xworm | hxxps://send[.]exploit[.]in/download/331f155401396937/#kDY2UXj6010ZyucrRa5Tjg

Resubmissions

21-11-2024 17:29

241121-v2vqhsyleq 10

Analysis

max time kernel
273s
max time network
272s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21-11-2024 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://send.exploit.in/download/331f155401396937/#kDY2UXj6010ZyucrRa5Tjg

Score

10^/10

xworm discovery execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:7000

Mutex

ypBAFnbDUrfrztJx

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 7 IoCs

resource	yara_rule
behavioral1/files/0x000800000002a846-642.dat	family_xworm
behavioral1/memory/4600-650-0x00000000002C0000-0x00000000002EA000-memory.dmp	family_xworm
behavioral1/files/0x001900000002abd8-728.dat	family_xworm
behavioral1/files/0x001a00000002abde-756.dat	family_xworm
behavioral1/files/0x0005000000025004-761.dat	family_xworm
behavioral1/files/0x0007000000025ae5-775.dat	family_xworm
behavioral1/memory/1448-777-0x0000000000A20000-0x0000000000A30000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3100	powershell.exe
4728	powershell.exe
2280	powershell.exe
5048	powershell.exe
2324	powershell.exe
4172	powershell.exe

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x001900000002abbd-612.dat	net_reactor
behavioral1/files/0x000800000002a846-642.dat	net_reactor
behavioral1/memory/4600-650-0x00000000002C0000-0x00000000002EA000-memory.dmp	net_reactor

Executes dropped EXE 7 IoCs

pid	Process
3988	XwormLoader.exe
4600	svchost.exe
2704	Xworm V5.6.exe
1452	svchost.exe
1448	XClient.exe
2688	svchost.exe
2360	svchost.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3292	timeout.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Xworm V5.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133766838211157652"	chrome.exe

Modifies registry class 62 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0 = 60003100000000007559e38b100058574f524d567e312e360000460009000400efbe7559d28b7559e38b2e0000003baa020000001e000000000000000000000000000000e0168700580057006f0072006d002000560035002e00360000001a000000	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000000000002000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\NodeSlot = "6"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\MRUListEx = ffffffff	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Xworm V5.6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000000000001000000ffffffff	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0 = 60003100000000007559d28b100058576f726d5f56352e360000460009000400efbe7559d28b7559d38b2e0000004aa8020000000300000000000000000000000000000076903f00580057006f0072006d005f00560035002e00360000001a000000	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Rev = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = 00000000ffffffff	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 010000000200000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\MRUListEx = 00000000ffffffff	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Xworm V5.6.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\XWorm_V5.6.rar:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3976	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4600	svchost.exe
4716	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
2356	msedge.exe
2356	msedge.exe
5004	msedge.exe
5004	msedge.exe
4944	identity_helper.exe
4944	identity_helper.exe
4728	msedge.exe
4728	msedge.exe
1460	chrome.exe
1460	chrome.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
5048	powershell.exe
5048	powershell.exe
5048	powershell.exe
2324	powershell.exe
2324	powershell.exe
2324	powershell.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
4600	svchost.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe
2704	Xworm V5.6.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2704	Xworm V5.6.exe
4716	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeShutdownPrivilege	1460	chrome.exe
Token: SeCreatePagefilePrivilege	1460	chrome.exe
Token: SeRestorePrivilege	5088	7zG.exe
Token: 35	5088	7zG.exe
Token: SeSecurityPrivilege	5088	7zG.exe
Token: SeSecurityPrivilege	5088	7zG.exe
Token: SeDebugPrivilege	3988	XwormLoader.exe
Token: SeDebugPrivilege	4600	svchost.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	2280	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: 33	1704	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1704	AUDIODG.EXE
Token: SeDebugPrivilege	1452	svchost.exe
Token: SeDebugPrivilege	1448	XClient.exe
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	1448	XClient.exe
Token: SeDebugPrivilege	2688	svchost.exe
Token: SeDebugPrivilege	3992	powershell.exe
Token: SeDebugPrivilege	428	powershell.exe
Token: SeDebugPrivilege	2360	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
1460	chrome.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2704	Xworm V5.6.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4600	svchost.exe
2704	Xworm V5.6.exe
3424	vbc.exe
2704	Xworm V5.6.exe
1312	vbc.exe
1448	XClient.exe
4716	explorer.exe
4716	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1104	2356	msedge.exe	77
PID 2356 wrote to memory of 1104	2356	msedge.exe	77
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 4580	2356	msedge.exe	78
PID 2356 wrote to memory of 3924	2356	msedge.exe	79
PID 2356 wrote to memory of 3924	2356	msedge.exe	79
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80
PID 2356 wrote to memory of 3552	2356	msedge.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://send.exploit.in/download/331f155401396937/#kDY2UXj6010ZyucrRa5Tjg
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa3c4a3cb8,0x7ffa3c4a3cc8,0x7ffa3c4a3cd8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,17013329744782320285,10576914801547263729,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,17013329744782320285,10576914801547263729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,17013329744782320285,10576914801547263729,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,17013329744782320285,10576914801547263729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,17013329744782320285,10576914801547263729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,17013329744782320285,10576914801547263729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,17013329744782320285,10576914801547263729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,17013329744782320285,10576914801547263729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,17013329744782320285,10576914801547263729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,17013329744782320285,10576914801547263729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,17013329744782320285,10576914801547263729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,17013329744782320285,10576914801547263729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,17013329744782320285,10576914801547263729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3228 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,17013329744782320285,10576914801547263729,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5428 /prefetch:2
  2⤵
  PID:4100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffa2971cc40,0x7ffa2971cc4c,0x7ffa2971cc58
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,8563951123295301393,1765057015841123078,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1712,i,8563951123295301393,1765057015841123078,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2052 /prefetch:3
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,8563951123295301393,1765057015841123078,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2184 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,8563951123295301393,1765057015841123078,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3096,i,8563951123295301393,1765057015841123078,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4436,i,8563951123295301393,1765057015841123078,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4728,i,8563951123295301393,1765057015841123078,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4688,i,8563951123295301393,1765057015841123078,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:4888

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3172

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\XWorm_V5.6\" -spe -an -ai#7zMap11316:78:7zEvent13143
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\XwormLoader.exe
"C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\XwormLoader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3988
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3976
- C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\Xworm V5.6.exe
  "C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\Xworm V5.6.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2704
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ijphypfa\ijphypfa.cmdline"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3424
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A81.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD2F73A02F3E94678BA66D4F7F7922CCA.TMP"
      4⤵
      PID:4764
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zlny3nts\zlny3nts.cmdline"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1312
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB5B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB60610DDA93C4D18A94B71699C672F70.TMP"
      4⤵
      PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB2FF.tmp.bat""
  2⤵
  PID:3052
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3292

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3744

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\ProgramData\svchost.exe
C:\ProgramData\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\XClient.exe
"C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\XClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -c explorer shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3992
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" shell::: -encodedCommand MwAwADgAMABGADkAMABFAC0ARAA3AEEARAAtADEAMQBEADkALQBCAEQAOQA4AC0AMAAwADAAMAA5ADQANwBCADAAMgA1ADcA -inputFormat xml -outputFormat text
    3⤵
    PID:2584
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:428

C:\ProgramData\svchost.exe
C:\ProgramData\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4716

C:\ProgramData\svchost.exe
C:\ProgramData\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
b6c8383d1c553076018709d744e9c120

SHA1
2c3bc03ba57e32de53e1606df21bc4cb0bc507b2

SHA256
eaacf51a4a799b76a2775f722d31a28a17edc8829a2618186c68ae1a25cd84c8

SHA512
1bd6256e80c631b17332a2881260e0e78c3423cb3f9634fc97a998fe5dabf87aaa1eb00e41a53b77f08b1ab05a67c0cae909185efd59c5a40d3e7a9bac81f603

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
0bdb42a9b7bfbfd4b140b4c378af15e4

SHA1
e58f2ac7495ee2222c539089336032bfd486b0da

SHA256
fa649a061cfb0cb963e2523da04f2c699c9a96c60fff0c39cc792a232cfe50cd

SHA512
afc9994959ba920553ad2a3e088503d0a048c84f5001dcfc08f5af5a9c40766b2f16188f3e3640cae510698c0fa6e4589e73dec172244e1e8befeb11de154a3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
3a0452a0510b199146c1f0e8c9048cda

SHA1
f1cb234b7a5d559bea62f10d1397d6bf386ca5d2

SHA256
4d3c1f877f9ed4cfebaf5a56f02d8e4f1c573dca5fa59f247aea8b42c1f1eb51

SHA512
4b8f68144d45da9c5c5e138f5d10c0372a479a9e7532d1b4ff7540c8b066ded5a316a660bbae22d8faca9901089c9a9c6d395c4b3e0e03fc0ea3d3c92197a661

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
158fbfb9a460920e68bd8d6d3b85946c

SHA1
c37dd7624fcd9f221127841cbe990c2c8c788d9d

SHA256
1a33bcf523275d7d08b0d999e04c0069fc348a40ab24bc6ccd85e537c84888a4

SHA512
948661d6f73dcc6cffcf678ba5d38267f4c662d11b1da8dc8578ea82bff329bb70066e7f9ebcedcfa73f50dc77e4bfc95a5e849bc3cc6e2a597a2d0afde84f4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
e7c2d2f54a477e780a0b48cbfa6e40b0

SHA1
7645e204fd9da33d6210b2785a0a48b876848204

SHA256
4b472d287e03c0d0aeeadb600f576abdd0eb2bb30937a2bbe9a89d0fb0ee6405

SHA512
29f1034f275881c64102861eb20ed82a771d64b02e5e3813fa3f4e1fab71caacd7b112612a45619af61703c6c2d0506fd84957af7cc8d624fd97399cab830787

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
4f6c2e9790bf8b79d13a77ed3d6a15c1

SHA1
3d69f98a42a0c827b851d10d5943fd6b0102d59e

SHA256
cf99defcd175b27521abccfa4f07d202bcb7a81dce0cfa63b04815550a240414

SHA512
d5686440a857c691140a779b881a917931ac7d1a69d19197e9d94496b05c083f2d040132fc2196870ae4146b93c9edc01b3a23c11d2f875b420cce18f0fe55da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
7f8a8768ba0c864dd58bcd0e28de18a6

SHA1
71a04fc697457fd639d9f409840ab2fed6660185

SHA256
1c08c352a863e2058e6f60060809763420351284d7e9200580ad0e821b5903da

SHA512
401980c05e9ad429f5b3a5fcc4aac8ffa73565a6322a3451065625c305ccea71ae414705d20a159e7ed14e49620b8f14b3d416391526db992fcb236d51b1c72e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
f70a70c8adce6dae01db7c8afb3c1280

SHA1
5a8e5859069be43ab5c99fad187a4ad91e2c0c71

SHA256
b84c9d7a1f4af35d51d893f5cc89d3a794cb7432c5449b3d3c29e23710079b05

SHA512
ca9e908a6d902b5f578dd2f661bebdf38ee336205e2e021dd52070123ac44f8e5d0b9ec89f0644dfc2042f97f42f1e83bf0263fc5392c16f9f6a579744dd3d47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
14ab569b1c39ed54aa94ce24f1dad738

SHA1
b5fcee7196dddb7f20d102495ff23f1318a77e08

SHA256
2845ef8e9dba19b3d061dfb9aca831894f681f52ba506f471caf9dc6a2176ab2

SHA512
c79d72b368ff174634800efafa44d0f0ef1af787d24820b48fd6be8cccae153a1f5105e016668b726213b769705db9a09a782bc29b5fd959c771bf05ac4847f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cfcfc67c5b911396b756c77e6e2d0d25

SHA1
a1c9e9556b734e048e83a9453ed19e754a7ecdec

SHA256
2dce0275c8b7b2f3fcf849cf0801eb8bf5a99ffbc9b5b3167e0e6fa0c76685b9

SHA512
9753a67fd0b073367e86cbb2d49d5e7acbd5c3d2acaa04ea3903dbc2ffc8e7ba68748a3ac219dcd08a05c1c46bde1c153ee6043aad511a8615fba5e3a28812f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
34f530f1d999f856a9bb540469d7624a

SHA1
e4e7cb273de2ec9b26abf2a737ba4427c0bf918c

SHA256
6e9d7e932e7311d40f9869460f09e7b896e5072b98376c041114ad4ca5f08e13

SHA512
1a5ab842cac1cb975a260b89cc5aa3a55fcc3e46271659cce34ed7ec3fca9eb7afe861a0b54d72d51e215cb805e3ecc6977242906effd3e0b8b2416b0e84bf07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4ea6e46be70cd0500d27031dfb874d8aa52aadfa\41279c94-ac6d-4b78-bf76-d05cd0b9e2c9\index-dir\the-real-index

Filesize
192B

MD5
49e1d2c6f2cc5e0af0828363b1b2565f

SHA1
c51d6e969eab5abdd920cafcd64c903379a2837c

SHA256
4d9e114c4c1a08538b3abd5a3b1e6678ed7c0130ac6f2961f0583d96b4690d39

SHA512
4bf08242b741e1e483c8d855102642adf28a369d15bf9e508b88058d1171932fd41492be0c5f98994af28f99407364add124365162e15a336e293ca8904c8a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4ea6e46be70cd0500d27031dfb874d8aa52aadfa\41279c94-ac6d-4b78-bf76-d05cd0b9e2c9\index-dir\the-real-index

Filesize
168B

MD5
ef9939ec964e1f3e19aa2cd8f71cc3fa

SHA1
84c98da6cb4cdcad43e437ae3759158e081d5426

SHA256
69062d8bee5fb130a9c4cd2ad9ede8c2f58a190638cca2e2b47bf78fa5f416e8

SHA512
6729a2d0369455bf157b2b0e100452242b29122072b5f18c858c6cae585a74cbf91191cd09d0c5a529d819a1867d400b16289584588ee266b23985c3378e2447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4ea6e46be70cd0500d27031dfb874d8aa52aadfa\41279c94-ac6d-4b78-bf76-d05cd0b9e2c9\index-dir\the-real-index~RFe580366.TMP

Filesize
48B

MD5
eb4370ad216d9fd39808acab74da6521

SHA1
863acf794b7f14d98a995dbbe8b01803d2cd0978

SHA256
7265974a35fef4b7371651809d8f19392cf0721f6b972798b269a8af9a74482f

SHA512
c129e5c0dc979c875ef1b3d730f2922f317140dfa3be013815b4c7ce1e7780afe2731c9fe1727092fa27f679f3b3d2b7c5cecf2e7d47b80c746168d90479944d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4ea6e46be70cd0500d27031dfb874d8aa52aadfa\index.txt

Filesize
87B

MD5
6195ddc7994386b254a5f389a15c69c0

SHA1
a769f721b575eaad5e5ac7f86ccc7edcd37b71f6

SHA256
38912781eb12e20a1cebd08524fd6822d9dab5b7f78fd23e81b8089e8baa1409

SHA512
8a13aa73c618d44e67cbc6d64d63973c0bebec1b767c5d69bad94b1b782f59ba05351ce97a3adb31870b674a980710bece513aef57b69e405a0f1fb7cdb61ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4ea6e46be70cd0500d27031dfb874d8aa52aadfa\index.txt

Filesize
82B

MD5
bff79a680b07b413e25e04dfc518f1c7

SHA1
3a6ee81363366dc252c623b1846766b287759291

SHA256
24d573c37f8e7a2b61690f54db79851105232b762b272eeb08e636594e659cda

SHA512
2a2b47729afdced00be34b654f8d5a7e8427c575bba75bce9eeb04164debd2f6bfd3f3f549979640e29d6f197efa9e4ce501b6671200156d1d96995a5e90df1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4ea6e46be70cd0500d27031dfb874d8aa52aadfa\index.txt.tmp

Filesize
82B

MD5
05224addc7890e0e7baa91597f05a5d9

SHA1
91cde92bc9d39db40d5be20ef2ffacd1669913e6

SHA256
282e3589701223b00fdf19daca4d84ff1333599a73c27d210eb489ef370c6871

SHA512
75e7aea03c4c32a2a75e719e4357d4cc3497b79a0eafe323428d5b8f919b3d656b75bcdb1e5f6189fb499d7abd8a08950510d5524e42fbf34162345ad4b10233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
469a795e608fe955c9313dfe0dfa4e80

SHA1
397ec305ab2eb71adf2ac95a4be4e2c061ac0077

SHA256
883ec62936d8071057ba20631eb18fc3e0b1a221f33aa1beb8cc93f1ccda578e

SHA512
2ca723599428e25255533fc7952d398f08602e840506600553f0d1fd1684137a741b462c77ce46f2b5f66bf4e2123302b9b2e7e5da51a20fffbbbb4d63586c15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f7cd.TMP

Filesize
48B

MD5
fa966a222e1a98e45677ec743872e581

SHA1
079d433780cec7879be2dbca363ce7c0dfa57b84

SHA256
35500b4c8aca2024cd7b1d59f57df9b7c1e140a64a25b4dfb830404cf9890ccb

SHA512
79b83535c023831132b4f97f6cb005ac663dfbf916908fe2a6311dbd7512e69f85510badca7f09317be11b1f5ea933498aa7fd33f721b452af5230a376c87b35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
a312ba9a426b9b24e52e80b191f604df

SHA1
8586b60ffa0f45682a2b7be4b59dcbdd699457a0

SHA256
beff501ef803a34970562ea6ee27f1d445ba3112dada30c91eb2fe7f88ccbdf5

SHA512
ac9de854513538aaab0435ff9c49ad69e480d7e0e3ebeba60ab0674108aae02fe50bf3b51eb44380a35c2f972b9fc0eac95d2873854680831ae1b4b33470c701

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580308.TMP

Filesize
203B

MD5
cd83543c6d6eb935ee0aa8ceb5fb4727

SHA1
d65d7386bb8e5c581ec8cf2e740198ed081c59ea

SHA256
af724359a8a34d78a4055dbc83b71de3e3d3bd5db940226cf3d86de83b686d46

SHA512
55415071272a0c6bb33162b4ceddad7d133989ffbb99e2dc6e59da8d7969df10ea72bbcc2d972475b9a8b695beb23edde0e08d3df9296a771fba022fe85c0df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aed3becee12cc0de756e90c77712dff2

SHA1
f601e9fda10088a3f838c9615a833b20c5096be2

SHA256
0e12df4c2026dfe9a65ed447425dfece6b4da29426d3ca03661f9dead7cd5c64

SHA512
47c596c4a792d64f8b387e6ef328928756c2d89c83e403ed7a831e949fdce5ec051f63c998833cc5fc150788e3d59c7d407f131973fa7877bbd50a0fcd9dd335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d2f03a037de1a634da39501ff914f042

SHA1
0f692895390924649530ff2405e74b2d2611ca6c

SHA256
beb923dcbc6da5221551b1c2b354cbca137c7feb3b8fb20b93250ce9c78378af

SHA512
ec4d3e478556ff448354e48217cfd0a77a059f08d5f490924153ce467f7dfebc26a2a40b75f49075b9315cc0a0e7be8d8aa092f5ab11ea4a6ff80aea132460bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e3840d9bcedfe7017e49ee5d05bd1c46

SHA1
272620fb2605bd196df471d62db4b2d280a363c6

SHA256
3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f

SHA512
76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cef328ddb1ee8916e7a658919323edd8

SHA1
a676234d426917535e174f85eabe4ef8b88256a5

SHA256
a1b5b7ada8ebc910f20f91ada3991d3321104e9da598c958b1edac9f9aca0e90

SHA512
747400c20ca5b5fd1b54bc24e75e6a78f15af61df263be932d2ee7b2f34731c2de8ce03b2706954fb098c1ac36f0b761cf37e418738fa91f2a8ea78572f545cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
051a74485331f9d9f5014e58ec71566c

SHA1
4ed0256a84f2e95609a0b4d5c249bca624db8fe4

SHA256
3f67e4ba795fd89d33e9a1fe7547e297a82ae50b8f25eedc2b33a27866b28888

SHA512
1f15fd8ca727b198495ef826002c1cbcc63e98eecb2e92abff48354ae668e6c3aaf9bd3005664967ae75637bacee7e730ce36142483d08ae6a068d9ae3e0e17d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
df808b11175970c23f00e611a7b6d2cc

SHA1
0243f099e483fcafb6838c0055982e65634b6db6

SHA256
2d5eec6aeee0c568d08cc1777a67b529dce3133efc761ef4b4643d4b2003d43d

SHA512
c7c4e39be7cb6bfda48055cd2b0b05a6b6a71131a124730f62928600a5870303e06e3db54634c45f86310413126d2524f51002d5f36f7012e41b641992b5ac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9A81.tmp

Filesize
1KB

MD5
7a82f2609ce771dc5018180b543bc4f5

SHA1
5110bc0697873706d9dd7139f822b01043c00f3a

SHA256
41667739f3b582011bc8465be76875da46e670501bac4901364104cdf1057b07

SHA512
9b92aa5319592169552752ec41c0fa5cd2d3f93f93030f1f32729bb73e011402d37e3a8e44366f5c05a5371424f349ea4dc09a8098f8d5fdd2529f7ade746463

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB5B.tmp

Filesize
1KB

MD5
8543499f7677ed961d701f04499abd71

SHA1
4944b3277a575ecf5a067658d731e8ebf68b05e7

SHA256
0229f562fd78bfefb3b75cc7dea8161db1399b4ae43f1cd2951a7cb89404a5d1

SHA512
fe461a90998827494ee66ec68489162cb483ab6334e27b0c95e799bd3aabd5816fa47972500f0bf8feb21551fd95ec5808bb95c1a16533feadf74044fd28bfde

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c2ne1cng.zkq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ijphypfa\ijphypfa.0.vb

Filesize
78KB

MD5
5e5a6a5e0ff86fa9f9ae50075c494102

SHA1
9ba093037291dbfbeb332333dcc5eb6e665331a5

SHA256
7a7e91e83677347dc3576a2942a854051d7a7dee84ae0ad0b0af891fc6b0b8c8

SHA512
1d477196ce5b48cb988d10a34e407f75dfd2b903e2e1ff586b0b33e3d83802dd9cf7cd6bd5f922483d8396b2ac7eef14f619e4833b29b66bb0e42f436b5855a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ijphypfa\ijphypfa.cmdline

Filesize
312B

MD5
90665e640376f9711a1c762236894e2b

SHA1
6afc1019a7933b5db5245b2c20f338715f8605bb

SHA256
1f32960cbcefaec92600dcb65b2804899bf84aa6ab391aebd29bf4c20f7ab470

SHA512
37a4b8ce4f519b17c437493480607845e1e51d34df99149a026d5f116924a39daf56facaefe7efca1abc0aefa9a1a77165a08c5cd1aa830982c5ab4adfa745ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
144KB

MD5
4b90399888a12fb85ccc3d0190d5a1d3

SHA1
3326c027bac28b9480b0c7f621481a6cc033db4e

SHA256
cede03d0ef98d200bd5b68f6ca4e0d74e2a62fc430a38083663c3031dbb1c77f

SHA512
899ec2df2f5d70716ad5d0686bfe0a6c66ccbcf7f0485efbdfc0615f90b3526cd3d31069fa66c7c6ae8bba6ce92200836c50da40a3731888b7326b970d93216a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB2FF.tmp.bat

Filesize
174B

MD5
9fc70ddf9c8e5a33a357538012c4f9b7

SHA1
be09611ab84b06d0315fbabd278b9add625f5c7c

SHA256
b9756244c0ae228f390e47cdfe202d8f43188cf6a5519587c139e0928b870623

SHA512
5a874daad80df8a4dd66b440dddbea54d868db0eb1ba820e1163fb17b916cb4346235ad037d2a13d3ab09fbc7691f84185d4f3f48bcb03ea3b66b1f8caf2bb2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcD2F73A02F3E94678BA66D4F7F7922CCA.TMP

Filesize
1KB

MD5
d40c58bd46211e4ffcbfbdfac7c2bb69

SHA1
c5cf88224acc284a4e81bd612369f0e39f3ac604

SHA256
01902f1903d080c6632ae2209136e8e713e9fd408db4621ae21246b65bfea2ca

SHA512
48b14748e86b7d92a3ea18f29caf1d7b4b2e1de75377012378d146575048a2531d2e5aaeae1abf2d322d06146177cdbf0c2940ac023efae007b9f235f18e2c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\zlny3nts\zlny3nts.0.vb

Filesize
78KB

MD5
4bb3d1a6fbc48909aa3eea8d10187bcd

SHA1
1ca76ed79ed2606db374a40bf65896bdb17cebaf

SHA256
9964307acbc0bd1bc6881c35591695597c3815da417fa1d05df30a10b588c2c8

SHA512
28e34b5b844093d240e606eaf600b70af6306376b69039759dd3752161b69734f13378cc87a7919a7f6ed9cde533fc9e5600f6c9e0c68aec2540f3d2887101fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\zlny3nts\zlny3nts.cmdline

Filesize
312B

MD5
79d6653bee1c084ab5870e0ac30ca7f0

SHA1
1f73a7c59954f6f15489bfaf8c83b58677a1b5b2

SHA256
be9eb9a6a8f45642c76e7038fe84a45ad22241131f6c40cbcc28c2941103e98f

SHA512
d5de74bf6ced490600a9f7cbc55db4c897c6ead79165e1b0894f862ebfa46a75a10aa3179057537c652032d7b8e87015b7a4e4b9b448b9ee9361d77cf8dc761f

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6.rar

Filesize
22.7MB

MD5
bf2914828889b9f53f5dca3d9bda6f17

SHA1
7155e7938a6474d637a83c692eb60d34a8c6e94b

SHA256
0a10a2d40d0d1af7fe2d6c90e6ec033bebac388c247845459c59a6cb3e1f1350

SHA512
304b612339c0698c4ced92672eb559be4bcdfcdf94c16621430d8822939b970ee9491a7686aa36c3e14527bf0137728c57462e5bbc2107aab32bdce2f929727f

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\GMap.NET.Core.dll

Filesize
2.9MB

MD5
819352ea9e832d24fc4cebb2757a462b

SHA1
aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11

SHA256
58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86

SHA512
6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\GMap.NET.WindowsForms.dll

Filesize
147KB

MD5
32a8742009ffdfd68b46fe8fd4794386

SHA1
de18190d77ae094b03d357abfa4a465058cd54e3

SHA256
741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365

SHA512
22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\GeoIP.dat

Filesize
1.2MB

MD5
8ef41798df108ce9bd41382c9721b1c9

SHA1
1e6227635a12039f4d380531b032bf773f0e6de0

SHA256
bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

SHA512
4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\Guna.UI2.dll

Filesize
1.9MB

MD5
bcc0fe2b28edd2da651388f84599059b

SHA1
44d7756708aafa08730ca9dbdc01091790940a4f

SHA256
c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

SHA512
3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\NAudio.dll

Filesize
502KB

MD5
3b87d1363a45ce9368e9baec32c69466

SHA1
70a9f4df01d17060ec17df9528fca7026cc42935

SHA256
81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451

SHA512
1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\Plugins\ActiveWindows.dll

Filesize
14KB

MD5
5a766a4991515011983ceddf7714b70b

SHA1
4eb00ae7fe780fa4fe94cedbf6052983f5fd138b

SHA256
567b9861026a0dbc5947e7515dc7ab3f496153f6b3db57c27238129ec207fc52

SHA512
4bd6b24e236387ff58631207ea42cd09293c3664468e72cd887de3b3b912d3795a22a98dcf4548fb339444337722a81f8877abb22177606d765d78e48ec01fd8

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\Plugins\Chat.dll

Filesize
18KB

MD5
59f75c7ffaccf9878a9d39e224a65adf

SHA1
46b0f61a07e85e3b54b728d9d7142ddc73c9d74b

SHA256
aab20f465955d77d6ec3b5c1c5f64402a925fb565dda5c8e38c296cb7406e492

SHA512
80056163b96ce7a8877874eaae559f75217c0a04b3e3d4c1283fe23badfc95fe4d587fd27127db4be459b8a3adf41900135ea12b0eeb4187adbcf796d9505cb8

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\Plugins\Chromium.dll

Filesize
32KB

MD5
edb2f0d0eb08dcd78b3ddf87a847de01

SHA1
cc23d101f917cad3664f8c1fa0788a89e03a669c

SHA256
b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982

SHA512
8f87da834649a21a908c95a9ea8e2d94726bd9f33d4b7786348f6371dfae983cc2b5b5d4f80a17a60ded17d4eb71771ec25a7c82e4f3a90273c46c8ee3b8f2c3

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\Plugins\Cmstp-Bypass.dll

Filesize
11KB

MD5
cf15259e22b58a0dfd1156ab71cbd690

SHA1
3614f4e469d28d6e65471099e2d45c8e28a7a49e

SHA256
fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b

SHA512
7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\SimpleObfuscator.dll

Filesize
1.4MB

MD5
9043d712208178c33ba8e942834ce457

SHA1
e0fa5c730bf127a33348f5d2a5673260ae3719d1

SHA256
b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c

SHA512
dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\Sounds\Intro.wav

Filesize
238KB

MD5
ad3b4fae17bcabc254df49f5e76b87a6

SHA1
1683ff029eebaffdc7a4827827da7bb361c8747e

SHA256
e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf

SHA512
3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\XClient.exe

Filesize
39KB

MD5
bace41b4f9764fd36781802467769278

SHA1
aa3bebfd6b3ec16521aaf71475f3cd40daa6b0c4

SHA256
d2f3efdf430fa93d46c851b8f24de5e5ac34fec17c582609264016eaa3cd0cb6

SHA512
42c14d9cd4fea63693cc8a848f13b3b0260f1e89bc123c623386b90d78c25827ba7a967078b657505293d6bb66d79ea65c78537f8df1fdbf50e1749d37295681

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\XClient.exe

Filesize
32KB

MD5
aac7778d3e7cd9c5ea2b20d4fb4efbd4

SHA1
03fa2a8832c094116f66f6a2a3447d3dfa527359

SHA256
92427ac5d6ab746473f202ffd09b6001a9620e5d4a599e7570a11c220eb63633

SHA512
4cac5106fcce14963025655d5891302c66b89b772d4f5d1b5cf4591f0436fb856ad4b43043bfde4526192c5a0a884373e4576f62aad504f155cd98d018d1a7ab

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\Xworm V5.6.exe

Filesize
14.9MB

MD5
db51a102eab752762748a2dec8f7f67a

SHA1
194688ec1511b83063f7b0167ae250764b7591d1

SHA256
93e5e7f018053c445c521b010caff89e61f61743635db3500aad32d6e495abb2

SHA512
fb2fb6605a17fedb65e636cf3716568e85b8ea423c23e0513eb87f3a3441e2cabc4c3e6346225a9bf7b81e97470f3ab516feea649a7afb5cdf02faff8d7f09a5

Download Submit
C:\Users\Admin\Desktop\XWorm_V5.6\XWorm V5.6\XwormLoader.exe

Filesize
7.9MB

MD5
5b757c6d0af650a77ba1bf7edea18b36

SHA1
c2ee4e12ff4b70511dbcab25dbf8b0d45f2d52b3

SHA256
c2a9fefda9159dd2712510c1c9077a1885d0ebc45251285dad95ba7184b98856

SHA512
93ca04887c63c3a0a4a5d42c48d0f4f7cc7fe7f6dad4dd45136ac048639d2edab66a2d2459779b9a2a075fa8981ea40567b34e5ed0535c1deecfe5e838385960

Download Submit
C:\Users\Admin\Downloads\XWorm_V5.6.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/428-837-0x0000011770A40000-0x0000011770A86000-memory.dmp

Filesize
280KB

Download
memory/1448-816-0x0000000001460000-0x0000000001470000-memory.dmp

Filesize
64KB

Download
memory/1448-777-0x0000000000A20000-0x0000000000A30000-memory.dmp

Filesize
64KB

Download
memory/1448-814-0x000000001D7C0000-0x000000001D7CA000-memory.dmp

Filesize
40KB

Download
memory/2704-806-0x000001FE747A0000-0x000001FE74A82000-memory.dmp

Filesize
2.9MB

Download
memory/2704-666-0x000001FE67890000-0x000001FE68778000-memory.dmp

Filesize
14.9MB

Download
memory/2704-808-0x000001FE74300000-0x000001FE743B2000-memory.dmp

Filesize
712KB

Download
memory/2704-804-0x000001FE73E00000-0x000001FE73E2C000-memory.dmp

Filesize
176KB

Download
memory/2704-712-0x000001FE6C3B0000-0x000001FE6C5A4000-memory.dmp

Filesize
2.0MB

Download
memory/2704-741-0x000001FE71D10000-0x000001FE71DB6000-memory.dmp

Filesize
664KB

Download
memory/2704-723-0x000001FE740D0000-0x000001FE74238000-memory.dmp

Filesize
1.4MB

Download
memory/2704-802-0x000001FE73E90000-0x000001FE73F12000-memory.dmp

Filesize
520KB

Download
memory/3988-662-0x000000001EAB0000-0x000000001EF7E000-memory.dmp

Filesize
4.8MB

Download
memory/3988-637-0x000000001BF80000-0x000000001C026000-memory.dmp

Filesize
664KB

Download
memory/4600-650-0x00000000002C0000-0x00000000002EA000-memory.dmp

Filesize
168KB

Download
memory/4728-668-0x0000018447E80000-0x0000018447EA2000-memory.dmp

Filesize
136KB

Download