xworm | c03c2ec5ef0958a61a913e2bfb80a420a030f579858cc203b3d2bc3b938400cd

Analysis

max time kernel
754s
max time network
564s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
18-11-2024 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWorm.rar
Size

59.1MB
MD5

6ec728dd292a8e1f39cd6baea415ff66
SHA1

e1103f0af9d27f5c56667d98a36dd40ab5ec8392
SHA256

c03c2ec5ef0958a61a913e2bfb80a420a030f579858cc203b3d2bc3b938400cd
SHA512

ffc584bfb586e7c123f5e7c153fd9e9187e7010e7b4bce9ae590c05961bbbfa46b4c2f25ded830626e30aea919cec31f7026ccf699510f8cccb1921507829a40
SSDEEP

1572864:c3UGEBh79oS6ea3nG8zWxYKClanZV79oS6eaqAHRvr:QEBhxb6eaxixDnZVxb6eaFJ

Score

10^/10

xworm agilenet discovery persistence phishing rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:7777

h-asset.gl.at.ply.gg:7777

Mutex

lEKFfsS3mf7zGun2

Attributes

Install_directory
%LocalAppData%
install_file
RobloxBud.exe

aes.plain

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/776-1241-0x0000000001100000-0x000000000110E000-memory.dmp	disable_win_def

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/776-1045-0x00000000007B0000-0x00000000007C0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 5 IoCs

pid	Process
3908	XWorm V5.2.exe
1596	XWormLoader 5.2 x32.exe
776	XClient.exe
4016	XWorm V5.2.exe
564	XWormLoader 5.2 x64.exe

Loads dropped DLL 23 IoCs

pid	Process
3908	XWorm V5.2.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
4016	XWorm V5.2.exe
564	XWormLoader 5.2 x64.exe
776	XClient.exe

Obfuscated with Agile.Net obfuscator 4 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/files/0x001c00000002abf7-336.dat	agile_net
behavioral1/memory/3908-340-0x0000019B729A0000-0x0000019B735D8000-memory.dmp	agile_net
behavioral1/memory/1596-830-0x0000000006250000-0x0000000006E88000-memory.dmp	agile_net
behavioral1/memory/564-1229-0x000002A07B040000-0x000002A07BC78000-memory.dmp	agile_net

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\RobloxBud = "C:\\Users\\Admin\\AppData\\Local\\RobloxBud.exe"	XClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormLoader 5.2 x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	XWormLoader 5.2 x32.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	XWormLoader 5.2 x32.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWorm V5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWorm V5.2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWormLoader 5.2 x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWorm V5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWorm V5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWormLoader 5.2 x32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWorm V5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWorm V5.2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWormLoader 5.2 x32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWormLoader 5.2 x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWormLoader 5.2 x32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWormLoader 5.2 x64.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff	XWormLoader 5.2 x32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 50003100000000006e57237f100058576f726d003c0009000400efbe7259442f7259442f2e00000004ab020000001a00000000000000000000000000000053a98400580057006f0072006d00000014000000	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 60003100000000006e571b80100058574f524d567e312e320000460009000400efbe7259442f7259442f2e00000081ab0200000019000000000000000000000000000000e6397c00580057006f0072006d002000560035002e00320000001a000000	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	XWormLoader 5.2 x32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "3"	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	XWormLoader 5.2 x32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
3452	msedge.exe
3452	msedge.exe
3132	identity_helper.exe
3132	identity_helper.exe
1120	msedge.exe
1120	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
776	XClient.exe
564	XWormLoader 5.2 x64.exe
564	XWormLoader 5.2 x64.exe
564	XWormLoader 5.2 x64.exe
564	XWormLoader 5.2 x64.exe
564	XWormLoader 5.2 x64.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2488	7zFM.exe
1596	XWormLoader 5.2 x32.exe
564	XWormLoader 5.2 x64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	2488	7zFM.exe
Token: 35	2488	7zFM.exe
Token: SeSecurityPrivilege	2488	7zFM.exe
Token: SeDebugPrivilege	3908	XWorm V5.2.exe
Token: SeDebugPrivilege	1596	XWormLoader 5.2 x32.exe
Token: 33	2316	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2316	AUDIODG.EXE
Token: SeDebugPrivilege	776	XClient.exe
Token: SeDebugPrivilege	776	XClient.exe
Token: SeDebugPrivilege	4016	XWorm V5.2.exe
Token: SeDebugPrivilege	564	XWormLoader 5.2 x64.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
2488	7zFM.exe
2488	7zFM.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
1596	XWormLoader 5.2 x32.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
564	XWormLoader 5.2 x64.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
1596	XWormLoader 5.2 x32.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
564	XWormLoader 5.2 x64.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
1596	XWormLoader 5.2 x32.exe
776	XClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3452	3908	XWorm V5.2.exe	83
PID 3908 wrote to memory of 3452	3908	XWorm V5.2.exe	83
PID 3452 wrote to memory of 4240	3452	msedge.exe	84
PID 3452 wrote to memory of 4240	3452	msedge.exe	84
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2540	3452	msedge.exe	85
PID 3452 wrote to memory of 2352	3452	msedge.exe	86
PID 3452 wrote to memory of 2352	3452	msedge.exe	86
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87
PID 3452 wrote to memory of 2228	3452	msedge.exe	87

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2488

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1892

C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWorm V5.2.exe
"C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWorm V5.2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe98dd3cb8,0x7ffe98dd3cc8,0x7ffe98dd3cd8
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
    3⤵
    PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3416 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1960 /prefetch:1
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:1
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
    3⤵
    PID:784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7092 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
    3⤵
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
    3⤵
    PID:3728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7272 /prefetch:1
    3⤵
    PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3742486644960646854,12172523026583952854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
    3⤵
    PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe98dd3cb8,0x7ffe98dd3cc8,0x7ffe98dd3cd8
    3⤵
    PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe98dd3cb8,0x7ffe98dd3cc8,0x7ffe98dd3cd8
    3⤵
    PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x124,0x128,0x120,0x12c,0x7ffe98dd3cb8,0x7ffe98dd3cc8,0x7ffe98dd3cd8
    3⤵
    PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe98dd3cb8,0x7ffe98dd3cc8,0x7ffe98dd3cd8
    3⤵
    PID:3372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe
"C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe98dd3cb8,0x7ffe98dd3cc8,0x7ffe98dd3cd8
    3⤵
    PID:1492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bzft3lkt\bzft3lkt.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3704
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2FE7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4F4EBEB7973A4F7CA20641EFA7E86C3.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1292

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3120

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XClient.exe
"C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XClient.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:776

C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWorm V5.2.exe
"C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWorm V5.2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe98dd3cb8,0x7ffe98dd3cc8,0x7ffe98dd3cd8
    3⤵
    PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe98dd3cb8,0x7ffe98dd3cc8,0x7ffe98dd3cd8
    3⤵
    PID:3564

C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWormLoader 5.2 x64.exe
"C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWormLoader 5.2 x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:564

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\014474b6-a9b9-459c-b0c8-59f590124732.tmp

Filesize
1KB

MD5
3bf6c759f50db09872c02215c36c6a62

SHA1
59402f93f0e6001bea42bb4a7f865f48d8b8c166

SHA256
d83a91047d124429c289fb7bd7390b23d8640021a95094d8a7ee33d58791fa46

SHA512
1308a23228cec474b7380cb526b83eebcf3a8377b562f84944112e86cca8c317170628905a4f6e1490d1f36da709b099134547a6e2974c4f50b35cc9d4f23f86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
28KB

MD5
0ce7ba1811d82ca152c78c38d4242e79

SHA1
e327749885a1d77eb55c46ba8c80eebafcd780f7

SHA256
3cf0019982747c8c72fb10281accbc112536484fb0aa39e26c7f464f63628502

SHA512
57dc527dc6cdfa28b69cebb6634e6fb2cafeb507687770d15b68160f860c865282855eff4638709c8177ee8534bae4233ee2b2ccc47d26f45fdcf6ac4f2b5073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
80KB

MD5
14e39be019da848a73da7658165674cb

SHA1
e016473c4189a8cc3dbff754a48b3e42d68af25a

SHA256
39595a1806156cfcadf3cc4e20c5c3f3eec721386a0551790a15f025ba9402bd

SHA512
828a383de549871aa80ec960a7e371ef47da96d01ebb9628d1484ceed9eb698aec5109b3de0b24ff8000610a2c2d633616c9fd28d380656fecbaa930cffed029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\efa986235cc38916_0

Filesize
2KB

MD5
df4bdc3e9b50e9fe4121cc81ec66895f

SHA1
13b13758049a5c189deb8d94a267b388e0046d83

SHA256
c3ded6e8abec67d59384674cd4306350c97f78036967bebce4f06a0af570827d

SHA512
6bfb8df54094c439ef826b349633d8b025f999665db92e01d7d0b039cffdd19380979c78e20e37f5f664595dfda8f6a0b413f325fce21e1a8a722c1dc0c90df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
08a09fcde9de0d4e354c1b2e28abf07c

SHA1
1e6c1f494fb8828b6918afd6b1398e1e252b9f22

SHA256
daaba182c0a6d2664915c1ac04ba94e7a8c8712af0557da3c9b82da578bb5717

SHA512
b6a3606faaddcc1f8f01dba9daec50c96eff9c17313635543782f6860aae4d5839118c2340ff09967d915fe787afe1d36b04aaa22618bdce2b28fe8e633399af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
d73e503ebc65f396ee191843ee777f43

SHA1
fd54c01ddee1f19f02464efeb6d288dda0d27d58

SHA256
59f6027543be381c71bae555f6b9dd8a01fbbb79bd33acaf52f95ba350fc45b3

SHA512
e954cb1da867f36c1c31759232f9c5e247f2f240290c58d8f12c6cbb21ac1ee37437f519a8a8779bb07b88e6aee78dd504d68fd76f2a1390e1a79e26d8247a35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
c42cfa10b8011265782b1a26deca9e4f

SHA1
b6e4069f4f2db211b65c6f58767607111360a39e

SHA256
1e765e0da89290d7e669f4b75761642be0593858324d6f2a9e961eb8e800256e

SHA512
043b85f8f94327edb2a89006933af8dd084732e100c1d3f514d52def726af4d58c59affb78b9073086e0d9b1c329e301daaa652826686bb69e3638c4bd0930cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
442B

MD5
7af9ec65649e17b54150c9fae16fd871

SHA1
b600c4db469e24abfaba074355ebc07458943934

SHA256
50c16032f3f99147b48e22325e35dabb98d37f56eb570897eb5f82c662961a83

SHA512
c458f172d169050930220e35079ed6c0aa36d0340497e163f9a0fe45736fc570b8f2bef1858953d983f68a13971979ae34204e8a67c45015522235c7d4ce0988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9bded8f5895190afddf6e1516f45dae2

SHA1
9dd431d16a4da435cb3e8108116923f08ff0b7ae

SHA256
cce0308b7efe741df412a6731273892e074993002089c8ffa81a1717684b2137

SHA512
f6279ac8ff1f617366f79de881fdb2f6956a375ad13fd0c890700f855f74d0e52df606e2758ef225c649e564b5ef52ead6a8b2d42e2f0a07018f6507747c33ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a93a23ca1a9f249ee4b4810db7f13ba5

SHA1
3d51744f43cc8aeba036d53b5bb3b01537d7b358

SHA256
71e2292da58f9c9ea8dd1f2eb036eb44b05a9c8bc7ea0e2c0a8002ea6890a6df

SHA512
9230cc1f1f922c5eebf42d96475c9edc4a42b9499f610d36efd23f54557021f3689542f3e7796f1e6ec020716f684e36a530a70abea356b0b3fdcf422701c326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dbcfd9f214b9beba0a63bfddee24d44b

SHA1
8e8fe4a1b401b1dab0981e61b02b4eabe542a59b

SHA256
d492fe389b4c795497fbc51f7f563b15bf136ab168beae3fdbca6a364e046b78

SHA512
092998b076e5be3d1a8f12bff1a9b526abe5cfc00f92214e95e93956b226abfe5a0d66624b3686738f4ade82700b14782e176170edb73cd1c7368628d1ca18ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c05d2327023c5d3d2adb6dccc83abb19

SHA1
a7558763b348889f786945c3f61b8015a2802021

SHA256
e6b652a014be55e1830a0e798d1effa815e54fa7a9784bebf73a666353729477

SHA512
2a6eedadab52ff03d495d948e561a1eb22656f2572ae6ecbf8739e9d7513f7aa8a1c35ab67acec38e493ebe17785eba2d941dd3b3f5b6c3ce78db0c323a54b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
acd4a055d9a2a67fabbaeba8a06572a0

SHA1
3d5d4ea3704db8817bbda2f9eeab9a1d6e13da37

SHA256
35f5427cc0ba20c2c1e8bb9130ced3e6b45526d2a5f929368a11f326c1d68f91

SHA512
cb3852b7cd397944a06ec06bb9604b9036044a0a67fe266ad53c1f419c2a5c0646069a82b84b6bf0eaefa4ede7118942a05b60a7216c88394ab9ba8e4938470f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
58a950fefbf3468b145ea5eead5af2ba

SHA1
83cc5b080a7e4a203a3b8f556da4d72fa6ec0c02

SHA256
78a7a21d01e4b0bec3cc879c673a029b59f3004947d0f59d6ddfe17d91313e6e

SHA512
dc1219a60385b43fdf5c5c9a89c775fce0a6285560584efa66c4938a5f33af895121f3ba6aaa7bb04d97f64df863a7f5ac3895882d0849d9f64e3823f7847608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9925d26380656b4b7a5e9be623fa09d0

SHA1
8099ec79c5929ae05a2169b69cee9e2656c54869

SHA256
919f3f1485f72b9f0ce9eaec5a15d2a5bcadbbdf659b51688c3ec9d81562e921

SHA512
26b6643d59f2a273c02fa47f234bcde27748ab3d4e9dca2876102aa818e36546ca9f4d211c7f81ecd0c63f583fcf7ead25de363c59be727c44e3dab1acdd0aa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eeebe6cf0b50e4261fdb3fd10ca3d1f5

SHA1
e8a189eab3c7849319efe8363d2447ded963f830

SHA256
ffb7564037ccd80c2e7d2cc3594771bcfadf588e9f3df1892e7bb20e76d9b50b

SHA512
4455f4f9323e871d39fa0d763f42bf1249108bb96b9e3f81a2606400b34cd98f3206d54ca9dd1dadb74fb25352c654b0daa52a1fb59a233195053b037b75cfe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
85a644c11afcc2876d2f78521b842ee7

SHA1
9791d73fa80be90cc87ea3a4b485a321632c4b4a

SHA256
56446db024c065a2dcdd326727955c8a6ef7c1edd38075d0cac95ce6bfb960e1

SHA512
4c730abecfb5798e3acfd3c08fc56f21a72063584fa05d16b8a3a0b1967f5f2da2557ad8c6667e1d0c499cc19cfebf4450434d82cc958053086813d94a323998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dbd0b737f6549410526923dcb3bd49ed

SHA1
cfbe89f2b71a909a56be54252f8b6b4c9d9efe56

SHA256
742f06595f7649cf3f990a7aafa178558895224d529844ed1f7924aadabb924d

SHA512
2634b3595320f26c919a470a50cbbec0adfcc7beff5fa67df081b4b1bad5b20e941543fa1b3274cf3f145ed8bc78bc532574803beb0966da522b0ab698ec02ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b2fc02f475504ccfedc53cedaea774b0

SHA1
bf293bfaa9f0b792771fc7c21b810de421f14b69

SHA256
5500594236ae8e35f4c8a7315205482e18304ecd19cdeaca159812f5321f15a4

SHA512
648377406f6ee03a54c01abcfc6b188f238e3baa72dc0e4cf3c175e2de8be9f2a089c1e62a6bc3e4e185a278128b27d5d05b827694aefae501c1fd3c68310348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5be59aec6a41d26adf9854ed5d8fb5a2

SHA1
39e0bacd4054ad592e77a4f976c40e31d0058c99

SHA256
a4483443e858e53f9fd43ac6f3b522714c94ca13793a205c44934451765c40f6

SHA512
f5654579d8898082752511d453bacef8cc26bdc9e21e3c0623a78d0dcceab2ac87ca2026ae268298724a4195dfc29cdd4407904c6764ce27d3b8f358e08a6d7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
61b239ae819dd4bf2da1f4c6c2c11660

SHA1
ba834e7c26d95fcda5b353e2a2099f452c7c6eba

SHA256
5f3fd80913227b8dd0d3557298f692f61ad35aa9b45b260ed278d6a9d3835530

SHA512
5a7130f004b80d11a451b4dd5071e958085e6c612c3c4f8542ddd197b6a5377119e83837b577f09a24356612128422c7e4b7b5947ab6102c53e6fb092fc88494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3de3e5f716f42f42080c59d05e48dcf9

SHA1
08c6bd5952581b3895fa6aa740c1823d36a626b9

SHA256
3bd9f22719fbd90c50a50e31490e19f890c510ed80198d8bac54754c300ccc16

SHA512
b179feab4c4cd2d1e4041e8332b099764a76cc0b0a3da43d3476e1db8edcc718d3cb81f17bd27c96316a6dc044affb4a13185bc28951f1ea13b7306c2294e108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
98b85d1868540a604d561525e683ee05

SHA1
7a9ea3fa9f8b31ce4761019b2ee908bfd7e56c1b

SHA256
165f8a8e27bc467dfbe2cf5c102069d3172543045f39499e442bddbbee5b5dbb

SHA512
97840d4dbe9402903c828a72109449694da5e3f3f339c587b91f7395383250783a07fd3f4b633e118d48e2443b8b2e7485809b779fff05b903dff96365d012e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
af87507567f6e3dc7a72df3d97fb12a1

SHA1
24a2a2553769866a7a32f4295dedfdf23de95bd8

SHA256
a598ec2da51d89d7d8fd18c9c095a8b20f533b010a0e71342d9240d0f7f9e11c

SHA512
682fcc0dd42a86c10396ec20a65f70678e380b479afcb0f846157c1afc28705a28698a0f8a5858f8f8bef0070fcd8a0b3fdd84dface27c7acb209faa8d9e967d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c089582d7a9acf4cfa7a33ce32eb2a40

SHA1
605534bb7d99cb376f817f73a802a5b55c42df6c

SHA256
0fa7bf35d6e93470c541cb2d440b067afa1a31025d6057ea5ca7ea9a66cdf6d6

SHA512
d0a74baa0a9bbd000bba675ea5a0b46244eebfac05543110db045f8cbf4ce7496957b4bca5bafef84e64a355c840abe76dcef2cff2d9a0c00d119797647b1da9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
cd7032b36a45e2a24fa5ef1cb6fb3987

SHA1
1a9c3d5c04007659361e282ac903b182d9063950

SHA256
fa780ff1f08e9566997eeeb68b7d2649b6a6c3ccbb4465a5ea8b4c094b3f130a

SHA512
39053910390ae2c270051f6d68899bf3e38c3447c5bafb9f63c6a9bb3b4554beb3040f139ef55d398d93cc3dda25134b2dd6f2b077f17b44f1ee3ada65deb4b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593cc1.TMP

Filesize
538B

MD5
c5378ee8dc5c0d859bb2f7e07f9a2437

SHA1
9f7a0779935e33c0bae2792d926f465b510b2dea

SHA256
8f37b27b1c1aa7b0ee998b2d973339654c06ba2c653e3e576fa26280793357e3

SHA512
862379f9394667aaa6ebb4fa767b33058f8da1057e57b76c2886324b2c3b695916bc2aa78d1a721df65cb23a0ba8df4a446fb6c9be88e49f4684c17f61643c31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0e6922bff0f11427c830792d8847ef06

SHA1
c7f29f9f8aac7439accae344ea8225d417ff2b28

SHA256
1173e64b4386dcae2d538c4ee1b006b7ded60253b7c4749ad688b9259a0d6d32

SHA512
eae2df9ef3055f75dac41dc73c22d26a1b35188e7d8b94eee03da4f46ea3bf4b2bda3616cc3931bd7db0e242f7cd64c74168ba888b1d94577781b6852c431eb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bd79dc7df887ddd85d63f6b5508914fc

SHA1
5702c4d3c2ed04862a1fef6b7ef007e9f414e654

SHA256
4afca3e0aed3b1175e8cdf76da051dcabd6812b75620f02019775e9967e79068

SHA512
3a9ff26db13469196360ad12afceb411d94ff8f3c064c210f71590d45b663b60880877e62d758d34e0a44032d8d8ea00c4846893f3c62c5410caccee0441c371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fd4878be3f3f6390ebad1006434bfaf5

SHA1
836fd2071d43f454e71fa06b96a90b1cf40df643

SHA256
f1f6366fadf90c693331598bf6160db0f9e877d693ff6735a459952dad587056

SHA512
4f283f4e08a245118c7b79b9aaa59db7a488b2b35aecc8bea35c4c0ff1ece9c906af23639a14713854012dc74be2b286ccc2f8b1aed1c63af44f818e11137ecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d9fba890ce12a7e0da71e3241a4b197d

SHA1
699c98eae6fadcb39db756164ca729522722b566

SHA256
48dd6736d613c0aa05b13f8feb106bb2946c155352d377c018708068f8242d09

SHA512
7ccca7fb0e48f5e6e3542b34f983bfe892ac4cd4b36e8c4eb3a633f59a42ec74d3e132ee9f0cf70d285282e5260bf82a94ea5b6737d7ff63509985c86011922e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
910cc431cfbcd4462e6ccf0c9a1c7c73

SHA1
a18f329e281f41cae7b74e66305bbec09fa7f3ff

SHA256
124e8174d0aaefbd2bf253b0e6e0df3de1f26d04e6cce497f1267c29f5720ddc

SHA512
8c228a50894bd61aa6760079fabff0297ace7159e41832743f5b730731b3cb8a590d537f49bff12c5268b7ea189667fce6081bf9873f06687cfe1d62681160c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
90fbbf99beef484c3e60c66fcd6533e0

SHA1
0dcb5d6b4581bf8fbeb6a6b0cde42fe5b86f3a53

SHA256
39848e55af3e8c86a055b17c9f678d667c85cf04047e30827c31e7b09119638f

SHA512
23b165dace6359e7f7d8b1f20db4bdf31510e38c9746cf399d1c9bfc8e4025d6b950d83695c74a0a3fa1fd9a0ec7241491bc9cf6fd8aa3fee290daafeed1b50c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
575f6caf38bee593f253a327c0b23a21

SHA1
f2674f299caa642ee904376650a1b023111a7da1

SHA256
c07e4a95a6e6103384f6a9115b9787fb4dc360a83d534eef10b784476587354b

SHA512
a1b048ba8e9a0c4f7148e2b03efb745e09a08db729eae4fb61affb49487ed2623b312d0ac4095a7fdf54d8aef6fc8b506c7638ec5bc90b48b2347dcc881dab8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b544d1a794e8919171b7d738e5a089ad

SHA1
b1b07616e5f14a7427b728fec27ad508ffd79579

SHA256
40b88e66943fc4c4b9522e5b847a181efc7be341c255491348fa1075b064e4a4

SHA512
bcf6e9abe7ef73b5414b41b5dc03bd463705147ed5a28de431dfe775ec746942e3b75f41b151d5690cbd4350a20336b21ae3419dbb922ff0402c27d2d21da0ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
828dca93564804a048538ef12d9f190b

SHA1
c41302fb6fc2463ced6888cef20e7bece67df8a7

SHA256
4dda5f6d1630e8a41ecf7863e5b0bb61d0f8552a2f2e490c7aab6d8de36a45b5

SHA512
f001656926a9af388acae083c6c6448377c5974b832348b6f4d91bf8cdb854f4e448b4fb1a99a93465064daee5e77163e54169274c9a07049645b9ce2cb9845c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
900bc1b37a90ce430a44a37ff2ae0d0c

SHA1
8998cd5b8634bf37ab6af47c347e22f2e06cee96

SHA256
7820fa50c013344df4496cc0c204ae1956b4271b3896cadbc0fcb6e7bd57d748

SHA512
c736663180fa57eab4e641facb7e600c10d02d28a63007fac4302700b487589ee3abffd70cdf50611b1c11d156017ac76fcb079d890c2650dd29227ff40f8616

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE8B99C787\XWorm\XWorm V5.1\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE8B99C787\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe.config

Filesize
187B

MD5
15c8c4ba1aa574c0c00fd45bb9cce1ab

SHA1
0dad65a3d4e9080fa29c42aa485c6102d2fa8bc8

SHA256
f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15

SHA512
52baac63399340427b94bfdeb7a42186d5359ce439c3d775497f347089edfbf72a6637b23bb008ab55b8d4dd3b79a7b2eb7c7ef922ea23d0716d5c3536b359d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TMzpx\TMzpx.dll

Filesize
112KB

MD5
2f1a50031dcf5c87d92e8b2491fdcea6

SHA1
71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f

SHA256
47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed

SHA512
1c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\aPjMR\aPjMR.dll

Filesize
84KB

MD5
0b0e63957367e620b8697c5341af35b9

SHA1
69361c2762b2d1cada80667cd55bc5082e60af86

SHA256
bd9cdcfaa0edecdb89a204965d20f4a896c6650d4840e28736d9bd832390e1c5

SHA512
07d0e52c863f52ecb3d12fab9e71c7a18d54cbedb47250bee7e4297ff72ed793c23a2735c48090c261fe4633d53d03e305c1338dfc881bb86874d1633ff6ecee

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
33c043e6487e82329755f36c02419f38

SHA1
17498140153019448c0427045216af1a5857f1e1

SHA256
8fad1ba4fa388bdb3f64a0d2979f36eee64ec86a9085df683cf09802636e40d6

SHA512
654231f7419dbbaec26a58eb933b6980d3b7f8a5c1ad3d3d79ccbfed8dda69b16346ee437bc2e70f7af865e9f64af18bfd1fc62b9b82eb304faa187879b01f7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
561aae9148715520975f8387e1866e61

SHA1
fa1fa8343cd9e27ab015248a7401c80d121a2c36

SHA256
13e9b000a16c7daa141286e603bb8ded24c1fd45fb690a7d78460cff736da8a3

SHA512
40345b6a9a6031c89bfdb53d1c05a89c6a923c721a65172d315da1a2b1708f6b6fa791797aad1b9fa78d1be57bafcf316e1a4bc0fdefbeb4dcf4fb3fe2664de7

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\GeoIP.dat

Filesize
1.2MB

MD5
8ef41798df108ce9bd41382c9721b1c9

SHA1
1e6227635a12039f4d380531b032bf773f0e6de0

SHA256
bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

SHA512
4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\Guna.UI2.dll

Filesize
1.9MB

MD5
bcc0fe2b28edd2da651388f84599059b

SHA1
44d7756708aafa08730ca9dbdc01091790940a4f

SHA256
c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

SHA512
3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\Mono.Cecil.dll

Filesize
350KB

MD5
de69bb29d6a9dfb615a90df3580d63b1

SHA1
74446b4dcc146ce61e5216bf7efac186adf7849b

SHA256
f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc

SHA512
6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\MonoMod.Backports.dll

Filesize
138KB

MD5
dd43356f07fc0ce082db4e2f102747a2

SHA1
aa0782732e2d60fa668b0aadbf3447ef70b6a619

SHA256
e375b83a3e242212a2ed9478e1f0b8383c1bf1fdfab5a1cf766df740b631afd6

SHA512
284d64b99931ed1f2e839a7b19ee8389eefaf6c72bac556468a01f3eb17000252613c01dbae88923e9a02f3c84bcab02296659648fad727123f63d0ac38d258e

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\MonoMod.Core.dll

Filesize
216KB

MD5
b808181453b17f3fc1ab153bf11be197

SHA1
bce86080b7eb76783940d1ff277e2b46f231efe9

SHA256
da00cdfab411f8f535f17258981ec51d1af9b0bfcee3a360cbd0cb6f692dbcdd

SHA512
a2d941c6e69972f99707ade5c5325eb50b0ec4c5abf6a189eb11a46606fed8076be44c839d83cf310b67e66471e0ea3f6597857a8e2c7e2a7ad6de60c314f7d3

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\MonoMod.ILHelpers.dll

Filesize
6KB

MD5
6512e89e0cb92514ef24be43f0bf4500

SHA1
a039c51f89656d9d5c584f063b2b675a9ff44b8e

SHA256
1411e4858412ded195f0e65544a4ec8e8249118b76375050a35c076940826cd0

SHA512
9ffb2ff050cce82dbfbbb0e85ab5f976fcd81086b3d8695502c5221c23d14080f0e494a33e0092b4feb2eda12e2130a2f02df3125733c2f5ec31356e92dea00b

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\MonoMod.Utils.dll

Filesize
319KB

MD5
79f1c4c312fdbb9258c2cdde3772271f

SHA1
a143434883e4ef2c0190407602b030f5c4fdf96f

SHA256
f22a4fa1e8b1b70286ecf07effb15d2184454fa88325ce4c0f31ffadb4bef50a

SHA512
b28ed3c063ae3a15cd52e625a860bbb65f6cd38ccad458657a163cd927c74ebf498fb12f1e578e869bcea00c6cd3f47ede10866e34a48c133c5ac26b902ae5d9

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\RVGLib.dll

Filesize
241KB

MD5
d34c13128c6c7c93af2000a45196df81

SHA1
664c821c9d2ed234aea31d8b4f17d987e4b386f1

SHA256
aaf9fb0158bd40ab562a4212c2a795cb40ef6864042dc12f3a2415f2446ba1c7

SHA512
91f4e0e795f359b03595b01cbf29188a2a0b52ab9d64eadd8fb8b3508e417b8c7a70be439940975bf5bdf26493ea161aa45025beb83bc95076ed269e82d39689

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWorm V5.2.exe

Filesize
12.2MB

MD5
8b7b015c1ea809f5c6ade7269bdc5610

SHA1
c67d5d83ca18731d17f79529cfdb3d3dcad36b96

SHA256
7fc9c7002b65bc1b33f72e019ed1e82008cc7b8e5b8eaf73fc41a3e6a246980e

SHA512
e652913f73326f9d8461ac2a631e1e413719df28c7938b38949c005fda501d9e159554c3e17a0d5826d279bb81efdef394f7fb6ff7289cf296c19e92fd924180

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWorm V5.2.exe.config

Filesize
183B

MD5
66f09a3993dcae94acfe39d45b553f58

SHA1
9d09f8e22d464f7021d7f713269b8169aed98682

SHA256
7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

SHA512
c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

Download Submit
C:\Users\Admin\Desktop\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe

Filesize
109KB

MD5
f3b2ec58b71ba6793adcc2729e2140b1

SHA1
d9e93a33ac617afe326421df4f05882a61e0a4f2

SHA256
2d74eb709aea89a181cf8dfcc7e551978889f0d875401a2f1140487407bf18ae

SHA512
473edcaba9cb8044e28e30fc502a08a648359b3ed0deba85e559fe76b484fc8db0fc2375f746851623e30be33da035cec1d6038e1fcf4842a2afb6f9cd397495

Download Submit
memory/564-1220-0x000002A077FD0000-0x000002A078012000-memory.dmp

Filesize
264KB

Download
memory/564-1219-0x0000000000FC0000-0x0000000000FE0000-memory.dmp

Filesize
128KB

Download
memory/564-1233-0x000002A07D8B0000-0x000002A07D962000-memory.dmp

Filesize
712KB

Download
memory/564-1232-0x000002A07D760000-0x000002A07D7E2000-memory.dmp

Filesize
520KB

Download
memory/564-1231-0x000002A07F090000-0x000002A07F372000-memory.dmp

Filesize
2.9MB

Download
memory/564-1230-0x000002A07D6A0000-0x000002A07D6CC000-memory.dmp

Filesize
176KB

Download
memory/564-1229-0x000002A07B040000-0x000002A07BC78000-memory.dmp

Filesize
12.2MB

Download
memory/564-1228-0x000002A079AA0000-0x000002A079ABA000-memory.dmp

Filesize
104KB

Download
memory/564-1227-0x000002A079AE0000-0x000002A079B1C000-memory.dmp

Filesize
240KB

Download
memory/564-1226-0x000002A078030000-0x000002A078036000-memory.dmp

Filesize
24KB

Download
memory/564-1225-0x000002A078020000-0x000002A078026000-memory.dmp

Filesize
24KB

Download
memory/564-1223-0x000002A07A200000-0x000002A07A25E000-memory.dmp

Filesize
376KB

Download
memory/564-1224-0x000002A07A260000-0x000002A07A2B6000-memory.dmp

Filesize
344KB

Download
memory/564-1222-0x000002A078050000-0x000002A078056000-memory.dmp

Filesize
24KB

Download
memory/564-1221-0x000002A079920000-0x000002A079948000-memory.dmp

Filesize
160KB

Download
memory/776-1045-0x00000000007B0000-0x00000000007C0000-memory.dmp

Filesize
64KB

Download
memory/776-1234-0x00000000010A0000-0x00000000010AC000-memory.dmp

Filesize
48KB

Download
memory/776-1241-0x0000000001100000-0x000000000110E000-memory.dmp

Filesize
56KB

Download
memory/776-1236-0x000000001B520000-0x000000001B55A000-memory.dmp

Filesize
232KB

Download
memory/1596-844-0x000000000E4C0000-0x000000000E526000-memory.dmp

Filesize
408KB

Download
memory/1596-813-0x0000000005420000-0x000000000547E000-memory.dmp

Filesize
376KB

Download
memory/1596-817-0x0000000005480000-0x00000000054D6000-memory.dmp

Filesize
344KB

Download
memory/1596-805-0x00000000052C0000-0x00000000052E8000-memory.dmp

Filesize
160KB

Download
memory/1596-830-0x0000000006250000-0x0000000006E88000-memory.dmp

Filesize
12.2MB

Download
memory/1596-809-0x0000000005260000-0x0000000005266000-memory.dmp

Filesize
24KB

Download
memory/1596-831-0x0000000006E90000-0x0000000007436000-memory.dmp

Filesize
5.6MB

Download
memory/1596-801-0x0000000005320000-0x00000000053BC000-memory.dmp

Filesize
624KB

Download
memory/1596-800-0x0000000004E60000-0x0000000004EA2000-memory.dmp

Filesize
264KB

Download
memory/1596-796-0x0000000000560000-0x0000000000580000-memory.dmp

Filesize
128KB

Download
memory/1596-832-0x0000000005870000-0x0000000005902000-memory.dmp

Filesize
584KB

Download
memory/1596-824-0x00000000055C0000-0x00000000055DA000-memory.dmp

Filesize
104KB

Download
memory/1596-839-0x0000000004970000-0x000000000497A000-memory.dmp

Filesize
40KB

Download
memory/1596-1015-0x000000000F3D0000-0x000000000F538000-memory.dmp

Filesize
1.4MB

Download
memory/1596-818-0x00000000053D0000-0x00000000053D6000-memory.dmp

Filesize
24KB

Download
memory/1596-819-0x0000000005400000-0x0000000005406000-memory.dmp

Filesize
24KB

Download
memory/1596-823-0x0000000005550000-0x000000000558C000-memory.dmp

Filesize
240KB

Download
memory/1596-825-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/1596-843-0x000000000B570000-0x000000000B764000-memory.dmp

Filesize
2.0MB

Download
memory/1596-840-0x0000000006190000-0x00000000061E6000-memory.dmp

Filesize
344KB

Download
memory/3908-351-0x0000019B77A10000-0x0000019B77C04000-memory.dmp

Filesize
2.0MB

Download
memory/3908-353-0x00007FFE9D990000-0x00007FFE9E452000-memory.dmp

Filesize
10.8MB

Download
memory/3908-792-0x00007FFE9D990000-0x00007FFE9E452000-memory.dmp

Filesize
10.8MB

Download
memory/3908-352-0x00007FFE9D993000-0x00007FFE9D995000-memory.dmp

Filesize
8KB

Download
memory/3908-339-0x00007FFE9D993000-0x00007FFE9D995000-memory.dmp

Filesize
8KB

Download
memory/3908-340-0x0000019B729A0000-0x0000019B735D8000-memory.dmp

Filesize
12.2MB

Download
memory/3908-349-0x0000019B76B30000-0x0000019B7771C000-memory.dmp

Filesize
11.9MB

Download
memory/3908-348-0x00007FFE9D990000-0x00007FFE9E452000-memory.dmp

Filesize
10.8MB

Download