Overview

overview

10

Static

static

1

URLScan

urlscan

1

http://google.com

windows11-21h2-x64

10

Resubmissions

17-01-2025 09:49

250117-ltejws1qdv 3

17-01-2025 09:48

250117-ls436a1qct 4

17-01-2025 06:31

250117-hakp1svnfz 10

Analysis

  • max time kernel
    970s
  • max time network
    971s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17-01-2025 06:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://google.com

Score
10/10
xenarmorxwormagilenetcollectiondefense_evasiondiscoveryevasionpasswordpersistenceprivilege_escalationratrecoveryspywarestealertrojanupx

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

Mutex

BBx9l5I6Q2Py8Dhu

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 3 IoCs
  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

    recoverypasswordxenarmor
  • Xenarmor family
    xenarmor
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables Task Manager via registry modification
    evasion
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • ACProtect 1.3x - 1.4x DLL software 5 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 6 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 23 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Control Panel 3 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://google.com
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4536
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xe4,0xe8,0xdc,0xe0,0x10c,0x7ffd36633cb8,0x7ffd36633cc8,0x7ffd36633cd8
      2⤵
        PID:5036
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1960 /prefetch:2
        2⤵
          PID:848
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1600
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
          2⤵
            PID:2304
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
            2⤵
              PID:4112
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
              2⤵
                PID:5044
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
                2⤵
                  PID:1936
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4108 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1824
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
                  2⤵
                    PID:2876
                  • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:932
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
                    2⤵
                      PID:988
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
                      2⤵
                        PID:1124
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
                        2⤵
                          PID:816
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
                          2⤵
                            PID:348
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
                            2⤵
                              PID:1280
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
                              2⤵
                                PID:2320
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
                                2⤵
                                  PID:4136
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
                                  2⤵
                                    PID:1168
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
                                    2⤵
                                      PID:5016
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
                                      2⤵
                                        PID:3196
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
                                        2⤵
                                          PID:500
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
                                          2⤵
                                            PID:4420
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6684 /prefetch:8
                                            2⤵
                                              PID:3120
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
                                              2⤵
                                                PID:4968
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6800 /prefetch:8
                                                2⤵
                                                • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                • NTFS ADS
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3248
                                              • C:\Users\Admin\Downloads\tsetup-x64.5.10.3.exe
                                                "C:\Users\Admin\Downloads\tsetup-x64.5.10.3.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:3512
                                                • C:\Users\Admin\AppData\Local\Temp\is-CC386.tmp\tsetup-x64.5.10.3.tmp
                                                  "C:\Users\Admin\AppData\Local\Temp\is-CC386.tmp\tsetup-x64.5.10.3.tmp" /SL5="$B01E4,46037689,827904,C:\Users\Admin\Downloads\tsetup-x64.5.10.3.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of FindShellTrayWindow
                                                  PID:2900
                                                  • C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
                                                    "C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Drops desktop.ini file(s)
                                                    • Enumerates system info in registry
                                                    • Modifies registry class
                                                    • NTFS ADS
                                                    • Suspicious behavior: AddClipboardFormatListener
                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4500
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4744 /prefetch:2
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1960
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
                                                2⤵
                                                  PID:3160
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,16382195076987369263,17257954429198244885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
                                                  2⤵
                                                    PID:2736
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:4356
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:3488
                                                    • C:\Windows\System32\rundll32.exe
                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                      1⤵
                                                        PID:3836
                                                      • C:\Program Files\7-Zip\7zG.exe
                                                        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\" -ad -an -ai#7zMap8000:122:7zEvent22714
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3360
                                                      • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWormLoader 5.2 x64.exe
                                                        "C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWormLoader 5.2 x64.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Enumerates system info in registry
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:3964
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
                                                          2⤵
                                                            PID:3508
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd36633cb8,0x7ffd36633cc8,0x7ffd36633cd8
                                                              3⤵
                                                                PID:3596
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mjlthmml\mjlthmml.cmdline"
                                                              2⤵
                                                                PID:3892
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB0ED.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFBB40B139517419A83511AFA6C5AF9AE.TMP"
                                                                  3⤵
                                                                    PID:4916
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/maps/place/51.5074,-0.1196
                                                                  2⤵
                                                                  • Enumerates system info in registry
                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                  PID:4252
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd36633cb8,0x7ffd36633cc8,0x7ffd36633cd8
                                                                    3⤵
                                                                      PID:3084
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,769215419918879186,6799815084777612039,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
                                                                      3⤵
                                                                        PID:8828
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,769215419918879186,6799815084777612039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
                                                                        3⤵
                                                                          PID:3032
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,769215419918879186,6799815084777612039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
                                                                          3⤵
                                                                            PID:3064
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,769215419918879186,6799815084777612039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                                                                            3⤵
                                                                              PID:5404
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,769215419918879186,6799815084777612039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
                                                                              3⤵
                                                                                PID:5436
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,769215419918879186,6799815084777612039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
                                                                                3⤵
                                                                                  PID:5656
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,769215419918879186,6799815084777612039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3856 /prefetch:8
                                                                                  3⤵
                                                                                    PID:2988
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,769215419918879186,6799815084777612039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
                                                                                    3⤵
                                                                                      PID:348
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,769215419918879186,6799815084777612039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
                                                                                      3⤵
                                                                                        PID:3356
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,769215419918879186,6799815084777612039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:8
                                                                                        3⤵
                                                                                          PID:2840
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,769215419918879186,6799815084777612039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
                                                                                          3⤵
                                                                                            PID:6600
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,769215419918879186,6799815084777612039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
                                                                                            3⤵
                                                                                              PID:6608
                                                                                        • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                          C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                          1⤵
                                                                                            PID:1188
                                                                                          • C:\Windows\system32\AUDIODG.EXE
                                                                                            C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E8
                                                                                            1⤵
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:3704
                                                                                          • C:\Users\Admin\Downloads\rat.exe
                                                                                            "C:\Users\Admin\Downloads\rat.exe"
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            • Checks processor information in registry
                                                                                            • Enumerates system info in registry
                                                                                            • Modifies Control Panel
                                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:1064
                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                              "cmd"
                                                                                              2⤵
                                                                                                PID:332
                                                                                                • C:\Windows\system32\netsh.exe
                                                                                                  netsh wlan show profiles
                                                                                                  3⤵
                                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                                  • System Network Configuration Discovery: Wi-Fi Discovery
                                                                                                  PID:3624
                                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                                                                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nkegsrhp\nkegsrhp.cmdline"
                                                                                                2⤵
                                                                                                  PID:588
                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc97797F037ADA4D3982BDC3C1271DBEB8.TMP"
                                                                                                    3⤵
                                                                                                      PID:4800
                                                                                                  • C:\Windows\SYSTEM32\CMD.EXE
                                                                                                    "CMD.EXE"
                                                                                                    2⤵
                                                                                                      PID:496
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\lgwryj.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\lgwryj.exe"
                                                                                                      2⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4776
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c Cd %temp% && All-In-One.exe OutPut.json
                                                                                                      2⤵
                                                                                                        PID:3880
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\All-In-One.exe
                                                                                                          All-In-One.exe OutPut.json
                                                                                                          3⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          • Accesses Microsoft Outlook accounts
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:4280
                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                        taskkill /F /IM explorer.exe
                                                                                                        2⤵
                                                                                                        • Kills process with taskkill
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:8448
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        "C:\Windows\explorer.exe"
                                                                                                        2⤵
                                                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                                                        • Enumerates connected drives
                                                                                                        • Checks SCSI registry key(s)
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:8636
                                                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                        taskkill /F /IM explorer.exe
                                                                                                        2⤵
                                                                                                        • Kills process with taskkill
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:5068
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        "C:\Windows\explorer.exe"
                                                                                                        2⤵
                                                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                                                        • Enumerates connected drives
                                                                                                        • Checks SCSI registry key(s)
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:4108
                                                                                                      • C:\Windows\System32\netsh.exe
                                                                                                        "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state on
                                                                                                        2⤵
                                                                                                        • Modifies Windows Firewall
                                                                                                        • Event Triggered Execution: Netsh Helper DLL
                                                                                                        PID:1328
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:9080
                                                                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                      1⤵
                                                                                                      • Enumerates system info in registry
                                                                                                      • Modifies Internet Explorer settings
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:9092
                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                      1⤵
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:6220
                                                                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                      1⤵
                                                                                                      • Enumerates system info in registry
                                                                                                      • Modifies Internet Explorer settings
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:6228
                                                                                                    • C:\Windows\system32\vssvc.exe
                                                                                                      C:\Windows\system32\vssvc.exe
                                                                                                      1⤵
                                                                                                        PID:4576
                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                        1⤵
                                                                                                          PID:5188
                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:5544

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                          Reconnaissance

                                                                                                          Resource Development

                                                                                                          Initial Access

                                                                                                          Execution

                                                                                                          Command and Scripting Interpreter

                                                                                                          1
                                                                                                          T1059

                                                                                                          Persistence

                                                                                                          Boot or Logon Autostart Execution

                                                                                                          1
                                                                                                          T1547

                                                                                                          Active Setup

                                                                                                          1
                                                                                                          T1547.014

                                                                                                          Create or Modify System Process

                                                                                                          1
                                                                                                          T1543

                                                                                                          Windows Service

                                                                                                          1
                                                                                                          T1543.003

                                                                                                          Event Triggered Execution

                                                                                                          1
                                                                                                          T1546

                                                                                                          Netsh Helper DLL

                                                                                                          1
                                                                                                          T1546.007

                                                                                                          Privilege Escalation

                                                                                                          Boot or Logon Autostart Execution

                                                                                                          1
                                                                                                          T1547

                                                                                                          Active Setup

                                                                                                          1
                                                                                                          T1547.014

                                                                                                          Create or Modify System Process

                                                                                                          1
                                                                                                          T1543

                                                                                                          Windows Service

                                                                                                          1
                                                                                                          T1543.003

                                                                                                          Event Triggered Execution

                                                                                                          1
                                                                                                          T1546

                                                                                                          Netsh Helper DLL

                                                                                                          1
                                                                                                          T1546.007

                                                                                                          Defense Evasion

                                                                                                          Impair Defenses

                                                                                                          1
                                                                                                          T1562

                                                                                                          Disable or Modify System Firewall

                                                                                                          1
                                                                                                          T1562.004

                                                                                                          Modify Registry

                                                                                                          2
                                                                                                          T1112

                                                                                                          Subvert Trust Controls

                                                                                                          1
                                                                                                          T1553

                                                                                                          SIP and Trust Provider Hijacking

                                                                                                          1
                                                                                                          T1553.003

                                                                                                          Credential Access

                                                                                                          Credentials from Password Stores

                                                                                                          1
                                                                                                          T1555

                                                                                                          Credentials from Web Browsers

                                                                                                          1
                                                                                                          T1555.003

                                                                                                          Unsecured Credentials

                                                                                                          5
                                                                                                          T1552

                                                                                                          Credentials In Files

                                                                                                          4
                                                                                                          T1552.001

                                                                                                          Credentials in Registry

                                                                                                          1
                                                                                                          T1552.002

                                                                                                          Discovery

                                                                                                          Browser Information Discovery

                                                                                                          1
                                                                                                          T1217

                                                                                                          Peripheral Device Discovery

                                                                                                          2
                                                                                                          T1120

                                                                                                          Query Registry

                                                                                                          6
                                                                                                          T1012

                                                                                                          System Information Discovery

                                                                                                          5
                                                                                                          T1082

                                                                                                          System Location Discovery

                                                                                                          1
                                                                                                          T1614

                                                                                                          System Language Discovery

                                                                                                          1
                                                                                                          T1614.001

                                                                                                          System Network Configuration Discovery

                                                                                                          1
                                                                                                          T1016

                                                                                                          Wi-Fi Discovery

                                                                                                          1
                                                                                                          T1016.002

                                                                                                          Lateral Movement

                                                                                                          Collection

                                                                                                          Data from Local System

                                                                                                          5
                                                                                                          T1005

                                                                                                          Email Collection

                                                                                                          1
                                                                                                          T1114

                                                                                                          Command and Control

                                                                                                          Exfiltration

                                                                                                          Impact

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          • C:\Users\Admin\AppData\Local\GMap.NET\DllCache\SQLite_v98_NET4_x64\System.Data.SQLite.DLL
                                                                                                            Filesize

                                                                                                            1.6MB

                                                                                                            MD5

                                                                                                            1b1a6d076bbde5e2ac079ef6dbc9d5f8

                                                                                                            SHA1

                                                                                                            6aa070d07379847f58adcab6b5739fc97b487a28

                                                                                                            SHA256

                                                                                                            eaadfbcafd981ec51c9c039e3adb4963b5a9d85637e27fd4c8cfca5f07ff8471

                                                                                                            SHA512

                                                                                                            05b0cb3d343a5706434390fe863e41852019aa27797fe5d1b80d13b8e24e0de0c2cb6e23d15e89a0f427aaeaf04bf0239f90feb95bfc6913ca4dc59007e6659e

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                            Filesize

                                                                                                            152B

                                                                                                            MD5

                                                                                                            3d68c7edc2a288ee58e6629398bb9f7c

                                                                                                            SHA1

                                                                                                            6c1909dea9321c55cae38b8f16bd9d67822e2e51

                                                                                                            SHA256

                                                                                                            dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

                                                                                                            SHA512

                                                                                                            0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                            Filesize

                                                                                                            152B

                                                                                                            MD5

                                                                                                            53b27f582cb38d5ab3937585ac1a1b67

                                                                                                            SHA1

                                                                                                            9b9876f673fbe903ad258a02812664f27409edc4

                                                                                                            SHA256

                                                                                                            75280f5cf4711a1b5826ed98b88176664b5cc30fe6c0e2b90d9b2ec0cba646e8

                                                                                                            SHA512

                                                                                                            4ec4090c745651ebc1f6e8cc82ebf7f9ea2931f58f40430f6d0dae6e2acc064aa8a6a3d40f6fc7548b1e05d4c7228365442bfb08e443790891618e73a212e692

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                            Filesize

                                                                                                            152B

                                                                                                            MD5

                                                                                                            032ea96b5df60569e774029bccf6b69b

                                                                                                            SHA1

                                                                                                            289de82a4681299f2eae6691bf379a4bcb03d488

                                                                                                            SHA256

                                                                                                            27addaee8b9de97e09fd5f55cc6bdd9a9c27eac0fa529f9957a64118bcef7ec2

                                                                                                            SHA512

                                                                                                            c2c3f070d770b72a157880fec5929494e8dbe44882b196f405cd786bc919388ceae086e7587c7fa603cfdb4977f61317762d45002d3c0cd35d2ecca1fd189fb6

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                            Filesize

                                                                                                            152B

                                                                                                            MD5

                                                                                                            c03d23a8155753f5a936bd7195e475bc

                                                                                                            SHA1

                                                                                                            cdf47f410a3ec000e84be83a3216b54331679d63

                                                                                                            SHA256

                                                                                                            6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

                                                                                                            SHA512

                                                                                                            6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
                                                                                                            Filesize

                                                                                                            215KB

                                                                                                            MD5

                                                                                                            d474ec7f8d58a66420b6daa0893a4874

                                                                                                            SHA1

                                                                                                            4314642571493ba983748556d0e76ec6704da211

                                                                                                            SHA256

                                                                                                            553a19b6f44f125d9594c02231e4217e9d74d92b7065dc996d92f1e53f6bcb69

                                                                                                            SHA512

                                                                                                            344062d1be40db095abb7392b047b16f33ea3043158690cf66a2fa554aa2db79c4aa68de1308f1eddf6b9140b9ac5de70aad960b4e8e8b91f105213c4aace348

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                            Filesize

                                                                                                            1KB

                                                                                                            MD5

                                                                                                            2529cc6270042d891c149473b3df2baf

                                                                                                            SHA1

                                                                                                            4d23a9a634c18c54f663cf0d1ad69c56c39d8da5

                                                                                                            SHA256

                                                                                                            e7649eb286a90b4e243c6b23682e6da6db0f08ef16ed5695119b0a126db994c1

                                                                                                            SHA512

                                                                                                            91aa1e24661ee57ec4c3b7a1ceeafd4a64aff56a59b6d536e4ffc88698dbb8957bf6ef256e75c190e23f63d65dd44de0ac4ffdbd8ad0c906a14c5d385c2f446d

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                            Filesize

                                                                                                            1KB

                                                                                                            MD5

                                                                                                            25d54b5679d37a90fe5bb5a49ff0785c

                                                                                                            SHA1

                                                                                                            d1d14aef29d9fd2f974971329094c36c2b7ea61e

                                                                                                            SHA256

                                                                                                            75523e0714abdc92df8ebe8431c0642e18f2d6ca9a07e27bad708826bc38c7f1

                                                                                                            SHA512

                                                                                                            22f83511bb0dee8a5d539e33ce244466e6ab698f5bf5659b303bacee9af404c48ba8ebde5e41fff6e7c56b93b7df9f8b57f7f31d0441e85f804c2eebd2c95207

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                            Filesize

                                                                                                            1KB

                                                                                                            MD5

                                                                                                            80acc81347a00f863c23c9b2c1d290e3

                                                                                                            SHA1

                                                                                                            f1c508998817ca35528d3c389e495b1b76c1c081

                                                                                                            SHA256

                                                                                                            74e425438b057523e2c71862407fe15063b85dbc3ffb433a2a673fa37e759b4b

                                                                                                            SHA512

                                                                                                            282ca88883506ce1a12c8c8fce379933cbe16741be8ee4b3a8fae333f9c751e161237f13d2a9efc0d9be9f0f39edf2308398ebe3dba1059cac4e0cf7bafd86e2

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            4f67952dd2ff885d53c5f8921f82ae70

                                                                                                            SHA1

                                                                                                            5347b30958dfff05fac3cc2ae3ceb852a4ea16e8

                                                                                                            SHA256

                                                                                                            0f16a3bc63dfb6f7c4ad6c9a4d1b3a2d00648c57671ce04925e34f1518405001

                                                                                                            SHA512

                                                                                                            c1af029d08a74e69492af22c15a2b3b31cf4cf6d0fc7bba9d17414f1d885229349ca180756a8a38b2936e889786f765fffbafa5247ac03e3e51dbacb8e2cc71d

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                            Filesize

                                                                                                            1KB

                                                                                                            MD5

                                                                                                            b39451bcc0b82ad1950c8be61848cc87

                                                                                                            SHA1

                                                                                                            8ac619e60efe6e55069aa20a04ed5a9bb99762ba

                                                                                                            SHA256

                                                                                                            10f92a10f108b6d4ae092e37b7ef7f757ac1a41960e3f7b590bd71f0e479749e

                                                                                                            SHA512

                                                                                                            ee91eb386598710cfc9e192fffe97158b1a0dee0b3c2a8a5156a2c04c49a6bb892f54312f9fe7c49afbad9d26fcb484a8c40d7ad77727b1e87585ca799a759db

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                            Filesize

                                                                                                            1KB

                                                                                                            MD5

                                                                                                            800c28a75a01f601d89c4440ac3de7c6

                                                                                                            SHA1

                                                                                                            5344bd6879b589e237965a7562f41b390e25748d

                                                                                                            SHA256

                                                                                                            3cc908f71fffe339d829f08935e7b0b62a0f15f716a32bd51cbd40072029ba4e

                                                                                                            SHA512

                                                                                                            51f4e147a9b3e283e8df1fc6b9a183cd78b073918637925ae71cd32882b62e9bad93bfe5c136eb240b75cd6dc63eb68e9f533676dd60cf0c5c4e0773775ee651

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                            Filesize

                                                                                                            5KB

                                                                                                            MD5

                                                                                                            06621253412797f09823b17090f37e63

                                                                                                            SHA1

                                                                                                            9eb4d8bb0929333a59223c41c430ef3c393653fe

                                                                                                            SHA256

                                                                                                            486de78574547b9a43b4bf3944ad469724550ed3a2c2a3ae5564d61bb327ed4d

                                                                                                            SHA512

                                                                                                            de96c425398d49b2b946e53576ffec24d88a71521fb9e90ae9f00f1f7e20d7bf0e886e6dd70d98a9772734a4b39b171586ba7e046672297c714cc3cc4f5fab6f

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                            Filesize

                                                                                                            7KB

                                                                                                            MD5

                                                                                                            90074c9273d2772458dbd2f5588d29b3

                                                                                                            SHA1

                                                                                                            c86cfc48390f24652c6455488622b670b077e75c

                                                                                                            SHA256

                                                                                                            8a4c0c405abbeca5f89ac3954894a22d38f1a4f85a11f4b7b70dd5b47f79352e

                                                                                                            SHA512

                                                                                                            542ed1c8cd6da15b09e22c845202e0784f8644e368117fbfa3fb88f0ca4a14a33d7d92b4a6b9eab46e5ac554d1aa50bd37374f1590c23aaf6cf9240b37500a57

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                            Filesize

                                                                                                            6KB

                                                                                                            MD5

                                                                                                            d75cd5ace8aa154ede67dbc672201f3b

                                                                                                            SHA1

                                                                                                            2b62a520fcadb8352a625e0d6f1e28be9faf0666

                                                                                                            SHA256

                                                                                                            f8d42513b9498770ec5e3eee625735505fca452be9661197d46b5b05c28c1e19

                                                                                                            SHA512

                                                                                                            1c8608738736497eb1ffb1011526b6a805577393a9e03e31ecfd19409137d3a0727566aa3020bd841bc87c92c8bec193be44f752def336851ec24c3aadca757a

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                            Filesize

                                                                                                            7KB

                                                                                                            MD5

                                                                                                            95b873a57f907fbd2ae0bd8ae2b959a4

                                                                                                            SHA1

                                                                                                            9a2708c3cae84831523a1c6abb4f074140e8af07

                                                                                                            SHA256

                                                                                                            8b582311df4ad67e114ce1bdd43fdd5a906204d456e4890cd571643c59cbce75

                                                                                                            SHA512

                                                                                                            ffb1d09150adf708a9281831a05078142731d646e2d512a966fd5b7da52fb23158f3a0a53fd9696d0f9534667aa6f9d71c90b8de26eed27acfb19baf7b0fe574

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                            Filesize

                                                                                                            7KB

                                                                                                            MD5

                                                                                                            c9374c65259f9f8f9ef8fa7b65f9413a

                                                                                                            SHA1

                                                                                                            8842edeb6f332fe1f04421bc73090be593d7a686

                                                                                                            SHA256

                                                                                                            4d83a2a6881a0217473a34ca56f088e987b2f9b9a348b935aec352c1123884b3

                                                                                                            SHA512

                                                                                                            7a6b45d2c114350715548f764f1a4b77be4a97064045cc2370730a2094b76ac5ed81c2debfef161144de0f10911fda633fb13a449ac796a3db2838b8f890546d

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                            Filesize

                                                                                                            6KB

                                                                                                            MD5

                                                                                                            7bf149827b61f7a20b360d3d8b3cef3f

                                                                                                            SHA1

                                                                                                            f3c7ad4c1eedb25595c956f1a12fb955f651ea19

                                                                                                            SHA256

                                                                                                            ce2a185446a89d0c1671b6191791c62fe6d541093c4620950b2b6468ba9b209e

                                                                                                            SHA512

                                                                                                            b2d545b1590888e48575d3b240247d9f2dd4b54cf753058d4312e3932efbe2d64b3424de8c177dfd6ece8e87dd932616b5788594794c89a9758c03636b16aa85

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                            Filesize

                                                                                                            6KB

                                                                                                            MD5

                                                                                                            6281b1a4df7387e0d64b8fd94a398247

                                                                                                            SHA1

                                                                                                            7e1725b981b52e21e3934d9447dfd58eaa4be56a

                                                                                                            SHA256

                                                                                                            5b9e151025925cfdf01d6290fd5bd62204cb72a37dc61ced18df4cf015e01fdf

                                                                                                            SHA512

                                                                                                            7ad15c89ed70155e105528bd3bdf25b5c7e093252d8b24e0b18fc8303c041b3dc2c8b86a0329a69870b24837b29d852df4435a6eb0d43b0739d855d4fe06450c

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                            Filesize

                                                                                                            7KB

                                                                                                            MD5

                                                                                                            e6da25744acfdb9c1989b5d4d363cb3f

                                                                                                            SHA1

                                                                                                            b7e5a4d4a330203932afc4507df1375ff73e260c

                                                                                                            SHA256

                                                                                                            1634a7e3bedc7ef663b6204177ce3a114254f56b5c10780b6b34144a8c12495c

                                                                                                            SHA512

                                                                                                            c1da31194d9a1af1af14d070b56d127528f0f920d5f62cd74b590c1b1ba6f189014a8440248a5595bac7a1c825d77f80a8c594211e1be36539b6795d409a16f0

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                            Filesize

                                                                                                            1KB

                                                                                                            MD5

                                                                                                            69c986d7c93666314b8cfa2499e0f97a

                                                                                                            SHA1

                                                                                                            a049bbd09e53b3bedbe781b07e471cabe7aab4e8

                                                                                                            SHA256

                                                                                                            6cc0971dbfd1d7ea4d1a84e1407168ccba5f81607aae921246b1fd8f796f3533

                                                                                                            SHA512

                                                                                                            6506f400136d452519058cdf4c73464432c22b90db85a8c2bf908ad69e33a801dbc4e7d86271e89c430fca1811d7a335c211c28cd9c1e70f6a0758a65c6aad52

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b0feb.TMP
                                                                                                            Filesize

                                                                                                            1KB

                                                                                                            MD5

                                                                                                            78b1c8ea457297c4b657b6e55e2338dd

                                                                                                            SHA1

                                                                                                            f3045275b091c2bee233306d01655a09cad90213

                                                                                                            SHA256

                                                                                                            f645f4a471b2dd495df06265bfa43a3d7a246baeb01539820e00a231a79be147

                                                                                                            SHA512

                                                                                                            4206d8853cdc386663642f16f352b6e55570e69d2aee0e713393ef9b93a0486c1705a3cee2b6ef8cbc9bf6ede2e4f693cde0f70b3e526d0af9237ff9aa88d87f

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                            Filesize

                                                                                                            16B

                                                                                                            MD5

                                                                                                            46295cac801e5d4857d09837238a6394

                                                                                                            SHA1

                                                                                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                            SHA256

                                                                                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                            SHA512

                                                                                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                            Filesize

                                                                                                            16B

                                                                                                            MD5

                                                                                                            206702161f94c5cd39fadd03f4014d98

                                                                                                            SHA1

                                                                                                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                            SHA256

                                                                                                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                            SHA512

                                                                                                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                            Filesize

                                                                                                            16B

                                                                                                            MD5

                                                                                                            6752a1d65b201c13b62ea44016eb221f

                                                                                                            SHA1

                                                                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                            SHA256

                                                                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                            SHA512

                                                                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                            Filesize

                                                                                                            10KB

                                                                                                            MD5

                                                                                                            c1e6c08cb33948fa460f20dfc1a0b50b

                                                                                                            SHA1

                                                                                                            0e4bf517bc713817137c66abc751912d4e69095c

                                                                                                            SHA256

                                                                                                            62e2e91c2bd54188ce4d98dee1a336168bb5510b606e5e1fa464a03e3a4f5362

                                                                                                            SHA512

                                                                                                            2b841c31ccb89d1e73a1430335ee7f20d08c7b00511f158154dbeb73b7ee96b5ffe4c4648304c521939867a5ba0d86815550e9fa75ace606b6c31681c034d2e2

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                            Filesize

                                                                                                            10KB

                                                                                                            MD5

                                                                                                            0fefa434621866bee63811ce4e020d93

                                                                                                            SHA1

                                                                                                            0d3686f57f1ce395ed5916237d4e5ce9d4e9aa57

                                                                                                            SHA256

                                                                                                            d7c1fabfe972e83eccbd2a000701a8fb663bb38abc55f0ccb5f135ec56de6d30

                                                                                                            SHA512

                                                                                                            d3578dceecb05cb3d79b711c23bab1d61d11c2c2bd52529de022c8910839d61d6162c1b25814c6308d6536df796d3592aae796c12162425a57faa44f83490dd2

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                            Filesize

                                                                                                            11KB

                                                                                                            MD5

                                                                                                            52ccb64177a9ee3d4ee76c083e2530f5

                                                                                                            SHA1

                                                                                                            cfdd631403571842592fdfde073451aa390f550b

                                                                                                            SHA256

                                                                                                            05d61836a592a4b00750b79127c14acac2043ee127a4d4356d2e11c2bf31442e

                                                                                                            SHA512

                                                                                                            1485238719d441d8aaea9eabc23f0ce1d86477484bbdcb46fe6a32b3182b922eec664c14722abf3903e6257f0e227b5de86909512bdc5273c0d635ecb0f34652

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                            Filesize

                                                                                                            11KB

                                                                                                            MD5

                                                                                                            e8004fbaf02bbb67b9f6c0c59f570c12

                                                                                                            SHA1

                                                                                                            e4132a20fb4690ef29fc875f1ff8ad563dbb5cc8

                                                                                                            SHA256

                                                                                                            0ee4bd7f16c0aa49b55160020624b5a20878a654701992d4d86bf3fcb07a0e5f

                                                                                                            SHA512

                                                                                                            3f0dbaccd7310242dad8d3f6426bd5dfe0ad2140da4a24052f0c348f1d1e188987e3e3a0c17ba3aca7cd8d67c7c2622c00b7f90b753edb454f4cb894e4fbd63c

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                            Filesize

                                                                                                            11KB

                                                                                                            MD5

                                                                                                            56ea45fe00ffd799b90c63883b3ba7f7

                                                                                                            SHA1

                                                                                                            6be4cfceedc510e98b11dcf32a1312943a3d043c

                                                                                                            SHA256

                                                                                                            b03d890300d16281ef77573f120eccacc8b0604df9605ae7a4269337033c6660

                                                                                                            SHA512

                                                                                                            91433626b99c6c01ec9270c15605e6509d28d0ff61b55c94d8c5218b17b67d956ecd5d2d6d79e20fa116f75d9295851ad79ce6fcf712a7fb8ce9283959b24bc4

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\6CGRGUCT\www.bing[1].xml
                                                                                                            Filesize

                                                                                                            15KB

                                                                                                            MD5

                                                                                                            3030279b50527b79f3e93530960c2144

                                                                                                            SHA1

                                                                                                            46d6ce28f3039f21ec46681c4d9ab102872bac75

                                                                                                            SHA256

                                                                                                            c9c075ed43476f400bda37f414b019a40fa56fc8265bbe4ab8920b954515c047

                                                                                                            SHA512

                                                                                                            ba5f7b76a948453af65da24dfc500f922aadfe3c216da6b7c4e9e61cff8344bb6fa6dc5290d9a653e20612312a642eabedaa94fd5b4d77028a701513447f8389

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133815697300281853.txt
                                                                                                            Filesize

                                                                                                            68KB

                                                                                                            MD5

                                                                                                            d53a5bb1b064be22e78230be062c6299

                                                                                                            SHA1

                                                                                                            7c4d4fef400024c5fc1d1263b7f9073d9c12a235

                                                                                                            SHA256

                                                                                                            8a275c644ba9def8cbc6cefa203e019ced358e42eb0098016acb198744ca39a4

                                                                                                            SHA512

                                                                                                            16843e968389d8fae80719538f82401b671c30bff8c461daa87d5068de34276592e04918412307a5388d10ade59e79efb0e9d344de73fe207785a55bf0566ad5

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\All-In-One.exe
                                                                                                            Filesize

                                                                                                            5.1MB

                                                                                                            MD5

                                                                                                            a48e3197ab0f64c4684f0828f742165c

                                                                                                            SHA1

                                                                                                            f935c3d6f9601c795f2211e34b3778fad14442b4

                                                                                                            SHA256

                                                                                                            baecc747370a4c396ef5403a3a2b286465d8fe4677bf1bfd23b8164ef5c22bbb

                                                                                                            SHA512

                                                                                                            e0b0b73c39850a30aac89f84f721c79f863612f596d6ff3df0860a9faf743a81364656773c99708e9c0656c74b6a278b6bf7e648f7ff1b9080f9a21e10515a59

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dll
                                                                                                            Filesize

                                                                                                            18KB

                                                                                                            MD5

                                                                                                            6ea692f862bdeb446e649e4b2893e36f

                                                                                                            SHA1

                                                                                                            84fceae03d28ff1907048acee7eae7e45baaf2bd

                                                                                                            SHA256

                                                                                                            9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2

                                                                                                            SHA512

                                                                                                            9661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-convert-l1-1-0.dll
                                                                                                            Filesize

                                                                                                            21KB

                                                                                                            MD5

                                                                                                            72e28c902cd947f9a3425b19ac5a64bd

                                                                                                            SHA1

                                                                                                            9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7

                                                                                                            SHA256

                                                                                                            3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1

                                                                                                            SHA512

                                                                                                            58ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dll
                                                                                                            Filesize

                                                                                                            18KB

                                                                                                            MD5

                                                                                                            ac290dad7cb4ca2d93516580452eda1c

                                                                                                            SHA1

                                                                                                            fa949453557d0049d723f9615e4f390010520eda

                                                                                                            SHA256

                                                                                                            c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382

                                                                                                            SHA512

                                                                                                            b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dll
                                                                                                            Filesize

                                                                                                            19KB

                                                                                                            MD5

                                                                                                            aec2268601470050e62cb8066dd41a59

                                                                                                            SHA1

                                                                                                            363ed259905442c4e3b89901bfd8a43b96bf25e4

                                                                                                            SHA256

                                                                                                            7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2

                                                                                                            SHA512

                                                                                                            0c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dll
                                                                                                            Filesize

                                                                                                            18KB

                                                                                                            MD5

                                                                                                            93d3da06bf894f4fa21007bee06b5e7d

                                                                                                            SHA1

                                                                                                            1e47230a7ebcfaf643087a1929a385e0d554ad15

                                                                                                            SHA256

                                                                                                            f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d

                                                                                                            SHA512

                                                                                                            72bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dll
                                                                                                            Filesize

                                                                                                            18KB

                                                                                                            MD5

                                                                                                            a2f2258c32e3ba9abf9e9e38ef7da8c9

                                                                                                            SHA1

                                                                                                            116846ca871114b7c54148ab2d968f364da6142f

                                                                                                            SHA256

                                                                                                            565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33

                                                                                                            SHA512

                                                                                                            e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dll
                                                                                                            Filesize

                                                                                                            28KB

                                                                                                            MD5

                                                                                                            8b0ba750e7b15300482ce6c961a932f0

                                                                                                            SHA1

                                                                                                            71a2f5d76d23e48cef8f258eaad63e586cfc0e19

                                                                                                            SHA256

                                                                                                            bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed

                                                                                                            SHA512

                                                                                                            fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-multibyte-l1-1-0.dll
                                                                                                            Filesize

                                                                                                            25KB

                                                                                                            MD5

                                                                                                            35fc66bd813d0f126883e695664e7b83

                                                                                                            SHA1

                                                                                                            2fd63c18cc5dc4defc7ea82f421050e668f68548

                                                                                                            SHA256

                                                                                                            66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735

                                                                                                            SHA512

                                                                                                            65f8397de5c48d3df8ad79baf46c1d3a0761f727e918ae63612ea37d96adf16cc76d70d454a599f37f9ba9b4e2e38ebc845df4c74fc1e1131720fd0dcb881431

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dll
                                                                                                            Filesize

                                                                                                            22KB

                                                                                                            MD5

                                                                                                            41a348f9bedc8681fb30fa78e45edb24

                                                                                                            SHA1

                                                                                                            66e76c0574a549f293323dd6f863a8a5b54f3f9b

                                                                                                            SHA256

                                                                                                            c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b

                                                                                                            SHA512

                                                                                                            8c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dll
                                                                                                            Filesize

                                                                                                            23KB

                                                                                                            MD5

                                                                                                            fefb98394cb9ef4368da798deab00e21

                                                                                                            SHA1

                                                                                                            316d86926b558c9f3f6133739c1a8477b9e60740

                                                                                                            SHA256

                                                                                                            b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7

                                                                                                            SHA512

                                                                                                            57476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dll
                                                                                                            Filesize

                                                                                                            22KB

                                                                                                            MD5

                                                                                                            404604cd100a1e60dfdaf6ecf5ba14c0

                                                                                                            SHA1

                                                                                                            58469835ab4b916927b3cabf54aee4f380ff6748

                                                                                                            SHA256

                                                                                                            73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c

                                                                                                            SHA512

                                                                                                            da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dll
                                                                                                            Filesize

                                                                                                            20KB

                                                                                                            MD5

                                                                                                            849f2c3ebf1fcba33d16153692d5810f

                                                                                                            SHA1

                                                                                                            1f8eda52d31512ebfdd546be60990b95c8e28bfb

                                                                                                            SHA256

                                                                                                            69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d

                                                                                                            SHA512

                                                                                                            44dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dll
                                                                                                            Filesize

                                                                                                            18KB

                                                                                                            MD5

                                                                                                            b52a0ca52c9c207874639b62b6082242

                                                                                                            SHA1

                                                                                                            6fb845d6a82102ff74bd35f42a2844d8c450413b

                                                                                                            SHA256

                                                                                                            a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0

                                                                                                            SHA512

                                                                                                            18834d89376d703bd461edf7738eb723ad8d54cb92acc9b6f10cbb55d63db22c2a0f2f3067fe2cc6feb775db397030606608ff791a46bf048016a1333028d0a4

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\freebl3.dll
                                                                                                            Filesize

                                                                                                            324KB

                                                                                                            MD5

                                                                                                            04a2ba08eb17206b7426cb941f39250b

                                                                                                            SHA1

                                                                                                            731ac2b533724d9f540759d84b3e36910278edba

                                                                                                            SHA256

                                                                                                            8e5110ce03826f680f30013985be49ebd8fc672de113fc1d9a566eced149b8c4

                                                                                                            SHA512

                                                                                                            e6e90b4becf472b2e8f716dbb962cd7de61676fcce342c735fccdc01268b5a221139bc9be0e0c9722e9978aefaae79c10bc49c43392aa05dd12244b3147aeffc

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\mozglue.dll
                                                                                                            Filesize

                                                                                                            135KB

                                                                                                            MD5

                                                                                                            591533ca4655646981f759d95f75ae3d

                                                                                                            SHA1

                                                                                                            b4a02f18e505a1273f7090a9d246bc953a2cb792

                                                                                                            SHA256

                                                                                                            4434f4223d24fb6e2f5840dd6c1eedef2875e11abe24e4b0e9bc1507f8f6fd47

                                                                                                            SHA512

                                                                                                            915b124ad595ee78feab8f3c9be7e80155445e58ed4c88b89665df5fb7e0a04e973374a01f97bb67aaa733a8ce2e91a9f92605ec96251906e0fb2750a719b579

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\msvcp140.dll
                                                                                                            Filesize

                                                                                                            429KB

                                                                                                            MD5

                                                                                                            109f0f02fd37c84bfc7508d4227d7ed5

                                                                                                            SHA1

                                                                                                            ef7420141bb15ac334d3964082361a460bfdb975

                                                                                                            SHA256

                                                                                                            334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                                                                                                            SHA512

                                                                                                            46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\nss3.dll
                                                                                                            Filesize

                                                                                                            1.2MB

                                                                                                            MD5

                                                                                                            fc57d044bfd635997415c5f655b5fffa

                                                                                                            SHA1

                                                                                                            1b5162443d985648ef64e4aab42089ad4c25f856

                                                                                                            SHA256

                                                                                                            17f8c55eba797bbc80c8c32ca1a3a7588415984386be56f4b4cdefd4176fb4c3

                                                                                                            SHA512

                                                                                                            f5a944230000730bc0aad10e6607e3389d9d82a0a4ab1b72a19d32e94e8572789d46fb4acd75ad48f17e2bbc27389d432086696f2ccc899850ff9177d6823efb

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\softokn3.dll
                                                                                                            Filesize

                                                                                                            140KB

                                                                                                            MD5

                                                                                                            1b304dad157edc24e397629c0b688a3e

                                                                                                            SHA1

                                                                                                            ae151af384675125dfbdc96147094cff7179b7da

                                                                                                            SHA256

                                                                                                            8f0c9ac7134773d11d402e49daa90958fe00205e83a7389f7a58da03892d20cb

                                                                                                            SHA512

                                                                                                            2dc625dbdf2aae4ade600cca688eb5280200e8d7c2dfc359590435afe0926b3a7446cc56a66023ee834366132a68ae68da51a5079e4f107201e2050f5c5512ad

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\vcruntime140.dll
                                                                                                            Filesize

                                                                                                            81KB

                                                                                                            MD5

                                                                                                            7587bf9cb4147022cd5681b015183046

                                                                                                            SHA1

                                                                                                            f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                                                                                                            SHA256

                                                                                                            c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                                                                                                            SHA512

                                                                                                            0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\Components\nspr4.dll
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            72414dfb0b112c664d2c8d1215674e09

                                                                                                            SHA1

                                                                                                            50a1e61309741e92fe3931d8eb606f8ada582c0a

                                                                                                            SHA256

                                                                                                            69e73fea2210adc2ae0837ac98b46980a09fe91c07f181a28fda195e2b9e6b71

                                                                                                            SHA512

                                                                                                            41428624573b4a191b33657ed9ad760b500c5640f3d62b758869a17857edc68f90bc10d7a5e720029519c0d49b5ca0fa8579743e80b200ef331e41efde1dc8c9

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\Components\nss3.dll
                                                                                                            Filesize

                                                                                                            172KB

                                                                                                            MD5

                                                                                                            7ddbd64d87c94fd0b5914688093dd5c2

                                                                                                            SHA1

                                                                                                            d49d1f79efae8a5f58e6f713e43360117589efeb

                                                                                                            SHA256

                                                                                                            769703fb1ba6c95fb6c889e8a9baaea309e62d0f3ca444d01cc6b495c0f722d1

                                                                                                            SHA512

                                                                                                            60eaad58c3c4894f1673723eb28ddb42b681ff7aafe7a29ff8bf87a2da6595c16d1f8449096accdb89bd6cda6454eb90470e71dde7c5bd16abd0f80e115cfa2d

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\Components\plc4.dll
                                                                                                            Filesize

                                                                                                            8KB

                                                                                                            MD5

                                                                                                            c73ec58b42e66443fafc03f3a84dcef9

                                                                                                            SHA1

                                                                                                            5e91f467fe853da2c437f887162bccc6fd9d9dbe

                                                                                                            SHA256

                                                                                                            2dc0171b83c406db6ec9389b438828246b282862d2b8bdf2f5b75aec932a69f7

                                                                                                            SHA512

                                                                                                            6318e831d8f38525e2e49b5a1661440cd8b1f3d2afc6813bb862c21d88d213c4675a8ec2a413b14fbdca896c63b65a7da6ec9595893b352ade8979e7e86a7fcf

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\Components\plds4.dll
                                                                                                            Filesize

                                                                                                            6KB

                                                                                                            MD5

                                                                                                            ee44d5d780521816c906568a8798ed2f

                                                                                                            SHA1

                                                                                                            2da1b06d5de378cbfc7f2614a0f280f59f2b1224

                                                                                                            SHA256

                                                                                                            50b2735318233d6c87b6efccccc23a0e3216d2870c67f2f193cc1c83c7c879fc

                                                                                                            SHA512

                                                                                                            634a1cd2baaef29b4fe7c7583c04406bb2ea3a3c93294b31f621652844541e7c549da1a31619f657207327604c261976e15845571ee1efe5416f1b021d361da8

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\External\Components\softokn3.dll
                                                                                                            Filesize

                                                                                                            155KB

                                                                                                            MD5

                                                                                                            e846285b19405b11c8f19c1ed0a57292

                                                                                                            SHA1

                                                                                                            2c20cf37394be48770cd6d396878a3ca70066fd0

                                                                                                            SHA256

                                                                                                            251f0094b6b6537df3d3ce7c2663726616f06cfb9b6de90efabd67de2179a477

                                                                                                            SHA512

                                                                                                            b622ff07ae2f77e886a93987a9a922e80032e9041ed41503f0e38abb8c344eb922d154ade29e52454d0a1ad31596c4085f4bd942e4412af9f0698183acd75db7

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\License.XenArmor
                                                                                                            Filesize

                                                                                                            104B

                                                                                                            MD5

                                                                                                            774a9a7b72f7ed97905076523bdfe603

                                                                                                            SHA1

                                                                                                            946355308d2224694e0957f4ebf6cdba58327370

                                                                                                            SHA256

                                                                                                            76e56835b1ac5d7a8409b7333826a2353401cf67f3bd95c733adc6aa8d9fec81

                                                                                                            SHA512

                                                                                                            c5c77c6827c72901494b3a368593cb9a990451664b082761294a845c0cd9441d37e5e9ac0e82155cb4d97f29507ffc8e26d6ff74009666c3075578aa18b28675

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RESB0ED.tmp
                                                                                                            Filesize

                                                                                                            1KB

                                                                                                            MD5

                                                                                                            d239a535cd9e791686387fe1b57d12d6

                                                                                                            SHA1

                                                                                                            00832893c0b771f943487c7d2527d591c4a19c57

                                                                                                            SHA256

                                                                                                            82006398b0962f3d21d02e6b5958006b3855d1c0ccdd99e7ac13d8dd44a756f9

                                                                                                            SHA512

                                                                                                            04cd8d104ce0d9bc81ee290ba8e725e24ec2aaceb49c3a13db93e53e5f1d60302a201cd6446e29f5403c9a1d79b37d30c49be1860a751c388fdeb2675f35c9f1

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TMzpx\TMzpx.dll
                                                                                                            Filesize

                                                                                                            112KB

                                                                                                            MD5

                                                                                                            2f1a50031dcf5c87d92e8b2491fdcea6

                                                                                                            SHA1

                                                                                                            71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f

                                                                                                            SHA256

                                                                                                            47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed

                                                                                                            SHA512

                                                                                                            1c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XenManager.dll
                                                                                                            Filesize

                                                                                                            2.0MB

                                                                                                            MD5

                                                                                                            7a5c53a889c4bf3f773f90b85af5449e

                                                                                                            SHA1

                                                                                                            25b2928c310b3068b629e9dca38c7f10f6adc5b6

                                                                                                            SHA256

                                                                                                            baa9c3a0d0524263c4f848056b3f1da3b4bb913162362cbcabe77ce76a39870c

                                                                                                            SHA512

                                                                                                            f5943687d7e098790581bf56ac6fec3b7e9b83d0e29301077a8bc48768c5a0e9f54f53d926f9847885f6035a2b31e456e4e45ccf1c70be27229c46e79876e2ed

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-CC386.tmp\tsetup-x64.5.10.3.tmp
                                                                                                            Filesize

                                                                                                            3.2MB

                                                                                                            MD5

                                                                                                            8eb6dbed29908cca18e736655debff24

                                                                                                            SHA1

                                                                                                            53bc18d3a03527f681a68b8f300854f30adea350

                                                                                                            SHA256

                                                                                                            fe7c52b5a8594d9d6b7932c52274f71b926b9d74407ee18afbe0e085a6dc5154

                                                                                                            SHA512

                                                                                                            52bce495e14e5ae6a3cc8d0f9c87368350faaafa68ba8f2dc2e521d4b3b8c3971cc18c89e79c79e58927d809f0666d4fde75edd3dcfaaf9580007252132dc176

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mjlthmml\mjlthmml.0.vb
                                                                                                            Filesize

                                                                                                            77KB

                                                                                                            MD5

                                                                                                            6d86bb92c44aa9047cf2b8eaddb5f495

                                                                                                            SHA1

                                                                                                            a6e53841eb035692fd5e67987ce718006b2afef0

                                                                                                            SHA256

                                                                                                            5213f3bf3954693c168086569aa19745ebe62118307f679508dd29a03128ad18

                                                                                                            SHA512

                                                                                                            9f9786f6875563304d2fce61b4bf7c27f3c0f4e7236e2253b702c70ab564f561d17807ff0f27bbedfb340759f365687a1ca0819c7ec22faad67001ffaef24f00

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mjlthmml\mjlthmml.cmdline
                                                                                                            Filesize

                                                                                                            288B

                                                                                                            MD5

                                                                                                            25437a303bd4d3c63200834dda2a9ae9

                                                                                                            SHA1

                                                                                                            80cc0ea65bced049c6d2182ce769de1ec26531d7

                                                                                                            SHA256

                                                                                                            7332c488eca3307075dbc06de9448f1cf6e1eac267a8e759e4fdc234f476f789

                                                                                                            SHA512

                                                                                                            2ff034f179cda77c1438f5a799e984f9e63d220e42df61fdf2bbb0cb6ca79ab1a038704cacaefee423f4a478c0f6c1810104fcedf7d0cdbc572092c00cc4e0cc

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\settings.db
                                                                                                            Filesize

                                                                                                            20KB

                                                                                                            MD5

                                                                                                            56b941f65d270f2bf397be196fcf4406

                                                                                                            SHA1

                                                                                                            244f2e964da92f7ef7f809e5ce0b3191aeab084a

                                                                                                            SHA256

                                                                                                            00c020ba1cce022364976f164c575993cb3b811c61b5b4e05a8a0c3d1b560c0c

                                                                                                            SHA512

                                                                                                            52ad8c7ed497a5b8eed565b3abcbf544841f3c8c9ec3ca8f686846a2afd15ac4ac8b16abf1cb14aeca1a2fb31f3086ad17206ec4af28e77bae600dca15e8deab

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\vbcFBB40B139517419A83511AFA6C5AF9AE.TMP
                                                                                                            Filesize

                                                                                                            1KB

                                                                                                            MD5

                                                                                                            a4e574715e4e27dfb942a4148117aa1c

                                                                                                            SHA1

                                                                                                            e375f98d63b9c431112474958b5fa5127265eba7

                                                                                                            SHA256

                                                                                                            ac2e0e7da83bc8174e8a51cef6d0cb0ab59aba711d7a864682716b12c84e6ee2

                                                                                                            SHA512

                                                                                                            63972580d4cd0cfcbf17981cbfc5d84103baae80b415843c3323e4515e143547a709f47a3bfe2bc42bcd98d5e4f7d341374e0d6d7d65fdff8f40e6ddcbfabe17

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_4B675B2060704CB794B6FFFF54993619.dat
                                                                                                            Filesize

                                                                                                            940B

                                                                                                            MD5

                                                                                                            2942a5ff72be77592d0d4c601cf710e9

                                                                                                            SHA1

                                                                                                            50beaf3fbf356013f4d0f087a8b3d53bcdd7a239

                                                                                                            SHA256

                                                                                                            6fa0a2403a90d7cd7ee08ab36e64b66e7a67b6e717f2e6e7dc4b07cedd1139fc

                                                                                                            SHA512

                                                                                                            22a2b1a8e28d8177c45a902c5673bbbb21f49955d4a686349a1d3497b331289bb24a65c5ebacb00c5b59d7afc092a6500b9ccc4ec3b24f5e82004d5801d61eff

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                            Filesize

                                                                                                            2B

                                                                                                            MD5

                                                                                                            f3b25701fe362ec84616a93a45ce9998

                                                                                                            SHA1

                                                                                                            d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                            SHA256

                                                                                                            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                            SHA512

                                                                                                            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                            Filesize

                                                                                                            22B

                                                                                                            MD5

                                                                                                            14f705f549f3028d93387168a973b57d

                                                                                                            SHA1

                                                                                                            904d2cdfa31872976e6144d3049fd93241077cb6

                                                                                                            SHA256

                                                                                                            0994bef5e49e421d0af1c4833f5410e131f3f2a49ccc5d217a553f41ca59cb86

                                                                                                            SHA512

                                                                                                            2f7dc1827e66c6dbd89c189fa87250971ad033490489f657a6939b5bf30e6e7eadc36deb1d215afb622418b9cea01c7fce321acb2335d3f2b73795d8fccf2052

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\41f23bb65d5a09df.customDestinations-ms
                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            47aac8862e79af0f7aeb2fee35ed63f4

                                                                                                            SHA1

                                                                                                            140c05ddffbfa9007920c7889acfee373d681649

                                                                                                            SHA256

                                                                                                            870cdd31d96112d0a4c0ee4c065f555d1e7433999ff299292659cc78c0c53858

                                                                                                            SHA512

                                                                                                            1421695a4b4bfc80fb1e88d5d3e79e376b82828dc96b56b26dea1001febb27f10b4584562e011cc74b764e6fba9807748236e40b1601f319568d6b5f84490ff0

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\41f23bb65d5a09df.customDestinations-ms
                                                                                                            Filesize

                                                                                                            2KB

                                                                                                            MD5

                                                                                                            c3da8394be5e99dcb5af8f889c556392

                                                                                                            SHA1

                                                                                                            4c7848d3e600d60445a8fc41e3dfbdecf03c7195

                                                                                                            SHA256

                                                                                                            f19fb7151825424b9fe702537f012210f56fc50612c9bcb376d539713684f21d

                                                                                                            SHA512

                                                                                                            4e4e3e70f4dc51b338401021104e1d246ab9a5729207b94a9f676dec8e6bc68a157cc319d7d1dd5049a1e47d6c356a5faa9bb121f0005363504bf0ec62261218

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk
                                                                                                            Filesize

                                                                                                            1KB

                                                                                                            MD5

                                                                                                            a9a4b36650f2b6f92659237fad460837

                                                                                                            SHA1

                                                                                                            83af2c49c2f8c4be1ded1ca0fdd76bb77ffc1ef1

                                                                                                            SHA256

                                                                                                            0f4e0a6b6aee17b41732823eda881f8722e1e9ce4a305bbbfeaf78f43f3107a4

                                                                                                            SHA512

                                                                                                            8fdfef5e4fd563f71012c082c8827f694c0114cb5bfe23722741078c937ba92b00974336a8664a4d9cdf59c530975bfd3e663bf3165b98b0bacba446847e69a0

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Roaming\Telegram Desktop\modules\x64\d3d\d3dcompiler_47.dll
                                                                                                            Filesize

                                                                                                            4.7MB

                                                                                                            MD5

                                                                                                            a7349236212b0e5cec2978f2cfa49a1a

                                                                                                            SHA1

                                                                                                            5abb08949162fd1985b89ffad40aaf5fc769017e

                                                                                                            SHA256

                                                                                                            a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082

                                                                                                            SHA512

                                                                                                            c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.1\Icons\icon (15).ico
                                                                                                            Filesize

                                                                                                            361KB

                                                                                                            MD5

                                                                                                            e3143e8c70427a56dac73a808cba0c79

                                                                                                            SHA1

                                                                                                            63556c7ad9e778d5bd9092f834b5cc751e419d16

                                                                                                            SHA256

                                                                                                            b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

                                                                                                            SHA512

                                                                                                            74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\GMap.NET.WindowsForms.dll
                                                                                                            Filesize

                                                                                                            147KB

                                                                                                            MD5

                                                                                                            32a8742009ffdfd68b46fe8fd4794386

                                                                                                            SHA1

                                                                                                            de18190d77ae094b03d357abfa4a465058cd54e3

                                                                                                            SHA256

                                                                                                            741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365

                                                                                                            SHA512

                                                                                                            22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\GeoIP.dat
                                                                                                            Filesize

                                                                                                            1.2MB

                                                                                                            MD5

                                                                                                            8ef41798df108ce9bd41382c9721b1c9

                                                                                                            SHA1

                                                                                                            1e6227635a12039f4d380531b032bf773f0e6de0

                                                                                                            SHA256

                                                                                                            bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

                                                                                                            SHA512

                                                                                                            4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\Guna.UI2.dll
                                                                                                            Filesize

                                                                                                            1.9MB

                                                                                                            MD5

                                                                                                            bcc0fe2b28edd2da651388f84599059b

                                                                                                            SHA1

                                                                                                            44d7756708aafa08730ca9dbdc01091790940a4f

                                                                                                            SHA256

                                                                                                            c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

                                                                                                            SHA512

                                                                                                            3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\Mono.Cecil.dll
                                                                                                            Filesize

                                                                                                            350KB

                                                                                                            MD5

                                                                                                            de69bb29d6a9dfb615a90df3580d63b1

                                                                                                            SHA1

                                                                                                            74446b4dcc146ce61e5216bf7efac186adf7849b

                                                                                                            SHA256

                                                                                                            f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc

                                                                                                            SHA512

                                                                                                            6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\MonoMod.Backports.dll
                                                                                                            Filesize

                                                                                                            138KB

                                                                                                            MD5

                                                                                                            dd43356f07fc0ce082db4e2f102747a2

                                                                                                            SHA1

                                                                                                            aa0782732e2d60fa668b0aadbf3447ef70b6a619

                                                                                                            SHA256

                                                                                                            e375b83a3e242212a2ed9478e1f0b8383c1bf1fdfab5a1cf766df740b631afd6

                                                                                                            SHA512

                                                                                                            284d64b99931ed1f2e839a7b19ee8389eefaf6c72bac556468a01f3eb17000252613c01dbae88923e9a02f3c84bcab02296659648fad727123f63d0ac38d258e

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\MonoMod.Core.dll
                                                                                                            Filesize

                                                                                                            216KB

                                                                                                            MD5

                                                                                                            b808181453b17f3fc1ab153bf11be197

                                                                                                            SHA1

                                                                                                            bce86080b7eb76783940d1ff277e2b46f231efe9

                                                                                                            SHA256

                                                                                                            da00cdfab411f8f535f17258981ec51d1af9b0bfcee3a360cbd0cb6f692dbcdd

                                                                                                            SHA512

                                                                                                            a2d941c6e69972f99707ade5c5325eb50b0ec4c5abf6a189eb11a46606fed8076be44c839d83cf310b67e66471e0ea3f6597857a8e2c7e2a7ad6de60c314f7d3

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\MonoMod.ILHelpers.dll
                                                                                                            Filesize

                                                                                                            6KB

                                                                                                            MD5

                                                                                                            6512e89e0cb92514ef24be43f0bf4500

                                                                                                            SHA1

                                                                                                            a039c51f89656d9d5c584f063b2b675a9ff44b8e

                                                                                                            SHA256

                                                                                                            1411e4858412ded195f0e65544a4ec8e8249118b76375050a35c076940826cd0

                                                                                                            SHA512

                                                                                                            9ffb2ff050cce82dbfbbb0e85ab5f976fcd81086b3d8695502c5221c23d14080f0e494a33e0092b4feb2eda12e2130a2f02df3125733c2f5ec31356e92dea00b

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\MonoMod.Utils.dll
                                                                                                            Filesize

                                                                                                            319KB

                                                                                                            MD5

                                                                                                            79f1c4c312fdbb9258c2cdde3772271f

                                                                                                            SHA1

                                                                                                            a143434883e4ef2c0190407602b030f5c4fdf96f

                                                                                                            SHA256

                                                                                                            f22a4fa1e8b1b70286ecf07effb15d2184454fa88325ce4c0f31ffadb4bef50a

                                                                                                            SHA512

                                                                                                            b28ed3c063ae3a15cd52e625a860bbb65f6cd38ccad458657a163cd927c74ebf498fb12f1e578e869bcea00c6cd3f47ede10866e34a48c133c5ac26b902ae5d9

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\RVGLib.dll
                                                                                                            Filesize

                                                                                                            241KB

                                                                                                            MD5

                                                                                                            d34c13128c6c7c93af2000a45196df81

                                                                                                            SHA1

                                                                                                            664c821c9d2ed234aea31d8b4f17d987e4b386f1

                                                                                                            SHA256

                                                                                                            aaf9fb0158bd40ab562a4212c2a795cb40ef6864042dc12f3a2415f2446ba1c7

                                                                                                            SHA512

                                                                                                            91f4e0e795f359b03595b01cbf29188a2a0b52ab9d64eadd8fb8b3508e417b8c7a70be439940975bf5bdf26493ea161aa45025beb83bc95076ed269e82d39689

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\SimpleObfuscator.dll
                                                                                                            Filesize

                                                                                                            1.4MB

                                                                                                            MD5

                                                                                                            9043d712208178c33ba8e942834ce457

                                                                                                            SHA1

                                                                                                            e0fa5c730bf127a33348f5d2a5673260ae3719d1

                                                                                                            SHA256

                                                                                                            b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c

                                                                                                            SHA512

                                                                                                            dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\Sounds\Intro.wav
                                                                                                            Filesize

                                                                                                            238KB

                                                                                                            MD5

                                                                                                            ad3b4fae17bcabc254df49f5e76b87a6

                                                                                                            SHA1

                                                                                                            1683ff029eebaffdc7a4827827da7bb361c8747e

                                                                                                            SHA256

                                                                                                            e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf

                                                                                                            SHA512

                                                                                                            3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWorm V5.2.exe
                                                                                                            Filesize

                                                                                                            12.2MB

                                                                                                            MD5

                                                                                                            8b7b015c1ea809f5c6ade7269bdc5610

                                                                                                            SHA1

                                                                                                            c67d5d83ca18731d17f79529cfdb3d3dcad36b96

                                                                                                            SHA256

                                                                                                            7fc9c7002b65bc1b33f72e019ed1e82008cc7b8e5b8eaf73fc41a3e6a246980e

                                                                                                            SHA512

                                                                                                            e652913f73326f9d8461ac2a631e1e413719df28c7938b38949c005fda501d9e159554c3e17a0d5826d279bb81efdef394f7fb6ff7289cf296c19e92fd924180

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWorm V5.2.exe.Config
                                                                                                            Filesize

                                                                                                            183B

                                                                                                            MD5

                                                                                                            66f09a3993dcae94acfe39d45b553f58

                                                                                                            SHA1

                                                                                                            9d09f8e22d464f7021d7f713269b8169aed98682

                                                                                                            SHA256

                                                                                                            7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

                                                                                                            SHA512

                                                                                                            c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe
                                                                                                            Filesize

                                                                                                            109KB

                                                                                                            MD5

                                                                                                            f3b2ec58b71ba6793adcc2729e2140b1

                                                                                                            SHA1

                                                                                                            d9e93a33ac617afe326421df4f05882a61e0a4f2

                                                                                                            SHA256

                                                                                                            2d74eb709aea89a181cf8dfcc7e551978889f0d875401a2f1140487407bf18ae

                                                                                                            SHA512

                                                                                                            473edcaba9cb8044e28e30fc502a08a648359b3ed0deba85e559fe76b484fc8db0fc2375f746851623e30be33da035cec1d6038e1fcf4842a2afb6f9cd397495

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWormLoader 5.2 x32.exe.config
                                                                                                            Filesize

                                                                                                            187B

                                                                                                            MD5

                                                                                                            15c8c4ba1aa574c0c00fd45bb9cce1ab

                                                                                                            SHA1

                                                                                                            0dad65a3d4e9080fa29c42aa485c6102d2fa8bc8

                                                                                                            SHA256

                                                                                                            f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15

                                                                                                            SHA512

                                                                                                            52baac63399340427b94bfdeb7a42186d5359ce439c3d775497f347089edfbf72a6637b23bb008ab55b8d4dd3b79a7b2eb7c7ef922ea23d0716d5c3536b359d4

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\Telegram Desktop\XWorm v5.1-5.2\XWorm\XWorm V5.2\XWormLoader 5.2 x64.exe
                                                                                                            Filesize

                                                                                                            109KB

                                                                                                            MD5

                                                                                                            e6a20535b636d6402164a8e2d871ef6d

                                                                                                            SHA1

                                                                                                            981cb1fd9361ca58f8985104e00132d1836a8736

                                                                                                            SHA256

                                                                                                            b461c985b53de4f6921d83925b3c2a62de3bbc5b8f9c02eecd27926f0197fae2

                                                                                                            SHA512

                                                                                                            35856a0268ed9d17b1570d5392833ed168c8515d73fac9f150cf63cc1aea61c096aa2e6b3c8e091a1058ba062f9333f6767e323a37dfb6f4fa7e508a2a138a30

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\rat.exe
                                                                                                            Filesize

                                                                                                            33KB

                                                                                                            MD5

                                                                                                            a2ac66d49c90c9632447a8c066e1e2f3

                                                                                                            SHA1

                                                                                                            78cb793c253555e792d2f212b60b020a94c1b55b

                                                                                                            SHA256

                                                                                                            2a25ae78583f91cf1dc4276aa84d19a793b37b41d446fc2fb853a880f0e2552c

                                                                                                            SHA512

                                                                                                            8e2cb8ff77caf2b3f6e2fa3049dc8525a04591ec28fba352d929b2f95b831fac5ddc90c3b9e6ed45ae6c7b73b0eaaa2568b62a91eb4aafffb0295acaba356216

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\tsetup-x64.5.10.3.exe
                                                                                                            Filesize

                                                                                                            44.9MB

                                                                                                            MD5

                                                                                                            44cd29a9aa80d66ab0bc48a7a44ecd05

                                                                                                            SHA1

                                                                                                            32711d8b4e9d773da1887ad2fb83d9c69854e17b

                                                                                                            SHA256

                                                                                                            53ed3e82c1d3d963f80c82be1c17c3f1a35d23734a41fe6826372ec45f454e23

                                                                                                            SHA512

                                                                                                            3550f8b1005dbee6d9a76b8f3f05a085d1a073ab6c61b75b359629391419c23aba95d0d2bbfa9676abd4852e15218a23153fb8bfbd3741ba39909520729ebe9a

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\Downloads\tsetup-x64.5.10.3.exe:Zone.Identifier
                                                                                                            Filesize

                                                                                                            26B

                                                                                                            MD5

                                                                                                            fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                                            SHA1

                                                                                                            d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                                            SHA256

                                                                                                            eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                                            SHA512

                                                                                                            aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                                            Download Submit

                                                                                                          • memory/1064-1696-0x000000001C6F0000-0x000000001C7A0000-memory.dmp

                                                                                                            Filesize

                                                                                                            704KB

                                                                                                            Download

                                                                                                          • memory/1064-2168-0x000000001C120000-0x000000001C128000-memory.dmp

                                                                                                            Filesize

                                                                                                            32KB

                                                                                                            Download

                                                                                                          • memory/1064-1503-0x000000001C500000-0x000000001C50E000-memory.dmp

                                                                                                            Filesize

                                                                                                            56KB

                                                                                                            Download

                                                                                                          • memory/1064-1502-0x000000001C490000-0x000000001C49A000-memory.dmp

                                                                                                            Filesize

                                                                                                            40KB

                                                                                                            Download

                                                                                                          • memory/1064-1500-0x000000001C480000-0x000000001C488000-memory.dmp

                                                                                                            Filesize

                                                                                                            32KB

                                                                                                            Download

                                                                                                          • memory/1064-2166-0x000000001C0C0000-0x000000001C0CA000-memory.dmp

                                                                                                            Filesize

                                                                                                            40KB

                                                                                                            Download

                                                                                                          • memory/1064-1489-0x000000001B720000-0x000000001B72A000-memory.dmp

                                                                                                            Filesize

                                                                                                            40KB

                                                                                                            Download

                                                                                                          • memory/1064-1488-0x000000001CC20000-0x000000001CF70000-memory.dmp

                                                                                                            Filesize

                                                                                                            3.3MB

                                                                                                            Download

                                                                                                          • memory/1064-1482-0x0000000001270000-0x000000000127A000-memory.dmp

                                                                                                            Filesize

                                                                                                            40KB

                                                                                                            Download

                                                                                                          • memory/1064-1361-0x0000000001300000-0x000000000130A000-memory.dmp

                                                                                                            Filesize

                                                                                                            40KB

                                                                                                            Download

                                                                                                          • memory/1064-1700-0x000000001C090000-0x000000001C09C000-memory.dmp

                                                                                                            Filesize

                                                                                                            48KB

                                                                                                            Download

                                                                                                          • memory/1064-1699-0x000000001C190000-0x000000001C19C000-memory.dmp

                                                                                                            Filesize

                                                                                                            48KB

                                                                                                            Download

                                                                                                          • memory/1064-1698-0x000000001C080000-0x000000001C092000-memory.dmp

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            Download

                                                                                                          • memory/1064-1697-0x0000000020B30000-0x0000000021058000-memory.dmp

                                                                                                            Filesize

                                                                                                            5.2MB

                                                                                                            Download

                                                                                                          • memory/1064-1345-0x0000000000A10000-0x0000000000A1E000-memory.dmp

                                                                                                            Filesize

                                                                                                            56KB

                                                                                                            Download

                                                                                                          • memory/1064-2267-0x000000001C7C0000-0x000000001C7D2000-memory.dmp

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            Download

                                                                                                          • memory/1064-1514-0x000000001E430000-0x000000001E904000-memory.dmp

                                                                                                            Filesize

                                                                                                            4.8MB

                                                                                                            Download

                                                                                                          • memory/1064-2170-0x000000001C1F0000-0x000000001C1FA000-memory.dmp

                                                                                                            Filesize

                                                                                                            40KB

                                                                                                            Download

                                                                                                          • memory/1064-2169-0x000000001C140000-0x000000001C14C000-memory.dmp

                                                                                                            Filesize

                                                                                                            48KB

                                                                                                            Download

                                                                                                          • memory/1064-2164-0x000000001C0A0000-0x000000001C0AA000-memory.dmp

                                                                                                            Filesize

                                                                                                            40KB

                                                                                                            Download

                                                                                                          • memory/1064-2167-0x000000001C0D0000-0x000000001C0DC000-memory.dmp

                                                                                                            Filesize

                                                                                                            48KB

                                                                                                            Download

                                                                                                          • memory/2900-336-0x0000000000780000-0x0000000000AB7000-memory.dmp

                                                                                                            Filesize

                                                                                                            3.2MB

                                                                                                            Download

                                                                                                          • memory/2900-297-0x0000000000780000-0x0000000000AB7000-memory.dmp

                                                                                                            Filesize

                                                                                                            3.2MB

                                                                                                            Download

                                                                                                          • memory/3512-337-0x00000000007D0000-0x00000000008A8000-memory.dmp

                                                                                                            Filesize

                                                                                                            864KB

                                                                                                            Download

                                                                                                          • memory/3512-294-0x00000000007D0000-0x00000000008A8000-memory.dmp

                                                                                                            Filesize

                                                                                                            864KB

                                                                                                            Download

                                                                                                          • memory/3512-278-0x00000000007D0000-0x00000000008A8000-memory.dmp

                                                                                                            Filesize

                                                                                                            864KB

                                                                                                            Download

                                                                                                          • memory/3964-2173-0x000002AE7A5B0000-0x000002AE7A74B000-memory.dmp

                                                                                                            Filesize

                                                                                                            1.6MB

                                                                                                            Download

                                                                                                          • memory/3964-1226-0x000002AE6AA20000-0x000002AE6AA26000-memory.dmp

                                                                                                            Filesize

                                                                                                            24KB

                                                                                                            Download

                                                                                                          • memory/3964-1490-0x000002AE78A40000-0x000002AE78A9A000-memory.dmp

                                                                                                            Filesize

                                                                                                            360KB

                                                                                                            Download

                                                                                                          • memory/3964-1359-0x000002AE79A00000-0x000002AE79AB2000-memory.dmp

                                                                                                            Filesize

                                                                                                            712KB

                                                                                                            Download

                                                                                                          • memory/3964-1358-0x000002AE70340000-0x000002AE703C2000-memory.dmp

                                                                                                            Filesize

                                                                                                            520KB

                                                                                                            Download

                                                                                                          • memory/3964-1357-0x000002AE79390000-0x000002AE79672000-memory.dmp

                                                                                                            Filesize

                                                                                                            2.9MB

                                                                                                            Download

                                                                                                          • memory/3964-1356-0x000002AE70120000-0x000002AE7014C000-memory.dmp

                                                                                                            Filesize

                                                                                                            176KB

                                                                                                            Download

                                                                                                          • memory/3964-1220-0x00000000005A0000-0x00000000005C0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/3964-1326-0x000002AE79720000-0x000002AE79888000-memory.dmp

                                                                                                            Filesize

                                                                                                            1.4MB

                                                                                                            Download

                                                                                                          • memory/3964-1222-0x000002AE6ABD0000-0x000002AE6AC12000-memory.dmp

                                                                                                            Filesize

                                                                                                            264KB

                                                                                                            Download

                                                                                                          • memory/3964-1231-0x000002AE6A9C0000-0x000002AE6A9C6000-memory.dmp

                                                                                                            Filesize

                                                                                                            24KB

                                                                                                            Download

                                                                                                          • memory/3964-1224-0x000002AE6C290000-0x000002AE6C2B8000-memory.dmp

                                                                                                            Filesize

                                                                                                            160KB

                                                                                                            Download

                                                                                                          • memory/3964-1232-0x000002AE6AA00000-0x000002AE6AA06000-memory.dmp

                                                                                                            Filesize

                                                                                                            24KB

                                                                                                            Download

                                                                                                          • memory/3964-1234-0x000002AE6CB10000-0x000002AE6CB4C000-memory.dmp

                                                                                                            Filesize

                                                                                                            240KB

                                                                                                            Download

                                                                                                          • memory/3964-1235-0x000002AE6CAD0000-0x000002AE6CAEA000-memory.dmp

                                                                                                            Filesize

                                                                                                            104KB

                                                                                                            Download

                                                                                                          • memory/3964-1237-0x000002AE6D990000-0x000002AE6E5C8000-memory.dmp

                                                                                                            Filesize

                                                                                                            12.2MB

                                                                                                            Download

                                                                                                          • memory/3964-1245-0x000002AE6EDD0000-0x000002AE6F9BC000-memory.dmp

                                                                                                            Filesize

                                                                                                            11.9MB

                                                                                                            Download

                                                                                                          • memory/3964-1247-0x000002AE6D6A0000-0x000002AE6D894000-memory.dmp

                                                                                                            Filesize

                                                                                                            2.0MB

                                                                                                            Download

                                                                                                          • memory/3964-1230-0x000002AE6CCE0000-0x000002AE6CD36000-memory.dmp

                                                                                                            Filesize

                                                                                                            344KB

                                                                                                            Download

                                                                                                          • memory/3964-2185-0x000002AE79310000-0x000002AE7934A000-memory.dmp

                                                                                                            Filesize

                                                                                                            232KB

                                                                                                            Download

                                                                                                          • memory/3964-2186-0x000002AE78940000-0x000002AE78966000-memory.dmp

                                                                                                            Filesize

                                                                                                            152KB

                                                                                                            Download

                                                                                                          • memory/3964-1228-0x000002AE6CC80000-0x000002AE6CCDE000-memory.dmp

                                                                                                            Filesize

                                                                                                            376KB

                                                                                                            Download

                                                                                                          • memory/6228-2064-0x0000021181CF0000-0x0000021181DF0000-memory.dmp

                                                                                                            Filesize

                                                                                                            1024KB

                                                                                                            Download

                                                                                                          • memory/6228-1981-0x000002117E180000-0x000002117E1A0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/6228-1980-0x000002117E260000-0x000002117E360000-memory.dmp

                                                                                                            Filesize

                                                                                                            1024KB

                                                                                                            Download

                                                                                                          • memory/6228-1979-0x000002117D450000-0x000002117D470000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/6228-1922-0x000002115AE00000-0x000002115AF00000-memory.dmp

                                                                                                            Filesize

                                                                                                            1024KB

                                                                                                            Download

                                                                                                          • memory/9092-1808-0x00000240B4700000-0x00000240B4800000-memory.dmp

                                                                                                            Filesize

                                                                                                            1024KB

                                                                                                            Download

                                                                                                          • memory/9092-1728-0x0000024091C60000-0x0000024091D60000-memory.dmp

                                                                                                            Filesize

                                                                                                            1024KB

                                                                                                            Download

                                                                                                          • memory/9092-1853-0x00000240C66C0000-0x00000240C66E0000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/9092-1850-0x00000240C5370000-0x00000240C5390000-memory.dmp

                                                                                                            Filesize

                                                                                                            128KB

                                                                                                            Download

                                                                                                          • memory/9092-1852-0x00000240C69D0000-0x00000240C6AD0000-memory.dmp

                                                                                                            Filesize

                                                                                                            1024KB

                                                                                                            Download