stormkitty | hxxps://github[.]com/Worm-x/XWorm-5[.]6-FULL-Source-Code?tab=readme-ov-file

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2024, 23:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Worm-x/XWorm-5.6-FULL-Source-Code?tab=readme-ov-file

Score

10^/10

stormkitty discovery stealer

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/files/0x0007000000023f84-1413.dat	disable_win_def

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023f8a-1425.dat	family_stormkitty

Stormkitty family
stormkitty

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfh007.dat	lodctr.exe
File created	C:\Windows\system32\perfh009.dat	lodctr.exe
File created	C:\Windows\system32\perfc00A.dat	lodctr.exe
File created	C:\Windows\system32\perfh00A.dat	lodctr.exe
File created	C:\Windows\system32\perfc010.dat	lodctr.exe
File created	C:\Windows\system32\perfh010.dat	lodctr.exe
File created	C:\Windows\system32\perfc007.dat	lodctr.exe
File created	C:\Windows\system32\perfc00C.dat	lodctr.exe
File created	C:\Windows\system32\perfh00C.dat	lodctr.exe
File created	C:\Windows\system32\perfc011.dat	lodctr.exe
File created	C:\Windows\system32\perfh011.dat	lodctr.exe
File created	C:\Windows\system32\perfc009.dat	lodctr.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
3924	msedge.exe
3924	msedge.exe
3304	identity_helper.exe
3304	identity_helper.exe
2872	msedge.exe
2872	msedge.exe
5712	mspaint.exe
5712	mspaint.exe
5552	msedge.exe
5552	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	4972	7zG.exe
Token: 35	4972	7zG.exe
Token: SeSecurityPrivilege	4972	7zG.exe
Token: SeSecurityPrivilege	4972	7zG.exe
Token: SeRestorePrivilege	5900	7zG.exe
Token: 35	5900	7zG.exe
Token: SeSecurityPrivilege	5900	7zG.exe
Token: SeSecurityPrivilege	5900	7zG.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
4972	7zG.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
5900	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5828	OpenWith.exe
5712	mspaint.exe
5712	mspaint.exe
5712	mspaint.exe
5712	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 3972	3924	msedge.exe	84
PID 3924 wrote to memory of 3972	3924	msedge.exe	84
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 4148	3924	msedge.exe	85
PID 3924 wrote to memory of 2672	3924	msedge.exe	86
PID 3924 wrote to memory of 2672	3924	msedge.exe	86
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87
PID 3924 wrote to memory of 2968	3924	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Worm-x/XWorm-5.6-FULL-Source-Code?tab=readme-ov-file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdae9c46f8,0x7ffdae9c4708,0x7ffdae9c4718
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1944452627165527886,13350403394137496446,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4444

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\XWorm\" -ad -an -ai#7zMap100:70:7zEvent11881
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4972

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5828

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\XWorm\XWorm\app.ico"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5892

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\" -ad -an -ai#7zMap30921:124:7zEvent11682
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Fixer.bat" "
1⤵
PID:5416
- C:\Windows\system32\lodctr.exe
  lodctr /r
  2⤵
  - Drops file in System32 directory
  PID:5708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
18KB

MD5
7d54dd3fa3c51a1609e97e814ed449a0

SHA1
860bdd97dcd771d4ce96662a85c9328f95b17639

SHA256
7a258cd27f674e03eafc4f11af7076fb327d0202ce7a0a0e95a01fb33c989247

SHA512
17791e03584e77f2a6a03a7e3951bdc3220cd4c723a1f3be5d9b8196c5746a342a85226fcd0dd60031d3c3001c6bdfee0dcc21d7921ea2912225054d7f75c896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
361KB

MD5
7299d5c3cd19c17dd5d4887c653c4b3c

SHA1
9df68872944392710713e02e77d4589176acb17d

SHA256
5a47a201b7f85208100196aa225d21785f7268242910829d0ab5ddfe1b0fd260

SHA512
9be959d7f73d963d1c3e5d850b82f0a64810b6e42203657c1e460047a73f4d2a25cbadfb0b2526c3bd16ada0029ddb5dbf47b4b0b3560ddde4f87a07087a0faa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
8240ac820d9f61a6204415803f0e8381

SHA1
0e4d290ac007291919352dd22ea7ab00a761849c

SHA256
d6bc96eba09bfcc706d2a4bbb3c9502f13efc7cba59a6115b4869721564cfe0a

SHA512
03d60d8b23f70c20777bbe59015c2504a42e91938acc08329f2dcd4ee403980c1c167892c78a7bd2d0b1c09f72d757a9da4215b1d7d7858dcebbff5b7d1ce54a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cde0f6226268295863713e1f352fcb6e

SHA1
b24735c1c8a60e3353e5ad6362df595bafaa4276

SHA256
e936a7d9f8d2aca242533e96a8be042dc28a6c1f9a78d2a6dfc7488ecadbb5f6

SHA512
32a6f8d8b85381038f688928a56670c4f5964e48071e2f32f37eedda570df0d80bfae1a99aa3125f521a289b8ce8c33f0a62f5d5fe3fe17591432f46dc6123e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
672B

MD5
76c4c24848b89d88f404014d51da658b

SHA1
bb2c1e349489e503d5439ab6bcc643a142a6f155

SHA256
fb3515d204b9f4da23c57984c7cfea1d7b4c0315a5b621331f8390ed0e28d838

SHA512
e1039c83f0d0992201823260bbe0e224b5f16c1fd8821fab0327b019f46917d0a4adf21e975da030e05ff988a83d9e8528b32973dc2c469348863f3657bd8df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
595B

MD5
273766ca8ab13f0b883b382799a34b5b

SHA1
255ccd8558846cd11bc60f40e67cf5da1b5fe7f3

SHA256
084334c8c62d9bb23bcb4011ff6fb66fe6465e8dedf1905c7fd03275334d6390

SHA512
7a55ee45cac4dbf65da9b43d6a0ffb1213022134c3171656ebe6bf77875dda33c1f4b348fc2204e297937f0e880bc45bde9ab62036aace732ed04f2c60404f1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1e66724ac6cf9c1fb58434bb77bd2ed

SHA1
ca1157601006b67edbd3b737e121496be778446c

SHA256
963330f9d398271a261bcc5c04a4d537f6d1cae76852c489cea005dce7b4cd5e

SHA512
0c9b334e175823b8f9da0ad2418e2ae3334846d53b376535e322fd7eadfe0902790c0ca2e5e10ed7c43daf3f94dd70c6dd763ba63339a3de3aa1de3e66445ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ac481d764ecc0c067d48edbd1a93542d

SHA1
1b2ed34a93ad86f1aade8281ffbfb9066b4d0cc4

SHA256
215c5881cf1d2b06767bbcebaee300cd58934df18cd1ee23296152d09d6fef27

SHA512
cf7bdb1016deac31a8b398f768a7733cdb32e47890ea7a88cc21277328b0da61997ffc83f5c234efc6c7319430984dd4bf3ea76c6de2a62d5fd0debc56711bdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f98d4f4c5c51e7c046b091f7a0837f9

SHA1
bd632996b024757091fbf53f76f360fdd0b2f7af

SHA256
168eb2fb3faeb2283a32e8e9a2e4e29958d2c025809c71845730411723f75afd

SHA512
0d37ea155e5331d4d6aa1e74523a325e9a98f98448f27414c794147f2d6d496eef31d15040734acb6a22fdcc0ecad9471fa75b78b860e55b7d49bbbae9c9faec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c80e36bf88f2495a5cad3b6105e671c3

SHA1
a4bc52a8370b95ba15d7963f03bb9220a2dae24c

SHA256
f7594a76d400e15e065961f68fd99cd0696b0e51acfba38a03676d7276a5d98c

SHA512
50ba2af17e48ff28015126e9614d334368acca5a98c2b7f35868d8000ac63e79e7dc6b47a016d1d94731d7d07f3020f2f82e8e5b22f5243833cf3b7cf4ac340b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
856fef8534f3fe1af0cb9400df2f51b7

SHA1
65460a08f0325add9b84faabe14d6c44175f5e44

SHA256
acc16c13b1e53fbdf20913fdfa5211c3211262d7c159bce4275fa5db3d53fe59

SHA512
1e6c437135f7488f3cf699bac3b14a99117a1c290b055a1c82731a800252967bcf560048a6bc7b8414553877642cabf6b09b0bbf29da60b76259a065b51992c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6ed809b3c06869c93e92123a5f065391

SHA1
e6b3df7ab5054d52f3636d2107869198c92db6fb

SHA256
f8c2bd94db5c55515c5e698ad9d13b740f5591f681b914226e3bb79a18441dda

SHA512
eb44e68751e2f747de036e142768ee2c0fc442f5678aaff65eda4340407892c488b720cc25f8f61ad2e52360eb9c9d7b80a24f3bcdc1031e1145ec6f5bfc0d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58026c.TMP

Filesize
1KB

MD5
cb4a280614f5a27bb5c96b10deddc395

SHA1
b6e3ec546fd66d5def595a0084e7a209dcc1e207

SHA256
e56f0e76853ec37390999f888da716d7ab6b23533b85edd2f5510fc9eaffb0a0

SHA512
db4bc77082bc9d92f538463e91b57dd1c8aa796d7a250bfa0c9312d3e57ed655fd454153cde1bd7eac28c2826cc353da492818a8538c1ad9788fc38eb0fb81ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
400d2eb4aec42e8204a98217f64768b2

SHA1
72941299078338ab8e48f97cad65f4b7cb2f6378

SHA256
266fa101bc46eed602ca55f845f161f8f4dc95662268e4db6ad5b5a6ffaae940

SHA512
a1a28a5aea3a2f910bc292060bd53f258403dedfbbb65e740bed18bcca9a23d1e3a6ee837252b95446630c48681742638ed962dc3cd95770aad159e90428b145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e704929a03b3bff7e9ce64518eca3a31

SHA1
d23796c8b67f5258cd6c44761457f8400c3c8d67

SHA256
38f013e5afbfc7901ad2fbcbd9e34c18ae73c5916df7ff407d576a344c89880c

SHA512
ecb8b31c617f566aeac17ab8008b8f1b18c03870a6d8ff07b68172df9968a56ba1a1b811ef65dedc745a859ca7db8624f9fb894811f5013ce8ff45efddedf5a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
991c5b5b827bf327a7256053942f8259

SHA1
19b34e5fbd7883ceea17934af8f57bbfce36c767

SHA256
36dc38437dd18ced228a4d9c8c2fd23ce5dadc241197bcab1189ad44728b3eb2

SHA512
d2296392db76d21eca61fb53cb78982e9016474f976c991697d3095df10257f15314a7d51b26a5e92919e62fbb773a499583e219f2260b9f574c8d499b363580

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 33353.crdownload

Filesize
24.4MB

MD5
ef72133998bc00bb042590cd89619268

SHA1
3f5b1bb3d1595e37602250ad4a24944ed7a59eff

SHA256
ec02a2ba4fb3099d78d5e21d968d4394ac2c5d9ff5e4a4da3815d564419e05b2

SHA512
c078bfece97b922f4114a8ab5d091249f73195a17a2037d6e25fcbc2b77c072608aafc11a10d0c48e2c7c0ba3a19fa0b21c95dbce1c1b3155481ed4c6de62928

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 938446.crdownload

Filesize
14.8MB

MD5
4dd73d277387e57b57be3bd8fac2d0d8

SHA1
276d9a427925166b4e224f357a000ca66e668c77

SHA256
16a21546c9073090dcda3fdfa0779ba9caa9ce3f675bf0cfc0234c2db1dc096f

SHA512
d2c32a46009e5180f4da33033139bd1ebc6dee47eda5999d5d20aa7eca8284d20eed3f5ff0fb45433aa662ddab4c019483dd0190ae75717654c787dd67790cfb

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\XWorm.EditReg.resx

Filesize
144KB

MD5
18a4c827e4e99593b8674ba70d54b0c2

SHA1
d9cddfa0e4c179eeeb73953495ebb55e54f602ac

SHA256
d5e7279789541c5d71c47c632f07747ca3a32e39633b0f94a919433d2e182e2a

SHA512
f19ca68fda5426028ac18b476a47185d20d424c61c8e95cb6b775677e5460d8108450c4054e7cbbe6dbc162b7c30ca0b608a80efeab4206762908f2e04ad9ee2

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\XWorm.csproj.user

Filesize
4KB

MD5
559621adf2aedb001bd63891c87e76d1

SHA1
9f89245280e772b4c868bcd1096ca40d696e3fca

SHA256
5dacd5f7d6d217a37ca45198b24f11fdc589f090a520ea83b99d5c0740becb52

SHA512
c39b083cdf57bd3b03da3bb2398bf388a5a5fd009c046603ccf0fb5130a9034f4bb28ada12e35c7ea517eefc9ed96e27e34171cc38e960643a66e10ab9416a03

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Background.png

Filesize
924KB

MD5
c93ee3abeff4ac24936471f80b36ec7a

SHA1
0120649571a4b692ff5d10aae8dd87dffd3a0f81

SHA256
2f691caff7e1980cfb069d2608b6470b3a06cdb90467ce47820e8602115a0c5b

SHA512
dd319d1eea708284588ff67268cb23bd7b5cde505f3a8a1e7a27a587920ee5877efa4c1d8264cae48de343cabbf11bbe457b49f348b46288765eeff45d20cab5

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Fixer.bat

Filesize
122B

MD5
2dabc46ce85aaff29f22cd74ec074f86

SHA1
208ae3e48d67b94cc8be7bbfd9341d373fa8a730

SHA256
a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55

SHA512
6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\GeoIP.dat

Filesize
1.2MB

MD5
8ef41798df108ce9bd41382c9721b1c9

SHA1
1e6227635a12039f4d380531b032bf773f0e6de0

SHA256
bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

SHA512
4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Icons\icon (1).ico

Filesize
97KB

MD5
4f409511e9f93f175cd18187379e94cb

SHA1
598893866d60cd3a070279cc80fda49ee8c06c9b

SHA256
115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f

SHA512
0d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Icons\icon (10).ico

Filesize
115KB

MD5
ad1740cb3317527aa1acae6e7440311e

SHA1
7a0f8669ed1950db65632b01c489ed4d9aba434e

SHA256
7a97547954aaad629b0563cc78bca75e3339e8408b70da2ed67fa73b4935d878

SHA512
eee7807b78d4dd27b51cee07a6567e0d022180e007e1241266f4c53f1192c389be97332fcd9f0b8fda50627b40b8cf53027872304a68a210f4d754aa0243b0c2

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Icons\icon (11).ico

Filesize
9KB

MD5
1c2cea154deedc5a39daec2f1dadf991

SHA1
6b130d79f314fa9e4015758dea5f331bbe1e8997

SHA256
3b64b79e4092251ebf090164cd2c4815390f34849bbd76fb51085b6a13301b6d

SHA512
dceebc1e6fdfe67afebaef1aff11dd23eda6fae79eb6b222de16edebdfebd8e45de896e501608254fb041824080cb41c81ac972032638407efc6bfeb930bfd00

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Icons\icon (12).ico

Filesize
9KB

MD5
4ea9ab789f5ae96766e3f64c8a4e2480

SHA1
423cb762ce81fab3b2b4c9066fe6ea197d691770

SHA256
84b48ca52dfcd7c74171cf291d2ef1247c3c7591a56b538083834d82857fee50

SHA512
f917059b6f85e4a25909a27cad38b1ef0659161c32df54860226ff3d858127d8da592ea9072ad41d5a9986dd8c04a37e9ad34e2251883a8c2f0933e6aa201414

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Icons\icon (16).ico

Filesize
97KB

MD5
14465d8d0f4688a4366c3bf163ba0a17

SHA1
9f1fa68a285db742e4834f7d670cae415ce6b3b6

SHA256
3f3c5ce486e5b9fa88dc60b60916053e8808c69167df1a11287fd3cd6db1ca6e

SHA512
01db4fac75136baf9c162265785877b21fba9c4b8d9dbe4e495191f15aa9c914e3d5baf1c4606041279a7138c7e5c8f4ccf6e64689354fc3fb3fa66ab3b1da2d

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Icons\icon (17).ico

Filesize
66KB

MD5
167425a3fa7114b1800aa903adc35b2a

SHA1
601e8bd872ea31aff03721a0361e65a57b299cad

SHA256
12f600b09c0db00877684a950fc14936ecc28df8f0ddc6821d68e4b82077ad92

SHA512
586ce1360eb06f1df8e95ad178abfae7c9d41cba1be55276b3d3947d0504ca09185e543b7dbf1ba72dde4942ff626859a6d2e8a1faaaf6c5daaebd8740dcf538

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Icons\icon (2).ico

Filesize
112KB

MD5
f1463f4e1a6ef6cc6e290d46830d2da1

SHA1
bda0d74a53c3f7aaf0da0f375d0c1b5aca2a7aaf

SHA256
142b529799268a753f5214265c53a26a7a6f8833b31640c90a69a4ff94cee5ec

SHA512
0fa93d009cc2f007d19e6fdda7ebe44c7ed77f30b49a6ef65c319133c0570ab84f2d86e8282b5069d7f2e238547722ac3966d2fa2fae4504133f0001a0387ae2

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Icons\icon (3).ico

Filesize
131KB

MD5
a512719efc9e6ecc5e2375abceb1669a

SHA1
51fae98edfab7cd6b6baac6df5ecbda082eeb1db

SHA256
b2f7fb22cd5b935cf19a2f58f7fef9db99db40772ff4bb331a73c345161c2574

SHA512
e0153dbc8f3fdda8d1a7082bc30a3895d7f4b3bc2982b4b4ece55653d1b4c293eba3ba6d4a0a581f0f7db95ab287d6616ef7bf03af4485904111798bf9d9e625

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Icons\icon (4).ico

Filesize
125KB

MD5
9c053bef57c4a7b575a0726af0e26dae

SHA1
47148d30bc9a6120a1d92617bf1f3e1ba6ca1a2c

SHA256
5bb21d6c04ed64a1368dace8f44aff855860e69f235492a5dc8b642a9ea88e41

SHA512
482d639ba60f57827d8a343f807f4f914289c45643307efaa666b584a085fe01ac7892252f41b7756fde93d215b4f3fed16e608bc45102d320d77239fa93146a

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Icons\icon (5).ico

Filesize
100KB

MD5
9dbdd6972e129d31568661a89c81d8f9

SHA1
747399af62062598120214cef29761c367cfd28a

SHA256
45c85bdaaf0e0c30678d8d77e2585871ea6d1298ee0d30037745bacea6338484

SHA512
e52572de3f0d57d24a24d65eca4ff638890ccc9c5aca3f213ff885eda3c40de115849eb64c341f557d601f566ce21f8fc0df25cc4b13aaad5e941449a6b7f87d

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Icons\icon (6).ico

Filesize
106KB

MD5
d7c9666d30936e29ce156a2e04807863

SHA1
845e805d55156372232e0110e5dc80380e2cb1e5

SHA256
6ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5

SHA512
3cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Icons\icon (7).ico

Filesize
164KB

MD5
7891c91d1761dc8a8846d362e6e31869

SHA1
0229bb01b7b4a0fca305eb521ec5dfbaa53674ea

SHA256
29d38c75af79aa0554f34cdfecb311f88f8dd02b02facaa299b9700841806ab8

SHA512
ed14614a706da985566853dc13df0d1128a718f39ec9957320813803fe07e59de337d51033970e2f57d9f56da3546c506f5f0f3becfa91ce741576855be14ba7

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Icons\icon (8).ico

Filesize
108KB

MD5
af1739a9b1a1bf72e7072ad9551c6eea

SHA1
8da0a34c3a8040c4b7c67d7143c853c71b3d208d

SHA256
a65cbbdc2ca671a9edd7edac0c6737b3b116e357727e003e5fdeff163c6c21ab

SHA512
eeeac307371c38b75e256083c55a3fe4ab096c1c7520a4b7acb40fad3af5a0d6c88aaf85f2c3e418034abee422c2a3ba13731adf7ee6078016da4dd2e989b120

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Icons\icon (9).ico

Filesize
264KB

MD5
3e24e40b41ecc59750c9231d8f8da40b

SHA1
91a701cf25aea2984f75846b6c83865d668ccad6

SHA256
bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80

SHA512
fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\ActiveWindows.dll

Filesize
14KB

MD5
5a766a4991515011983ceddf7714b70b

SHA1
4eb00ae7fe780fa4fe94cedbf6052983f5fd138b

SHA256
567b9861026a0dbc5947e7515dc7ab3f496153f6b3db57c27238129ec207fc52

SHA512
4bd6b24e236387ff58631207ea42cd09293c3664468e72cd887de3b3b912d3795a22a98dcf4548fb339444337722a81f8877abb22177606d765d78e48ec01fd8

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Chat.dll

Filesize
18KB

MD5
59f75c7ffaccf9878a9d39e224a65adf

SHA1
46b0f61a07e85e3b54b728d9d7142ddc73c9d74b

SHA256
aab20f465955d77d6ec3b5c1c5f64402a925fb565dda5c8e38c296cb7406e492

SHA512
80056163b96ce7a8877874eaae559f75217c0a04b3e3d4c1283fe23badfc95fe4d587fd27127db4be459b8a3adf41900135ea12b0eeb4187adbcf796d9505cb8

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Chromium.dll

Filesize
32KB

MD5
edb2f0d0eb08dcd78b3ddf87a847de01

SHA1
cc23d101f917cad3664f8c1fa0788a89e03a669c

SHA256
b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982

SHA512
8f87da834649a21a908c95a9ea8e2d94726bd9f33d4b7786348f6371dfae983cc2b5b5d4f80a17a60ded17d4eb71771ec25a7c82e4f3a90273c46c8ee3b8f2c3

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Clipboard.dll

Filesize
14KB

MD5
831eb0de839fc13de0abab64fe1e06e7

SHA1
53aad63a8b6fc9e35c814c55be9992abc92a1b54

SHA256
e31a1c2b1baa2aa2c36cabe3da17cd767c8fec4c206bd506e889341e5e0fa959

SHA512
2f61bcf972671d96e036b3c99546cd01e067bef15751a87c00ba6d656decb6b69a628415e5363e650b55610cf9f237585ada7ce51523e6efc0e27d7338966bee

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Cmstp-Bypass.dll

Filesize
11KB

MD5
cf15259e22b58a0dfd1156ab71cbd690

SHA1
3614f4e469d28d6e65471099e2d45c8e28a7a49e

SHA256
fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b

SHA512
7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\FileManager.dll

Filesize
679KB

MD5
641a8b61cb468359b1346a0891d65b59

SHA1
2cdc49bcd7428fe778a94cdcd19cabf5ece8c9c0

SHA256
b58ed3ebbcd27c7f4b173819528ff4db562b90475a5e304521ed5c564d39fffd

SHA512
042702d34664ea6288e891c9f7aa10a5b4b07317f25f82d6c9fa9ba9b98645c14073d0f66637060b416a30c58dec907d9383530320a318523c51f19ebd0a4fee

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\FilesSearcher.dll

Filesize
478KB

MD5
6f8f1621c16ac0976600146d2217e9d2

SHA1
b6aa233b93aae0a17ee8787576bf0fbc05cedde4

SHA256
e66e1273dc59ee9e05ce3e02f1b760b18dd296a47d92b3ce5b24efb48e5fb21b

SHA512
eb55acdea8648c8cdefee892758d9585ff81502fc7037d5814e1bd01fee0431f4dde0a4b04ccb2b0917e1b11588f2dc9f0bfe750117137a01bbd0c508f43ef6a

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\HBrowser.dll

Filesize
25KB

MD5
f0e921f2f850b7ec094036d20ff9be9b

SHA1
3b2d76d06470580858cc572257491e32d4b021c0

SHA256
75e8ff57fa6d95cf4d8405bffebb2b9b1c55a0abba0fe345f55b8f0e88be6f3c

SHA512
16028ae56cd1d78d5cb63c554155ae02804aac3f15c0d91a771b0dcd5c8df710f39481f6545ca6410b7cd9240ec77090f65e3379dcfe09f161a3dff6aec649f3

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\HRDP.dll

Filesize
1.7MB

MD5
f27b6e8cf5afa8771c679b7a79e11a08

SHA1
6c3fcf45e35aaf6b747f29a06108093c284100da

SHA256
4aa18745a5fddf7ec14adaff3ad1b4df1b910f4b6710bf55eb27fb3942bb67de

SHA512
0d84966bbc9290b04d2148082563675ec023906d58f5ba6861c20542271bf11be196d6ab24e48372f339438204bd5c198297da98a19fddb25a3df727b5aafa33

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\HVNC.dll

Filesize
58KB

MD5
30eb33588670191b4e74a0a05eecf191

SHA1
08760620ef080bb75c253ba80e97322c187a6b9f

SHA256
3a287acb1c89692f2c18596dd4405089ac998bb9cf44dd225e5211923d421e96

SHA512
820cca77096ff2eea8e459a848f7127dc46af2e5f42f43b2b7375be6f4778c1b0e34e4aa5a97f7fbabe0b53dcd351d09c231bb9afedf7bcec60d949918a06b97

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\HVNCMemory.dll

Filesize
39KB

MD5
065f0830d1e36f8f44702b0f567082e8

SHA1
724c33558fcc8ecd86ee56335e8f6eb5bfeac0db

SHA256
285b462e3cd4a5b207315ad33ee6965a8b98ca58abb8d16882e4bc2d758ff1a4

SHA512
bac0148e1b78a8fde242697bff1bbe10a18ffab85fdced062de3dc5017cd77f0d54d8096e273523b8a3910fe17fac111724acffa5bec30e4d81b7b3bd312d545

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\HiddenApps.dll

Filesize
45KB

MD5
ba2141a7aefa1a80e2091bf7c2ca72db

SHA1
9047b546ce9c0ea2c36d24a10eb31516a24a047d

SHA256
6a098f5a7f9328b35d73ee232846b13e2d587d47f473cbc9b3f1d74def7086ea

SHA512
91e43620e5717b699e34e658d6af49bba200dcf91ac0c9a0f237ec44666b57117a13bc8674895b7a9cac5a17b2f91cdc3daa5bcc52c43edbabd19bc1ed63038c

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Informations.dll

Filesize
22KB

MD5
67a884eeb9bd025a1ef69c8964b6d86f

SHA1
97e00d3687703b1d7cc0939e45f8232016d009d9

SHA256
cba453460be46cfa705817abbe181f9bf65dca6b6cea1ad31629aa08dbeaf72b

SHA512
52e852021a1639868e61d2bd1e8f14b9c410c16bfca584bf70ae9e71da78829c1cada87d481e55386eec25646f84bb9f3baee3b5009d56bcbb3be4e06ffa0ae7

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Keylogger.dll

Filesize
17KB

MD5
246f7916c4f21e98f22cb86587acb334

SHA1
b898523ed4db6612c79aad49fbd74f71ecdbd461

SHA256
acfe5c3aa2a3bae3437ead42e90044d7eee972ead25c1f7486bea4a23c201d3a

SHA512
1c256ca9b9857e6d393461b55e53175b7b0d88d8f3566fd457f2b3a4f241cb91c9207d54d8b0867ea0abd3577d127835beb13157c3e5df5c2b2b34b3339bd15d

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Maps.dll

Filesize
15KB

MD5
806c3802bfd7a97db07c99a5c2918198

SHA1
088393a9d96f0491e3e1cf6589f612aa5e1df5f8

SHA256
34b532a4d0560e26b0d5b81407befdc2424aacc9ef56e8b13de8ad0f4b3f1ab6

SHA512
ed164822297accd3717b4d8e3927f0c736c060bb7ec5d99d842498b63f74d0400c396575e9fa664ad36ae8d4285cfd91e225423a0c77a612912d66ea9f63356c

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\MessageBox.dll

Filesize
14KB

MD5
7db8b7e15194fa60ffed768b6cf948c2

SHA1
3de1b56cc550411c58cd1ad7ba845f3269559b5c

SHA256
bc09b671894c9a36f4eca45dd6fbf958a967acea9e85b66c38a319387b90dd29

SHA512
e7f5430b0d46f133dc9616f9eeae8fb42f07a8a4a18b927dd7497de29451086629dfc5e63c0b2a60a4603d8421c6570967c5dbde498bb480aef353b3ed8e18a1

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Microphone.dll

Filesize
540KB

MD5
9c3d90ccf5d47f6eef83542bd08d5aeb

SHA1
0c0aa80c3411f98e8db7a165e39484e8dae424c7

SHA256
612898afdf9120cfef5843f9b136c66ecc3e0bb6f3d1527d0599a11988b7783c

SHA512
0786f802fbd24d4ab79651298a5ba042c275d7d01c6ac2c9b3ca1e4ee952de7676ec8abf68d226b72696e9480bd4d4615077163efbcda7cff6a5f717736cbdfe

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Ngrok-Installer.dll

Filesize
400KB

MD5
3e19341a940638536b4a7891d5b2b777

SHA1
ca6f5b28e2e54f3f86fd9f45a792a868c82e35b5

SHA256
b574aabf02a65aa3b6f7bfff0a574873ce96429d3f708a10f87bc1f6518f14aa

SHA512
06639892ea4a27c8840872b0de450ae1a0dac61e1dcb64523973c629580323b723c0e9074ff2ddf9a67a8a6d45473432ffc4a1736c0ddc74e054ae13b774f3e2

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Options.dll

Filesize
30KB

MD5
97193fc4c016c228ae0535772a01051d

SHA1
f2f6d56d468329b1e9a91a3503376e4a6a4d5541

SHA256
5c34aee5196e0f8615b8d1d9017dd710ea28d2b7ac99295d46046d12eea58d78

SHA512
9f6d7da779e8c9d7307f716d4a4453982bb7f090c35947850f13ec3c9472f058fc11e1120a9641326970b9846d3c691e0c2afd430c12e5e8f30abadb5dcf5ed2

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Pastime.dll

Filesize
17KB

MD5
6430ab4458a703fb97be77d6bea74f5b

SHA1
59786b619243d4e00d82b0a3b7e9deb6c71b283c

SHA256
a46787527ac34cd71d96226ddfc0a06370b61e4ad0267105be2aec8d82e984c1

SHA512
7b6cf7a613671826330e7f8daddc4c7c37b4d191cf4938c1f5b0fb7b467b28a23fb56e412dc82192595cfa9d5b552668ef0aaa938c8ae166029a610b246d3ecc

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Performance.dll

Filesize
16KB

MD5
1841c479da7efd24521579053efcf440

SHA1
0aacfd06c7223b988584a381cb10d6c3f462fc6a

SHA256
043b6a0284468934582819996dbaa70b863ab4caa4f968c81c39a33b2ac81735

SHA512
3005e45728162cc04914e40a3b87a1c6fc7ffde5988d9ff382d388e9de4862899b3390567c6b7d54f0ec02283bf64bcd5529319ca32295c109a7420848fa3487

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\ProcessManager.dll

Filesize
19KB

MD5
3d4ec14005a25a4cb05b1aa679cf22bf

SHA1
6f4a827d94ad020bc23fbd04b7d8ca2995267094

SHA256
7cf1921a5f8429b2b9e8197de195cfae2353fe0d8cb98e563bdf1e782fe2ee4e

SHA512
0ee72d345d5431c7a6ffc71cf5e37938b93fd346e5a4746f5967f1aa2b69c34ca4ba0d0abd867778d8ca60b56f01e2d7fc5e7cf7c5a39a92015d4df2d68e382e

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Programs.dll

Filesize
13KB

MD5
a6734a047b0b57055807a4f33a80d4dd

SHA1
0b3a78b2362b0fd3817770fdc6dd070e3305615c

SHA256
953a8276faa4a18685d09cd9187ed3e409e3cccd7daf34b6097f1eb8d96125a4

SHA512
7292eab25f0e340e78063f32961eff16bb51895ad46cfd09933c0c30e3315129945d111a877a191fc261ad690ad6b02e1f2cabc4ff2fdac962ee272b41dd6dfa

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Ransomware.dll

Filesize
20KB

MD5
ccc9ea43ead4aa754b91e2039fe0ac1c

SHA1
f382635559045ac1aeb1368d74e6b5c6e98e6a48

SHA256
14c2bbccdabb8408395d636b44b99de4b16db2e6bf35181cb71e7be516d83ad9

SHA512
5d05254ba5cd7b1967a84d5b0e6fd23c54766474fb8660a001bf3d21a3f5c8c20fcdb830fb8659a90da96655e6ee818ceefb6afa610cc853b7fba84bb9db4413

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Recovery.dll

Filesize
1.1MB

MD5
776193701a2ed869b5f1b6e71970a0ac

SHA1
2f973458531aaa283cdc835af4e24f5f709cbad1

SHA256
66dbe3b90371fe58caa957e83c1c1f0acce941a36cf140a0f07e64403dd13303

SHA512
a41f981c861e8d40487a9cd0863f9055165427e10580548e972a47ef47cf3e777aab2df70dc6f464cc3077860e86eda7462e9754f9047a1ecc0ed9721663aeb9

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Regedit.dll

Filesize
15KB

MD5
53a2cfe273c311b64cf5eaca62f8c2fd

SHA1
4ec95ec4777a0c5b4acde57a3490e1c139a8f648

SHA256
2f73dc0f3074848575c0408e02079fd32b7497f8816222ae3ce8c63725a62fe6

SHA512
992b37d92157ae70a106a9835de46a4ac156341208cfe7fb0477dc5fc3bc9ddae71b35e2336fc5c181630bac165267b7229f97be436912dfd9526a020d012948

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\RemoteDesktop.dll

Filesize
18KB

MD5
e6367d31cf5d16b1439b86ae6b7b31c3

SHA1
f52f1e73614f2cec66dab6af862bdcb5d4d9cf35

SHA256
cc52384910cee944ddbcc575a8e0177bfa6b16e3032438b207797164d5c94b34

SHA512
8bc78a9b62f4226be146144684dc7fcd085bcf4d3d0558cb662aacc143d1438b7454e8ac70ca83ebeedc2a0fcea38ad8e77a5d926a85254b5a7d420a5605538a

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\ReverseProxy.dll

Filesize
16KB

MD5
a22d11379e413cf832b3943ce46f2463

SHA1
99b9552e8a25bff29678aff828901edbc23eaba5

SHA256
8c4efe2c8702141ffa8ff8f55d248dc4220231ae8d12ecea1f22906a9285b32b

SHA512
cc1eccb29135acd35804b44f73447bd8dedc8ea085dee3670cf49120baa905aa7ca512c14a3f4df6aeb5a70347bd214865f9dc8b709a00abbb0c745164d87074

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\RunPE.dll

Filesize
11KB

MD5
224be01635cff2dca827fbdeaddb983c

SHA1
11fa00c5e172c9cd1c81acaef52934f785f91374

SHA256
7adfe849345edd76aa975b0647fed2ccaa5f4a6aaf7d55f488af939c0dbef153

SHA512
1a4915b7b21e8166a6ddb6460c77e02c306a460c08fc7ee574832b0576c827db343eda9533959298819ee443790769328ad580fc67fe4817110b63d49248c736

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\ServiceManager.dll

Filesize
14KB

MD5
2e5f127cb0a69cdd46aa4fd9e603f982

SHA1
994a6ab276c417301ed9208aaaf6719bf9594bc6

SHA256
c552d11db168a4f64db584283a617a6ec51ab6095c20ba4b706c3138beb68a22

SHA512
4455cb3b9d4a9c69abec7180e9a60e16e6be0ae2290f48aa09c5d926370de5512ced4d37b6e6e49515d5f51999211eff6f751c4594db936882fb7f40ee5bf97e

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Shell.dll

Filesize
14KB

MD5
04609b39e656e297db73be0d02c7e35e

SHA1
f8abd484e7703a4d9629b033e8ec39c82eaf4654

SHA256
6c69b4d45638097e31169d94914e4acb6a8cc7f46788ffa4f241e4c1efb213bb

SHA512
11a88d55497fedeeb05b146ebd3135755aeb08c4596e9379eec83501e734aa6ba926d9bbda1c5f50e361836d65ea88d2c018f0b4b4b668c82ff2163730eaaf27

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\StartupManager.dll

Filesize
188KB

MD5
3d76ef15ab712b93eabd4b68ea0111d5

SHA1
0f309663fae17c4ccae983e1fabb16a1e5f77d9b

SHA256
1802e16379d96021fee05f583633c8091bb669350b7d32064179a8944d45a5a6

SHA512
6c0d0291abb696bee33b6e42392b07028c82bcffc8fb7934ba234f178f011ab14fde38cdccb322c8dba058ae66fc023349de5db1c587d3417709bf263cfd28f3

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\Stealer.dll

Filesize
3.3MB

MD5
ade4edd66bc695c9465816fa2538d0cb

SHA1
e4351a2531307c848c60b20ffb50bcc04156fdbc

SHA256
018e06f57725563e4525700edffafb1b062bf5d4b0e9fee498507f0f8200fcdf

SHA512
e2bf3962787366d7a975eb55d2edd1fe35935205febc00f720dc0efff0c62b5df7f0207fd569f692205e8a227c059eea596904995855458e9c02306842e88a6f

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\TCPConnections.dll

Filesize
16KB

MD5
9cae90969d14ab4d686c56bae19e041e

SHA1
0359e8eeed993bbbc6f141b115bd533eeb52533d

SHA256
27e17a43478448f64107df786a170753dbd116eafca7c027f6d357f11e6a4def

SHA512
04a9dc16299d866af7f56ff2ef355310d9437c909ec0dd3549d2f142e71149b09822106e254970f00801fe2f0df6b6d2670cf6a8256d85cd35b963c028f6202d

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\UACBypass.dll

Filesize
10KB

MD5
158e789d0b6cbc52fcb6653fefca38f9

SHA1
4e913315dc3d69abe2be5e5b3a5d37b5f49f7deb

SHA256
ebd51f1e33673cb8e55f10aa890a04027d62b1c1c0b0ae9b1d6f83f1602f53a2

SHA512
23243daadbad2f68b6ed6720d5792226f9c2aeb0b14cf3bf24ac54dcb7a2aa4aff9d26a5633d3add0d871e4ec65c230752c7c173cc4a4374f9263e2c46f9977a

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\VB.NET Compiler.dll

Filesize
14KB

MD5
2401bee633ea4032a758ffc6d729deac

SHA1
3040e0e27f48eacf45860be4ece6f94db7bc1c4e

SHA256
1940d563046c67dbbeaf5f2a2417aaccdae587c1eb97b79c263994896805bece

SHA512
af016b5d2bf8c08e16b593d72a25284f31d6de7300ef98a226db8ce4f2a9dd512ec793adf0730b40dc0a37e9dc5a9d6ef0a50354a697aa5816b3cbe440655692

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\VoiceChat.dll

Filesize
539KB

MD5
56a8b030ade4736915e5b601a4bf39f8

SHA1
ab03e7948c4604fbd15d285f674ea879082a8e7c

SHA256
1a2da0a66c7771962d525b8fe9491052efbd5f87b97d935c267fd96519b5a35e

SHA512
d0f2990adb10221c88bbe04b4f2b702f99c046ae9ce5e713e2d26f73f9353dfe5fd983cd37c7b712341a58cfc4f833e590ff1e449c66fd5de98604d58a92dbd9

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\WSound.dll

Filesize
539KB

MD5
f0d8beccffd6a4831c0712a4da4a0c2d

SHA1
238a2878f1bef8f002ba501c1f65862ed384cc75

SHA256
4bea01b7d691d1f59ca0bb5149e5baf71cde71019da3d352141b1d4921e70bc2

SHA512
1c5244736aa53d5dda52b65a26facda8334bc7f98ce2eb6356c51fcae03b183623d0c3bb7f45993b8bab0c65d261a23164f987aa5f6a47f2f307380567367904

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Plugins\WebCam.dll

Filesize
209KB

MD5
71a9109ccafa90550c1c879a304d27f5

SHA1
c77ce45aaf8b2d8aaaa2a41833275f3eda78046d

SHA256
8d413b40aef41e53557d91f3b3ac64cfc13adb0f8c3edc364e7b8501170e2657

SHA512
fc92190d8a889fb088b2e8c2e4ea4751fcda59eff076b205da7c420b2f26564c1835d6ff1af470b583ec2ec92c0fcfb472e443e29d33f538572e6edd36c8c47e

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Sounds\Chat.wav

Filesize
45KB

MD5
832a3652fd780edcdb2439ec33532c0d

SHA1
f0754ee6519d77700f5ee5b744b8c99386d7b577

SHA256
45f4136e58a5f749d125d2ab54308f81954d2c5b364b66013660a6c358845d1e

SHA512
3b3b55afcdfa00d9b7085b20ed52a7b4d8b7d403f5d0d1c539781db1a20257efd8c856e19b8f32ea33766a580690b498ff063849519691a9a4cbbcd3e9447cd4

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-FULL-Source-Code-main\XWorm-5.6-FULL-Source-Code-main\XWorm\bin\Debug\net45\Sounds\Intro.wav

Filesize
238KB

MD5
ad3b4fae17bcabc254df49f5e76b87a6

SHA1
1683ff029eebaffdc7a4827827da7bb361c8747e

SHA256
e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf

SHA512
3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3

Download Submit
C:\Users\Admin\Downloads\XWorm\XWorm\app.ico

Filesize
135KB

MD5
0f6c3b07dfae913f583b2f7d54fc77c0

SHA1
c93f1aeb589f753541c65b5f1853d0c100fe1000

SHA256
0d829c0f7a67fcaeeb0d1a02ecbc886abe4f648d1c5711e25160c8ef0e64d1a9

SHA512
f544674ff90f151e03339642ea2bfb04d7547feb63a8a21126cc848188a69694a4b7c30eaead0fef8a0023d8bbfb9e3a3b5ad1623e12280a478490c7af0a3906

Download Submit
C:\Users\Admin\Downloads\XWorm\XWorm\bin\Debug\net45\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Windows\System32\perfc007.dat

Filesize
44KB

MD5
bc3d1639f16cb93350a76b95cd59108b

SHA1
47f1067b694967d71af236d5e33d31cb99741f4c

SHA256
004818827ecc581f75674919f4605d28eed27e3f2229ae051d6849129eef40e9

SHA512
fe44f3dbd009d932491af26c3615e616bc0042741dc3815ffb4d2b8d201efd8ab89f7cdd747406609393f005a596a6e9ea8e3f231bc150dc406c2adb8f806249

Download Submit
C:\Windows\System32\perfc00A.dat

Filesize
47KB

MD5
69c02ba10f3f430568e00bcb54ddf5a9

SHA1
8b95d298633e37c42ea5f96ac08d950973d6ee9d

SHA256
62e5660f9018da67d3c6727c39e9690650beb62749df0b4c00e6085f36c8e94e

SHA512
16e4d29324c2b50e1347532cd0982a149a7c67c4f27a743bbad8609ac662c3e00fa1be645b1b5f23adca3abd60c812f3f87d669f5ffb42b90ca5026dcbf2824e

Download Submit
C:\Windows\System32\perfc00C.dat

Filesize
43KB

MD5
8b4b53cf469919a32481ce37bcce203a

SHA1
58ee96630adf29e79771bfc39a400a486b4efbb0

SHA256
a7b3a2b6c67e98cf2b13684c8774113c4ed4f60cd6fc673d4c9dcb360c60ce42

SHA512
62217e68c9e4c7b077e127040318c603e2f2cbcc5517ce0cfc6189e43023f8d8a05b8e694b2a35d4b409241136a1067749b7b6e2049d6910246d8c0fa6e9e575

Download Submit
C:\Windows\System32\perfc010.dat

Filesize
42KB

MD5
bea0a3b9b4dc8d06303d3d2f65f78b82

SHA1
361df606ee1c66a0b394716ba7253d9785a87024

SHA256
e88439ae381e57e207ce09bbf369859c34b239b08124339534dcc935a89ac927

SHA512
341132d443cd41acf0a7eaee0d6883c40d8a4db8c59e056211e898c817c2847377f0208ed3a40e0fd6f73f0196ffcc680c55754e160edafd97036739861a6c88

Download Submit
C:\Windows\System32\perfc011.dat

Filesize
32KB

MD5
50681b748a019d0096b5df4ebe1eab74

SHA1
0fa741b445f16f05a1984813c7b07cc66097e180

SHA256
33295c7ee1b56a41e809432bc25dd745ba55b2dc91bfa97aa1f55156880cd71a

SHA512
568439b3547dcbcce28499d45663fdd0e2222f6c5c90053769ce2585f65721f679c071393328bde72c9a3f03da4c17abb84b8303897688b59598887ceb31438e

Download Submit
C:\Windows\System32\perfh007.dat

Filesize
307KB

MD5
312d855b1d95ae830e067657cffdd28c

SHA1
8133c02adeae24916fa9c53e52b3bfe66ac3d5a3

SHA256
ca3f8056e3e2378509ab24f8b8471e5fccac403a5413be518ac35bbb42a2e2cf

SHA512
f25c1a81a582a2a5e3142bd97f425c6ee5c26f878b1155232002fff1e4a3528bc371fb962da256c281e05c6c537160a4f48e00ea1fcf3e9887097f8ca6ec2b14

Download Submit
C:\Windows\System32\perfh009.dat

Filesize
297KB

MD5
50362589add3f92e63c918a06d664416

SHA1
e1f96e10fb0f9d3bec9ea89f07f97811ccc78182

SHA256
9a60acb9d0cb67b40154feb3ff45119f122301ee059798c87a02cc0c23e2ffce

SHA512
e21404bc7a5708ab1f4bd1df5baff4302bc31ac894d0940a38b8967b40aac46c2b3e51566d6410e66c4e867e1d8a88489adccf8bdcaec682e9ddabc0dac64468

Download Submit
C:\Windows\System32\perfh00A.dat

Filesize
347KB

MD5
49032045f6bcb9f676c7437df76c7ffa

SHA1
f1bf3ba149cd1e581fe12fb06e93d512fe3a241b

SHA256
089f30c1e60f038627531d486659fab66a8b927d65e4eca18f104d6ae4c7f641

SHA512
55b459b7787e6efacdcc17adb830dc3172a316ff8dd3b14a51bf4496a9479f513ae279a839674b472c1424170ee4aa63a5d45fc7fbd38a533a885282858c74f1

Download Submit
C:\Windows\System32\perfh00C.dat

Filesize
350KB

MD5
518020fbecea70e8fecaa0afe298a79e

SHA1
c16d691c479a05958958bd19d1cb449769602976

SHA256
9a139a16fe741593e50fa5e1e2a0c706c0eba7f4d1e1a7a91035428185fde125

SHA512
ff910efee092c2b4a3fa1114f745feb7d01a38b55b0345e0118cdc601a056f79035bd92c76b49559480b515da4cd66d2fbe789baacdde67485cab989ff009b2e

Download Submit
C:\Windows\System32\perfh010.dat

Filesize
340KB

MD5
f9fcefdf318c60de1e79166043b85ec4

SHA1
a99d480b322c9789c161ee3a46684f030ec9ad33

SHA256
9c92309f7a11b916d0e9b99f9083f58b1a2fa7a9aad283b064f01c11781160e7

SHA512
881e112fedccc8643d872396baf726ceb7a49c5cce09489ddcb88400b5a4578dd5ee62a4082d81a6c721c74edb00d84d225e08ab892cc094976149a1a2c486d8

Download Submit
C:\Windows\System32\perfh011.dat

Filesize
145KB

MD5
f4f62aa4c479d68f2b43f81261ffd4e3

SHA1
6fa9ff1dbb2c6983afc3d57b699bc1a9d9418daa

SHA256
c2f81f06c86bf118a97fba7772d20d2c4ba92944551cd14e9d9bab40bf22816c

SHA512
cbd94b41fc3136c05981e880e1f854a5847a18708459112ca7eb0bdcb04d0034c42af8c58501a21ae56e07a29751236af9735b0a4ded3a6b0ef57d717acd5ff3

Download Submit