xworm | 4414027d7369fa5b62c6cff9836dc792389c085defc5cba782793159e81036b1

Analysis

max time kernel
149s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20-01-2025 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spoofer.exe
Size

90KB
MD5

cb8398c640f85445d6e14a2e325eb826
SHA1

2e888003ab1bda0e17297361901be57fbc746e4e
SHA256

4414027d7369fa5b62c6cff9836dc792389c085defc5cba782793159e81036b1
SHA512

268d3bace276b09e15f089e5e19b0181c3060c2965f1d24a2355123bfff8d0f274051c24132040002a0abf727f259756fecebc858050eeaa5445525a7d9d4833
SSDEEP

1536:5jx25uS8KkpHTe9yivqHLrZ+UGpCr8lFo4XwCjAaBhlPrTAdxJ2MT6UaIPxnLxHY:51KuNrpH21CHLt9GMCbHlPXAhEU3xZ6z

Score

10^/10

xworm defense_evasion discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

trip-thesaurus.gl.at.ply.gg:16715

Attributes

Install_directory
%AppData%
install_file
SecurityHealthSystray.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000028c52-4.dat	family_xworm
behavioral1/memory/4276-12-0x0000000000F00000-0x0000000000F1C000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1916	powershell.exe
3088	powershell.exe
1716	powershell.exe
1220	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk	Woofer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk	Woofer.exe

Executes dropped EXE 4 IoCs

pid	Process
4276	Woofer.exe
4656	SecurityHealthSystray.exe
924	wgweag.exe
600	SecurityHealthSystray.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthSystray.exe"	Woofer.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wgweag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spoofer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1244	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4276	Woofer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4384	powershell.exe
4384	powershell.exe
1716	powershell.exe
1716	powershell.exe
1220	powershell.exe
1220	powershell.exe
1916	powershell.exe
1916	powershell.exe
3088	powershell.exe
3088	powershell.exe
4276	Woofer.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2092	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	Woofer.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeDebugPrivilege	4276	Woofer.exe
Token: SeDebugPrivilege	2092	taskmgr.exe
Token: SeSystemProfilePrivilege	2092	taskmgr.exe
Token: SeCreateGlobalPrivilege	2092	taskmgr.exe
Token: SeDebugPrivilege	4656	SecurityHealthSystray.exe
Token: SeDebugPrivilege	600	SecurityHealthSystray.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4276	Woofer.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4384	4960	Spoofer.exe	77
PID 4960 wrote to memory of 4384	4960	Spoofer.exe	77
PID 4960 wrote to memory of 4384	4960	Spoofer.exe	77
PID 4960 wrote to memory of 4276	4960	Spoofer.exe	79
PID 4960 wrote to memory of 4276	4960	Spoofer.exe	79
PID 4276 wrote to memory of 1716	4276	Woofer.exe	81
PID 4276 wrote to memory of 1716	4276	Woofer.exe	81
PID 4276 wrote to memory of 1220	4276	Woofer.exe	83
PID 4276 wrote to memory of 1220	4276	Woofer.exe	83
PID 4276 wrote to memory of 1916	4276	Woofer.exe	85
PID 4276 wrote to memory of 1916	4276	Woofer.exe	85
PID 4276 wrote to memory of 3088	4276	Woofer.exe	87
PID 4276 wrote to memory of 3088	4276	Woofer.exe	87
PID 4276 wrote to memory of 1244	4276	Woofer.exe	89
PID 4276 wrote to memory of 1244	4276	Woofer.exe	89
PID 4276 wrote to memory of 924	4276	Woofer.exe	95
PID 4276 wrote to memory of 924	4276	Woofer.exe	95
PID 4276 wrote to memory of 924	4276	Woofer.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAYgBhACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAawBqACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAdgB4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGUAdQBnACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4384
- C:\Users\Admin\AppData\Roaming\Woofer.exe
  "C:\Users\Admin\AppData\Roaming\Woofer.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Woofer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Woofer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3088
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1244
- - C:\Users\Admin\AppData\Local\Temp\wgweag.exe
    "C:\Users\Admin\AppData\Local\Temp\wgweag.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:924

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2092

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3096

C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe
C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SecurityHealthSystray.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
21017c68eaf9461301de459f4f07e888

SHA1
41ff30fc8446508d4c3407c79e798cf6eaa5bb73

SHA256
03b321e48ff3328d9c230308914961fe110c4c7bc96c0a85a296745437bcb888

SHA512
956990c11c6c1baa3665ef7ef23ef6073e0a7fcff77a93b5e605a83ff1e60b916d80d45dafb06977aed90868a273569a865cf2c623e295b5157bfff0fb2be35d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
635782826eea7a1619843bb8a43a1262

SHA1
b995cc1f084a2dd1ee63d62dfbfbe129bbbe231a

SHA256
e1aba1e8aa68627ec15c7bac32ea5590557f4f6503bcffa889a4ea83454222c5

SHA512
c37445b2df9b823ab45fb043d663100a2b5455042cb269c76c0d94f526427b304039eae27c9e5520098edfc3116336deca76c1597af2430945f466c7aed55704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6344564097353c8e7e68991fffa80d88

SHA1
2ac4d108a30ec3fbd2938b0563eb912415ea7c62

SHA256
d0af6d69f8bc0c98e9fb61dead6327bbc8b4f5292529313515382d8f883de0da

SHA512
e2b37a9001a91cb05483d72f88bd70a61ca5655939c2290fd1580710eec9d8d26a5fedbcb5223f5413b5dcc46f1d8b6b408e57be0e4ad4b37b55cbce9023a303

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2n2idwu5.dqp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\wgweag.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk

Filesize
843B

MD5
e8d160784d0f26f8d3eede5584d66c9b

SHA1
47cd7e27fb703752f2b3056fea3bbfe65ac50782

SHA256
acf1778354575a2cf224504e04300a2f19cdad6bca716160aee0d5fbad810eb0

SHA512
5b1191c56c27b8be6dfc4ab3126c6cdb28dee58774495941041b4f4282717ae8e6d8e3db5ed19452028d6016da767296e965834894efa92752b4f80d076ce05d

Download Submit
C:\Users\Admin\AppData\Roaming\Woofer.exe

Filesize
84KB

MD5
401884996ecf50f3c44e4bc55e228b3c

SHA1
8eec44a33a180a8ea816f1d07d40c396dfa243d0

SHA256
602eb973f30d7c9533eb827f3731b057e17271bcc7617c1526c9909b71baa683

SHA512
ea8b57b10ad3c569e2456c0cfedaada977db6f8dd768e15800e3af535b68299e66e3f77df613ee3a30a8bcd68a8deff315f5531ac6a40135de0a0126a28e6d08

Download Submit
memory/1716-63-0x000002422CB00000-0x000002422CB22000-memory.dmp

Filesize
136KB

Download
memory/2092-114-0x0000021867A70000-0x0000021867A71000-memory.dmp

Filesize
4KB

Download
memory/2092-107-0x0000021867A70000-0x0000021867A71000-memory.dmp

Filesize
4KB

Download
memory/2092-117-0x0000021867A70000-0x0000021867A71000-memory.dmp

Filesize
4KB

Download
memory/2092-119-0x0000021867A70000-0x0000021867A71000-memory.dmp

Filesize
4KB

Download
memory/2092-113-0x0000021867A70000-0x0000021867A71000-memory.dmp

Filesize
4KB

Download
memory/2092-108-0x0000021867A70000-0x0000021867A71000-memory.dmp

Filesize
4KB

Download
memory/2092-109-0x0000021867A70000-0x0000021867A71000-memory.dmp

Filesize
4KB

Download
memory/2092-118-0x0000021867A70000-0x0000021867A71000-memory.dmp

Filesize
4KB

Download
memory/2092-115-0x0000021867A70000-0x0000021867A71000-memory.dmp

Filesize
4KB

Download
memory/2092-116-0x0000021867A70000-0x0000021867A71000-memory.dmp

Filesize
4KB

Download
memory/4276-106-0x0000000003110000-0x0000000003120000-memory.dmp

Filesize
64KB

Download
memory/4276-50-0x0000000003110000-0x0000000003120000-memory.dmp

Filesize
64KB

Download
memory/4276-12-0x0000000000F00000-0x0000000000F1C000-memory.dmp

Filesize
112KB

Download
memory/4276-11-0x00007FF914D73000-0x00007FF914D75000-memory.dmp

Filesize
8KB

Download
memory/4384-29-0x0000000005B60000-0x0000000005EB7000-memory.dmp

Filesize
3.3MB

Download
memory/4384-44-0x0000000007080000-0x0000000007124000-memory.dmp

Filesize
656KB

Download
memory/4384-51-0x00000000075C0000-0x00000000075D1000-memory.dmp

Filesize
68KB

Download
memory/4384-52-0x00000000075F0000-0x00000000075FE000-memory.dmp

Filesize
56KB

Download
memory/4384-53-0x0000000007600000-0x0000000007615000-memory.dmp

Filesize
84KB

Download
memory/4384-54-0x00000000076F0000-0x000000000770A000-memory.dmp

Filesize
104KB

Download
memory/4384-48-0x0000000007430000-0x000000000743A000-memory.dmp

Filesize
40KB

Download
memory/4384-64-0x00000000076E0000-0x00000000076E8000-memory.dmp

Filesize
32KB

Download
memory/4384-47-0x00000000073C0000-0x00000000073DA000-memory.dmp

Filesize
104KB

Download
memory/4384-46-0x00000000079E0000-0x000000000805A000-memory.dmp

Filesize
6.5MB

Download
memory/4384-71-0x0000000073340000-0x0000000073AF1000-memory.dmp

Filesize
7.7MB

Download
memory/4384-45-0x0000000073340000-0x0000000073AF1000-memory.dmp

Filesize
7.7MB

Download
memory/4384-32-0x0000000007020000-0x0000000007054000-memory.dmp

Filesize
208KB

Download
memory/4384-49-0x0000000007630000-0x00000000076C6000-memory.dmp

Filesize
600KB

Download
memory/4384-33-0x0000000070940000-0x000000007098C000-memory.dmp

Filesize
304KB

Download
memory/4384-43-0x0000000073340000-0x0000000073AF1000-memory.dmp

Filesize
7.7MB

Download
memory/4384-42-0x0000000007060000-0x000000000707E000-memory.dmp

Filesize
120KB

Download
memory/4384-31-0x00000000065B0000-0x00000000065FC000-memory.dmp

Filesize
304KB

Download
memory/4384-30-0x0000000006040000-0x000000000605E000-memory.dmp

Filesize
120KB

Download
memory/4384-19-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Filesize
408KB

Download
memory/4384-20-0x0000000005AF0000-0x0000000005B56000-memory.dmp

Filesize
408KB

Download
memory/4384-18-0x00000000051B0000-0x00000000051D2000-memory.dmp

Filesize
136KB

Download
memory/4384-17-0x0000000073340000-0x0000000073AF1000-memory.dmp

Filesize
7.7MB

Download
memory/4384-16-0x0000000073340000-0x0000000073AF1000-memory.dmp

Filesize
7.7MB

Download
memory/4384-15-0x0000000005450000-0x0000000005A7A000-memory.dmp

Filesize
6.2MB

Download
memory/4384-14-0x0000000002840000-0x0000000002876000-memory.dmp

Filesize
216KB

Download
memory/4384-13-0x000000007334E000-0x000000007334F000-memory.dmp

Filesize
4KB

Download