Analysis

  • max time kernel
    131s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2024, 22:25

General

  • Target

    XWorm.V5.3.Optimized.Bin.7z

  • Size

    29.5MB

  • MD5

    187b25b9e02c2b5d01a70d9d1855dd7c

  • SHA1

    d0c7d39012ad0507239a3b060ea42cc13b22eb65

  • SHA256

    f26803b764a54a90852b7fd274d5ced7a8a58f1715d3ab4b96900ad4f9dd0410

  • SHA512

    bea5cec59d0ebee26a71c78dc38da47a25ea7932d119868caf82b5e4bbbcecd8969abea80ad41b65352f264ced33c457a041c0d9f321c272a8f913802ee254ed

  • SSDEEP

    786432:ILW4dBG6KKNtxT6xewFcJbnYrFWNbqjnZ5M5od:3wT6xhqRsubq15bd

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Obfuscated with Agile.Net obfuscator 3 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm.V5.3.Optimized.Bin.7z"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:560
    • C:\Users\Admin\AppData\Local\Temp\7zO03218EA8\XWorm V5.2.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO03218EA8\XWorm V5.2.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:3156
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3876
    • C:\Users\Admin\Desktop\ratr\XWorm V5.2.exe
      "C:\Users\Admin\Desktop\ratr\XWorm V5.2.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1352
    • C:\Users\Admin\Desktop\ratr\XWormLoader 5.2 x64.exe
      "C:\Users\Admin\Desktop\ratr\XWormLoader 5.2 x64.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
        2⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3084
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff971c946f8,0x7ff971c94708,0x7ff971c94718
          3⤵
            PID:3836
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3642588194404504118,16576495321049459574,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
            3⤵
              PID:2272
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3642588194404504118,16576495321049459574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:368
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3642588194404504118,16576495321049459574,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
              3⤵
                PID:2596
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3642588194404504118,16576495321049459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
                3⤵
                  PID:1904
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3642588194404504118,16576495321049459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
                  3⤵
                    PID:1956
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3642588194404504118,16576495321049459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
                    3⤵
                      PID:540
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3642588194404504118,16576495321049459574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
                      3⤵
                        PID:516
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3642588194404504118,16576495321049459574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
                        3⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:944
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3642588194404504118,16576495321049459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                        3⤵
                          PID:2108
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3642588194404504118,16576495321049459574,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
                          3⤵
                            PID:212
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3642588194404504118,16576495321049459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
                            3⤵
                              PID:2288
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3642588194404504118,16576495321049459574,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
                              3⤵
                                PID:2968
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3642588194404504118,16576495321049459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
                                3⤵
                                  PID:1468
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3642588194404504118,16576495321049459574,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
                                  3⤵
                                    PID:1672
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
                                  2⤵
                                    PID:2164
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff971c946f8,0x7ff971c94708,0x7ff971c94718
                                      3⤵
                                        PID:1400
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:4336
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:316

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        37f660dd4b6ddf23bc37f5c823d1c33a

                                        SHA1

                                        1c35538aa307a3e09d15519df6ace99674ae428b

                                        SHA256

                                        4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

                                        SHA512

                                        807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        d7cb450b1315c63b1d5d89d98ba22da5

                                        SHA1

                                        694005cd9e1a4c54e0b83d0598a8a0c089df1556

                                        SHA256

                                        38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

                                        SHA512

                                        df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        5KB

                                        MD5

                                        e54f69b689ad7ca63ba3a66340a97231

                                        SHA1

                                        bb10244a70c9716106ea58dcd29f5c34844b9faf

                                        SHA256

                                        655c9d85029ba68cf96313fbbe93d5760bfb086d1ce870842a0cfb6a3438f0f7

                                        SHA512

                                        381139f3215f9286205703957d7ac76fc9f3c54b1b0a991e2f36e5fbeb2298e843aad0a75e3f846b0608f8a0de8187d51787abf63f09076baa9a28615d1e06b2

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        ac3877930cf724402b7bb9ef62f22cbd

                                        SHA1

                                        29cd38eff093c455fc58ee811b0ef6dbf6062882

                                        SHA256

                                        872e284f0404757701bf011b2855cba40a5d71427fe9172405d5d24995849138

                                        SHA512

                                        00637e61a5541b9e2c7b660f3f21c208a265694d0f2767d064f134e54a90ffdcf581c82de6d619944f2fa88a822aadd04075ea3fc49d229eed36810fa83e04f8

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                        Filesize

                                        16B

                                        MD5

                                        6752a1d65b201c13b62ea44016eb221f

                                        SHA1

                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                        SHA256

                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                        SHA512

                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                        Filesize

                                        10KB

                                        MD5

                                        73777c4b230c9f7a96438274207adc48

                                        SHA1

                                        2bf8e2a070b339a935747a61f857032fa0c3e209

                                        SHA256

                                        a0373fa8c9471e48a0f133ad6a1224fc0dc1c2b953e0663e671615601c2e6442

                                        SHA512

                                        23c5e82140d9f717d6ff3f199a12a8a0f5ee4f2d4d44afe2e3ae8f2012ed50b0f317446c5956cb9198f7a826c3d280d3bda5b3af4733fe95591d2efcb97cffa9

                                      • C:\Users\Admin\AppData\Local\Temp\7zE03221B39\Icons\icon (15).ico

                                        Filesize

                                        361KB

                                        MD5

                                        e3143e8c70427a56dac73a808cba0c79

                                        SHA1

                                        63556c7ad9e778d5bd9092f834b5cc751e419d16

                                        SHA256

                                        b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

                                        SHA512

                                        74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

                                      • C:\Users\Admin\AppData\Local\Temp\7zO03218EA8\XWorm V5.2.exe

                                        Filesize

                                        13.8MB

                                        MD5

                                        897201dc6254281404ab74aa27790a71

                                        SHA1

                                        9409ddf7e72b7869f4d689c88f9bbc1bc241a56e

                                        SHA256

                                        f41828bd13a3a85fdf7a1d688b21ce33d2015c3c5f46b4d92ab6ea8ea019e03a

                                        SHA512

                                        2673cd7b927ffc22f3a4b4fbfcb1b4f576c416d67168e486e6d79fdd132129c9e244e36d7b7883a4a1ed51e993cc4384bf24f2fa3129584f2bd43fd16042de20

                                      • C:\Users\Admin\AppData\Local\Temp\RFZzY\RFZzY.dll

                                        Filesize

                                        112KB

                                        MD5

                                        2f1a50031dcf5c87d92e8b2491fdcea6

                                        SHA1

                                        71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f

                                        SHA256

                                        47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed

                                        SHA512

                                        1c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8

                                      • C:\Users\Admin\Desktop\ratr\GeoIP.dat

                                        Filesize

                                        1.2MB

                                        MD5

                                        8ef41798df108ce9bd41382c9721b1c9

                                        SHA1

                                        1e6227635a12039f4d380531b032bf773f0e6de0

                                        SHA256

                                        bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

                                        SHA512

                                        4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

                                      • C:\Users\Admin\Desktop\ratr\Guna.UI2.dll

                                        Filesize

                                        1.9MB

                                        MD5

                                        bcc0fe2b28edd2da651388f84599059b

                                        SHA1

                                        44d7756708aafa08730ca9dbdc01091790940a4f

                                        SHA256

                                        c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

                                        SHA512

                                        3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

                                      • C:\Users\Admin\Desktop\ratr\Mono.Cecil.dll

                                        Filesize

                                        350KB

                                        MD5

                                        de69bb29d6a9dfb615a90df3580d63b1

                                        SHA1

                                        74446b4dcc146ce61e5216bf7efac186adf7849b

                                        SHA256

                                        f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc

                                        SHA512

                                        6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015

                                      • C:\Users\Admin\Desktop\ratr\MonoMod.Backports.dll

                                        Filesize

                                        138KB

                                        MD5

                                        dd43356f07fc0ce082db4e2f102747a2

                                        SHA1

                                        aa0782732e2d60fa668b0aadbf3447ef70b6a619

                                        SHA256

                                        e375b83a3e242212a2ed9478e1f0b8383c1bf1fdfab5a1cf766df740b631afd6

                                        SHA512

                                        284d64b99931ed1f2e839a7b19ee8389eefaf6c72bac556468a01f3eb17000252613c01dbae88923e9a02f3c84bcab02296659648fad727123f63d0ac38d258e

                                      • C:\Users\Admin\Desktop\ratr\MonoMod.Core.dll

                                        Filesize

                                        216KB

                                        MD5

                                        b808181453b17f3fc1ab153bf11be197

                                        SHA1

                                        bce86080b7eb76783940d1ff277e2b46f231efe9

                                        SHA256

                                        da00cdfab411f8f535f17258981ec51d1af9b0bfcee3a360cbd0cb6f692dbcdd

                                        SHA512

                                        a2d941c6e69972f99707ade5c5325eb50b0ec4c5abf6a189eb11a46606fed8076be44c839d83cf310b67e66471e0ea3f6597857a8e2c7e2a7ad6de60c314f7d3

                                      • C:\Users\Admin\Desktop\ratr\MonoMod.ILHelpers.dll

                                        Filesize

                                        6KB

                                        MD5

                                        6512e89e0cb92514ef24be43f0bf4500

                                        SHA1

                                        a039c51f89656d9d5c584f063b2b675a9ff44b8e

                                        SHA256

                                        1411e4858412ded195f0e65544a4ec8e8249118b76375050a35c076940826cd0

                                        SHA512

                                        9ffb2ff050cce82dbfbbb0e85ab5f976fcd81086b3d8695502c5221c23d14080f0e494a33e0092b4feb2eda12e2130a2f02df3125733c2f5ec31356e92dea00b

                                      • C:\Users\Admin\Desktop\ratr\MonoMod.Utils.dll

                                        Filesize

                                        319KB

                                        MD5

                                        79f1c4c312fdbb9258c2cdde3772271f

                                        SHA1

                                        a143434883e4ef2c0190407602b030f5c4fdf96f

                                        SHA256

                                        f22a4fa1e8b1b70286ecf07effb15d2184454fa88325ce4c0f31ffadb4bef50a

                                        SHA512

                                        b28ed3c063ae3a15cd52e625a860bbb65f6cd38ccad458657a163cd927c74ebf498fb12f1e578e869bcea00c6cd3f47ede10866e34a48c133c5ac26b902ae5d9

                                      • C:\Users\Admin\Desktop\ratr\RVGLib.dll

                                        Filesize

                                        241KB

                                        MD5

                                        d34c13128c6c7c93af2000a45196df81

                                        SHA1

                                        664c821c9d2ed234aea31d8b4f17d987e4b386f1

                                        SHA256

                                        aaf9fb0158bd40ab562a4212c2a795cb40ef6864042dc12f3a2415f2446ba1c7

                                        SHA512

                                        91f4e0e795f359b03595b01cbf29188a2a0b52ab9d64eadd8fb8b3508e417b8c7a70be439940975bf5bdf26493ea161aa45025beb83bc95076ed269e82d39689

                                      • C:\Users\Admin\Desktop\ratr\XWorm V5.2.exe.config

                                        Filesize

                                        183B

                                        MD5

                                        66f09a3993dcae94acfe39d45b553f58

                                        SHA1

                                        9d09f8e22d464f7021d7f713269b8169aed98682

                                        SHA256

                                        7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

                                        SHA512

                                        c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

                                      • C:\Users\Admin\Desktop\ratr\XWormLoader 5.2 x64.exe

                                        Filesize

                                        109KB

                                        MD5

                                        e6a20535b636d6402164a8e2d871ef6d

                                        SHA1

                                        981cb1fd9361ca58f8985104e00132d1836a8736

                                        SHA256

                                        b461c985b53de4f6921d83925b3c2a62de3bbc5b8f9c02eecd27926f0197fae2

                                        SHA512

                                        35856a0268ed9d17b1570d5392833ed168c8515d73fac9f150cf63cc1aea61c096aa2e6b3c8e091a1058ba062f9333f6767e323a37dfb6f4fa7e508a2a138a30

                                      • C:\Users\Admin\Desktop\ratr\XWormLoader 5.2 x64.exe.config

                                        Filesize

                                        187B

                                        MD5

                                        15c8c4ba1aa574c0c00fd45bb9cce1ab

                                        SHA1

                                        0dad65a3d4e9080fa29c42aa485c6102d2fa8bc8

                                        SHA256

                                        f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15

                                        SHA512

                                        52baac63399340427b94bfdeb7a42186d5359ce439c3d775497f347089edfbf72a6637b23bb008ab55b8d4dd3b79a7b2eb7c7ef922ea23d0716d5c3536b359d4

                                      • memory/1352-196-0x0000020AE0A10000-0x0000020AE0C04000-memory.dmp

                                        Filesize

                                        2.0MB

                                      • memory/3064-204-0x000002B658CD0000-0x000002B658CF8000-memory.dmp

                                        Filesize

                                        160KB

                                      • memory/3064-210-0x000002B658F70000-0x000002B658FC6000-memory.dmp

                                        Filesize

                                        344KB

                                      • memory/3064-211-0x000002B6403F0000-0x000002B6403F6000-memory.dmp

                                        Filesize

                                        24KB

                                      • memory/3064-212-0x000002B640470000-0x000002B640476000-memory.dmp

                                        Filesize

                                        24KB

                                      • memory/3064-208-0x000002B658F10000-0x000002B658F6E000-memory.dmp

                                        Filesize

                                        376KB

                                      • memory/3064-214-0x000002B658EB0000-0x000002B658EEC000-memory.dmp

                                        Filesize

                                        240KB

                                      • memory/3064-215-0x000002B658D20000-0x000002B658D3A000-memory.dmp

                                        Filesize

                                        104KB

                                      • memory/3064-216-0x000002B659DB0000-0x000002B65AB8E000-memory.dmp

                                        Filesize

                                        13.9MB

                                      • memory/3064-206-0x000002B640490000-0x000002B640496000-memory.dmp

                                        Filesize

                                        24KB

                                      • memory/3064-200-0x0000000000650000-0x0000000000670000-memory.dmp

                                        Filesize

                                        128KB

                                      • memory/3064-202-0x000002B658C80000-0x000002B658CC2000-memory.dmp

                                        Filesize

                                        264KB

                                      • memory/3156-23-0x00007FF958DF0000-0x00007FF9598B1000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3156-22-0x000001AC619B0000-0x000001AC6259C000-memory.dmp

                                        Filesize

                                        11.9MB

                                      • memory/3156-21-0x00007FF958DF0000-0x00007FF9598B1000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/3156-13-0x000001AC457B0000-0x000001AC4658E000-memory.dmp

                                        Filesize

                                        13.9MB

                                      • memory/3156-12-0x00007FF958DF3000-0x00007FF958DF5000-memory.dmp

                                        Filesize

                                        8KB