asyncrat | hxxps://cdn[.]discordapp[.]com/attachments/1171221884562587691/1171222232928890991/ZFy00Zb[.]rar?ex=67a34474&is=67a1f2f4&hm=b70b79b4d5ab317c25206d8808c3dd56f75ed54dfb33519a559050aae485229c&

Resubmissions

04-02-2025 16:29

250204-tza3nasjax 10

04-02-2025 16:25

250204-txf6ws1rdt 10

Analysis

max time kernel
159s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04-02-2025 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1171221884562587691/1171222232928890991/ZFy00Zb.rar?ex=67a34474&is=67a1f2f4&hm=b70b79b4d5ab317c25206d8808c3dd56f75ed54dfb33519a559050aae485229c&

Score

10^/10

asyncrat stormkitty xworm default discovery rat spyware stealer trojan

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot5602729079:AAHue5HGrezQGgwKeWyn3WQgaqOZM5nlF_c/sendMessage?chat_id=6067717150

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

xworm

Version

3.0

127.0.0.1:7000

Mutex

X5YBIgfxl9v2eUbs

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/files/0x001c00000002ab3e-301.dat	disable_win_def

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x001900000002ab62-223.dat	family_xworm
behavioral1/files/0x001900000002ab69-239.dat	family_xworm
behavioral1/memory/3756-241-0x00000000004F0000-0x00000000004FE000-memory.dmp	family_xworm

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/files/0x001900000002ab08-214.dat	family_stormkitty

Stormkitty family
stormkitty
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x001900000002ab08-214.dat	family_asyncrat

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x001c00000002ab5c-197.dat	net_reactor
behavioral1/memory/2088-198-0x0000016953CA0000-0x00000169543CA000-memory.dmp	net_reactor

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Executes dropped EXE 2 IoCs

pid	Process
2088	XWorm V3.0.exe
3756	XClient.exe

Loads dropped DLL 1 IoCs

pid	Process
3756	XClient.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	XWorm V3.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	XWorm V3.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\0\NodeSlot = "8"	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\0\MRUListEx = ffffffff	XWorm V3.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\MRUListEx = 00000000ffffffff	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	XWorm V3.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 5600310000000000445ab68310005a467930305a6200400009000400efbe445ab683445ab6832e000000bfaa020000001a000000000000000000000000000000f820cd005a0046007900300030005a006200000016000000	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 6000310000000000655795b3100058574f524d567e312e300000460009000400efbe445ab683445ab6832e000000feaa020000001b0000000000000000000000000000007066d900580057006f0072006d002000560033002e00300000001a000000	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	XWorm V3.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\0	XWorm V3.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0 = 6a003100000000009656af7c100058574f524d567e312e30424900004e0009000400efbe445ab683445ab6832e00000001ab020000001900000000000000000000000000000087bad300580057006f0072006d002000560033002e0030002000420069006e0000001c000000	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\MRUListEx = 00000000ffffffff	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	XWorm V3.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0 = 6a003100000000009656af7c100058574f524d567e312e30424900004e0009000400efbe445ab683445ab6832e00000003ab0200000019000000000000000000000000000000a0dccc00580057006f0072006d002000560033002e0030002000420069006e0000001c000000	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\MRUListEx = 00000000ffffffff	XWorm V3.0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	XWorm V3.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = 00000000ffffffff	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	XWorm V3.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic"	XWorm V3.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	XWorm V3.0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0 = 6a003100000000009656af7c100058574f524d567e312e30424900004e0009000400efbe445ab683445ab6832e00000002ab020000001c000000000000000000000000000000e29bcf00580057006f0072006d002000560033002e0030002000420069006e0000001c000000	XWorm V3.0.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\0\0\0\0 = 6a0031000000000096562b7d100058574f524d567e312e30424900004e0009000400efbe445ab683445ab6832e00000004ab0200000019000000000000000000000000000000b4052801580057006f0072006d002000560033002e0030002000420069006e0000001c000000	XWorm V3.0.exe
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	XWorm V3.0.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ZFy00Zb.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
2472	msedge.exe
2472	msedge.exe
1484	identity_helper.exe
1484	identity_helper.exe
4228	msedge.exe
4228	msedge.exe
1080	msedge.exe
1080	msedge.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe
2544	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2088	XWorm V3.0.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	1552	7zG.exe
Token: 35	1552	7zG.exe
Token: SeSecurityPrivilege	1552	7zG.exe
Token: SeSecurityPrivilege	1552	7zG.exe
Token: 33	2412	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2412	AUDIODG.EXE
Token: SeDebugPrivilege	3756	XClient.exe
Token: SeDebugPrivilege	3756	XClient.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
1552	7zG.exe
2088	XWorm V3.0.exe
2472	msedge.exe
2088	XWorm V3.0.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2088	XWorm V3.0.exe
2088	XWorm V3.0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2088	XWorm V3.0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 1548	2472	msedge.exe	77
PID 2472 wrote to memory of 1548	2472	msedge.exe	77
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3408	2472	msedge.exe	78
PID 2472 wrote to memory of 3880	2472	msedge.exe	79
PID 2472 wrote to memory of 3880	2472	msedge.exe	79
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80
PID 2472 wrote to memory of 3720	2472	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1171221884562587691/1171222232928890991/ZFy00Zb.rar?ex=67a34474&is=67a1f2f4&hm=b70b79b4d5ab317c25206d8808c3dd56f75ed54dfb33519a559050aae485229c&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff858863cb8,0x7ff858863cc8,0x7ff858863cd8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1692,11035052852876867804,13105934540449417337,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1692,11035052852876867804,13105934540449417337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1692,11035052852876867804,13105934540449417337,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,11035052852876867804,13105934540449417337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,11035052852876867804,13105934540449417337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1692,11035052852876867804,13105934540449417337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,11035052852876867804,13105934540449417337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,11035052852876867804,13105934540449417337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,11035052852876867804,13105934540449417337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1692,11035052852876867804,13105934540449417337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,11035052852876867804,13105934540449417337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1692,11035052852876867804,13105934540449417337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1692,11035052852876867804,13105934540449417337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1692,11035052852876867804,13105934540449417337,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5236 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2260

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ZFy00Zb\" -ad -an -ai#7zMap23502:76:7zEvent22116
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1552

C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0.exe
"C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2088
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v2kgy3tf\v2kgy3tf.cmdline"
  2⤵
  PID:4624
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6174.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE79F5E775646EC96332D6C38A0112E.TMP"
    3⤵
    PID:3156

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5108

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004E4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XClient.exe
"C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XClient.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aad1d98ca9748cc4c31aa3b5abfe0fed

SHA1
32e8d4d9447b13bc00ec3eb15a88c55c29489495

SHA256
2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

SHA512
150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb557349d7af9d6754aed39b4ace5bee

SHA1
04de2ac30defbb36508a41872ddb475effe2d793

SHA256
cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

SHA512
f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bf660ffaac465a5c95aff163a18b4935

SHA1
d5e43450f82f5f7b99cbf51ba1d27e4adb0b0d02

SHA256
e97e9a25e7dade1af0cf7478a6faa07b6b021fdbdb802fce0cd6f1ea66c782e2

SHA512
badae81063cc273e8760a3f78c927a0b2a0b6be05947e2507e2544d56286b67a9af41083d79dadcbb6154fbf3874afa3cb5a7d19e55ccf4d5f65c7c34e3bc46b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bc45f05336f60b2e060945b3d2e24597

SHA1
7a3518423d444173c497458efd1a67ad334bab81

SHA256
c9d75fb7d8778f5a2b62bdf8da7e369d1cb0cec816e4159993f1b77c1d9a8ce0

SHA512
a6fa8eea4a550bec9bf5c390b907722d7e7c74806ef60d9fa6413756128329ffec434fc5d2b246025cd6d03a09227e4de9e68aa7dc9c4df4cd45df64a6453ef9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
68bce706cfa02c818d0e9b5af180fb24

SHA1
0abb12ae66c184b208aaf4fed0ff71939f81d82c

SHA256
c2bcf8fe6f532a179802ef5bb5408e5f23bbb955e547167f60d6846c90904f90

SHA512
aa9d4ffdd8864b09b660e192896b7592aff05906f39c365b3432a1036f03029de2a40aab15c5ea75737d1c5ade83b880c8e594e95658590ad1a6cfad07571de6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cc4e40a59feb989794571366fc7d738b

SHA1
c84fe876624bd4a8cdd28ef7c9b249e6a0e848c6

SHA256
cf81690d9b1e7553585c2e08492084642ef87b70ce8a9ef6f0f37440bf652dfa

SHA512
60f72099ab951c0666294dc45e484129551948d77a412e95467b5e3fbc42677fbc745daf968ebe2b8b37e7e9259dfcbaa8f04d0bc0928768a52fad407f437220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c1b42d45a44578a234065a3371eed217

SHA1
67f970c1829b9397fe4cc32ee5f86bab89f9d1fd

SHA256
d69612d10a7ea2b7bee220fa73a243c25f1ce243ff4bdd5e698d615fb18702c0

SHA512
a3a001db4adfbfdb1ba761c83d363901e5763e24f824df35e99a6ff803fa2b90a495d7fc07527b3b27e2cba2c626c38b331ae2ece2554c161825b4335ea80457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
09113296417c5bad8134c9aa56a77bc7

SHA1
1af04f5b0459929cc10cb827308733b4a0733585

SHA256
e67c592e1017639452e53e598bd14393b032a7babb7678401a85962a2367b493

SHA512
a3aa897d1851180476b31763cee54d31e32e69fbbc5d5f23d5ffcc75693dd937a7f21bf94556e6fb6794a83205a00f480126fcae71179202f0d19f558ab2952e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6174.tmp

Filesize
1KB

MD5
ef6583337005d62ae4c48dc0ea6436f4

SHA1
296b202ace78b0fb72806faea210c61b84541550

SHA256
2813cfd7aeff973142bb858d5397de3f0566bb2af10530796647f44b0997a9d4

SHA512
9e2455f348fc1384164c1db6e879568003a1cb19873adac1d90beae0c70372ff03597406d8e6b4c0afec249b9d5cf3e628729dbcae772e6247f365edab9e4456

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4E74.tmp

Filesize
100KB

MD5
1b942faa8e8b1008a8c3c1004ba57349

SHA1
cd99977f6c1819b12b33240b784ca816dfe2cb91

SHA256
555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc

SHA512
5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43

Download Submit
C:\Users\Admin\AppData\Local\Temp\v2kgy3tf\v2kgy3tf.0.vb

Filesize
72KB

MD5
4b4d614c976d2d8db4a1f8f0af8ea1ec

SHA1
4d474ab3b9501024f14eb63437883f6dc4cb9308

SHA256
69e8ff4a5d976de68c1aad8e56ca2dc47cef5eb0f855039c052c906ed64eb0c6

SHA512
94aca9fc84dadfab068ce0234c2dfd8e8f5917f5ac1a22e9ebb3edb276f9e7f4fdbdf82ab9e99b360242666fe87756b5d7dacfed540972848106d33f830d2a84

Download Submit
C:\Users\Admin\AppData\Local\Temp\v2kgy3tf\v2kgy3tf.cmdline

Filesize
371B

MD5
6f331c1ca0b63522d5847a17dcefd55b

SHA1
9ca0a518fe4cb052f4b1159b23a90a1ef15ff1b2

SHA256
a48421b82fb58e30a924dd478b82c92a28f9e83d48da9836b2a1850545c66eab

SHA512
39ca6d4b4976b4c9385d735ffadc6d562d8ffd05c6d5657b4eebaeaa348a2b536ed410acc40ee27a8338df3eb7a3024bae809a74013a50893e66e52eee7e99ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcE79F5E775646EC96332D6C38A0112E.TMP

Filesize
1KB

MD5
d40c58bd46211e4ffcbfbdfac7c2bb69

SHA1
c5cf88224acc284a4e81bd612369f0e39f3ac604

SHA256
01902f1903d080c6632ae2209136e8e713e9fd408db4621ae21246b65bfea2ca

SHA512
48b14748e86b7d92a3ea18f29caf1d7b4b2e1de75377012378d146575048a2531d2e5aaeae1abf2d322d06146177cdbf0c2940ac023efae007b9f235f18e2c68

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb.rar

Filesize
18.3MB

MD5
ab2f8e0256c255932825ac164dff3b2f

SHA1
4e39451f49758179b706a4770dd535ef19c772a2

SHA256
c0bea2b4d19bf8677f5dd793987312e1119c9fad9d6cff33ced32f821c1f6658

SHA512
7ea8b2414cb9d29c2a04d4fb9594b2c028be1c7a22f3587a1a9495d542e4e7df4d078ab520111d398d59b1b6fa833745af8e291e114b6438188b6397d5afa003

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Builder.exe

Filesize
273KB

MD5
2a388e389df3136db839745d13a2bbd0

SHA1
1ba063842110c80d2a6bdf8280ec88b426b9d4ea

SHA256
a2251164857af32d0a13d3d91c9cb17af07f5858ad935c666a4787f12d585622

SHA512
01715c872281fffd8587f5cdabb5a9d80c720871424a6bf50ad0e8de7aae69536d0d4ffecb611ecfb8e98190e96b8ba896c96bf2dc0ebdda511f74909b5cb559

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\GMap.NET.Core.dll

Filesize
2.9MB

MD5
819352ea9e832d24fc4cebb2757a462b

SHA1
aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11

SHA256
58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86

SHA512
6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\GMap.NET.WindowsForms.dll

Filesize
147KB

MD5
32a8742009ffdfd68b46fe8fd4794386

SHA1
de18190d77ae094b03d357abfa4a465058cd54e3

SHA256
741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365

SHA512
22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\GeoIP.dat

Filesize
1.2MB

MD5
8ef41798df108ce9bd41382c9721b1c9

SHA1
1e6227635a12039f4d380531b032bf773f0e6de0

SHA256
bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

SHA512
4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Intro.wav

Filesize
1.7MB

MD5
dc28d546b643c5a33c292ae32d7cf43b

SHA1
b1f891265914eea6926df765bce0f73f8d9d6741

SHA256
20dcc4f50eb47cafda7926735df9ef8241598b83e233066ea495d4b8aa818851

SHA512
9d8c1bb61b6f564044aad931e685387df9bc00a92ab5efe7191b94a3d45c7d98a6f71d8ae5668252d6a7b5b44ab6704464d688772aedac8bdb2773d5765d4d56

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\NAudio.dll

Filesize
502KB

MD5
3b87d1363a45ce9368e9baec32c69466

SHA1
70a9f4df01d17060ec17df9528fca7026cc42935

SHA256
81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451

SHA512
1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\ActiveWindows.dll

Filesize
14KB

MD5
d45c2a95c5670074713be9e669e4d610

SHA1
96d26829b4ef8156eb5906f84535866f7f859203

SHA256
4263c50674c6ab64a9b5a1ad5e301628baa975e4c919d0c7767ec39adf4cbfe0

SHA512
e15a8fc7fa81ad1a6446db7c18494b2e4c15ab28844dbb77deadcae72064ed6bd6e08fe59604c27bd4e44ed059c1a424f322a753293d76bd574262aa31b9e3ea

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\All-In-One.dll

Filesize
4.8MB

MD5
f21e73b79f9aec821c976b4fbae7225c

SHA1
7be974156ad16f23f4b91b47c380f8c3422a9863

SHA256
2987ef4a83e2c44a9abe57cdd9a4bc2b8cbaa01f6835c45cfce180b4d978982c

SHA512
476bdb0c6ac8703e467c51b90b23e45ab72a2e81652e3106732b69d9d299c277c0f9d308117cd338089d3578ebe73d12559b4300fda24d32ca7f1991827aa8df

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\Chat.dll

Filesize
18KB

MD5
c1a27e18603cdd587ae47e0e4b71c5f1

SHA1
9a8a3b938c0e4c79687750dbbd459ff3879c4c2f

SHA256
eef8fb30e32b48e1480a6131de34436c0a8efafcf807856fcebd618661b7a6c6

SHA512
53467107f6f0443854879d61135d73e04e387f9cc5e6ccd277732d582095eea9268d5ad6be1a8502421109ba77d86bb20d42efbe67b97d309b4c6c215b6575b9

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\Clipboard.dll

Filesize
14KB

MD5
b23bb3be1718e1aeefc3e822119692f9

SHA1
d4dabddf9b9d3f0b2adb86a3799f1cf9ec614d48

SHA256
5a70530748decb0c81fb9c912fd3d75d7d493fd67675bb7dbfe141c3fda15587

SHA512
d66697d97146148978aa5f46cc14232230e553842601cc0e3b0eaaf86f21e91f907153dc710405df7d1dc32d8120134886b29ec164738cef0fa7a827a2ae90a1

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\FileManager.dll

Filesize
27KB

MD5
d2c7a574a9b9df92366a981761d494ba

SHA1
d7d6c4674eac54102e61331fc116ac5abebf42ee

SHA256
f13aa0515a65a4701269a57183884846417688d1476c7252291ac5bf7149746b

SHA512
a876da49f048fffb0dc522d4f7471b1c1076fda327d7ad0282162b749375dc13797300f51ccb0b5d2327d6b6f6e0f75f3204a83a4a384108f1e34b7a179b0ce0

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\FileSeacher.dll

Filesize
478KB

MD5
21e5acae055bddd2ad584271d77f881e

SHA1
df3b8db334e5bce0597cea77a4770fad8d7db6fb

SHA256
557a215cec1a3df37da8a6798354e79a3a70f548f7955cfa43a2d75e1d037053

SHA512
52896aabc03595320370a1318749e899b451020f74cedc511b6daa618908bcaa4aee7d0b808a4df6721e2c1a4f93e2f84cea00179f0c7149dccbe6f155eb3dab

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\HRDP.dll

Filesize
1.7MB

MD5
e8130166c9f0919f0c94f989898a26b2

SHA1
3611474d473bad7474f8bea8e3277652d72cd3b4

SHA256
7d4b0d5cc5f09f26183aa34468b78b083ddd895802a41273583f45202a9a618e

SHA512
a444b8945dec63fa64452408cb0f3f95d5b60330b74f927df7e16feedad08862d164381a137bf2a14c42af5fe9eaa6813c2f8d1d44fcbe570eec3b7cecf12a8d

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\Informations.dll

Filesize
22KB

MD5
92ba1499b2547f0e38e26360f94101af

SHA1
71b9ac23eca1c0f50517631cffe59ec1950147b3

SHA256
0452d60d658a43929bf2d5bc049e2c57c2d61f58b6444bab88834c870305dfdf

SHA512
1106d4386cda5fe98736138e0e6a01fb2e234700a9e5ed61e2b6a59cdfc82cf82dc2486488944ad009ad34fb3a04b9894bd52fea52968741350b09c7975d4d9c

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\Keylogger.dll

Filesize
17KB

MD5
666290af0aade9cf9f377c5fdce9cba3

SHA1
d981466e4838b2bac54edf53548169124bdea145

SHA256
c2dc7f27304ad0b1a726b5784b030207b93765a8986c4a4f3999733097a4d43e

SHA512
23ccd8c1ea776a70637dad70ccea3f435d99c7465fe99a6d4f8f726f6c320081f5d7327f654bc0f7abf0389b6b95c55809f474c52ca2e3898e99efbe454e77d9

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\Maps.dll

Filesize
15KB

MD5
fef310962c772bbce74c9d9dd3516803

SHA1
bc3923626417961059688730b464a10fe4eb6115

SHA256
b1699235a5ea07dd6516230309f6d94c697d6f9db96ac664dd269aa471a56dcc

SHA512
389ed724fbcb298e5e302166725ceef7067d85e5d71c0a11267717584906c328686110c19ab5b275ee075e1b88b294c9a072c9d3ddef76e0759c584862622bef

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\Microphone.dll

Filesize
540KB

MD5
563090381b43ef273e0dae20ada50d0d

SHA1
acd5271cf0f959c09d940733a92fc8ee0ed434a6

SHA256
b04ce7ba6ce58408b53ef7d4ef84866539727a76871cb09fef99314711aabb57

SHA512
f0f172b6591766f4e13b7df29c51674f84e80cd7c8317b305519b54f635605b96402764a04cc600024d3cca11c46b5e041692eba3ac919f8f63dd73e08ba37ec

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\Options.dll

Filesize
29KB

MD5
90a1c5c0d1cd88b6fe390278c93c4530

SHA1
b4bec20a1c53e8255518505709a8947dcf7e13aa

SHA256
035f48b413cf328ddf2bada1b6afd5698f9b8cddf2bcc0187a97629f1063c042

SHA512
ade19d4160bee947a0df9b5bc0ecb4976c1e4ba848e9360b978429fd94aa39a00016107d3daefdc795e45bcb3717c9673fdc543ef544b3e11d92ecfc473c71e8

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\Pastime.dll

Filesize
17KB

MD5
787f48174c04f87346bdb09f5aff1d95

SHA1
18278dbb1102a3e0772c5661a51bef6f4965f688

SHA256
87baedbd864856f6fdd2ee4fb256842de326b1eea2f71a4fc1914402cdda1f07

SHA512
af26853c8372529f109220722045e2a920c5cb9dea5310e1f6fe7d30a8189c54725db743e228709bcef3e20b50325fed57089b044eb18164b4affdbc388fbe12

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\Performance.dll

Filesize
15KB

MD5
7ed248558ba25c9fb1eb55e2f1e1dd2e

SHA1
3f2f71f24f94861922b54f147992d6b94b85acac

SHA256
1f6fd6b09773fbd53c4eac5d0e77ef4e1be43872ee226983414e65141921d634

SHA512
2ffe3b5220cf6b92e1f3d2065ba96c685c1ef9ff28470afb5ad8e38b6f821514f4e69ba23caae2f46fa64d94fb8b8de061ca2c979e8c5ae32a5a2dfd046db427

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\ProcessManager.dll

Filesize
17KB

MD5
96f281e2deb206e3561f0a2dc881b44c

SHA1
a41ac27787d3e61302d8139874ef68aff89d3f97

SHA256
dc12cb5a2c0be8d6e7dd02c761022bc6b12cc6777d38eb7d529178c3d6adaecf

SHA512
9f8336ccd0ed5f6936c9f68527056da7a88e986d24ffcf19e3aca2537307b9cd9e315b55f56e7712b4e49f4442244280073eac4c7d7da7e8a10b4c8200f4ac48

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\Programs.dll

Filesize
13KB

MD5
b7ae0664d55bd6b3800871baf6139aed

SHA1
eccee8e082d9002e551efb8791d323c07ac8abaa

SHA256
221e1461a2c950336c0a25cb147d996578c1e9461824b750ca9a4f9d3be93cb5

SHA512
84b8d2f80ea9b1b6b4c4b952f18f9f226473a7e98205c2ca6d5bc6b5cf97ec58f0393f39fbb43bf1f1118da8c369c88b9ee6e228b7012d8953c0607e7dbadf4d

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\Ransomware.dll

Filesize
20KB

MD5
9f2c86036e8454b2322fb37297e2b119

SHA1
f54ff6b78099548592db00d8667ece62312e1bb0

SHA256
1727ba841000a1c6176bc285853b54904ea69944fa2d59e8daf66872dd4c1d92

SHA512
a3201c1378b5c6bc1e427f6aaa1637a197ad18a5b38f705d8dc09c73d19e568c5ee8534e844eaed35e5c83da6d1b7db93c9ccbb789845a60943bb8c790a7edbd

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\Recovery.dll

Filesize
496KB

MD5
3830944fe780e36b1a3c67dabae5c29e

SHA1
afd2b6852330f86ad16103ac17a471602dc2a8e2

SHA256
179dcd0bad17db8e467a40d7b57437461cdc3263090966a687bdd40b279e4df2

SHA512
615bbb13305029ee2aa131ecb8bc397c2a3217fcc7d9a49469f90f1104726ac2c00cc534d72c90cf1cb4f2c2b720e5740089179e23d3394a519236c79cc6cd4b

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\Regedit.dll

Filesize
15KB

MD5
68d1cd646b429ee4845934cadd05695b

SHA1
c971c853ff3b53e336ebd150562d5f696f092409

SHA256
9e8b3185dfb4605cf9e1df4403fafa36f12f484f4d9604541da0121403dc39b1

SHA512
348988df175382247348e6d1329c61e4dd54f724cb2a3c624df1d74827058e4c00aa5f5acc1430d0ed3d63148c603bb75b60487e97e22699986c1e630dce5e88

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\RemoteDesktop.dll

Filesize
17KB

MD5
971ef565c65f696214cb77b06e46c5e5

SHA1
7d72c0b772a9b681ae463c3999998d7db6604785

SHA256
8be2fb14b479ccdd9bc15beaf091a52df492882cb14b74f194a69e01eef8e94c

SHA512
de4326f2575c7dfbd57ca51947d6698d21a384a4e6a393c9765d5fb6874820e3512fa338cedf94aa199514b8de363a393eb6beacc0a54da9d25c29394b8f72fe

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\ReverseProxy.dll

Filesize
16KB

MD5
c929f13e3096b725eb1475b3aed0bf8b

SHA1
ba7b4f294f0b198399bccb926afbad2cde38a822

SHA256
922563d6198f0ea597a0c862f18d6ff9c2c2201608cef962b8cc064c46c796d9

SHA512
238bb09f7b51027de7622ba0450f648d9ab52d0e5a3497192584bc1320f54737bba473aef3844533a22dd4ce2699c01881b2d3920a520e6143b2ce6d11290969

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\Shell.dll

Filesize
15KB

MD5
940ddf611e72e90cc2ba9f50cf5b38ad

SHA1
15be3b300a07a2f883201e5d45a1c89d8ecdb707

SHA256
e9beffde0866bf4bc9e53cf4a748a96525a459c7c49d0ce6d2b542609563491d

SHA512
6c6c1fbde1ffda75671a90295bbe9f8c8f654b089696df894debdd4c372fe5f281e49a076fe3c780f0b10200b0481cc618c99570eaed96adc6a1fe223c4c7d88

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\StartupManager.dll

Filesize
189KB

MD5
83572e22aabf502e47478cbadc9f625a

SHA1
537696a5a47719e58be7fe65367294eae996b1fa

SHA256
c8fe07db19e5103384495a8d9636927cf8203e21e21cdbc61884829349a43f00

SHA512
3b41041df3edeaddfbc09484499fcb3df809c607a3e526422e3dbf8ab65f8f72c40fd652d7e39afca65c45ab29667c16403e15083b0ba218c2c10dc87f09c121

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\TCPConnections.dll

Filesize
16KB

MD5
d41b8051db33f2915a7fcadc3f23f194

SHA1
05367451b5ff4fa3ed68c5fba553e435bbd31f3b

SHA256
2193a674c4816fef54b2fabb6ab321265edfc4ae932769ae017c658afbb84790

SHA512
30010fa9cb101a26da0f4f1422e5489c36633c103da67c11509186d3a18780ecb6b26ee84f7dd7679f36734da1f6d62d49560071abeeeafdc43bd08b6f5ab0a5

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\UACBypass.dll

Filesize
12KB

MD5
682099d00c1da6604a2e26103915f0e8

SHA1
29b22d96a514a8ee69cb2a33b691a076eb598df4

SHA256
2151d5f96bde452c96d280b00b3a99629b3d74b3c7526e988ab179c57f7b3335

SHA512
8f14c821906bfdf7b70233fb5d7a4b101e831bf59af0f7b48f79e1c6edf3cfb5cc588defd92b40a77712e083a8bf7865e1f5408f041b97802036edcb81e51075

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\VB.NET Compiler.dll

Filesize
15KB

MD5
f5797fdad244c71defa5095dea05d66e

SHA1
72a7a6385f754af0650eda0fa809df7eb302d6f7

SHA256
69f3273c8a43cfdb2e282f02da2ed084e154e33497f788f65f58bfdae3d9aa94

SHA512
be569ac5c01a72568d46ee956c85202a8f033de2159f7466f5f724e2b325b7494af2462e33e184be46170067613e8be3db0c03575ff7e841dfd99dd434b0316b

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\Plugins\WebCam.dll

Filesize
209KB

MD5
e35f3b277027fc5f1206f45d49bd8690

SHA1
84ff7a255a6125e5db26ee30224355c9f78a1132

SHA256
cf4cc0a8559162b17fd3c2f99b272da6145c9a5afed527547e682e5fb33dabc2

SHA512
5cb7b61450250b5d1022eafbe64c98d9e7e40744b577e8ba1f2a6b814df09fa56f4ccc542cb2dadaa51f9942b15a5485a0f30033ed73628796331f0e2e5474b1

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\SimpleObfuscator.dll

Filesize
1.4MB

MD5
9043d712208178c33ba8e942834ce457

SHA1
e0fa5c730bf127a33348f5d2a5673260ae3719d1

SHA256
b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c

SHA512
dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XClient.exe

Filesize
33KB

MD5
ba02b49051e1acf93ac169e1086bde2c

SHA1
5acd2ad61c33b63b5b27c3c9941fcce57cb2c59d

SHA256
4a15723890095ecd4297625ed04dffacfc07a887c85eba0c971844f23a9cf0da

SHA512
53abcc0725ee81cec309084056ec144b5402585fc96e3b06437dca8da5369b3defc8a2784d8f15fbb5d9e6936c4e3bc04af7762d50bf3d94d4229d04d64729dc

Download Submit
C:\Users\Admin\Downloads\ZFy00Zb\XWorm V3.0\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0 Bin\XWorm V3.0.exe

Filesize
7.1MB

MD5
a3607b02e971c7ca441ac55aa4721a52

SHA1
c253f23fd3e8d2a62372930853341a9dd2e6eb98

SHA256
27e652193898971746450f86b547945b5cdb47cd6e9a095481ee5db32e9bbd0b

SHA512
5c02782a35470f20898bef2e6965a6e9cbe041cd66f66c41261d96163bc1e2badce0b747ec51607314826a89cd1c80788793adb987a22fc30bce0d02c03d99a5

Download Submit
memory/2088-204-0x000001697B9D0000-0x000001697B9E6000-memory.dmp

Filesize
88KB

Download
memory/2088-201-0x000001697BA10000-0x000001697BA5F000-memory.dmp

Filesize
316KB

Download
memory/2088-456-0x000001697BA10000-0x000001697BA5F000-memory.dmp

Filesize
316KB

Download
memory/2088-216-0x000001697B9D0000-0x000001697B9E6000-memory.dmp

Filesize
88KB

Download
memory/2088-249-0x000001696F5A0000-0x000001696F5CC000-memory.dmp

Filesize
176KB

Download
memory/2088-218-0x000001697EAC0000-0x000001697EC28000-memory.dmp

Filesize
1.4MB

Download
memory/2088-199-0x000001696FEA0000-0x00000169709B6000-memory.dmp

Filesize
11.1MB

Download
memory/2088-253-0x000001696F660000-0x000001696F6E2000-memory.dmp

Filesize
520KB

Download
memory/2088-457-0x000001697B9D0000-0x000001697B9E6000-memory.dmp

Filesize
88KB

Download
memory/2088-198-0x0000016953CA0000-0x00000169543CA000-memory.dmp

Filesize
7.2MB

Download
memory/2088-251-0x000001697EC30000-0x000001697EF12000-memory.dmp

Filesize
2.9MB

Download
memory/3756-307-0x000000001C1B0000-0x000000001C232000-memory.dmp

Filesize
520KB

Download
memory/3756-450-0x0000000000C10000-0x0000000000C1A000-memory.dmp

Filesize
40KB

Download
memory/3756-337-0x000000001C230000-0x000000001C26A000-memory.dmp

Filesize
232KB

Download
memory/3756-241-0x00000000004F0000-0x00000000004FE000-memory.dmp

Filesize
56KB

Download