24054d2c74a966c47b41e676ac46949224bb551da2797fa63f7989ca

Download Submit
C:\Windows\system32\perfc00C.dat

Filesize
39KB

MD5
9f9af8517189b0d61b2615007e071084

SHA1
a33753ca07f370b7d99f6658b32abb97eed7bbc4

SHA256
b6dc84d6c21f558e69174d3b62e13fbb8aecd5e49de0fb737f56445a9b883034

SHA512
640f51590a6f5d61e9dcb9a463a6b7aae6d88749843d1ec62f30a00c95b4a449b442281ac61058db4da464bee03e62a1f43a91b0a05914d4dbda2bce007d745d

Download Submit
C:\Windows\system32\perfc010.dat

Filesize
134KB

MD5
579c88201673ae4d679c6da369fc768c

SHA1
46c67eb656a170c0e2f9193dd3a5cdeb6f99aed9

SHA256
dd841a219b2524a5403be0ad43271ff711147182487269726b60212139516fc1

SHA512
fc4370bda6e57d9060209ef2b66fa0aff30081a8391ad7a6cd2d35d7271f5d377db08508e46beae8cb7c9b3541673204de903154d8c76340788120c210acaa95

Download Submit
C:\Windows\system32\perfc011.dat

Filesize
122KB

MD5
451fd3eea8608134ff91280fb0ff7e4b

SHA1
e81546c72260060eb757195f3702014533b527dd

SHA256
a8228c74b4dc81c755c56beaa5e91515d09c24e80f820713b3095816c4e552db

SHA512
7bf51087ea8b8a0d2ea7b2a0e3b1cff8e44e3549735b1ae757622ca7157c9391132f7d68711a91fbee7f681927759ca552cf885f5aeca4a6a005d8a27fd5f8fb

Download Submit
C:\Windows\system32\perfh007.dat

Filesize
666KB

MD5
77beedf7f53f3cc4b858f8f285448f3c

SHA1
e0921ce65295184911bf45599857bdf1a4cadd3f

SHA256
e9378e37a1ace060073a032886af07e0928d3f085bbbd73a61f0ccb2ff525e67

SHA512
2f42646f989b15fd875a40cb980bf203acc0cf421c7eeadb0d36d926199a4f6366d71b2dd97e2255ef90d9e3ada085016287b566645083004f0ee86f6c425aae

Download Submit
C:\Windows\system32\perfh009.dat

Filesize
639KB

MD5
0e06730950deaeb094dc76f0e012b827

SHA1
2b4fb47055a364f34c0b4f3cb9cc95376346910f

SHA256
f8dba82e1659fcf93bba70fdac36be459cd60a6cc9217af125f5bd0b3dc7d6da

SHA512
2ee6d6cce846ccee1bcad666466a829160a9abaedbcb997ab4daa3ec9af18246d29195eeee4126b9efb399e169d15f92383ac82b5949e56e17ef78c08d63326f

Download Submit
C:\Windows\system32\perfh00A.dat

Filesize
338KB

MD5
757de55399f7c5167e7cdfa65f184108

SHA1
06876adabd18e79946cc5280861145432257d210

SHA256
e7c22cb8443fb549de7a3e826645450ed47169ce0168c740096de44addd360dd

SHA512
51977c1104108e5b5ab0042e6d10ec95195be8c62dbd547b85626cc02b35e46cb363be8804f360220ce347709da3ba1626f253477b7512cdd414f1ad96cf4571

Download Submit
C:\Windows\system32\perfh00C.dat

Filesize
710KB

MD5
23270ed87d184d7992983cd5941360b0

SHA1
600a3e067a2490f1c204b5280cfc475be4f50959

SHA256
b090fba956652c7bd1e48b6ddb64b443236dc828de37b1ddf777e0feac276976

SHA512
0ab0511f853220779b2a2cac3d93db9d084d0c4cd1153e1820350e9fca0bf24a03abd108a2a52309786caa16793c301aadddcf398c7d05b3b1f05e1b39720eb3

Download Submit
C:\Windows\system32\perfh010.dat

Filesize
697KB

MD5
97566ede26c69e0c3f452c491bc725b3

SHA1
c20ea4cf93a33378b9389be36d3dc919e84238a6

SHA256
16d1f5b0334a0bd79023e598a94b80e7ec84e0b7583030c0ea6acc46a4d6f8cf

SHA512
097c12024bb746803b29499ec68af33f98ff8d6d3c039e704a2f8344fd5d9b4d4c6ed63dd46735cc147305cf00cd84db3b2870bb9dabad0d96e1208d17285bc0

Download Submit
C:\Windows\system32\perfh011.dat

Filesize
446KB

MD5
e5966c4fef65e8fc0f66895f4776f1ca

SHA1
2819d993e64bf032fc2a4e71d0c40f349f9639d6

SHA256
51ae507017508db59eb8cd168a2219467ed9f9e434c78216c552619ff37601e1

SHA512
3e08fb643b8a7040ff5985d666b07d852f995da282e7ee388dae5785bb0ca543f18c34815077f23e277eb44454703fc0ac369b4ceccc04f20c2be861a8b61034

Download Submit
\??\pipe\LOCAL\crashpad_5116_DFZVGUFIIRMWEZMG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/876-302-0x00000000064D0000-0x0000000006536000-memory.dmp

Filesize
408KB

Download
memory/876-254-0x0000000000700000-0x0000000000722000-memory.dmp

Filesize
136KB

Download
memory/1076-998-0x0000000000D00000-0x000000000140A000-memory.dmp

Filesize
7.0MB

Download
memory/1272-6794-0x000001E667FD0000-0x000001E667FD1000-memory.dmp

Filesize
4KB

Download
memory/1272-6798-0x000001E667FD0000-0x000001E667FD1000-memory.dmp

Filesize
4KB

Download
memory/1272-6800-0x000001E667FD0000-0x000001E667FD1000-memory.dmp

Filesize
4KB

Download
memory/1272-6801-0x000001E667FD0000-0x000001E667FD1000-memory.dmp

Filesize
4KB

Download
memory/1272-6802-0x000001E667FD0000-0x000001E667FD1000-memory.dmp

Filesize
4KB

Download
memory/1272-6803-0x000001E667FD0000-0x000001E667FD1000-memory.dmp

Filesize
4KB

Download
memory/1272-6799-0x000001E667FD0000-0x000001E667FD1000-memory.dmp

Filesize
4KB

Download
memory/1272-6795-0x000001E667FD0000-0x000001E667FD1000-memory.dmp

Filesize
4KB

Download
memory/1272-6796-0x000001E667FD0000-0x000001E667FD1000-memory.dmp

Filesize
4KB

Download
memory/1600-794-0x000001D27CC60000-0x000001D27CC61000-memory.dmp

Filesize
4KB

Download
memory/1600-788-0x000001D27CC60000-0x000001D27CC61000-memory.dmp

Filesize
4KB

Download
memory/1600-796-0x000001D27CC60000-0x000001D27CC61000-memory.dmp

Filesize
4KB

Download
memory/1600-797-0x000001D27CC60000-0x000001D27CC61000-memory.dmp

Filesize
4KB

Download
memory/1600-798-0x000001D27CC60000-0x000001D27CC61000-memory.dmp

Filesize
4KB

Download
memory/1600-799-0x000001D27CC60000-0x000001D27CC61000-memory.dmp

Filesize
4KB

Download
memory/1600-795-0x000001D27CC60000-0x000001D27CC61000-memory.dmp

Filesize
4KB

Download
memory/1600-800-0x000001D27CC60000-0x000001D27CC61000-memory.dmp

Filesize
4KB

Download
memory/1600-790-0x000001D27CC60000-0x000001D27CC61000-memory.dmp

Filesize
4KB

Download
memory/1600-789-0x000001D27CC60000-0x000001D27CC61000-memory.dmp

Filesize
4KB

Download
memory/1964-6654-0x0000000000E60000-0x0000000000E78000-memory.dmp

Filesize
96KB

Download
memory/1976-6658-0x0000017967F50000-0x0000017967F51000-memory.dmp

Filesize
4KB

Download
memory/1976-6661-0x0000017967F50000-0x0000017967F51000-memory.dmp

Filesize
4KB

Download
memory/1976-6662-0x0000017967F50000-0x0000017967F51000-memory.dmp

Filesize
4KB

Download
memory/1976-6663-0x0000017967F50000-0x0000017967F51000-memory.dmp

Filesize
4KB

Download
memory/1976-6664-0x0000017967F50000-0x0000017967F51000-memory.dmp

Filesize
4KB

Download
memory/1976-6665-0x0000017967F50000-0x0000017967F51000-memory.dmp

Filesize
4KB

Download
memory/1976-6666-0x0000017967F50000-0x0000017967F51000-memory.dmp

Filesize
4KB

Download
memory/1976-6657-0x0000017967F50000-0x0000017967F51000-memory.dmp

Filesize
4KB

Download
memory/1976-6659-0x0000017967F50000-0x0000017967F51000-memory.dmp

Filesize
4KB

Download
memory/2064-4821-0x0000000000FD0000-0x0000000001212000-memory.dmp

Filesize
2.3MB

Download
memory/2252-303-0x0000000006260000-0x0000000006278000-memory.dmp

Filesize
96KB

Download
memory/2252-242-0x0000000004DC0000-0x0000000004E52000-memory.dmp

Filesize
584KB

Download
memory/2252-283-0x0000000008080000-0x000000000819C000-memory.dmp

Filesize
1.1MB

Download
memory/2252-240-0x00000000002C0000-0x00000000003BC000-memory.dmp

Filesize
1008KB

Download
memory/2252-241-0x0000000005550000-0x0000000005AF4000-memory.dmp

Filesize
5.6MB

Download
memory/2252-243-0x0000000004E80000-0x0000000004E8A000-memory.dmp

Filesize
40KB

Download
memory/2252-244-0x0000000006A40000-0x0000000006BE6000-memory.dmp

Filesize
1.6MB

Download
memory/2332-6620-0x00000168061D0000-0x00000168061D1000-memory.dmp

Filesize
4KB

Download
memory/2332-6628-0x00000168061D0000-0x00000168061D1000-memory.dmp

Filesize
4KB

Download
memory/2332-6624-0x00000168061D0000-0x00000168061D1000-memory.dmp

Filesize
4KB

Download
memory/2332-6625-0x00000168061D0000-0x00000168061D1000-memory.dmp

Filesize
4KB

Download
memory/2332-6626-0x00000168061D0000-0x00000168061D1000-memory.dmp

Filesize
4KB

Download
memory/2332-6627-0x00000168061D0000-0x00000168061D1000-memory.dmp

Filesize
4KB

Download
memory/2332-6622-0x00000168061D0000-0x00000168061D1000-memory.dmp

Filesize
4KB

Download
memory/2332-6621-0x00000168061D0000-0x00000168061D1000-memory.dmp

Filesize
4KB

Download
memory/2332-6629-0x00000168061D0000-0x00000168061D1000-memory.dmp

Filesize
4KB

Download
memory/2864-4862-0x0000000004DB0000-0x0000000004E4C000-memory.dmp

Filesize
624KB

Download
memory/2864-4870-0x0000000073610000-0x0000000073699000-memory.dmp

Filesize
548KB

Download
memory/2864-4861-0x0000000000210000-0x00000000003FA000-memory.dmp

Filesize
1.9MB

Download
memory/2864-4863-0x0000000005F20000-0x0000000006144000-memory.dmp

Filesize
2.1MB

Download
memory/2912-4832-0x0000018F07FB0000-0x0000018F08552000-memory.dmp

Filesize
5.6MB

Download
memory/2912-4838-0x0000018F0A160000-0x0000018F0A17E000-memory.dmp

Filesize
120KB

Download
memory/2912-4837-0x0000018F0A330000-0x0000018F0A3A6000-memory.dmp

Filesize
472KB

Download
memory/3232-301-0x0000000000D20000-0x0000000000D42000-memory.dmp

Filesize
136KB

Download
memory/3744-1020-0x0000000000B70000-0x0000000001266000-memory.dmp

Filesize
7.0MB

Download
memory/3744-1021-0x000000001D850000-0x000000001E3BA000-memory.dmp

Filesize
11.4MB

Download
memory/4048-782-0x0000000000F30000-0x0000000000F8A000-memory.dmp

Filesize
360KB

Download
memory/4048-786-0x0000000006B50000-0x0000000006B6E000-memory.dmp

Filesize
120KB

Download
memory/4048-785-0x0000000006B00000-0x0000000006B22000-memory.dmp

Filesize
136KB

Download
memory/4048-784-0x0000000005900000-0x0000000005976000-memory.dmp

Filesize
472KB

Download
memory/4048-783-0x00000000057D0000-0x0000000005882000-memory.dmp

Filesize
712KB

Download
memory/4152-6641-0x00000182AA490000-0x00000182AA684000-memory.dmp

Filesize
2.0MB

Download
memory/4152-6642-0x00000182B3AB0000-0x00000182B3C18000-memory.dmp

Filesize
1.4MB

Download
memory/4152-6640-0x000001828CA80000-0x000001828D968000-memory.dmp

Filesize
14.9MB

Download
memory/5068-1018-0x0000000000FE0000-0x0000000000FF8000-memory.dmp

Filesize
96KB

Download
memory/5212-6608-0x00000000007B0000-0x00000000007FB000-memory.dmp

Filesize
300KB

Download
memory/5212-6613-0x00000000007B0000-0x00000000007FB000-memory.dmp

Filesize
300KB

Download
memory/5372-6619-0x0000000000F50000-0x0000000000F9B000-memory.dmp

Filesize
300KB

Download
memory/5372-6614-0x0000000000F50000-0x0000000000F9B000-memory.dmp

Filesize
300KB

Download
memory/5528-4906-0x0000000073610000-0x0000000073699000-memory.dmp

Filesize
548KB

Download
memory/6032-4879-0x000002B818560000-0x000002B818586000-memory.dmp

Filesize
152KB

Download
memory/6032-4872-0x000002B87F190000-0x000002B87F19A000-memory.dmp

Filesize
40KB

Download
memory/6032-4873-0x000002B818200000-0x000002B81826A000-memory.dmp

Filesize
424KB

Download
memory/6032-4875-0x000002B87FB00000-0x000002B87FB50000-memory.dmp

Filesize
320KB

Download
memory/6032-4876-0x000002B87FA20000-0x000002B87FA42000-memory.dmp

Filesize
136KB

Download
memory/6032-4878-0x000002B8185A0000-0x000002B8185DA000-memory.dmp

Filesize
232KB

Download
memory/6032-4898-0x000002B87F1E0000-0x000002B87F1F2000-memory.dmp

Filesize
72KB

Download