Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
292s -
max time network
294s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
06/02/2025, 16:19
Behavioral task
behavioral1
Sample
Xworm-V5.6/Xworm V5.6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Xworm-V5.6/Xworm V5.6.exe
Resource
win10v2004-20250129-en
Errors
General
-
Target
Xworm-V5.6/Xworm V5.6.exe
-
Size
14.9MB
-
MD5
56ccb739926a725e78a7acf9af52c4bb
-
SHA1
5b01b90137871c3c8f0d04f510c4d56b23932cbc
-
SHA256
90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405
-
SHA512
2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1
-
SSDEEP
196608:P4/BAe1d4ihvy85JhhYc3BSL1kehn4inje:PuyIhhkRka4i
Malware Config
Extracted
xworm
5.0
127.0.0.1:7000
CiDnyVEGw2JEZ7Ym
-
install_file
USB.exe
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/412-216-0x0000000001180000-0x000000000118E000-memory.dmp disable_win_def -
Detect Xworm Payload 3 IoCs
resource yara_rule behavioral2/files/0x0008000000023cff-24.dat family_xworm behavioral2/files/0x0007000000023d08-36.dat family_xworm behavioral2/memory/412-38-0x00000000008B0000-0x00000000008BE000-memory.dmp family_xworm -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/412-238-0x000000001CC10000-0x000000001CD30000-memory.dmp family_stormkitty -
Stormkitty family
-
Xworm family
-
Executes dropped EXE 1 IoCs
pid Process 412 XClient.exe -
Loads dropped DLL 2 IoCs
pid Process 412 XClient.exe 412 XClient.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp" XClient.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 9 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Xworm V5.6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Xworm V5.6.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Xworm V5.6.exe -
Modifies Control Panel 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000\Control Panel\Desktop\PerMonitorSettings\ XClient.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000\Control Panel\Desktop\PerMonitorSettings\MSBDD_RHT12340_2A_07DE_FC_1234_1111_00000000_00010000_0^6E57C9F13ED851F87291CBEB2395B57E XClient.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000\Control Panel\Desktop\PerMonitorSettings\MSBDD_RHT12340_2A_07DE_FC_1234_1111_00000000_00010000_0^6E57C9F13ED851F87291CBEB2395B57E\DpiValue = "0" XClient.exe -
Modifies registry class 57 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings Xworm V5.6.exe Set value (str) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads" Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" Xworm V5.6.exe Set value (str) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff Xworm V5.6.exe Set value (str) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000 Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Xworm V5.6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2" Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Xworm V5.6.exe Set value (str) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Xworm V5.6.exe Key created \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff Xworm V5.6.exe Set value (int) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" Xworm V5.6.exe Set value (data) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff Xworm V5.6.exe Set value (str) \REGISTRY\USER\S-1-5-21-70482961-775596374-3727440602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" Xworm V5.6.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 4416 msedge.exe 4416 msedge.exe 4920 msedge.exe 4920 msedge.exe 3648 identity_helper.exe 3648 identity_helper.exe 5584 msedge.exe 5584 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2196 Xworm V5.6.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4920 msedge.exe 4920 msedge.exe 4476 msedge.exe 4476 msedge.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 2832 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2832 AUDIODG.EXE Token: SeDebugPrivilege 412 XClient.exe Token: SeShutdownPrivilege 412 XClient.exe -
Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 2196 Xworm V5.6.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 2196 Xworm V5.6.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe -
Suspicious use of SendNotifyMessage 49 IoCs
pid Process 2196 Xworm V5.6.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2196 Xworm V5.6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 704 2196 Xworm V5.6.exe 104 PID 2196 wrote to memory of 704 2196 Xworm V5.6.exe 104 PID 704 wrote to memory of 4388 704 vbc.exe 106 PID 704 wrote to memory of 4388 704 vbc.exe 106 PID 412 wrote to memory of 4920 412 XClient.exe 118 PID 412 wrote to memory of 4920 412 XClient.exe 118 PID 4920 wrote to memory of 4228 4920 msedge.exe 119 PID 4920 wrote to memory of 4228 4920 msedge.exe 119 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4028 4920 msedge.exe 120 PID 4920 wrote to memory of 4416 4920 msedge.exe 121 PID 4920 wrote to memory of 4416 4920 msedge.exe 121 PID 4920 wrote to memory of 5104 4920 msedge.exe 122 PID 4920 wrote to memory of 5104 4920 msedge.exe 122 PID 4920 wrote to memory of 5104 4920 msedge.exe 122 PID 4920 wrote to memory of 5104 4920 msedge.exe 122 PID 4920 wrote to memory of 5104 4920 msedge.exe 122 PID 4920 wrote to memory of 5104 4920 msedge.exe 122 PID 4920 wrote to memory of 5104 4920 msedge.exe 122 PID 4920 wrote to memory of 5104 4920 msedge.exe 122 PID 4920 wrote to memory of 5104 4920 msedge.exe 122 PID 4920 wrote to memory of 5104 4920 msedge.exe 122 PID 4920 wrote to memory of 5104 4920 msedge.exe 122 PID 4920 wrote to memory of 5104 4920 msedge.exe 122 PID 4920 wrote to memory of 5104 4920 msedge.exe 122 PID 4920 wrote to memory of 5104 4920 msedge.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\Xworm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\Xworm-V5.6\Xworm V5.6.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lstohte2\lstohte2.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESED88.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE56FA144B394482B86B7E7A746CE3AF7.TMP"3⤵PID:4388
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2544
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x150 0x3101⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:548
-
C:\Users\Admin\Downloads\XClient.exe"C:\Users\Admin\Downloads\XClient.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://exmple.com/2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa668a46f8,0x7ffa668a4708,0x7ffa668a47183⤵PID:4228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,13269385282391887406,4147563608826780233,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:23⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,13269385282391887406,4147563608826780233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,13269385282391887406,4147563608826780233,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:83⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13269385282391887406,4147563608826780233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:13⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13269385282391887406,4147563608826780233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:13⤵PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,13269385282391887406,4147563608826780233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:83⤵PID:2960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,13269385282391887406,4147563608826780233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4476 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa668a46f8,0x7ffa668a4708,0x7ffa668a47183⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13772429786154263903,5928156024016492431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:23⤵PID:5568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13772429786154263903,5928156024016492431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:5584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13772429786154263903,5928156024016492431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:83⤵PID:5712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13772429786154263903,5928156024016492431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:13⤵PID:1900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13772429786154263903,5928156024016492431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:13⤵PID:3456
-
-
-
C:\Windows\SYSTEM32\CMD.EXE"CMD.EXE"2⤵PID:6052
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3932
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3552
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4056
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a14ac0f6446ea636640cb43a2a0bff69
SHA1f73378373468d1cad3036a3dded21e7f6546f47f
SHA25697d47855aee9362a5aed2c976a9439411780b99b01e61ad46e1ef5bd993cc8ad
SHA512db3e37ecf799fe721fa07ee1ac6383b4381c2b96be10c6d12352472d3e13182ba4495d73742205d905c002bcd272f47eac46a0ae0433dfb19dbac85c3f889b35
-
Filesize
152B
MD51cf0dfad9d9a29927bdc2469d9eb63df
SHA15dd10aab460f4639de2fbdf3af142d5b99855fd9
SHA25656aa2a9fa655b9257cfe011ee02b7378a101d8bfb356515b7e3a7cfdd6c27fc9
SHA5123680a28b71f7ac434641b8c848d4900285f0794f2a9d259320556f5a8a346f6582ce72346f6a51ca1f25aa44fddf09778394aa16cb11c1f5f85a6bc756a07957
-
Filesize
152B
MD5ae2a8f2ebc841509f7b978edf590d3cd
SHA191358152e27c0165334913228005540756c35bd3
SHA256631550765e3db02be0709748c0634a2cfdab711cea94f5890854d0c1dfbcb214
SHA512e52180dd175f1e6ff72d76400085869387cd70da33919de219a04dc26871e8421e93b22e7c59125c19c6ee54a8a8f742d796ac68ea9077c9dab5f03b80967d11
-
Filesize
152B
MD59bfb45e464f029b27cd825568bc06765
SHA1a4962b4fd45004732f071e16977522709ab0ce60
SHA256ceb8f1b0aaa1ba575c3704e73fd77edf932d68c8be902b33f1ba3b1d130cd139
SHA512f87cce8bb5489b56027f5a285b948b639a1c7b0f213a111f057235177e5bffc537627c82586736704e398a0185cf2ad8ba8cdee788531fb753a2d08f16e906c7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD57afe5cc1d047facecb235b46e6640c5e
SHA165e2a1cfdcd244c00ae7100084128f59172734f8
SHA256944a4dc8d82f747d0f2beab7b2a57accd3d4a712634d005cb808b241f1fd078e
SHA5125708e0a2f674a0432d9bde3fae372efa68ba91d434ff5001db6c7fb0954daca840d2b98d50c56a4329ee340dd3d954eeb8eb538c8a08a9dc2cf2e2e5b153af63
-
Filesize
20KB
MD56c65ba7af3b185dc33de01d740b6f195
SHA16afe3f2e0ad62202c60ec4987ddbc23d3f0c6e31
SHA2562cbc6f827d8390ad27dde5e9f380e9c4998616446c018bf16936ed32a95ba23f
SHA512058cc1f1455054a71ad260558a0bde0ac65df7624284966e1b97e6a055f3000741f2311e79df6ea89414a12a25a4174dccec68c4e27bea46340192222410f9ac
-
Filesize
319B
MD5823f38e988f91b0f23f8736fdd77d5ed
SHA1145d9f7e3246968acc440fe1df9e735dd68bd2a2
SHA256933376deed99e5f9a984d64d8242a7ac0e610016098f188c28fda357d5283959
SHA512ac76109ce086e0f2017f98a3aff32e43716ccfb30beddbe539c88e20fda61684b4b1060e7696b6f2dd6129c1058a8279caf8e9d62ddccc351552eaeba852a0c9
-
Filesize
124KB
MD5fd65dec3ace5b63ddf269cc94b82fe78
SHA11c47c6fce2e41abacc6ac864b7de14660f0f6b2b
SHA2560c9c0694677b3ac6ab71627eec720b39b97c9e22b5cba2b69b958d40377fd0c4
SHA51256760bece73748144254fc90a1d5a0175ec2655bb40c9df92c57ae2127ff6fdfd161f9427d20401385c1213d5bc2bcb062d1e3ae110822f2a69020b85c2fb94b
-
Filesize
422B
MD5fc576b1aaf37a112d79b0ed55d31284f
SHA15672e7a84be34b0c5df9474ff80c48299b9ce063
SHA2569f0af0857f6f999effe9d78292eaaea8952b6ff29d6cfd32d94867fcd6d407a3
SHA5121c5ea4a4e7c36e443ee61dfe6c050cdf48aa339dc89121a68d41492ac364f5222ec271cddd4098c6f2e9d9f240424f5fe6b0b215c821b842674d07ccbeac4639
-
Filesize
28KB
MD5e6d7725a5bc8b4220f2fd240095e9183
SHA14712d99dde46ac1c5819b86f611e25e293ecf50a
SHA2564bef3166be0e5e990c5e04d4dc57e32cd5d4d01a7da7cd1cf2213f1927f1fb81
SHA5122760761ee67d98e13bd35b6eb26b93da8f22caa6f08466477f8c8ee6fb864a2ce0c7bc29d3b4c999b2109c337dc7abc2afb53ca343d520505834a3e9d4c2b157
-
Filesize
122B
MD55f2a38f8e18a6536a91f0b07ec3f13a5
SHA11d36d92c2a621f383057c58ce7cbdefa0fc17680
SHA256f156448afa74feb89b8fd15b9208b0538cbed141b49b0ed7ead77c0af816f7ec
SHA512c741316bcd1cdc23486ea2f094e68a2657c6ed46410fd85e16e98ed8df0f5da822b434df672b4d258693f58bb64100b956cd929648268811faf70057d94479db
-
Filesize
331B
MD5796dac1e2f623b92ba8dfa0fa36a6f0d
SHA151dfde1b2240cb6cc6d81714fb75ab3e97f9ec0a
SHA256acd506fc338931078314914c0a98b6a4928516d8a683d857e468d35a636b80c5
SHA512aaa3badb3608ee43fc46df8775e25584e08bf6009c2b3a1e3fe3c922e4ff4bd2de57e9819dc595253c76909641465e9691d81504524bd1fb16a0dfc1971feb09
-
Filesize
185B
MD5efa3b79297b792ddfa72609e2389407a
SHA17c959b0d9c508607119d7c112fe81939169c8ccb
SHA25604371cb7276a5868761433e311d805f97da580075fc9bf1a66f0a9d8ac9a4017
SHA5121f08b7ea9823ae979382586db83b05c0d0dc5cb565b3946fb8134c0dfaaf61fdf80d6c666ceca6522964ac446d2a2e798e1f0eaff3dd2ab5cae88a793db20eaf
-
Filesize
6KB
MD5549cf7175221da647f8c387c8e8a5f54
SHA1127ee09371ace8d0f538dad1275bf41ee602a44d
SHA25651deddc52759ed8393b8435740b55aca1a8769e158e4c3febf7060ccf4be166d
SHA5129e1a8db62a81e35de983aada1301bac37de02f7e3a6acd2358cb49a0b7602b4f3defb2c8194ea0487d3288189e0f4a64a1a5bec8aa3bc639228405e533b4a629
-
Filesize
6KB
MD53559f39f993230a6c5e507982ff0b99a
SHA195294909069c48f795b4778fadaca88d312865ae
SHA256f5f3f64e03ce59179a7b676150fdfbb094506091823da70e8d505442ff0a28b0
SHA51261f999d0570f117c096c3e179c66f4204d81af9937c1f78a874618e284745d56aa9071686545d921a41f314f92bdaa89bcc520a7bc2bd805f6e028c830218594
-
Filesize
6KB
MD599beab3220f623fcf7c8f8649bc38d46
SHA1a6e5a56bed77851392fcf5c0220956e66875f719
SHA25654e314d4c6e09dc252ac36122f5e3f81f8ba4707046c7b537d71b53af1f142c5
SHA5124cadef87d087c4353bc4da3a3d8ad9a561b112458ebfe5db93f6126759e9d98c462c8a4ec83a3463bd67abb86f2e9e9c3079d475244e74788baece2e2a48dd97
-
Filesize
7KB
MD5f5bda18d61c363095f9bb296d9945693
SHA1660c5d57509aa4cd05ca710c9f6f8200634a1a68
SHA256085d3132fcca99538be7d08ce4df49004aed45f50413309fdac7e18762272c34
SHA51227c84a78e27dcebe628a84aa440d5d6d676e69e0753fceeaabfa182207c4752b81ba2e5177c350667cb1c0838de6af4ac5783e9e479c8b1ee148ebb6a13e5ec0
-
Filesize
652B
MD5f07c0b8815c9f61b6029c9af694dfc43
SHA1c271ff78a4a5777feb9bb54db68cea5e15b943bd
SHA256b0a20d9637626ea56be20185a2d5db3ba454b59c41372489993c3bb10df27546
SHA51291d77b3ee50fccc7d74177db1198abcb3abcc79ed9e719b92cfc995ed9d1d148ee4bdc6752e11a05472340bd51d1819ff4813bc58c6392f3b1774f37de36b052
-
Filesize
319B
MD59de5aea6876da4b2f772997b33096d4e
SHA100b0edb2880326dafb9a07a8a8917fa881d88d31
SHA2562b7d7550a9b37cc48f584cda0a2d3b28ca3c26e22f19d65b62fbf02bd7b05719
SHA5121d2dc4eef6cff574fe94ab3d97813c27fa02a7c5e66876c0e4387f0624e333508a4de2100a13fc0a675c95119e9557d2e0b9854866815ed0f337cba61650e13e
-
Filesize
1KB
MD5447743d10d6f09886b3d2a9fb9c2f630
SHA16ddfca1aa3755e7476845e1a7692705822ebf925
SHA2561f8a02eeb1bbfd5e31c729645b440b9eb591f5579ee0c200018afd712c4544cf
SHA512c541bbf8857414d0c580416e7340d6f61aa1e9f26947bce47d6b55144614ab06217fe677f20eb001877f481ecc1517824a04e6dacd6261785072c809c5f27b12
-
Filesize
1KB
MD5041904577a2dc473bd391aba35a56094
SHA1eb4847a3a966f8d756cf8ef8cef1c4e38f36db57
SHA2560b3908ab340dd7036221e5b7990b66929e4d303d2b41167f1ef51441837282af
SHA512c178172cf6187c82b443e21170b0ad378d5e3efe73bbe7fecdcc6600a867ad3349134bfc5ecf72c98eaee1df894d4dc3cbfb6433103697377309a9b622567f4d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Filesize112B
MD5b0bc2c01b82c78556774193e33ebaff1
SHA17ad5e0b9f103a48173a73470b8ac81a34f6c4ff8
SHA2564f83b20ab4c0d4875a64fcad515e81700390fb7ed1b2ce04e33b1024775bec2c
SHA512c0f1d3c9a4c7c8cd22aceae485a18347250da53813adfe7f32f6bf19a36607a032d8387b97ca19471b667203d74a7d3fdbb20768720f1fc96aef0ca1ca58625b
-
Filesize
347B
MD5b5a3d8e0c956b20eb28c118c743ca42c
SHA1d66c6ae00724b28fea14a0ea88faaccda4f49032
SHA256a90da2e5547ea1ec4b8fd03447d63b8edf56b4a14d31ae8e4542f6e8a4f0a895
SHA512047ebf12ec36da5571fdffb2183c448b73dfed9d1e8e765a35790a37d7931e4262f997bbe13c922f20ecb5d8ebef11ea12e02c102e09bb6692072ff43e9913fc
-
Filesize
323B
MD5bf1bd16b1dca3c3c9644680c6e431a94
SHA194792f7591d9e83e3f1ea99ee1fcbd9a1b01edfa
SHA2563758c062ad7db614e5499bed39218dbf3df09661cc1b36314041017edecb60da
SHA512372625b31b6ef0a9ebbc727a16de05ee277c1508d928abc8b335a3426452025af223498f31778b72a680bd60168bb1927807954553d42b874589e0b6fd897682
-
Filesize
128KB
MD543816fe097c47b4bd31a18e26ae2407b
SHA13d4a331cbe02021d73bf4b159edd880e2cee20e5
SHA256a56b06ab71029a0862a0a64e3d8647759926c8e277c02a33d212dd975aba80aa
SHA512d4af80cbc450e8b853dc2bd692598d333524ff255d82ae0e7fb66a16553f01c7b76a494c7995168997f7a4210f654e4ddb964a82d0aaa56015fe74bf26460a20
-
Filesize
10KB
MD579732d96a035ea31ee2ad9b5bfeedf45
SHA1690234af8f3d80369143d50bebc9058ca2f90dc6
SHA256a049c92b20ef89e10e20c28e78ac57000528f4e4ef21858f6563d1da83dc8786
SHA512d3cffa3710f1e65a886604093b97c43801ccff0c5f3420690b025196637d6213557f02174b45aeb5aab1dfceaab2be4a03cbad2b45077ee125d769ff8c8b7b75
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f5e0cfa2-5c4d-4251-8fe2-ad115c022604.tmp
Filesize5KB
MD5d76d70f27ab1c978baf54cf65e616d54
SHA1036b373b7e7035a5d29de8966c3be472bc7f4733
SHA25617937592dbd55923811f649d47c860ab91aa1df18c1f9ed9f7d70324fae36459
SHA512e345362c2bc6c49890e26dd46a94b517c9c6bd30cc0c9ff28b59bee552aea55a9ae409ccd9b9ce06d4ac0f4e4047d07514a504964731f80f12c335496933b652
-
Filesize
44KB
MD5eb062f552680ab016b6fce3dc6b894bf
SHA1f61504ece39fd02ccfdb0042cee86e4f09ead476
SHA256819eb3a4581eea439a59b7e1e33b0796c856c2f5836141dd00cc2dc96e99b99a
SHA512edf0e8517b88a261b5f2e895384dbc81b525bd35f55b8d5b0604dbeda7efdf49fbd5f534bc7de57f913c281473ce97907eb8d95ddc32b9e35d3b57071ee9ccce
-
Filesize
187B
MD5be79bce26ff9314fb893231b8b45c8c6
SHA19708e6546d2617400aab8393a364d29df86945ec
SHA256873eba6e228a9475a9830a641b276e1e4528bcbe9361aab0c223d5f454dc94a3
SHA5122c9af95fab48177567ef9db18e5d7aa0e2432ee9f377cd20398b99d08c5addb085943f852b24da77b44d4048779d107580bab455af7d4666801b484c0331729a
-
Filesize
319B
MD58bfe617cdafe06fe2b4e1be8fd211dc9
SHA118a835ffca4a21f45c7bbf2b5b7157a39b67e5b3
SHA256146d1a9c1be6c0c09da42c0575dcf61b00860d8aad8d8559d91dcd30639d132f
SHA51250406fe4a41daf442366a372ee4837e3ab5fbe0108d6dc6514114be787262129a60eafc09196d0df419aca9a97c25e712386e3848353b4c07f6b3f3b86f91667
-
Filesize
594B
MD5ed1a9c71908eb50584d3d1ac678cfa57
SHA1c079d6a1591011425c28ad438d91ef6a50245883
SHA256b73364e030410e12fc6b84de28ac53cc4ee0f4bcccd41f3c167ede3d2cc4f293
SHA5125a4066447d270ad1fe0b1ed5dc3363709e13ee7eeacc1c4070c3b459fc31326e63351d7407fd6d973da8a06fb9a42559c4d4c63ba9e677293f75572fb4c8d54e
-
Filesize
337B
MD5731d44bd2aea618120b37cc963bb250f
SHA16191354d5f913d5794d3e73daf019b8b56ab6ebc
SHA2568fb33065a42348ed0567d14ec8478a4dae662dd4861e50315ee370b98093c0ad
SHA5128c3aa053a40a4c1b2427b1771c9e7acfe3f9bdd5c7821c9e20ef56eaf13357e14ae70f890c380479a8d4169c9467e7af715a18239137bc0f14af0b75803e650e
-
Filesize
44KB
MD5b3c588fa5001827c62d36cfa050fd509
SHA1a87ec7935bade72925e86deeb05e81992cded878
SHA25693b3aca897146d17bb2b8c1a1508f1b7df84b1b716a63d92d2ce3bdffcf0da1a
SHA5123c074f51e302577d83710f40e18a3aed471aa2d39d059701347236df05b5c6a811a7d82b6845190080cbcd82efb55cc6c7fbebf3741a5a70726e8cd4e60d7d57
-
Filesize
264KB
MD5cc6c39f94632e6f63e948ff07444d605
SHA1b2c2b9f17814385329ab78b78845b2fd0b1869ae
SHA2564f04f1831c56efcf014d90d4e448ad3e7a2aba6fc817e14bfe2908f6c5f7c600
SHA512954866967c1d2d00581a5662655e32edeffaff765d9ced20b6fbd09a7f6c5320d5d0d51010301adb46da53bc44290965bf657d69c7a6204f2af746545c728e98
-
Filesize
4.0MB
MD564b49d2295f3376486108b067fa98b7e
SHA10c82fa766ce73bdd0d894bb58ff1d748442480ad
SHA25680d4d078be0a7085487b9d7b9d1ee9f7a46346907ae64991adeeb9b2aae553b7
SHA512a82e2cea23f28d5b3e0044b4b23b0407b389d1779eec02dc004662a05617b50606fa5eb1a7fb31f9729307e60594dc31773df58eab48327e209e4b9229b72c21
-
Filesize
11B
MD5838a7b32aefb618130392bc7d006aa2e
SHA15159e0f18c9e68f0e75e2239875aa994847b8290
SHA256ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
SHA5129e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
-
Filesize
11KB
MD56032bef7098a171b81583d717382fa24
SHA13dd7227dce878838704d1fa45ca14f1598e3db05
SHA256f80b71a8cae840ca475a12fc2155a0eb7d785fcf02097fb0bb36237351e2ff3c
SHA512db74963e2636bce9f9a6b5dcf4514e30f28b00fb8544385ee964adbc002fef9e19e0bad130fe6db900b0b63726167812e05177c85826be3511e0cd70bd07dd3e
-
Filesize
11KB
MD58f7d563e248a1a5d9776401b33bc197c
SHA1fbd1ab37c79c3f4377fa81550d9f0855549cb0a5
SHA256dae5b27c4beed9e091dffc2a06eb18f3e427179cc2dc11445cd3b1940a9ab401
SHA5121f8aae99f1d9d3adbf01e49a054ffa387b4630f659c25b08d06d1e2c86f8b9ea6a2cd017ed732a357d3cd0237cca5f443413e5a67bf2f15cd7fa59e4f46c54ba
-
Filesize
10KB
MD57d9041411012494e390b4528c8648d8b
SHA1c49bce9cc82036b23eb54ae1105dbc8afd61e5fc
SHA256ceb0b6fde2e6da439fdc980997027278e7dfb3b5a160bbc5da7941f493bc9427
SHA5127408743eba9372491629a20eeb85e1b450ac5812eb17b33cecfb593bc510d25a34fd86c44769d448782f33c356893774c68e8e2d8a379287234ee810d2814586
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4B
MD590ad056a5be0c6ddf986931d45a8b34c
SHA1b4c469c2bb833e4aef40737017d32a5cbe1a924e
SHA2568e8d6b0952ce8a70fb08245162990376d29e0cbf0fc67e5ea37f00c858f9fccc
SHA512b70f138554cf2d534fff48a12aee01d0b6d0b1328d206c283b61b3cfa260a8bc16d97f4dd92beaa9c27b9774283934e5855fba62c12b7cba01fb2a4ec9767610
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Filesize4KB
MD52c2f46d402f245d331e390dc8603f982
SHA158787a6ebbe8e73fa965ab4d3825ab886e559784
SHA25607022ab182247fd838c87f8b108c50657a41f5947e6ec4d30804a552fb77ce6d
SHA51222932ad5760b25755c7504d424ec6971fbd0e080eae0a7701c73361266fe44d650cff4767bf774c3a15ae9216610831feb2bd65212b4b169f0507f53fbb7aa09
-
Filesize
1KB
MD5bbcbfc1914f15b392e3125311ec1a8af
SHA17c1d32c8660024e628744f570486e0a319c20c7d
SHA256a86af1dcf5b30a89281855acdec609f6c6b74ae06a9e8b1647e458de4c0e4f94
SHA512605e445d21e10d1e431c125c4f5731955062a35665acfde507f32ac94589e3091c040ef3e56c60fc099e41abd2b0d0747e8cd5d41c7c0a8686944e8f51403613
-
Filesize
78KB
MD5b7e903526ea5f41ba3351105df4d8b40
SHA1ac7da942d18c7968ff8d3d07162ff70f256c56aa
SHA256415d9f293de9ad5259e8da6e8a5b42cae725114d8e981d626e91e5c485975c68
SHA51243f7d193b1452a9c35cb7d35bcf4f5e1fd450945826aaa014dbdd6d5b7ccf7798bf2285fba6f08722fa8be8dc2a41da92826e9ac0cd6810b65683ca79fc7805b
-
Filesize
292B
MD5c7b1fd512153fadb0e13b27e5818d540
SHA1afeeb43a807975cba2cfd163ce9118423ee3afd6
SHA25633b3b49c917c9f096e78608f334e361c5b804b21b6cee8ca96612d039e9cc22b
SHA51252b3bd71592c61a033beda7a7807f7d985fe36aa1659fcd5d3a331332b9ddd990ea325b55c7adb42b5efcac9bf5b5001aece29b1487d61a8845985f53df4c110
-
Filesize
100KB
MD51b942faa8e8b1008a8c3c1004ba57349
SHA1cd99977f6c1819b12b33240b784ca816dfe2cb91
SHA256555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc
SHA5125aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43
-
Filesize
1KB
MD5d40c58bd46211e4ffcbfbdfac7c2bb69
SHA1c5cf88224acc284a4e81bd612369f0e39f3ac604
SHA25601902f1903d080c6632ae2209136e8e713e9fd408db4621ae21246b65bfea2ca
SHA51248b14748e86b7d92a3ea18f29caf1d7b4b2e1de75377012378d146575048a2531d2e5aaeae1abf2d322d06146177cdbf0c2940ac023efae007b9f235f18e2c68
-
Filesize
639B
MD5d2dbbc3383add4cbd9ba8e1e35872552
SHA1020abbc821b2fe22c4b2a89d413d382e48770b6f
SHA2565ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be
SHA512bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66
-
Filesize
32KB
MD5aabc7a8f1bbadb83d2330634c8ed36be
SHA14c46a7f30dca305b2a8907fd32d2a13d3f3b7ec2
SHA256f4eb002e9da242787c1e0bce55476f45ebfe9d890614141f2affff38d1dda853
SHA51253c7bb5a3f72d39042411c36713b2834a6b524cea046bcd4af88504ec23f33a1f8ccbe8e7cfca5c1473eae23164a4b0f646d2bcc6d182db7ca582ab98967693d
-
C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC
Filesize16B
MD5bd810ebaf2f00986b2fd4c13e69b8b25
SHA1fdb634851b8501049fa7e7fa9cd2eba535c02cd2
SHA256fa70ce905db76706e377ead3c7854b83b5cba7c57ca477b3715f71d9f2ae7b19
SHA5121f7e0cfdba93c24c8eacc754dbecfbe8f9de5eb0e69c10cebd87f2cf761417c6b1d053dd706e3790d9afdb1594c02832e91a041a236b0edd3a1bdc3f03c0e920