quasar | ea1d7a3a7ccaa19e036f9ce1f7861b0d32860e4ca23201cf5904e67863cb87c3

Analysis

max time kernel
965s
max time network
968s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26/01/2025, 16:39

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

lemon.mp4-1.mov
Size

103KB
MD5

de829ff9a0f5c07ec7e1a90de40da438
SHA1

c4b44374251296ff97c678afbbeb2009f7df6609
SHA256

ea1d7a3a7ccaa19e036f9ce1f7861b0d32860e4ca23201cf5904e67863cb87c3
SHA512

353bef6848b8a1cdee3bb677b4cacaa99b9139c14c5d86e3e89533fac80151165c5f2435eb87722207dff39769cf27fa11a7b434aabebd43d7762d06b8024ae6
SSDEEP

1536:OPJAF0bFCyP/Lq9htw7mrDGNowqLShO9E5CJljbPjyP51GIbIJexGmPTfA:yAF6f/Lq9htw7DN4SQ9EATryPfTXk

Score

10^/10

quasar xworm hawk tuah spit on that thang discovery ransomware rat spyware trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:7000

Mutex

RUss9jpgCGjKXozU

Attributes

Install_directory
%LocalAppData%
install_file
XClient.exe

aes.plain

Extracted

Family

xworm

127.0.0.1:7000

Attributes

Install_directory
%LocalAppData%
install_file
XClient.exe

Extracted

Family

quasar

Version

1.4.1

Botnet

hawk tuah spit on that thang

127.0.0.1:4782

Mutex

7fce0ae0-8078-4987-8717-6b158b43106e

Attributes

encryption_key
F12EAD15347FEFEAE51235126500C230593C9A9E
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000200000002965c-910.dat	family_xworm
behavioral1/files/0x000200000002a7a6-920.dat	family_xworm
behavioral1/files/0x000200000002a7a6-922.dat	family_xworm
behavioral1/memory/4700-924-0x0000000000CF0000-0x0000000000D02000-memory.dmp	family_xworm

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/1216-1968-0x000002442F610000-0x000002442F748000-memory.dmp	family_quasar
behavioral1/memory/1216-1969-0x000002442FB90000-0x000002442FBA6000-memory.dmp	family_quasar
behavioral1/memory/6040-2204-0x0000000000CE0000-0x0000000001004000-memory.dmp	family_quasar

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Executes dropped EXE 2 IoCs

pid	Process
4700	XClient.exe
6040	Client-built.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
202	camo.githubusercontent.com
203	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	XClient.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Xworm V6.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Xworm V6.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Xworm V6.1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133823831794189530"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Xworm V6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Quasar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Xworm V6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	Xworm V6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 = 66003100000000003a5a9a8610005155415341527e312e3100004c0009000400efbe3a5a9a863a5a9a862e00000094aa0200000022000000000000000000000000000000c7c41a015100750061007300610072002e00760031002e0034002e00310000001a000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Xworm V6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Xworm V6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 50003100000000003a5a0e86100041646d696e003c0009000400efbe4759005f3a5a0e862e0000002c5702000000010000000000000000000000000000003b2a4d00410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Xworm V6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	Xworm V6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell	Quasar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Quasar.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2253712635-4068079004-3870069674-1000\{972D5E34-936B-41CA-BFFF-A5D400D4FC92}	wmplayer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Xworm V6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Xworm V6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Xworm V6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Xworm V6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Xworm V6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Xworm V6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	Xworm V6.1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Xworm V6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Xworm V6.1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Xworm V6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11	Quasar.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Xworm V6.1.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Xworm V6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Xworm V6.1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Xworm V6.1.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 78003100000000004759005f1100557365727300640009000400efbec5522d603a5aee842e0000006c0500000000010000000000000000003a00000000002dcc690055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\SniffedFolderType = "Generic"	Quasar.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	explorer.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Xworm-V6.1.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Quasar.v1.4.1.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6728	explorer.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
3684	chrome.exe
3684	chrome.exe
420	chrome.exe
420	chrome.exe
420	chrome.exe
420	chrome.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
4312	Xworm V6.1.exe
2892	msedge.exe
2892	msedge.exe
1228	msedge.exe
1228	msedge.exe
2928	msedge.exe
2928	msedge.exe
400	identity_helper.exe
400	identity_helper.exe
6416	msedge.exe
6416	msedge.exe
6416	msedge.exe
6416	msedge.exe
748	msedge.exe
748	msedge.exe
6040	Client-built.exe
6040	Client-built.exe
6040	Client-built.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4312	Xworm V6.1.exe
1216	Quasar.exe
6728	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1672	wmplayer.exe
Token: SeCreatePagefilePrivilege	1672	wmplayer.exe
Token: SeShutdownPrivilege	644	unregmp2.exe
Token: SeCreatePagefilePrivilege	644	unregmp2.exe
Token: 33	892	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	892	AUDIODG.EXE
Token: SeShutdownPrivilege	1672	wmplayer.exe
Token: SeCreatePagefilePrivilege	1672	wmplayer.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe
Token: SeShutdownPrivilege	3684	chrome.exe
Token: SeCreatePagefilePrivilege	3684	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1672	wmplayer.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
4312	Xworm V6.1.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
3684	chrome.exe
4312	Xworm V6.1.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1216	Quasar.exe
6040	Client-built.exe
6040	Client-built.exe
6040	Client-built.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4312	Xworm V6.1.exe
1644	SystemSettingsAdminFlows.exe
4136	firefox.exe
6728	explorer.exe
6728	explorer.exe
1216	Quasar.exe
1216	Quasar.exe
1216	Quasar.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2784	1672	wmplayer.exe	77
PID 1672 wrote to memory of 2784	1672	wmplayer.exe	77
PID 1672 wrote to memory of 2784	1672	wmplayer.exe	77
PID 2784 wrote to memory of 644	2784	unregmp2.exe	78
PID 2784 wrote to memory of 644	2784	unregmp2.exe	78
PID 3684 wrote to memory of 1528	3684	chrome.exe	86
PID 3684 wrote to memory of 1528	3684	chrome.exe	86
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4500	3684	chrome.exe	87
PID 3684 wrote to memory of 4784	3684	chrome.exe	88
PID 3684 wrote to memory of 4784	3684	chrome.exe	88
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89
PID 3684 wrote to memory of 4576	3684	chrome.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\lemon.mp4-1.mov"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4224

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffa61bfcc40,0x7ffa61bfcc4c,0x7ffa61bfcc58
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1788,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2204 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4452,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4728,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4912,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4936,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4952,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:72
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5040,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5052,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4964,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5004 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4772,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5352,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3416,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4980,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4768,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4344 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5392,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5580,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5236,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - NTFS ADS
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5628,i,5827930687421390019,5626700767918606926,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1248

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4504

C:\Users\Admin\Downloads\Xworm-V6.1\Xworm-V6.1\Xworm-V6.1\Xworm V6.1.exe
"C:\Users\Admin\Downloads\Xworm-V6.1\Xworm-V6.1\Xworm-V6.1\Xworm V6.1.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4312
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wbtpgjfp\wbtpgjfp.cmdline"
  2⤵
  PID:4608
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5ED6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc61143925420443DAA19B78D47CF9AA4.TMP"
    3⤵
    PID:3040

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5008

C:\Users\Admin\Downloads\Xworm-V6.1\Xworm-V6.1\Xworm-V6.1\XClient.exe
"C:\Users\Admin\Downloads\Xworm-V6.1\Xworm-V6.1\Xworm-V6.1\XClient.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffa4ab13cb8,0x7ffa4ab13cc8,0x7ffa4ab13cd8
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4108 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5104 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:7116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
    3⤵
    PID:7132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1084 /prefetch:1
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1768,10961863825179286503,12834546524598207099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
    3⤵
    PID:6012

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Xworm-V6.1\Xworm-V6.1\Xworm-V6.1\ClientsFolder\920161FDAC75A94792C1\Recovery\ProductKey_01-26-2025 16;44;13;720.txt
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3080

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4400

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3672

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3892

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" EnterProductKey
1⤵
- Suspicious use of SetWindowsHookEx
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:4804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1056

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1224
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:4136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1948 -parentBuildID 20240401114208 -prefsHandle 1856 -prefMapHandle 1876 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {58f89944-485c-4f8f-b318-d6287c054441} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" gpu
    3⤵
    PID:2960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a18d4aa7-8b2b-4374-83ca-40c942e8650c} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" socket
    3⤵
    - Checks processor information in registry
    PID:3944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2996 -childID 1 -isForBrowser -prefsHandle 3064 -prefMapHandle 2528 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1169b44c-2b53-4e6d-96d2-567a2bcc767a} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:5244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1308 -childID 2 -isForBrowser -prefsHandle 3640 -prefMapHandle 3648 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c4cd2f4-15af-4ea9-a738-fa95320d0182} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:5428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4536 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4432 -prefMapHandle 4428 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b2cf551-4582-468a-97e0-bf2b4ab17cbd} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" utility
    3⤵
    - Checks processor information in registry
    PID:5236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5424 -childID 3 -isForBrowser -prefsHandle 5416 -prefMapHandle 5392 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbdca7f1-cee8-433b-ba17-c3b62064b75e} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:6536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5572 -childID 4 -isForBrowser -prefsHandle 5580 -prefMapHandle 5584 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {216c2441-ce8f-426c-91b1-a187f2d50a2c} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:6552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5852 -childID 5 -isForBrowser -prefsHandle 5772 -prefMapHandle 5776 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {72aef9ce-660c-4dbe-938a-a3dd5226ae4c} 4136 "\\.\pipe\gecko-crash-server-pipe.4136" tab
    3⤵
    PID:6564

C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Quasar.exe
"C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Quasar.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1216
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select, "C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12"
  2⤵
  PID:5928

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6728
- C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe
  "C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SendNotifyMessage
  PID:6040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
baf7138d062e89dcee8830436ae180ac

SHA1
0d8b083d9a7262dfb9e737e6319d4c7852509073

SHA256
a51a82a381a6f04639c3e2565c6c4c75e88704e00b7cd87276f8dd1c032f86b0

SHA512
ea2fe4e182a5bd24a8bbba682bcc515e06e8996b4040ea96db057d6b1a051de53b31c3341a1cdd0ff641708e95ba36072ceef6578996bd3377e9c8d9e95dd266

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
91f677eee102ca1c60bc6601c2e874ed

SHA1
93f8aeb061bb1187033911daea4fe9f879000164

SHA256
f4c7c842b3a8accb5744b0c6e9889437f7193c15b80796902541a8b9645285b7

SHA512
682103840e99af8ce11221be99250adb998bcadd29ef54ecc143eb742f6787d0b434e909ce5c1f8132dcfd0f8c87452e27fefc1d7de55340e2f44b8ac94b512d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
9c4536f5dd99464b8af5d13a540420d2

SHA1
e6b85052b7ddadb62ba554402fac66db2c0896cb

SHA256
babe1bf5b43d353297fdefa2373186d438861261ebf56243bd6de4bca76ae3c9

SHA512
477200b0c234a878533bdacaf5499e4ba2190c0c2795ddc085586deceb78f21357e13e46b6fa6ec7b383dc1a10334a2bd8930371f27bed98bcd972bfc959c0ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
0f8cb04aa80d2d6b0f4155698462cd1c

SHA1
6eb627593df228a407d99f87dbc5016a7aebc3dd

SHA256
b28c20860224d71b8d8af90855b77be898172c3da2b67c7bc02def4ef9cb9811

SHA512
1eb6ab470970da314fcfa518c22f2c95e9c373cb3f68a8ae9874c127411a4663363e04bf525617c20576d349594426bb33dc8f802acc0fd2d17e05ca1dd60ebe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
0c03a8b5a340b3b024e813c465bb4b3e

SHA1
7440bbd9db994999d35f1592fe5e55739de20912

SHA256
199d5fdd2701a042e285bca73a0823e9fb8aa9e507d8b2588b66598a3d00b8cc

SHA512
fb878fde3e4e9be3012260f9a15b1cd5a62dc560e5fb7a45594ea6b9d8cdf092aa8e6772a81e6011f296961b31700afb5b5ef0ca2cc81ceeff3262f2457b73e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
68c9e0135f801eb3f75ca32d9c3f559d

SHA1
8218bc60752260f789fa9d7ecc3338b87fef9ec3

SHA256
4b65056cc740690403355b6bd62b5f6f4f10a86ddc3fcc6aa08fdded22f41a5b

SHA512
f4bc6c13ea920a0a741bf47b559d5a5c4f7a45d70402df156e4aec530a33eeea459ebb3a5930c3dffec03acae33d349e1627ce20e92e15fa907a98cac1ea763a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
dfb429e427ca8d360ba303110cf3448c

SHA1
34a9457fcc0911b12c6f779367db9d6df1ecffc2

SHA256
1d9c5c8612e75e14be5fe0d6a0894b49161d9411be5bdaae2b547b089210c5ef

SHA512
66fbf10f681d3206471e602f433f6c0e671e8263f87b6d2bc7a36bb3bea0b7fac63d5d7752308307da3c48fa9a15490ee7b6b72354148735ee0a0477239c6497

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
912ff0f450729a27abfdbd917bef4426

SHA1
808bd2774cb2a3e3143c19fa4435c7dbeb4e4b5e

SHA256
d977deb533ce28c64c59d4dfcb942e8c5a117405bb20b18ca88e102392cc31ac

SHA512
becf2eb941d555eaddbbc38188f892f1019a59bc5a3a361b7e26282ebb9a7813319d4478315dbec02eaf2fefde8b2088c377680241c743f2688f525337a28856

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
12bb988ca43be3a59bb051a4fe113c01

SHA1
0c2abc1b14f58a7b3c494a5d717507275770c626

SHA256
ed950956dc964d1b2fc39116ac86461e4d16555e898274b892bbfbeb96ada3cb

SHA512
b9c7a6bb52979febf1ae3e251cf3e0f66872939749e1dfbd63e9a0a2194b16f9c2d168c69a096fcc7d70c8934a426929e84050bf0fbe41333c8448e66d52b7bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7bd84cde87098f6d08694d0470c2be5d

SHA1
09e5c6f95610efdf01c34aed029030eafd31b330

SHA256
641ab4ba7804e9e294accb606df89cdcf085e00285770dbd96386992a0ef755d

SHA512
2a581223e2b3d41b659e29821ed9ada849db869495c90500b0062d5b9be99682d3a4abec836e5712eac775e314bcbcadf5149e8efa64e53628ceac76c41e8695

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5c74004d3fc9c8e73eede1b672594fbe

SHA1
1c0ddadd4d8cf12138dcf2941c5bb1ed50f59c30

SHA256
2f5fabcba33d1fedd5a7f2eb43386d54fab00b21b276fdacd008bd37e56f6027

SHA512
0bdfe750cb63a0ced8851cfc7233ddaf466e0a4642b77500b1f819a976f5b2f512acdc5f034ae0bf7680ee422ccc74884d13358278e55fae28414e5acb7cbc49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
557c8ad531b1369f883d794ecf9f4f8e

SHA1
152f5d134d6d8b391de40fedebf6c549da70aa49

SHA256
a701b29522c275ca2de70d083c5524831faac1cb22b68c5d9559bccf53163d75

SHA512
afc2d8a0053f52239cb131f9517f8f473fd260272b55adc7baa5887517abb5efe860625dff0a5570b34c9a506f1ec1e1b031b69a37687a5f29697526263a377a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4a77c646362356fe8d318f15bea24c7f

SHA1
46e8f0cf473e5cafbf08b0ca03634ac03307ab63

SHA256
73c87d3caef7b020723e6994fba2bd1a54da631c8684e893375507d83c2083b7

SHA512
376053b51e5a69d5620a4c41a8a195c804036e96e8e1b1da3ded5969de4dc587d341e782bf7b32ae16c6f47ab8c54964fe24aefe382c63a0c71668b37f100625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a6071c9f9f93ba279b22edee7364d5a8

SHA1
daf4d53ab8d2dc4dd5bd7784c49f498421462afa

SHA256
f2a68135c2f67628adfb4c9664f19a6467d03d7bbef719b3f4a97c82ebede883

SHA512
613dda4679045999acd3b9aace5542444842e5d23a715a4eaac3945e6a7fe585f6d5a2f3c51cb606f860778998380d4fc727152fc4139ea29aa3cfcdbd1f7e5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
41566c4a8f9943af25b012d3dbd806aa

SHA1
14d99b774de7a8ea52dd3954f730e616cbdf76a3

SHA256
0b94f7dee6c08b3bdb9d4dc82f5179c94879cd778de9b9a949c852f29c096de0

SHA512
0a89f484c352ac3bb35cc1e37288e8f898f6b96d3b81d31440d7be07e06d31fe519bbdefa33171179f4eb389d929a26ffe1c212a08d0a1f247290f0b53058f4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1b8d0bf58a4a31d864a03042379cd17e

SHA1
e85606c7fc5181a887b34ed5e1d73ef8c43e77d9

SHA256
f0e6d230ed4fec3e29a58d219ca4339a30054d8fbbe562cb72b75340315fbbf1

SHA512
58fa007fde17c0566c75b7efbb1b87bab5f186a4927deaf4b657ca079b4750a0193c83ab2dd206f5ed3ce1740f09a61f3f072e98cfb0c0d8d8fa69afa6a8c31e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
9fc098f3ca6a25917fb4037a3f6e2b48

SHA1
429d578c170a65858b2c02d73c52b0a9c31be346

SHA256
29746159c4051e09114696f68885cf00481b90c557298124d4551553ee64bf07

SHA512
85c16b1753eafe6695a702facf9a6b9fecd1ba611cbd51c7f842796f44eaffc788471e283d284079253cd97ec45e72d7f49a4c6e41466d3dc637783ecb973448

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7681016696ad04e7b568398fb26be5b7

SHA1
e4889711585ecfe9abc3b75e1165f01d9731bc90

SHA256
727d12fdae02f075c331cdebc02059a8e70cb562ac60c7128209181381f9fab0

SHA512
40de12be92fead3ca9780639febe58853e7daa6ecdbe7326f7cf566f5d97fca5297dd09f7c29422b2900c7abda4063904eea4dd5214af16233dcff85d9994a3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
04b4877f664679e7f21d6bf1e6a5cf8a

SHA1
4aabc0dcf42c5c47678edea77b2e8708254c0942

SHA256
bda66d475ac4d767df441e6dc12fa9eea602bfa1ae6258fe3d9eef7314e42ea8

SHA512
ccd2f363c69b41f0a60e6cfcd3782b6492e98381e16ccc20f1d3eca4247ca880df69fedbf0eff8ecc2de615591028f7feeed095ec808de354d68dbb31bd1b7ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9cd3020b02464346ca080e209384d8a0

SHA1
45b11f54887017c1c0954e4c8ec1619efc043aa0

SHA256
473b1f31b673aa948029835f2057379bb066792b01636345601d704de0ca50bc

SHA512
e674e0a827c212fa6173cb4dff851563a750d6b02371fa87d8fa763c50760d74315c023c95e0bcb161238c17949f4bd7c17d61b0401cbf41167ef284af4a444b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
49d62a997db6d15e52d016a3abc09a3e

SHA1
737f7d5bd57d88682460d74c58b73b8b27eee3b8

SHA256
7640e977b3905b08190cfad39719cefff28641f71883726617bb0658773f16b0

SHA512
555533494ac2fa033e386b325bf40ab9c55314aee9d9ddd7e652271c0e5b90d064895a6957c405fecc1c098cb382f356d88d3287a50db2d12a766a75034f090a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b2f34f86371742b7af8cf4b3eb6c3430

SHA1
4c0875247ef738e958e02cc534b2eba6780cc12e

SHA256
7a6f2f8888aadcc30f2c48f87207e93575c69b9d2f55a4a2b6ef5bd19519a04b

SHA512
3d11ad3a05fec0e141e0e4d938a000219f1a323764914dae8f2382fe6d94e28066cf663735ea31f345f2fcbbaf1e44c3fe46b23328b2af82ea0f18b91afc5a7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
7bf06b4ebf9b65e56da8c742f57cc1ff

SHA1
bcbd96ad0acc730476dc9a2d3773719478cc687e

SHA256
586af20a671f2bdaa01bcbdf32f0bee4006275c022420a89d34e4be0fbe3b5e0

SHA512
5547332927f0856e8bf6156a7f668fc10d55ce23c592c1d8fdf6b62feb1c4bf02a272b40912ff75e1a009bca642cad91a8b263411adeab3814e65b4fbc4c29df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
430810056c36dfb561a74840d60b3551

SHA1
b3592cc9cd724fad1a2d2f938c8f84236f2f262f

SHA256
020039488621016f0df68e852e24f109263600de941e3b274c7fc278bc14607f

SHA512
b80bb76bcbf5be1fbfef06f998e49c6404bfbdca5eb76e76e0149b68aca0857d3942780b860222e32661d034092e11b055b9921b52d01c2ec332e7ddc385f728

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
f1d4b2a35048ad68e7258b8b89cee99c

SHA1
a879184440d85acdbd717b19c7038188caaaa053

SHA256
69373994089252b63db3cdd78fc400f572762c9208428042363a7522774923a6

SHA512
1874f9835717fd0dd258e30164a6b586fb4dc155948c91087329ad27591e85653447b019355d21702f319d58d6fbaaf685809de6774dbca59ed95f2877e6aed0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
e318f59d60325681628636f985a19dad

SHA1
eacf34a04bf389c258c2dacfb558c06c61a71fd9

SHA256
c0cb9f2c1b7f31d8b58ef361a6e5d89a04b62e5f2f016e16dfc89b0b0cf1ad73

SHA512
d2d73d0f2527fed2ae14a79e7c54b5ffa6de8f9c64a1a3e929e17da9670b665bf2ffce4b16ef60ce41cc463279cafe256d8ff179271bb0219a5ae2010a455f7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
cb3fd2c09b45a72ffbf8b36087498a28

SHA1
277101f55a8fa756c030b2f7b0853c8b5d27c03f

SHA256
fc41ecfe2edd24cc9fb8c64ffa5fbcb75b04a970a783827b95e4dbc3b7883cf5

SHA512
35a6331e082c726c81efb3dc92fc4e38fb25a4fba9d969972d3ca3668dcd1e632a23e8f9f23cee6843b29f1fcd70558ae70171ee53b458ee9374b10067436f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
3.3MB

MD5
13aa4bf4f5ed1ac503c69470b1ede5c1

SHA1
c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00

SHA256
4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

SHA512
767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
078e8658130a856d1a178ad9cf74d904

SHA1
a4aa944523ead3db7bafd4c1ab404624a5d858a8

SHA256
53c1cd1572637e510f171b59ccba5eb726524689d0e689200b128e487c147e12

SHA512
f79d194c9859741c3338561a6de942745c5f9b52fb7674e454e7f32ab97fc679556687a13c635aa848325ff94c38af15743963b4e4f23e4d30b3c051cb97f264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d8fd83f4720b4fd4d06e5cc70c527021

SHA1
bcda86137a4eb37782ce1331f4379664302b2c42

SHA256
2e3662fb9e06b687ee7899de73a1f51eb30d96d761492cac9778c147a6279c3d

SHA512
28fbdd685a6a7b988329f4629ac8ff871d30e13d138c57266e72483519ccbabb5292ba88c820857f6c8dcf3707226f4000fd6249159630f93a2e80c36764162c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
838B

MD5
702b32b09c65ee5d4e5b5e61821eebca

SHA1
867b37f20499d91a03c2b5ba43cc96c5ea74bf14

SHA256
66c814a035db6429c4fa5bab7152393348f8e16a803710fd85d52b9e5015478d

SHA512
cecd7859ce42c822d6132af4c31f5183c2bd7c3586eedbae5249d9d5f0bcee9cdee5bc40771fde77199e2b1f2f049bfce2644ef978d2b47d6779336f01975c05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
25cda3dd6e49c4ce8229197e980496c6

SHA1
c89f4417e9fcb7fc30552ab1af12509edd72a7b3

SHA256
68892c6c61fc05d1468c6b60ab213c440bbddb056f0ac99d1ec82e1d3d913029

SHA512
f7a3f561d1dda237b25a7ec32f4e5169d01c74a17403a26691d5daf56edf56a2b6d82cb701f628556b2c949c54fe00757b57e9b8dccf32a7cbd6ffb735987644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
562B

MD5
7916912d821c221f5b25b3b130ceb64f

SHA1
3f67e47042cec1155b3e0ff231aec4e1becc5226

SHA256
dbb3010eefff86a363fd7898aaf5448861e8c803b3f1e1e5d0c82d1ba4f1eef4

SHA512
8c93513e4a6c076643f0d29f7ecfc7b9c559e7ab0b5517387b766af2a93fb28924888f2026548261c1a57536f2c521bd9c64033e846cbc9584fad1cc593b56b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
638979a4d5623b6d182c540e6820e4ba

SHA1
4b175576a2cc27688834121a025061db3afd0105

SHA256
24769e10f90ddcfcc51979c2ad47fe3ff80463a93cd19ffd247940d54b55b4e8

SHA512
1831bc8dbe9e2656e7073fa14b60be7cc59bb02fba61375f7fd958ebf20c1dd8a2f532dc52724b38b2d690a01b8fe98ffad12c77e708f748b9e004c44a26076e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ffc4b6f14ed99064705055fb1194526

SHA1
7a0be6416053fbe4c97660622bd1b8be5f000f58

SHA256
f7b31273e4644bbfb954a84bb85f82264d4bf22d7b0ffe9c7ba3f7f2f764607f

SHA512
6dba9a274895ce4d11281063e765ca1257f5bcb1b5d1d82d4f04064689553682464ad66b581541c004db0a20efefe6c2404bc20a27a7622dfc7507fc6f407463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
891bd1a592313148df029dc6dfc71d87

SHA1
c0a0a2880e0eb4c8bbfe1c46df7514ee49d7d9a7

SHA256
e6eaa9955d89eb6d2f15fa1b84cdfa7220fae0bf8eb1c8b891984a2ef88aa278

SHA512
ab3b214e98d8c77abde18c3c2212c116a3cb09f971ccd23eade4a3b1c467aa3e095d19f66e7dfc32835b671a91475e1128068d1d14fdeb4ee1d063760f25622f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a2fc9889723caeeab80564706cabf949

SHA1
a3e8d7c29cf2935afc50680ac43c319b685f7e54

SHA256
6ef5ff0379ed1ede5e40c48a772c41fa9a5a5a17efba190f2773033d81c5f995

SHA512
e2e97e90f32242f4d84843271378442671c58a96cd6b8a982551ec456286b84c00e6d2d113750489c32053396e9764ec77c10448e05c014dbbf88ec78851151f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
af1c574d6945ab145f7d4561c90de773

SHA1
fdf6dde4c26f48c41a3266cc771ea788163842b7

SHA256
9f1dd3922a3a342e2245122e4f4ce4534a38f178915d46d73802a6f1a32542f5

SHA512
3029e0f5a61ce54bfb64f2046159f6685abcca1fefcec8e34ae17fa475e8c171dea5997f416021d9a2ff756a7b7e918d72a1607dc9dc45ae1c9a39f6da1cf4c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ff81e6235f06b37b8533b076a0082906

SHA1
9fb4e7daa5d07c82856f7e7f6a94b347fdcc2c8c

SHA256
d34050b768ca6bf4edba13ca345e37d893f34bdec63bcdab550b73282f91c581

SHA512
6a2483c5202e6e9930343be1bfb0112269050db1d7d14debc46ea3a6afd8530672ff7f895bb3550bad590681a4210d9c7de63718104ececcf9ee124e3aa067a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
af49f3d3be0084a25643bc1c388c82f2

SHA1
18fb0b4113a707c6b4e7e35f8b14518e5a27bc0a

SHA256
06936addb48c198a8d3b17f1c639e7854a77ab3d4108c6018f59ded185b5ec05

SHA512
5c7629c4627c7d46c103ec8f841b87ec69340d9f6f9f63b04cad57fe6c34177ff30a2abf6cbbfd3b7c9725e835319147c1c671c94b5973228db9cc3ce94c0c59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
1390f5e320f18d1e96cd6bb273e6ad18

SHA1
51c16baa8205acad58d86920d2b2d0862ec561ec

SHA256
2a84d157a3dc1fbda873adb3a786250fd943e98ac1953733b3334d8f3e9d2c84

SHA512
4d745719c1fee2ab0c676bda349a2dc2bf029d5745ebd0ee1bb095a0dd49c4dcbd32dddecb2180f39ed29be28502eec19f20e8566eff84a0f9e646abbc015503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe62f9cc.TMP

Filesize
203B

MD5
05461e592cbc85c045c6b299abd3ea48

SHA1
32ccd7afd023cabbb9a109e6bf671c27086f8c7b

SHA256
5c11d41e27903d47dcc5fae40c14f46cb4700e9af5eb90ab03ccd9fadfdde805

SHA512
575101813f165c95da04de88dcef05039e708d92999349550781d741e506946bff6ce5079671fc3745073aebbc24828ee000cc1fcac5291224959de7e7bc4afe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dcdfb28e-a63f-4ecb-bdae-780ca90e62dd.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1d775bef77a3913edce2a9c5ee879a0c

SHA1
6602752e3b10a40192f4367c7423ed60c6051b1b

SHA256
408d70fc8a5d621ae35b98e34ad02bbbb33d42f3ac473ccf174e3ac1a920ffff

SHA512
d66999b2f79b1e1c425e7b28a8a6de72f49b4104b6d80dc37e968c22b65f7712fb7179405934dd396c99a2b7bb01c62613fa556064922a6c41c5a1cf4f030845

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5d8640bc3397a2faf7319db7174a393d

SHA1
410f9e721c711c4d3516386d5b46f702b7079007

SHA256
d6b9f83bf46e603c72276c49858674091ffa65d6bc9c66b07ecce65cff71adb5

SHA512
6ee88d53bfa887c903a87d934df053bd81bc451aa81433bf012882505cbb3869086e71da4784654a85093333bdef1c87d36e5ead719082f86cc31491ea6acc8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
370ff29c8ec480cf3fc8ac1e675bbeef

SHA1
ea16bc1fe9d4683f94ccac822bbebe2695c76528

SHA256
5f18325ff6e74c0e62dffb0e988586873e4ac15fc33281edf642a63d46f26c7f

SHA512
a88a1aae9ccc55794f20f696421bbcc1d843b172534074fb2779e7d376f9e806db46261b5ca45105eb240997a8c63225d46e0a406f091e30d5188d637d3094f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
71ee2f4eb9e67942a01f9a0cebd7630a

SHA1
0fff9c44929276dbb68261ba1b7f9f07c9b37477

SHA256
b81de64dd2c12817227cf02ceb0d42dbe6beb2c2094d4784bc47db239178f217

SHA512
d3c9d1833bd659f500325b2f8820959c0d6347e4e92bf9c0e17306189eb6844ae466087d5e61ebddbe134c47ac81f4b0ff5d20322647afa2e846b7a1aee6f8b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
3e444f283f708d737734e034d1309c3f

SHA1
76d11fd3acc3320e246b2ef5a7acdcd44aae40d2

SHA256
be7b095ea9168e5eee6c83449094e962461ce2360ecb69efe6dc750453289fc6

SHA512
c8883de56016919263f91cb6c1d574e60f3c8f12594d54193856dfbadc4d9b9efc636eeb2d771b8de98cda2dc52bef1d12437132d905f17f4a5b072a99659424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
c256e5e211a00f3805a779a28873fe48

SHA1
a02b33085b88d79b7f198848476a84aca55549bd

SHA256
ec39d8e0f71e0031e0e1acd369b345204a11a930d796c9b16f24beb7919d3afb

SHA512
f74c2f445db82d3a4bed56d629f72091dd04be452ebc3d96201ec227698cc08a27235968c15150666a64a01297c3e42183b96b64bd117e473de87ad68d89a4eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
dc854d75447455a4cc7192096bb48a19

SHA1
1f31d323b1a6c97f23bfe18d7359d3ede4394da9

SHA256
8b2bcdef8974ccf390fcbb49873db8658db19926ab5ba133b1580ac24e200287

SHA512
fba354622d51944c83b7c82ab47fcd51e1e453db6c8db03bfb0d63c9d54b9dc38dd9d300c8328215c8f4917ce16409e21f38cf5f39d659b240ebc18da36145dd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jj59r4xg.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
95308502e3765b9496100872967051d9

SHA1
12f95c6bc8bb7f8688cb9e5f6ef709e00315c7a2

SHA256
303adcf8728dea65c607946e7c939463f07ebef2c909618e4a810ca60b7d8d2d

SHA512
9cba78f57e077ea8d47579ab12f757cb9bc468863c5b1d15ad6e41f79aea61b8ae93a5ac42f25c7aaea82c7083e8b219f183dd58aad319437a404998ec66078e

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\e1c868aa-19e1-4529-94c8-7035089f85a1.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5ED6.tmp

Filesize
1KB

MD5
a31059697aa8156c0760162d401319bf

SHA1
1b4d74bc9c3abce6d2125a543b277f8aa731f448

SHA256
c8d4fa1a6ea22c8fbf2c4b44e8f0cb7aa36a72913868fd6e4903f6994529eb46

SHA512
dc0db463e72d7dca3cffaa32cdc87b0534b935c29f5ea490c5954e8fc0cf6b79d5933211e416c4902bdb2f1a2aa054a04e6c39c52ea377f947bb288ff1897361

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3684_1867815726\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3684_1867815726\c0fda333-f389-4ee0-a500-3ef89b00d9f1.tmp

Filesize
150KB

MD5
14937b985303ecce4196154a24fc369a

SHA1
ecfe89e11a8d08ce0c8745ff5735d5edad683730

SHA256
71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

SHA512
1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc61143925420443DAA19B78D47CF9AA4.TMP

Filesize
1KB

MD5
d40c58bd46211e4ffcbfbdfac7c2bb69

SHA1
c5cf88224acc284a4e81bd612369f0e39f3ac604

SHA256
01902f1903d080c6632ae2209136e8e713e9fd408db4621ae21246b65bfea2ca

SHA512
48b14748e86b7d92a3ea18f29caf1d7b4b2e1de75377012378d146575048a2531d2e5aaeae1abf2d322d06146177cdbf0c2940ac023efae007b9f235f18e2c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\wbtpgjfp\wbtpgjfp.0.vb

Filesize
78KB

MD5
ad4fab517ad150e108d92d31b117921f

SHA1
e321bea9d24c4a2d69e808ac27e1dd096e0c9edc

SHA256
14080a4fb7f3b6259a8582d0c6716a7c990145ee1eb41e5fba8cbe8b7b2ee3ca

SHA512
a35012d52a9f49d00390456b40ae6f6230a185ad2ecfb378ee4fb6648e4d48bbb648836fd75b9c5bbe55fbc8e60b660f9602b428667a19135c54ba3b1f413e3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wbtpgjfp\wbtpgjfp.cmdline

Filesize
325B

MD5
05f27b8a551a53bd83fe2bb204ef64cb

SHA1
5b97aa7126aaa961f0cdb5e097525af72e8220e8

SHA256
386bc2cea8a8076899b5ba00e0c7ba071946c53022b169407559f245810d085e

SHA512
1e9fd0694bb911ef66e6c6025b850144d7511edd6bbd60cf85799595b2d4d720bdb99dfc3daa601962c8fcdd149d3b838f663165357bc4df09548c543a5a7c72

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
fc004026da205c8cc37672db9039632f

SHA1
4ef1ee9591222cbc802e0f4121eb27d121f49a8b

SHA256
d90dddc654e63cbb46c3fc74da28fbe91ec4636969700bde9a8fc2e9332c3efb

SHA512
5d6d26b3223785ec6ab6059b4277f7de415faedcb2270ec3c9982add7bc95795f1eb38dec8266e17e7677b4751e583daba804689ecfe59c37a9a0b22d4a74e8f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Filesize
966B

MD5
48e144760ea37c05c2df0032ce1475bf

SHA1
2ef1149975e4dae015d9908493160177e259475c

SHA256
64aac707df586caca23167e24e6335fe829952c702f3589bd14b72b341d71b0d

SHA512
3c4112f0c275e568c8ba00490c173a187e7faf0c7223af12199635ce332ad8e7fdfe068c08e9702adef1cdfe4a045bc3f5bc08db61511acf7b4478326d57fd38

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
74afb0b80a9cb51b0f9ff7ecc4c85cce

SHA1
b42012d84ac5bee0bdd93c0b13e224e8b96798f9

SHA256
e56f393cc5b1cebefe1d027addadf8e6990d4474354c75165dd1fafcd917f713

SHA512
3f4c73a510753f06d1ea42be48813e73b33cefe329b9800c0d926d20de1ee48aa756914f39674334d89971ffaa9d59816d4daf5e8ad81b67b908e8c560981741

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
a2054f21b617d7c83b808c7ce22ed8b5

SHA1
d0b05897728159aac373feee4e1db03ffa0df965

SHA256
69ca221696bf22abd390fc5a775ff3753a43845eb8c3fa6eb1613c83efade234

SHA512
8d33efbf6e846e31e23b7e322c468ed7c8f839447c74044def53bfed55c218326cbab020744a8c7406d155ce5d9afcbff0c4f39f360e4801e5866599230927ec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\0418d1c7-3d63-45d2-9552-7ce7d1847450

Filesize
982B

MD5
b3163716daaa6bfdc9b3870745c05091

SHA1
844fa93d5bd70a5db588313f13b4fb8457f8a6f7

SHA256
207b92a36745a6597a3222d6da534ca38a2ae93b1f2eb9bf24d3a9666a215f6b

SHA512
7ce5fd3c18ed8e88ff44aaf3907c60f9b605a3493d9b18947898db6ff0ebb8fdcab05efdfd9293912d5cd513e02b6a7b1c0ab0222ab9499c3c0675b44d60e83e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\90067518-ad0e-40e0-a9d6-79b22da41874

Filesize
24KB

MD5
f9ac454a6ad402f4d42b47ea5d6ec345

SHA1
792542fe749e36e5695ddda595c4a5fd2efdee57

SHA256
e11b8e4cc4417fd4026bb43de5f738e501591bae8e55f66aaf4e4367029f2b60

SHA512
3e11d6a942e9ec504d224ec946c8e12e8b59336c901292010eee783cb7bd83839c536881d7ac93f2f8d1e3ffd09428cfcfbef89f9cb19c20a2d950e7a9cc6163

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\datareporting\glean\pending_pings\e41e0784-d179-4b77-bbb2-e43068190f0c

Filesize
671B

MD5
54d96fe254296ea63e4729e3e1e4f4b8

SHA1
b1f32e5c6ff0e13be19c528a71327be64c6530ec

SHA256
4e9732c330ba34305d211e74eb92dfa4d55e86efc3553f974db1054bd90eeaf3

SHA512
1aab1a9ae0d13a12b5a39f7a62cade6658df4d54dbab5fe141c563cbbad0970fa564feb72bb83f3221a9ab6e3a6103eaaabe638c8c4ba2be249ccf02d0605306

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jj59r4xg.default-release\prefs-1.js

Filesize
11KB

MD5
b4e5609361bf697cda7d7575933e4424

SHA1
0d8da439947b4f2488b64a8e8bf6be4dd6ee0d69

SHA256
1a8178fca08cdb07c91832481305019e95ad668ed198dd67953abd42d210ea8a

SHA512
1d92f8133799233c23075c23363683e09e0d114a5d265d85c1beb5bc72d56d4be939a9c2a6e4b9246ad84ea8639bf2bdbcbf1b4a6ddd60b51cec8306c93ade2b

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
743B

MD5
01005ca63a569c8516a1a71b1bfe8be7

SHA1
0c9d30bce354ab449f7d56428020e89e7ebef4ec

SHA256
fd79cce28a831c24f545e27604108122c30670007154ab6e3974201cae801caa

SHA512
57f05ec7ac9968f34a349a343b26fa1a25c5e63a0cd4824163c843414dde6e36d2b2ceb20e6267d0a4bdcf1be4b4f0b356ee06e9a08377fc59b8ee39abdd9dc2

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\Profiles\Default.xml

Filesize
1KB

MD5
cd4f91328c6a3f494a1f621d206bd668

SHA1
bc0fe8acdaa2ba1850ea97c8812674989ab9ac40

SHA256
51b05e90963cb6ed9425445a7f7f9595a5a1e1401606a0c84f9f5275abbd1289

SHA512
49f9c3afa90bc6a40e2b87bae9e0413cf79d4c94270bfbf052c5fb41471ea5aab29432275dd7aa96a8d7a85e9f41c0c8680693c088d10b0da17161bb29fbe7e3

Download Submit
C:\Users\Admin\Downloads\Quasar.v1.4.1\Quasar v1.4.1\quasar.p12

Filesize
4KB

MD5
ebf6e79a4ed1f35cef49356e02c5a2cc

SHA1
34d66fc7f1c7be6ec95a089a594803e2a2c256d5

SHA256
328fa75716943dd6244ddf52855b34f87595f3061e45ab73d234dd15a1f26a68

SHA512
a97fb7349b5e436285887c03d85736b5893b84a7773ff512efdb9abefdec699f30c1eb901c75a09efdfcb5c6d6b3c6065184be55c75535a545f6d9ff666c4603

Download Submit
C:\Users\Admin\Downloads\Xworm-V6.1.zip

Filesize
26.5MB

MD5
75b715e998c88f168728e27dc6887819

SHA1
2d4d3f9702c0cd8b89b1b1d61ce05aa5c4b430d1

SHA256
76f7a5d79b8df10dec30dc9faf6cbb6039fde1b93bd74210a61bf0943931f09d

SHA512
85c4be0c1ed1d8bb740d314626c572bbd2258ce324394d4c27a87c2d8aa9f9723407ec792dcfe1467cc7d3a2e40178281ac964381db6b9d748f930c0907fdcf2

Download Submit
C:\Users\Admin\Downloads\Xworm-V6.1.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Xworm-V6.1\Xworm-V6.1\Xworm-V6.1\ClientsFolder\920161FDAC75A94792C1\Recovery\ProductKey_01-26-2025 16;44;13;720.txt

Filesize
29B

MD5
71eb5479298c7afc6d126fa04d2a9bde

SHA1
a9b3d5505cf9f84bb6c2be2acece53cb40075113

SHA256
f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

SHA512
7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

Download Submit
C:\Users\Admin\Downloads\Xworm-V6.1\Xworm-V6.1\Xworm-V6.1\Plugins\Ransomware.dll

Filesize
20KB

MD5
8da3ba5a28c9e0c90eba0ffbd00f66be

SHA1
9a155b3a87d065ab467fdf8711e6fce84038ca00

SHA256
5b7533fc4c3deb634e8a0aadaa0590bea75524c316e243df88cd9945411d4f4d

SHA512
76191861cfecb09576bb01679a034470cb84ecf31fa70fb1c3e0885a0103b91a97586662680cf56ac605db091dc6857d105e9ac09b0d1c02a35b75a8788ab387

Download Submit
C:\Users\Admin\Downloads\Xworm-V6.1\Xworm-V6.1\Xworm-V6.1\XClient.exe

Filesize
34KB

MD5
5dbaa27f65b90640f48260828977a56f

SHA1
c2958b8fda5902f7783560aacfb93c6604f1f712

SHA256
fbe25b0ed313032cdcec9338b12222a99803d2689c77b45bf796a68f33ce35f7

SHA512
de4e0912ccc620442a824ae0c4e8a1b32b9b39aea65a0acc930f93ba4c42982952f1b0d6c639a456524a2ad9aa4175aca51e92526df8d76f64c5ad6cb70f78bc

Download Submit
C:\Users\Admin\Downloads\Xworm-V6.1\Xworm-V6.1\Xworm-V6.1\XClient.exe

Filesize
50KB

MD5
743fe3546e1d91265e9e4467e4922baa

SHA1
27ea8e2e99ca637c94ea4f82c59a1b7fbf190685

SHA256
8361d0750653b522be0195057732cf3008cfc68a53d3c0cbf4d62192b5c08e58

SHA512
6a5e4cc9a3f5dec962b8896d3145a827b6e5ab54634c6d618d11d2bd75d27ea02f37ba19deeb67187925c6d04c4f223dc6e6c089aaaf5969d96ecc01f356ae98

Download Submit
C:\Users\Admin\NTUSER.DAT{2fa72cf3-34ca-11ed-acae-cbf1edc82a99}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
5288525db0ecb996d0300b6cd998ebf9

SHA1
e75d734e4cbcb424a373fb1cb7b7b745ed751f52

SHA256
a2a658ee29ba8d2411663f1f1e903025808f2a33cd502790db2586a60688319b

SHA512
d5ae73fd1fb90471d946273f5611555e55cd6391f2935af37bdfbd2a12853b671e9a296dfc11373a829a5a1eec9a77372bfaea215a02088b39f4df3c64a8178e

Download Submit
C:\Users\Admin\Videos\desktop.ini

Filesize
520B

MD5
a882cf89da04eb72950e65080a5cf857

SHA1
fa359f8d2e4502e5944bdadf46f05f9bf380a1cf

SHA256
b41bdfe903bf4ab529adf9a2624c5733f5e044d42a6cd6fed18fd2c281f7fcc5

SHA512
c5de397435424ea9f807f00f44ee1d57d87e71d8afebbfcea6f5a365bf20c1b971cfbb50e40e29430672b022634f8bc8bded25ae9061f0dc6407f3f44d5cc990

Download Submit
memory/1216-1969-0x000002442FB90000-0x000002442FBA6000-memory.dmp

Filesize
88KB

Download
memory/1216-1990-0x000002444A750000-0x000002444A768000-memory.dmp

Filesize
96KB

Download
memory/1216-2219-0x000002444A990000-0x000002444A9A2000-memory.dmp

Filesize
72KB

Download
memory/1216-2132-0x000002444C2D0000-0x000002444C2EA000-memory.dmp

Filesize
104KB

Download
memory/1216-2131-0x0000024450280000-0x00000244502DE000-memory.dmp

Filesize
376KB

Download
memory/1216-1993-0x000002444A810000-0x000002444A85C000-memory.dmp

Filesize
304KB

Download
memory/1216-1970-0x000002444C670000-0x000002444C99E000-memory.dmp

Filesize
3.2MB

Download
memory/1216-1968-0x000002442F610000-0x000002442F748000-memory.dmp

Filesize
1.2MB

Download
memory/1216-1992-0x000002444A8D0000-0x000002444A982000-memory.dmp

Filesize
712KB

Download
memory/1216-1991-0x000002444A7C0000-0x000002444A810000-memory.dmp

Filesize
320KB

Download
memory/1644-951-0x00000294EEFE0000-0x00000294EEFF0000-memory.dmp

Filesize
64KB

Download
memory/1644-949-0x00000294EEDF0000-0x00000294EEE00000-memory.dmp

Filesize
64KB

Download
memory/1644-948-0x00000294EEDF0000-0x00000294EEE00000-memory.dmp

Filesize
64KB

Download
memory/1644-950-0x00000294EEDF0000-0x00000294EEE00000-memory.dmp

Filesize
64KB

Download
memory/1644-952-0x00000294EEFE0000-0x00000294EEFF0000-memory.dmp

Filesize
64KB

Download
memory/1644-953-0x00000294EEFE0000-0x00000294EEFF0000-memory.dmp

Filesize
64KB

Download
memory/1672-33-0x0000000006B00000-0x0000000006B10000-memory.dmp

Filesize
64KB

Download
memory/1672-38-0x0000000007650000-0x0000000007660000-memory.dmp

Filesize
64KB

Download
memory/1672-37-0x0000000007470000-0x0000000007480000-memory.dmp

Filesize
64KB

Download
memory/1672-32-0x0000000006B00000-0x0000000006B10000-memory.dmp

Filesize
64KB

Download
memory/1672-41-0x0000000006B00000-0x0000000006B10000-memory.dmp

Filesize
64KB

Download
memory/1672-31-0x0000000006B00000-0x0000000006B10000-memory.dmp

Filesize
64KB

Download
memory/1672-40-0x0000000006B00000-0x0000000006B10000-memory.dmp

Filesize
64KB

Download
memory/1672-34-0x0000000006B00000-0x0000000006B10000-memory.dmp

Filesize
64KB

Download
memory/1672-39-0x0000000007650000-0x0000000007660000-memory.dmp

Filesize
64KB

Download
memory/1672-42-0x0000000007650000-0x0000000007660000-memory.dmp

Filesize
64KB

Download
memory/4312-903-0x000001AEAB580000-0x000001AEAB774000-memory.dmp

Filesize
2.0MB

Download
memory/4312-902-0x000001AE8EB10000-0x000001AE8F9F8000-memory.dmp

Filesize
14.9MB

Download
memory/4312-931-0x000001AEB3950000-0x000001AEB3C32000-memory.dmp

Filesize
2.9MB

Download
memory/4312-930-0x000001AEB0530000-0x000001AEB055C000-memory.dmp

Filesize
176KB

Download
memory/4312-905-0x000001AEB33F0000-0x000001AEB3558000-memory.dmp

Filesize
1.4MB

Download
memory/4312-932-0x000001AEB3150000-0x000001AEB3202000-memory.dmp

Filesize
712KB

Download
memory/4312-929-0x000001AEB0590000-0x000001AEB0612000-memory.dmp

Filesize
520KB

Download
memory/4700-924-0x0000000000CF0000-0x0000000000D02000-memory.dmp

Filesize
72KB

Download
memory/4700-955-0x000000001BA40000-0x000000001BA4C000-memory.dmp

Filesize
48KB

Download
memory/4700-954-0x0000000002F10000-0x0000000002F1A000-memory.dmp

Filesize
40KB

Download
memory/4700-934-0x000000001CCD0000-0x000000001D020000-memory.dmp

Filesize
3.3MB

Download
memory/6040-2205-0x000000001C650000-0x000000001C662000-memory.dmp

Filesize
72KB

Download
memory/6040-2206-0x000000001C710000-0x000000001C74C000-memory.dmp

Filesize
240KB

Download
memory/6040-2204-0x0000000000CE0000-0x0000000001004000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads