xworm | 9e0c79e062d3fc16c0c1599df4e8ae73dfe1fac6191766047831e7c3fcb6cf6b

Resubmissions

25/02/2025, 02:18

250225-crebnswnt6 10

25/02/2025, 02:14

250225-cnywxawk14 10

25/02/2025, 01:27

250225-bvjvwsslt6 10

Analysis

max time kernel
708s
max time network
673s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2025, 01:27

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

xworm.7z
Size

18.5MB
MD5

cceec836b15bfab2ce08828642145c32
SHA1

86742f0bbd6e29d4e62ca988c397093dc8d7a3f0
SHA256

9e0c79e062d3fc16c0c1599df4e8ae73dfe1fac6191766047831e7c3fcb6cf6b
SHA512

de44c7f423c27cbbcaedcddd0faf5b483e8337ade9e0f930e6c0ddbb174cd641bbb13ac5d762e025a701a6dc4fc768ed737d461a4ab5296d54f1c9dc2480f441
SSDEEP

393216:FqKeYOG5obypgrFXNDVE4cnsF/v3J3UaAi+ok2D4evUgKRGUG:FqVYOR2pgbD+4aQ3Ny8D7sgKRtG

Score

10^/10

xworm discovery persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:7000

Mutex

sR7B0GRcgGGndF2E

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

xworm

127.0.0.1:7000

Attributes

install_file
USB.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/824-1045-0x000000001D5A0000-0x000000001D5AE000-memory.dmp	disable_win_def

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023e01-276.dat	family_xworm
behavioral1/files/0x0007000000023e0a-286.dat	family_xworm
behavioral1/files/0x0009000000023dfa-437.dat	family_xworm
behavioral1/memory/824-569-0x0000000000AA0000-0x0000000000ACC000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Executes dropped EXE 2 IoCs

pid	Process
4780	Xworm V5.6.exe
824	XClient.exe

Loads dropped DLL 4 IoCs

pid	Process
824	XClient.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3160	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	XClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Xworm V5.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	XClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	XClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Xworm V5.6.exe

Modifies Control Panel 10 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\Mouse\SwapMouseButtons = "0"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\Desktop\UserPreferencesMask = 9e1e078012000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\Cursors	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\Cursors\ = "Windows Default"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\Cursors\Scheme Source = "2"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\Mouse\MouseThreshold1 = "6"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\Mouse\MouseTrails = "0"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\Mouse\MouseThreshold2 = "10"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\Mouse\MouseSpeed = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\Mouse\MouseSensitivity = "10"	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Microsoft\Internet Explorer\TypedURLs	Xworm V5.6.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133849206009060392"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0 = 7e00310000000000595a8c0b11004465736b746f7000680009000400efbe515a3578595a8c0b2e00000066e101000000010000000000000000003e0000000000bb0704014400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0\NodeSlot = "3"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0 = 6000310000000000595ab301100058776f726d2d56352e360000460009000400efbe595a8b0b595a8c0b2e000000ffe0010000000400000000000000000000000000000007a5ee00580077006f0072006d002d00560035002e00360000001a000000	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 7800310000000000515a35781100557365727300640009000400efbe874f7748595a8a0b2e000000c70500000000010000000000000000003a0000000000587de60055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "2"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Xworm V5.6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\MRUListEx = 00000000ffffffff	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\0\0\MRUListEx = ffffffff	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 5000310000000000515aa983100041646d696e003c0009000400efbe515a3578595a8a0b2e0000005ce10100000001000000000000000000000000000000dd450e01410064006d0069006e00000014000000	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "4"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Xworm V5.6.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
3780	chrome.exe
3780	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
4816	chrome.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
652	7zFM.exe
4780	Xworm V5.6.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	652	7zFM.exe
Token: 35	652	7zFM.exe
Token: SeSecurityPrivilege	652	7zFM.exe
Token: 33	548	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	548	AUDIODG.EXE
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe
Token: SeCreatePagefilePrivilege	3780	chrome.exe
Token: SeShutdownPrivilege	3780	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
652	7zFM.exe
652	7zFM.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4780	Xworm V5.6.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
3780	chrome.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe
1036	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe
4780	Xworm V5.6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 3336	4780	Xworm V5.6.exe	118
PID 4780 wrote to memory of 3336	4780	Xworm V5.6.exe	118
PID 3336 wrote to memory of 1836	3336	vbc.exe	120
PID 3336 wrote to memory of 1836	3336	vbc.exe	120
PID 3780 wrote to memory of 228	3780	chrome.exe	123
PID 3780 wrote to memory of 228	3780	chrome.exe	123
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2236	3780	chrome.exe	124
PID 3780 wrote to memory of 2100	3780	chrome.exe	125
PID 3780 wrote to memory of 2100	3780	chrome.exe	125
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126
PID 3780 wrote to memory of 2484	3780	chrome.exe	126

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\xworm.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4080

C:\Users\Admin\Desktop\Xworm-V5.6\Xworm V5.6.exe
"C:\Users\Admin\Desktop\Xworm-V5.6\Xworm V5.6.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\x55z223w\x55z223w.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD8ACFF5AF9C49699E9CD0F6816C948.TMP"
    3⤵
    PID:1836

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1140

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x468 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffad2ffcc40,0x7ffad2ffcc4c,0x7ffad2ffcc58
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2056,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1964,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2296,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2316 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3292,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3756,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4612,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4520,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4800,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4600,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4912,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3392,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5116,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3332,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3336 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1152,i,16470072896358665313,8557161946190578950,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3180

C:\Users\Admin\Desktop\XClient.exe
"C:\Users\Admin\Desktop\XClient.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
PID:824
- C:\Windows\SYSTEM32\MsiExec.exe
  MsiExec.exe /X{E634F316-BEB6-4FB3-A612-F7102F576165}
  2⤵
  PID:3256
- C:\Windows\SYSTEM32\cmd.exe
  "cmd"
  2⤵
  PID:3600
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3160

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1640

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\main.cpl ,2
1⤵
- Modifies Control Panel
PID:1140

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\GMap.NET\DllCache\SQLite_v98_NET4_x64\System.Data.SQLite.DLL

Filesize
1.6MB

MD5
1b1a6d076bbde5e2ac079ef6dbc9d5f8

SHA1
6aa070d07379847f58adcab6b5739fc97b487a28

SHA256
eaadfbcafd981ec51c9c039e3adb4963b5a9d85637e27fd4c8cfca5f07ff8471

SHA512
05b0cb3d343a5706434390fe863e41852019aa27797fe5d1b80d13b8e24e0de0c2cb6e23d15e89a0f427aaeaf04bf0239f90feb95bfc6913ca4dc59007e6659e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6141d16c-4605-4b86-848b-7fdec0067687.tmp

Filesize
10KB

MD5
cf63929f97477e58bfa71ed742a0afca

SHA1
ffaffe3bc52bc7bf58eb10db722140b35459d13f

SHA256
6550cfecf2848616eeba8982587f9a696d357f23e0cbcb6319c0bfd48b420540

SHA512
c8dd409e92edb184387b4b67c457d545b2c2e81fbf97c6a44c2c2ca03645f391dab449b04c6a7faa14aca2d7bb3873b3d1895b8f53e09b1e061829971e733bba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
d459f1b261340f46d114894bea76c09e

SHA1
3107179558fb36f590dd041f5323f00f530005f1

SHA256
cf04e9339ec8a0a04d605ee976400f18995c6ec2fb17a419cb2e3c0c8afa2271

SHA512
b22cf9ad8c5f1ab22874cd7ebb35b80fbf37c330e719780f4031876c2753bdc867626f233c572ed7322100c56ae853688e0babf469db2e0429f2e9cd95e190c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

Filesize
214KB

MD5
d20fef07db1e8a9290802e00d1d65064

SHA1
71befda9256ed5b8cd8889f0eeab41c50d66e64e

SHA256
f9cb4624d03224bfce50c4c0e484418acd462c249f38b4684e72b27a1f30144d

SHA512
ad5b2c8df60027c6dd5104bb8c2357b04eb24d69245c607ff99a6f2a887f929428252ad793d9aaa8c903c7b1e1bf9653cd35f79747d5281e7e3d2c21fa828537

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
47bbd1096a1c33d4d84666a736b6b229

SHA1
43bbcf68cfb0f80ede7501878f0cd09202fd2c7c

SHA256
a21c0517c250d801acfdec6806b7f443d08a35634be364ef2cd86c0fd446c7e9

SHA512
d8f7716a0fbee00b9a5b1ead3dbf15bfc54b9771295b99743bdb72367c5ef39159fd00ad2fb3316e50767169522e0bdeae2fe00c535182af0e4ed9fdb13387a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3d9ef7111694cf5c3b9ef8a5a6eec4df

SHA1
df370d4c142bf34627d4a151f35d776d6dc911ad

SHA256
41f13929dd220d7a3f6890f9f7bf2cdf7fdb21ad80b4b8c5c2b488207dd2c1dc

SHA512
fd51aa35741cae99a6bc670f4edad036cc3a45dd111db140c1dc1373c595aa155afba71aad16cfb7ee2c9d541b01d46e14b78743e3202b5525dff2ac71ecfca0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
d85125e967258459e5b15df70250bcb7

SHA1
bcc4def627deeef695412d7737006c22a90415f9

SHA256
6dddb3dc22856c55c8862fb7d769bdecdf75c68317362f9a29c6d6929796f8e4

SHA512
08ea717e79e42f5144a45c25c9c915c4c5c9976652df8253b2e2c91e53f0c54be5a8bb280fbeb10fc3f4a7b78573e7a37a18f2307e70320929c5a884e4209563

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
a8c51f3418ec6ba5bea8ee04d52786bd

SHA1
92ba184ab0800bcdbedb3ed3003b6cecc45c53a9

SHA256
741c9b92b3ae7d30a31f0e304f6c42be7a509740122a6357221d7204225ce8a5

SHA512
3649ef9ffb60d72d32266639f9ac5318d6c052bc7c5096d10eacae43089da6b66ffd836b192f8fd117d4958142052460f153370db881de8ebc57596015fdd89c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
858B

MD5
22929a3b2899f89f3c3eeb4c9778a94f

SHA1
367669bd8fc85593374a46d1d56b48ab269c9d40

SHA256
c458d24a5c5ec9cc0662babed8b3bd5602ea8eaf53d1104236f44107c345700a

SHA512
bd30dfff7496078a79261d96c53711cc47e8fbf62bcb51e8c562481c53f6523ab28ea6565bdafe7bd28bae8385ecb09446f309cd54f958487a0f01e0e45f77a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
733fe2289e9d85c679ef9c6bf8a80289

SHA1
fbade2ed40bbdac8f01abd3a7a7eef0a1f97bf14

SHA256
fc121b9d0b43bf78ce646add42cfef0def8313e15b432357abcb876e5c4e8684

SHA512
177893a91c9791537531b54d942161ba612ed932fdb26efce6d18229ae664254c7aa66e7b5232e11988d21f57fbf6e69c90f48b50a8210cb18c95904f34cfbb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c9e6441c8687615b0d5016d19d73955f

SHA1
52069c451ae35487a5f49a444e864173708b5e3d

SHA256
031345296988e2788f05ae8a106cd1260a0060e087b578880e064e0c065a53b8

SHA512
aa1e33c93020f731a9d52f15931fbb94ea425dbe81f7d88017c581a5e8a0ab62660569b5dfa95477aed05783ab0771e500ef203a8de79af7ab7333324a23690a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d35c9ee7b5a8dc55b7a9932934102d86

SHA1
1a8d2902665b962c1122d334085c64615354b9df

SHA256
71599a5c47cecae015be124ee43a0034f1d3f7b565e65b9d1120b0c5578dd7e1

SHA512
88427d2b70522dc15d98c63f9ed301c6725a655b38a65d55e81f9eee9f1394c6031be3d5ed43a4a6b3318a21cb47400a1dfae188a27c57a50a41b8d7b83e70cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
92650e64db855e288f6d81aa768bcc21

SHA1
cf6de6aed385ebf4f5504a551556b2930c73ad1e

SHA256
34d5c61fc88a2ba9d2116be3c1bbe8a9af3d9c18f79600aa65fb34f3e1dddab1

SHA512
390b6f30d778ed7670180762bd9a0001bec24a855bb4f926e0d302498b94b8dc404e5e7de3abac0d9e9522cdfd58f84c2f3e3a41ed8a9dd6042e13c4d5d4dc35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
83e10acdc51d6e81613b06286f599626

SHA1
a33f3dbceddb5410449787eea1dc1010cd076f6f

SHA256
46cc365603a9bc63650f387631533f8ed6a37be917d89d6bfd58ed574056d6db

SHA512
0c62364387f81ca8b9ff32096fac4cce62e9cbcd51544ca147488ff88de342bbe9cb1bd75142f8b2a07051ed4b691fcfabf49712db1b2cedfb070cf783927551

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5a2501665186c8b542e55f27b7ba5204

SHA1
e691c4da1c86837b9312ccb696eac579e842acff

SHA256
36a152cc5ea87769a15c192c09f2610b503091b8846d1c22af9ecbf45e3fb0e4

SHA512
f909444a7c6d4433a131cbc5426cc8f274ee27b14bec6e6c88e5acaefdb55d2233c8c3d641140baeae5248eb06fd38ae9fdd9cc68c263c218652c938e8774896

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9507ab72dd81984422844bec46aef74e

SHA1
16212fd3476114793eb9bf3704fd6ad035cff5ec

SHA256
b697a11ffb898ed9f5e648bb60331f5fd7e7f370bc7cea8f20e8c194677f6306

SHA512
a55f8bdc4892a73105118995a9772ff6779199a6b6506410c153d3d09982965b0f0be43a059ffd1744e3998b29b6a363c7249f038b3a32eec87b5876e2f85d33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
609892297d37316e249b62ae01c529fd

SHA1
8de1bed208f84c1c01abee1edf6bf36fbfe380aa

SHA256
fb5f9a8340520e48a7644e35c1a164088b11a82201e836bc5257b46ffa3e478e

SHA512
6964977eb2e6ca7b8c44407764dfb4c1c62ac1a12102d6b0e0ae09bb2fb8a7044b78974086c192c7903efcd2b2a3d66213c640631aeb0b5fcd20a214a0b01c11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
aaeacf593b12b7cf568b70bff21db184

SHA1
d3242af11d448d589d5c22d91e2551b1d2da12c6

SHA256
a7e772b3481ac5129a8058fa38b5633e63ab692e9d0c7b7233a42a1677a1293e

SHA512
714683e061eed61ff2247f28b406a2bb349c6676d8b8b2cb9f87c36814af19908dba7ae59aff4eab650c12190d3613d9a57c877323f16b0fb1a8029d04eafe86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8f82d8f29af375fbc5d7b98123421158

SHA1
8eb0b8b08509ca3ec4f205ce3980704db18983dc

SHA256
7a3da10a7e1833f55920d347f180b5f32677eb3b94b06bd50127d2e29fcf5f30

SHA512
2df7f77172744774fcbdebbcb9f659ccbd99576071bb93fa84ae9dd0b9c45ff58bac7f6c6cc92f86c5fcdb451bfab9a3ca0d855b64d40f724db23d9e7de93b02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7d99a5ce587f6e598ea7b2bbd3fb2efb

SHA1
7bd648d2b9f360c13f4486f6c0b0dfe2b1022b9a

SHA256
f8c26544f567495a7fa329a76bcd6f99558317ea17ad8f99b7029d4c7b1d6b1b

SHA512
dfb3ccbe96837d3e231a77fe9e7b47b41c0417b4ba14faf26930bbc09434592092f08cb1e1dc1c83a25430eece21faaa4ed7d73d3b91718b7e683d5d16444ed4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
00fd7ff8f24de84edde5da88c7369a0f

SHA1
391dc00e5fa01f3676ff93ba01aa95ea37961efb

SHA256
c7b00cbb190e54efa64db116533c8077043a0acf60c715a51ec7243fbe94d797

SHA512
613126725768a52c8257bd614ba4cb2a6a270de9642af0f63d5fc31f41ca53346b5956164659e98cb7b2e0e81147c7d99a29499c13459f99776fdca0f1e55ab1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a62aae9e76ddf528a2a718fe64a20185

SHA1
e6c65062dc52acd75e1ff7af7ff26912ffbe1e50

SHA256
1d7bd2f17e995466e773563bb6eb06685768bccb66dd2fad0deb3f566e550c35

SHA512
01bc160b8da69cfc9d1ef7bd4e5c4b2c8e78585812f832e31459214319cfa63a53b6292e526eda6c8a220861e06c6786ab3db569cd273c0c5d67f37a9c660ab9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1c10c336bfab21f10f13f4263c669398

SHA1
166cb1ce2ebe93a96d119feeb8105b20794bf84e

SHA256
9cd2532592144349f235cb9147193b0855e013cb20f935a883241dd3b7dc2841

SHA512
5ddaed5fad576235b52b8cd907bab6cec3f489d1d7f8db709e2fb338b61c2e35093fed0528feedcea0f06df10da2772fea9e83b24bd6321a99978a1a02c94521

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
227d5017664838bbc12a776986e9f0cc

SHA1
a216bf3fbcc4d1ce753b51aeeaf73e5ca5f662cb

SHA256
c774b775104bd62939a8663d83560f188e9e7c50bb75dfae03086f99a3ee6204

SHA512
1639834c70ab440edbe020c7797c11e9348ff45320c3613c7498c7501516710fea1708b4aa99998e387ac39220ce51d38cc89517303842553af884202cc310db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5da01b3c99717dcf373e9d70fb79dfaf

SHA1
75dac9c85cd592b33986d8ff624740fedc368d56

SHA256
3742116d600942c798c5584bc21b40bc8960d277789d2e3799b6a43e5c206b0b

SHA512
410e80a631d0dfab44a9713a35be9eb775f3b2adc8b42af5f9bf697ba717b1aea38e6ecbe4844c2251c93c87f7b6937dd8e73128828f862160029bcf9e4b724b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e1a47dc6f53833c9e1f15fcc77e0bf3b

SHA1
565fe03a5a39a4935165388e430308ac87abf050

SHA256
284cc45c5a55f6ca09d43210387aa500c66a57e7ca715d0be2d6c4540720edc2

SHA512
e00f86c0e3f711c331c98ebaf2bca81f591e18816c32c2d93a321b7ff48aa27fc3ba1261bab2a2bb14f5b69d585181664207a1c4bba297936ce58daa1d4c988a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7902c0ec774807756c497c4e8392b05d

SHA1
7631fe6c2110ac1c71004c0b93dff4facf43f4bc

SHA256
45238ef3cda15a679f328432b17efcf4172ed0b44fd9170187b7d93112a4db9c

SHA512
53f6a8012b33bcc4ecd2c1d1040929c7c3c0c760d05082bb3d707280fab7637d790d7303d95a54fc28d543bf15c6d075ee68899d3ebe7d8e5da65baf17ab1667

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
05dd8cdb13b5883f08312cd855ffd0af

SHA1
bb93ab0029f1d65a6c855d10c483547d7dc532cd

SHA256
059ec5ba833d0ea33fed71e33a8a9880fdf88ab9d3efdaa872e7e9fff7cf4b62

SHA512
20daaa57d75da123217a61ae754ef8c285cea0156eee23b6be0e255898b4326a24b62272a654446c6edb3152d8b02de19a3d112f47cbd728665aae9e80781f63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ff176cffeaa7774734a637804e8b3878

SHA1
e30c3d9ddaa54cd8e158b0b9e6fc7c5b569c88f1

SHA256
d2e791dd201410690ec64e3c6f5a17481b6983b403f3fd85ae8197e5553c5896

SHA512
13f181c8812b58c73da6f67fde557358b8a9f909c71764565b1f965436a65f76d636293a2251f97c599afef34e816fbff009d5108a734e17cbb111e0d9b4280a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
59be5f36c8bb3688ae26083f21d20d42

SHA1
e2dfc1d7cbf5186075f6bda3948f4deef97656d1

SHA256
ba9c9250cb5ffe9ccae3cbfb7cba988e55dfa2808f0f5c33e4d2995be814a84e

SHA512
3f3e6328c63eaf016c1b66f2ee9cabc49885d93a822c58e2e68724ddd5a26e8a129ce621751337135ccb0fc7271a54dc421fff686fceb094ec968aaf4bb66f28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
945407cda888d6c5f88746b7fa5fdad8

SHA1
782eab94beb0dae20f7502bf1c699424f884f61b

SHA256
946acdc3f900814e10b9f5b195d6c9c481f354533b6a249af4f0a8db59657247

SHA512
7228572f03917c3ae0fe99c3b8d5170bc63f025ff20cb898a63df0e0d9c5fece6e3437ba0bfdc8f7f0eb662cd682ff50083b51f55a5952cd4265187334c044c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
454e80d94e8572986fa9c9e80273df42

SHA1
80a355c33824187e5a5af654c71d46e88aca85da

SHA256
8f6ff48b0d2e7c6bb8c78dd9b492326d43981a8827d6e5b02e1351fe3ce40105

SHA512
10669ddc15d5d0ac456c09bbb89085f6c032ada678c4bd2276f5b776671e9d1a9f72f99b00302a6961d852e4d29e3c8476ec947040b682818391290137fd12b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1486a2f166607e296ba9d08466f4015c

SHA1
298d822a8f93ef3849535c1ab4686553a470d710

SHA256
aa3dfeb331f385caaa659920b0e31d41c1b20b722772b1be68c0b6f97739d998

SHA512
b50db5ce0359063a53fbbbc2648d65d5a255dec5647f4e03409807ccba34302e138d16a98ed94596c9bb0edc723289f1a0f908398547c36047a404e7746127ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
14233ab78dca394f4cc8bd8665c557ea

SHA1
67b641f86d62f6f0e95e69ea82449784c4ca37af

SHA256
f1b788180a218c0f5c4d400499ea3da4b0a96193989230fb16d92864639f292e

SHA512
131a1cf87c309486e2fb8d32f4b2aade6982c3e1ade6ee302c4a5a91e73d22438abbc7edd8aeb47da98ebb2dca61c3a4151c644423b7f548a4cce23bd209b4e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0596de98fdcda9e3e24e301286a0b988

SHA1
9fb8cf9f285a16a00a3d503b7393339cd8d04315

SHA256
681393655dd474bc99644b2cfe151675f4fef512b116927512a1f8aa04ac5828

SHA512
4b9dc6eeec18b3e0b4ae17628efaa1b8466e02bd5e23cf51de4a3595ef3da0df2bc1a6bb7b808a74a6a80a9b5e1a99aaf7871829cf5e5713cd1280dd4886ee8d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d76c0eb8290f57597059e5b3f0d0dcd9

SHA1
b552916b884f517fa82b9246ef295f611adaeb21

SHA256
feb4460a5dc1c9385e5a1b49f827bdd40db125920e1da6ceb549fdeab50024b4

SHA512
9d97b3c84a46b0c30bc2d55a698f9b4ace97cffd6ba1501bc495a0c948f68b6f0014854be19b3ca6fba25767437364fd6c4b0c1532e3ec5d6237d3abc8907d21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7495a973fe5430d83dafd410b648b581

SHA1
51ee4b3516d09f6b6472f7ffaf5f9d7e218552f9

SHA256
f05962c6f5c8bdc60fcbca8bcc72424f863551619ae2af1642ac480f152e84aa

SHA512
6520386a64e6ccd07cc089265c20dd2a29d53bc20c4f29fede36c61a19662fd5c041c65d8fa47e0bfda85056c9a9b638cd3810511448d67d48b225137304032f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1484278e4375ad0b75fe717fc4351aa2

SHA1
06e2576051482366581a52054f541dbe4addb9b5

SHA256
8444a7140aa9e4f6490c9b70a9bdf280671d38ab7fc0ca32ecfa61fa7ca893a2

SHA512
f5b5d2c294cf8be9170678ccc782735d4f5e993a80f47985e7cd64e705442bf3d22be273d11fb8403bee3d243116c333bb6b5fb43e2e68e911bad943d23ea8ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2f29b41879ce4480d2e8d7a822098414

SHA1
eb0e20ccabe900b7719ee775c038b95817a46469

SHA256
fefda09c92689ca0dd7f73d96aee7cf71f878b77ab0f580349d4170686f3b469

SHA512
0282f90cfc9be9716056470e1c7afff9b43e5b0f38248a169d70100955db6a68ddac481895430e649566d61a069fd1c577d6fba51f91739d7457018a9968eec6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
81e284d3c3da75f97d659e8f36921f4f

SHA1
be48f0f998af657f9aca61fcb7107767cbbfee04

SHA256
54efe384bf6027cef71bc1a1f4210a5c8c341c2fbcf6780a8901a9f477b6980c

SHA512
d510031f997212e363b4059668fd5b8a537dc1b36dbcf8297ec8528a466eea2495365d142c1d1938d1c36ce005be5a50c86653e5ba8b86f0783ae59483210084

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
14aa7314c9aeb50a8f66bbcff353371f

SHA1
58739921758899575ad8bce09a66caadee3be950

SHA256
0c162a6168c2b39ab9b5f0204ab6f3b3af18fdd89fc67b9f94de9febcf0b29c8

SHA512
8bf3ab5fadeaaaa7802261905b262d0d55862b194e1b9b890068885cbc4dde878439582dbd8fa93d1ac77adbb22c353d4ea430f0dae4b5fc2f39101d0cc8a448

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b3ff199fe26816ba1ce1db4100f63eec

SHA1
7b937e7ecf999d3895704bcbaf24af0d7f548463

SHA256
bc302dc9c91c0fa29be066fcbef97984cf7d1463214296e660608fef4d9e710b

SHA512
e8de561db06f79096122f352dc18b65a10290136a762e8c630dae8c56d04afabe24ab16ae354b5db40ee95bead7b672b697b5fad2189dcf9aedf5b9cd71ce1bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
900b19bfdd755911d8cb807cfa8ce1d4

SHA1
2032d965b3c29666a631b9d7f43ba3d707e91019

SHA256
afae203bcda347b9ee2ffb000f87c3d3cbd7f0c6c2e1b4aec3ff1945370bf015

SHA512
0f83533e291b12b21bedf3d0e3820cc328132ec4675e45bdf40b3e08a46f59c36023e894ee1775c1e93d528e0d0aab3b242011b01e4db49a668c206964c3a202

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
51e64da95ae1bbb5d3ae77bf04c2462a

SHA1
3b0f943190653e837efc20e4ef045a87cf838c25

SHA256
18559cb97525f3ddbdcecdb18033ed500a2f4dc699874050c2c57070da094111

SHA512
0a4aad3202440cad269ed0a54aa97c0d0e8be8f5cafa32365129bf48949a0d2f8aebc73bfe7fc9a1bdf8bf413a7c50a4e78553891d5d9a3484a5ae3297da2046

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f4992a3fea0abda0abc4809f7a77b4d9

SHA1
04491a2c8f0623e23597eec17e0c241383cb47fc

SHA256
16caf616deb7f05e8d95f694b9149e7b8aca55fe569baa8a2f2e43067c5540c7

SHA512
051574f718b639f4c7062d9c8089441bb390da959d3c0e9b31a1de798cf6ef5ed4f907689a4240e0f9d427dd035b69a51cc1bb495a950ebf0f1e3cbf5852aaeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7e81058456d68d788426f1dde013d9fc

SHA1
7ab98d0eef7fe0cf9e149b5ff18ded30ea89dca1

SHA256
02c9a356f61b3426cac7f67263ff5d3026d25bbc64b8b146b867dd66ca4d0462

SHA512
09fb097c43b60fc766364e212de1f55f3b4aeae053b23fca8801d56683fbb5de239ff297315c8b4c71497f4e33058ffc380140ab92037de5d68bf3abb03c4077

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
46c346f86f71f2104a8b1bbe9b2ac6cb

SHA1
795ea22ea64fbcfb30a4ca2032e08593b4f83957

SHA256
0dd76006f39fa6549f24d92f073ff46fb7249b1e196643396caa6b834648e62a

SHA512
a1be91567e8128c7680e9c4c87183e860c9c3e83b5a4940fdcc05f6b1dee5c257aa04e109c85001550eeba928e35746487bb6a825f57a611bc9d384c639b63a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
c4bd1e73eb54ecf101a525338ca267e4

SHA1
bbb8b0f65c74495527e38ed63b2efcfe4dd8d6df

SHA256
038f1151528b1c0e533fc3af44bddb09488116a36079f5053d9e49c2a3986a2d

SHA512
291eda2e6c6131a68564a404482a7bbc3d73b1f73c91d17c2c40a1f74d03f2238ef20bcd259a5c3ed53d1f82e59ed90b44bbd700b8f0f689ddad4b3c9ab4bcd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
14c3c1b153f0abccae86394f7d0b0529

SHA1
f70e06221af1708ea005a03e77c3490b8e0ed9ea

SHA256
e3ce6535cf58af8295e3ad72db303c156c75fed97a60a8416e5000c3955c169a

SHA512
a1944e501e253fc350504e5e9d846eb65d0315593a82506a9d611fa80cc048f48cda0909cb8ca0036e267a6773089f2b9e6dce0886df3e1de49a2474964fed99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
242KB

MD5
30ba7adaafca2e1e238837a8b6eee105

SHA1
b747cf63ca6536ff8fe24adf607c1663ad85f18d

SHA256
38c5e881972fb5f66c39850d87f16faef1d322f8afa393f4b39153bf87d019e7

SHA512
140a352094fbd176ff26d5b6105f90fcc3720de7676ffe89daee836cac640d591486d03289a85c9fb9a0be302c650bb6bcfb6117ff09c549878e537d8ce652e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
242KB

MD5
f85d722717cd82c1009e2123c9a553f7

SHA1
d5b45e0353f4ea7a96705b31405012da78f58ea2

SHA256
ca5c5841927b29a4a318c0359d952129e8c27d02b14f98cc30d7235b84663f4f

SHA512
0cd7fcc40c2e657078239ba30a623015dfffd83c5067b9da96ccfed2a31747b4fab52b1ba07d27190de62736fe068600fd3265534209741eac9729db8d138fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zEC82D3BE7\Xworm-V5.6\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2E4.tmp

Filesize
1KB

MD5
8ffdad3f0ece728988eb3d43d36e1be4

SHA1
63e57bf468aa59484935bcec8745324f1b330828

SHA256
7ab574dd3ba17e8745d440ee912d4992aa64b71f1d24015ed6359c09dda00518

SHA512
7c427d35f8260f6388bbff23b526a78b3d0241194e0483c1d6c4c6cc6cacc5fe4ef21689125fe4877a03b8c99e88c78ba88d210016bc2d6d7049e91ef5846cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcD8ACFF5AF9C49699E9CD0F6816C948.TMP

Filesize
1KB

MD5
d40c58bd46211e4ffcbfbdfac7c2bb69

SHA1
c5cf88224acc284a4e81bd612369f0e39f3ac604

SHA256
01902f1903d080c6632ae2209136e8e713e9fd408db4621ae21246b65bfea2ca

SHA512
48b14748e86b7d92a3ea18f29caf1d7b4b2e1de75377012378d146575048a2531d2e5aaeae1abf2d322d06146177cdbf0c2940ac023efae007b9f235f18e2c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\x55z223w\x55z223w.0.vb

Filesize
78KB

MD5
bb0b4aa9ae59df9332f520700461c667

SHA1
c8f84989b41bc227dfcb64cfa1a090c8a7a6f678

SHA256
a64d0cf9b299928583b774a039d8f174d991dad6858bca730092a8f08908c807

SHA512
4df66d5737d15f19ea8777a8349fe39368f4af5c0ad7dc0ab425d223dbc6c3e91ca04978f10ff081672c5fe61ad533683409579aff81f3335b27649e2270e57b

Download Submit
C:\Users\Admin\AppData\Local\Temp\x55z223w\x55z223w.cmdline

Filesize
290B

MD5
bfe62616686010755852ea8bb5356450

SHA1
f94e26c8249f0bc7409f221177e5ffc08169289e

SHA256
3c034196f047dd9fd45a15dcf5de8d7a256c60cc99dfddbbd21a2210ed420fb8

SHA512
0f27e1f855b7e5ec8b74c026f8b8cb4cbb6b50fe7f8a1113c73c0ff891dd8a137cc96e7951fd432494b3f08c67f9157a3fa4b2bcef0094968858e6e241f1d7fb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_67DDF70FDDEE4C4E841988C1DD5D2736.dat

Filesize
940B

MD5
a862f367f0d80e38c4036646a9501023

SHA1
5d7861a0d159a17b5a86473d5e28e3aca696a93e

SHA256
a1b3ab0c911acd908a53fb2c207ffbbc1cd9d3449ac1bc540a2823d71b817e17

SHA512
56d82ec358c5e04a8b1f00592a0d34457c1f316e89f59bf78663045428a5c21202ec7961e4dba5eadce75b97e2c313bdb74ae044165721315b3e59ecd282695c

Download Submit
C:\Users\Admin\Desktop\XClient.exe

Filesize
32KB

MD5
6b57b266ac5ceb553e9efb255019b2e2

SHA1
2f491de0107e677b0869b87c063b1aeb3b0499fe

SHA256
a931dad6d52e6685c606496895638f34b09188961b6cd67a3fde8c1327ce224e

SHA512
1b19b4d863c60bda8f6a1946e3ce9d70497342e80f329abc580c6ce477c9f4a1b71032aa806e6345c86e82aca94ca8ceca159f4ae4aa0f788d95b629888127b3

Download Submit
C:\Users\Admin\Desktop\XClient.exe

Filesize
155KB

MD5
8bbffe2f47bcbb7e7386f06f077dcab2

SHA1
a36c4d9a13dc568ea0b509f15984e85e322f33c9

SHA256
d239c36a1af8dda4d0aab6e9cae23633a1d402ef8b6b7d2a991ea1d896ccbc96

SHA512
5cf309a5c12564d0112f3f9bfe4df469942c9629c6e2ec267d33935c8c220bb413349b393def909017c1a4c08fabcced77c2dad73b7d02d077683c14d778e757

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\GMap.NET.Core.dll

Filesize
2.9MB

MD5
819352ea9e832d24fc4cebb2757a462b

SHA1
aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11

SHA256
58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86

SHA512
6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\GMap.NET.WindowsForms.dll

Filesize
147KB

MD5
32a8742009ffdfd68b46fe8fd4794386

SHA1
de18190d77ae094b03d357abfa4a465058cd54e3

SHA256
741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365

SHA512
22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\GeoIP.dat

Filesize
1.2MB

MD5
8ef41798df108ce9bd41382c9721b1c9

SHA1
1e6227635a12039f4d380531b032bf773f0e6de0

SHA256
bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

SHA512
4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Guna.UI2.dll

Filesize
1.9MB

MD5
bcc0fe2b28edd2da651388f84599059b

SHA1
44d7756708aafa08730ca9dbdc01091790940a4f

SHA256
c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

SHA512
3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (1).ico

Filesize
97KB

MD5
4f409511e9f93f175cd18187379e94cb

SHA1
598893866d60cd3a070279cc80fda49ee8c06c9b

SHA256
115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f

SHA512
0d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (10).ico

Filesize
115KB

MD5
ad1740cb3317527aa1acae6e7440311e

SHA1
7a0f8669ed1950db65632b01c489ed4d9aba434e

SHA256
7a97547954aaad629b0563cc78bca75e3339e8408b70da2ed67fa73b4935d878

SHA512
eee7807b78d4dd27b51cee07a6567e0d022180e007e1241266f4c53f1192c389be97332fcd9f0b8fda50627b40b8cf53027872304a68a210f4d754aa0243b0c2

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (11).ico

Filesize
9KB

MD5
1c2cea154deedc5a39daec2f1dadf991

SHA1
6b130d79f314fa9e4015758dea5f331bbe1e8997

SHA256
3b64b79e4092251ebf090164cd2c4815390f34849bbd76fb51085b6a13301b6d

SHA512
dceebc1e6fdfe67afebaef1aff11dd23eda6fae79eb6b222de16edebdfebd8e45de896e501608254fb041824080cb41c81ac972032638407efc6bfeb930bfd00

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (12).ico

Filesize
9KB

MD5
4ea9ab789f5ae96766e3f64c8a4e2480

SHA1
423cb762ce81fab3b2b4c9066fe6ea197d691770

SHA256
84b48ca52dfcd7c74171cf291d2ef1247c3c7591a56b538083834d82857fee50

SHA512
f917059b6f85e4a25909a27cad38b1ef0659161c32df54860226ff3d858127d8da592ea9072ad41d5a9986dd8c04a37e9ad34e2251883a8c2f0933e6aa201414

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (13).ico

Filesize
361KB

MD5
e6fec4185b607e01a938fa405e0a6c6c

SHA1
565e72809586e46700b74931e490e2dc1e7e3db1

SHA256
2e2f17b7dd15007192e7cbbd0019355f8be58068dc5042323123724b99ae4b44

SHA512
13daeb2bf124e573590359f18a1d962157dc635a88319c9ed1a2e8ccad6322fb081579e1e8fbe62ffe55c8286c2bc8acb251d572a4beb00641ad5009a380e513

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (14).ico

Filesize
361KB

MD5
0c24edec606abda7c6570b7dcf439298

SHA1
4478a102892e5eb4bb1da8e9c62d17724965691a

SHA256
8fc693238afc49a8098dac1762bfae891e818bb84749c6eef5f1b0c6c8ffddb2

SHA512
f8de3ffb8f9fe1394b3626ae5616213d4612b43f0635fa9053d74ac6fe536657e796289487f245b8abff74f1de8368c0df8e56bf21f540366ed86a378649ea24

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (16).ico

Filesize
97KB

MD5
14465d8d0f4688a4366c3bf163ba0a17

SHA1
9f1fa68a285db742e4834f7d670cae415ce6b3b6

SHA256
3f3c5ce486e5b9fa88dc60b60916053e8808c69167df1a11287fd3cd6db1ca6e

SHA512
01db4fac75136baf9c162265785877b21fba9c4b8d9dbe4e495191f15aa9c914e3d5baf1c4606041279a7138c7e5c8f4ccf6e64689354fc3fb3fa66ab3b1da2d

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (17).ico

Filesize
66KB

MD5
167425a3fa7114b1800aa903adc35b2a

SHA1
601e8bd872ea31aff03721a0361e65a57b299cad

SHA256
12f600b09c0db00877684a950fc14936ecc28df8f0ddc6821d68e4b82077ad92

SHA512
586ce1360eb06f1df8e95ad178abfae7c9d41cba1be55276b3d3947d0504ca09185e543b7dbf1ba72dde4942ff626859a6d2e8a1faaaf6c5daaebd8740dcf538

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (2).ico

Filesize
112KB

MD5
f1463f4e1a6ef6cc6e290d46830d2da1

SHA1
bda0d74a53c3f7aaf0da0f375d0c1b5aca2a7aaf

SHA256
142b529799268a753f5214265c53a26a7a6f8833b31640c90a69a4ff94cee5ec

SHA512
0fa93d009cc2f007d19e6fdda7ebe44c7ed77f30b49a6ef65c319133c0570ab84f2d86e8282b5069d7f2e238547722ac3966d2fa2fae4504133f0001a0387ae2

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (3).ico

Filesize
131KB

MD5
a512719efc9e6ecc5e2375abceb1669a

SHA1
51fae98edfab7cd6b6baac6df5ecbda082eeb1db

SHA256
b2f7fb22cd5b935cf19a2f58f7fef9db99db40772ff4bb331a73c345161c2574

SHA512
e0153dbc8f3fdda8d1a7082bc30a3895d7f4b3bc2982b4b4ece55653d1b4c293eba3ba6d4a0a581f0f7db95ab287d6616ef7bf03af4485904111798bf9d9e625

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (4).ico

Filesize
125KB

MD5
9c053bef57c4a7b575a0726af0e26dae

SHA1
47148d30bc9a6120a1d92617bf1f3e1ba6ca1a2c

SHA256
5bb21d6c04ed64a1368dace8f44aff855860e69f235492a5dc8b642a9ea88e41

SHA512
482d639ba60f57827d8a343f807f4f914289c45643307efaa666b584a085fe01ac7892252f41b7756fde93d215b4f3fed16e608bc45102d320d77239fa93146a

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (5).ico

Filesize
100KB

MD5
9dbdd6972e129d31568661a89c81d8f9

SHA1
747399af62062598120214cef29761c367cfd28a

SHA256
45c85bdaaf0e0c30678d8d77e2585871ea6d1298ee0d30037745bacea6338484

SHA512
e52572de3f0d57d24a24d65eca4ff638890ccc9c5aca3f213ff885eda3c40de115849eb64c341f557d601f566ce21f8fc0df25cc4b13aaad5e941449a6b7f87d

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (6).ico

Filesize
106KB

MD5
d7c9666d30936e29ce156a2e04807863

SHA1
845e805d55156372232e0110e5dc80380e2cb1e5

SHA256
6ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5

SHA512
3cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (7).ico

Filesize
164KB

MD5
7891c91d1761dc8a8846d362e6e31869

SHA1
0229bb01b7b4a0fca305eb521ec5dfbaa53674ea

SHA256
29d38c75af79aa0554f34cdfecb311f88f8dd02b02facaa299b9700841806ab8

SHA512
ed14614a706da985566853dc13df0d1128a718f39ec9957320813803fe07e59de337d51033970e2f57d9f56da3546c506f5f0f3becfa91ce741576855be14ba7

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (8).ico

Filesize
108KB

MD5
af1739a9b1a1bf72e7072ad9551c6eea

SHA1
8da0a34c3a8040c4b7c67d7143c853c71b3d208d

SHA256
a65cbbdc2ca671a9edd7edac0c6737b3b116e357727e003e5fdeff163c6c21ab

SHA512
eeeac307371c38b75e256083c55a3fe4ab096c1c7520a4b7acb40fad3af5a0d6c88aaf85f2c3e418034abee422c2a3ba13731adf7ee6078016da4dd2e989b120

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Icons\icon (9).ico

Filesize
264KB

MD5
3e24e40b41ecc59750c9231d8f8da40b

SHA1
91a701cf25aea2984f75846b6c83865d668ccad6

SHA256
bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80

SHA512
fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\NAudio.dll

Filesize
502KB

MD5
3b87d1363a45ce9368e9baec32c69466

SHA1
70a9f4df01d17060ec17df9528fca7026cc42935

SHA256
81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451

SHA512
1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\ActiveWindows.dll

Filesize
14KB

MD5
5a766a4991515011983ceddf7714b70b

SHA1
4eb00ae7fe780fa4fe94cedbf6052983f5fd138b

SHA256
567b9861026a0dbc5947e7515dc7ab3f496153f6b3db57c27238129ec207fc52

SHA512
4bd6b24e236387ff58631207ea42cd09293c3664468e72cd887de3b3b912d3795a22a98dcf4548fb339444337722a81f8877abb22177606d765d78e48ec01fd8

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\Chat.dll

Filesize
18KB

MD5
59f75c7ffaccf9878a9d39e224a65adf

SHA1
46b0f61a07e85e3b54b728d9d7142ddc73c9d74b

SHA256
aab20f465955d77d6ec3b5c1c5f64402a925fb565dda5c8e38c296cb7406e492

SHA512
80056163b96ce7a8877874eaae559f75217c0a04b3e3d4c1283fe23badfc95fe4d587fd27127db4be459b8a3adf41900135ea12b0eeb4187adbcf796d9505cb8

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\Chromium.dll

Filesize
32KB

MD5
edb2f0d0eb08dcd78b3ddf87a847de01

SHA1
cc23d101f917cad3664f8c1fa0788a89e03a669c

SHA256
b6d8bccdf123ceac6b9642ad3500d4e0b3d30b9c9dd2d29499d38c02bd8f9982

SHA512
8f87da834649a21a908c95a9ea8e2d94726bd9f33d4b7786348f6371dfae983cc2b5b5d4f80a17a60ded17d4eb71771ec25a7c82e4f3a90273c46c8ee3b8f2c3

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\Clipboard.dll

Filesize
14KB

MD5
831eb0de839fc13de0abab64fe1e06e7

SHA1
53aad63a8b6fc9e35c814c55be9992abc92a1b54

SHA256
e31a1c2b1baa2aa2c36cabe3da17cd767c8fec4c206bd506e889341e5e0fa959

SHA512
2f61bcf972671d96e036b3c99546cd01e067bef15751a87c00ba6d656decb6b69a628415e5363e650b55610cf9f237585ada7ce51523e6efc0e27d7338966bee

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\Cmstp-Bypass.dll

Filesize
11KB

MD5
cf15259e22b58a0dfd1156ab71cbd690

SHA1
3614f4e469d28d6e65471099e2d45c8e28a7a49e

SHA256
fa420fd3d1a5a2bb813ef8e6063480099f19091e8fa1b3389004c1ac559e806b

SHA512
7302a424ed62ec20be85282ff545a4ca9e1aecfe20c45630b294c1ae72732465d8298537ee923d9e288ae0c48328e52ad8a1a503e549f8f8737fabe2e6e9ad38

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\FileManager.dll

Filesize
679KB

MD5
641a8b61cb468359b1346a0891d65b59

SHA1
2cdc49bcd7428fe778a94cdcd19cabf5ece8c9c0

SHA256
b58ed3ebbcd27c7f4b173819528ff4db562b90475a5e304521ed5c564d39fffd

SHA512
042702d34664ea6288e891c9f7aa10a5b4b07317f25f82d6c9fa9ba9b98645c14073d0f66637060b416a30c58dec907d9383530320a318523c51f19ebd0a4fee

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\FilesSearcher.dll

Filesize
478KB

MD5
6f8f1621c16ac0976600146d2217e9d2

SHA1
b6aa233b93aae0a17ee8787576bf0fbc05cedde4

SHA256
e66e1273dc59ee9e05ce3e02f1b760b18dd296a47d92b3ce5b24efb48e5fb21b

SHA512
eb55acdea8648c8cdefee892758d9585ff81502fc7037d5814e1bd01fee0431f4dde0a4b04ccb2b0917e1b11588f2dc9f0bfe750117137a01bbd0c508f43ef6a

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\HBrowser.dll

Filesize
25KB

MD5
f0e921f2f850b7ec094036d20ff9be9b

SHA1
3b2d76d06470580858cc572257491e32d4b021c0

SHA256
75e8ff57fa6d95cf4d8405bffebb2b9b1c55a0abba0fe345f55b8f0e88be6f3c

SHA512
16028ae56cd1d78d5cb63c554155ae02804aac3f15c0d91a771b0dcd5c8df710f39481f6545ca6410b7cd9240ec77090f65e3379dcfe09f161a3dff6aec649f3

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\HRDP.dll

Filesize
1.7MB

MD5
f27b6e8cf5afa8771c679b7a79e11a08

SHA1
6c3fcf45e35aaf6b747f29a06108093c284100da

SHA256
4aa18745a5fddf7ec14adaff3ad1b4df1b910f4b6710bf55eb27fb3942bb67de

SHA512
0d84966bbc9290b04d2148082563675ec023906d58f5ba6861c20542271bf11be196d6ab24e48372f339438204bd5c198297da98a19fddb25a3df727b5aafa33

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\HVNC.dll

Filesize
58KB

MD5
30eb33588670191b4e74a0a05eecf191

SHA1
08760620ef080bb75c253ba80e97322c187a6b9f

SHA256
3a287acb1c89692f2c18596dd4405089ac998bb9cf44dd225e5211923d421e96

SHA512
820cca77096ff2eea8e459a848f7127dc46af2e5f42f43b2b7375be6f4778c1b0e34e4aa5a97f7fbabe0b53dcd351d09c231bb9afedf7bcec60d949918a06b97

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\HVNCMemory.dll

Filesize
39KB

MD5
065f0830d1e36f8f44702b0f567082e8

SHA1
724c33558fcc8ecd86ee56335e8f6eb5bfeac0db

SHA256
285b462e3cd4a5b207315ad33ee6965a8b98ca58abb8d16882e4bc2d758ff1a4

SHA512
bac0148e1b78a8fde242697bff1bbe10a18ffab85fdced062de3dc5017cd77f0d54d8096e273523b8a3910fe17fac111724acffa5bec30e4d81b7b3bd312d545

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\HiddenApps.dll

Filesize
45KB

MD5
ba2141a7aefa1a80e2091bf7c2ca72db

SHA1
9047b546ce9c0ea2c36d24a10eb31516a24a047d

SHA256
6a098f5a7f9328b35d73ee232846b13e2d587d47f473cbc9b3f1d74def7086ea

SHA512
91e43620e5717b699e34e658d6af49bba200dcf91ac0c9a0f237ec44666b57117a13bc8674895b7a9cac5a17b2f91cdc3daa5bcc52c43edbabd19bc1ed63038c

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\Informations.dll

Filesize
22KB

MD5
67a884eeb9bd025a1ef69c8964b6d86f

SHA1
97e00d3687703b1d7cc0939e45f8232016d009d9

SHA256
cba453460be46cfa705817abbe181f9bf65dca6b6cea1ad31629aa08dbeaf72b

SHA512
52e852021a1639868e61d2bd1e8f14b9c410c16bfca584bf70ae9e71da78829c1cada87d481e55386eec25646f84bb9f3baee3b5009d56bcbb3be4e06ffa0ae7

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\Keylogger.dll

Filesize
17KB

MD5
246f7916c4f21e98f22cb86587acb334

SHA1
b898523ed4db6612c79aad49fbd74f71ecdbd461

SHA256
acfe5c3aa2a3bae3437ead42e90044d7eee972ead25c1f7486bea4a23c201d3a

SHA512
1c256ca9b9857e6d393461b55e53175b7b0d88d8f3566fd457f2b3a4f241cb91c9207d54d8b0867ea0abd3577d127835beb13157c3e5df5c2b2b34b3339bd15d

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\Maps.dll

Filesize
15KB

MD5
806c3802bfd7a97db07c99a5c2918198

SHA1
088393a9d96f0491e3e1cf6589f612aa5e1df5f8

SHA256
34b532a4d0560e26b0d5b81407befdc2424aacc9ef56e8b13de8ad0f4b3f1ab6

SHA512
ed164822297accd3717b4d8e3927f0c736c060bb7ec5d99d842498b63f74d0400c396575e9fa664ad36ae8d4285cfd91e225423a0c77a612912d66ea9f63356c

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Plugins\Programs.dll

Filesize
13KB

MD5
a6734a047b0b57055807a4f33a80d4dd

SHA1
0b3a78b2362b0fd3817770fdc6dd070e3305615c

SHA256
953a8276faa4a18685d09cd9187ed3e409e3cccd7daf34b6097f1eb8d96125a4

SHA512
7292eab25f0e340e78063f32961eff16bb51895ad46cfd09933c0c30e3315129945d111a877a191fc261ad690ad6b02e1f2cabc4ff2fdac962ee272b41dd6dfa

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\SimpleObfuscator.dll

Filesize
1.4MB

MD5
9043d712208178c33ba8e942834ce457

SHA1
e0fa5c730bf127a33348f5d2a5673260ae3719d1

SHA256
b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c

SHA512
dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Sounds\Intro.wav

Filesize
238KB

MD5
ad3b4fae17bcabc254df49f5e76b87a6

SHA1
1683ff029eebaffdc7a4827827da7bb361c8747e

SHA256
e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf

SHA512
3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Xworm V5.6.exe

Filesize
14.9MB

MD5
56ccb739926a725e78a7acf9af52c4bb

SHA1
5b01b90137871c3c8f0d04f510c4d56b23932cbc

SHA256
90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405

SHA512
2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1

Download Submit
C:\Users\Admin\Desktop\Xworm-V5.6\Xworm V5.6.exe.config

Filesize
183B

MD5
66f09a3993dcae94acfe39d45b553f58

SHA1
9d09f8e22d464f7021d7f713269b8169aed98682

SHA256
7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

SHA512
c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

Download Submit
memory/824-950-0x0000000001340000-0x0000000001352000-memory.dmp

Filesize
72KB

Download
memory/824-630-0x000000001B8C0000-0x000000001B8CA000-memory.dmp

Filesize
40KB

Download
memory/824-806-0x000000001DA00000-0x000000001DAB0000-memory.dmp

Filesize
704KB

Download
memory/824-829-0x00000000012F0000-0x00000000012FA000-memory.dmp

Filesize
40KB

Download
memory/824-1045-0x000000001D5A0000-0x000000001D5AE000-memory.dmp

Filesize
56KB

Download
memory/824-796-0x0000000020260000-0x0000000020788000-memory.dmp

Filesize
5.2MB

Download
memory/824-840-0x0000000001300000-0x000000000130A000-memory.dmp

Filesize
40KB

Download
memory/824-608-0x000000001B840000-0x000000001B84A000-memory.dmp

Filesize
40KB

Download
memory/824-722-0x00000000011E0000-0x000000000126E000-memory.dmp

Filesize
568KB

Download
memory/824-868-0x000000001D4C0000-0x000000001D54E000-memory.dmp

Filesize
568KB

Download
memory/824-1035-0x000000001D560000-0x000000001D56C000-memory.dmp

Filesize
48KB

Download
memory/824-776-0x00000000012C0000-0x00000000012CC000-memory.dmp

Filesize
48KB

Download
memory/824-643-0x00000000010A0000-0x00000000010AA000-memory.dmp

Filesize
40KB

Download
memory/824-987-0x0000000001330000-0x000000000133C000-memory.dmp

Filesize
48KB

Download
memory/824-795-0x00000000012E0000-0x00000000012EC000-memory.dmp

Filesize
48KB

Download
memory/824-1006-0x000000001C300000-0x000000001C30A000-memory.dmp

Filesize
40KB

Download
memory/824-927-0x0000000001310000-0x000000000131A000-memory.dmp

Filesize
40KB

Download
memory/824-569-0x0000000000AA0000-0x0000000000ACC000-memory.dmp

Filesize
176KB

Download
memory/824-759-0x0000000001370000-0x00000000013AA000-memory.dmp

Filesize
232KB

Download
memory/824-819-0x000000001F2A0000-0x000000001F5F0000-memory.dmp

Filesize
3.3MB

Download
memory/1036-884-0x00000163DF610000-0x00000163DF611000-memory.dmp

Filesize
4KB

Download
memory/1036-885-0x00000163DF610000-0x00000163DF611000-memory.dmp

Filesize
4KB

Download
memory/1036-886-0x00000163DF610000-0x00000163DF611000-memory.dmp

Filesize
4KB

Download
memory/1036-887-0x00000163DF610000-0x00000163DF611000-memory.dmp

Filesize
4KB

Download
memory/1036-889-0x00000163DF610000-0x00000163DF611000-memory.dmp

Filesize
4KB

Download
memory/1036-890-0x00000163DF610000-0x00000163DF611000-memory.dmp

Filesize
4KB

Download
memory/1036-888-0x00000163DF610000-0x00000163DF611000-memory.dmp

Filesize
4KB

Download
memory/1036-878-0x00000163DF610000-0x00000163DF611000-memory.dmp

Filesize
4KB

Download
memory/1036-879-0x00000163DF610000-0x00000163DF611000-memory.dmp

Filesize
4KB

Download
memory/1036-880-0x00000163DF610000-0x00000163DF611000-memory.dmp

Filesize
4KB

Download
memory/4780-599-0x000002966C070000-0x000002966C09C000-memory.dmp

Filesize
176KB

Download
memory/4780-249-0x00007FFAD1300000-0x00007FFAD1DC1000-memory.dmp

Filesize
10.8MB

Download
memory/4780-248-0x00007FFAD1303000-0x00007FFAD1305000-memory.dmp

Filesize
8KB

Download
memory/4780-271-0x0000029674F10000-0x0000029675078000-memory.dmp

Filesize
1.4MB

Download
memory/4780-247-0x000002966DFE0000-0x000002966E1D4000-memory.dmp

Filesize
2.0MB

Download
memory/4780-245-0x00007FFAD1300000-0x00007FFAD1DC1000-memory.dmp

Filesize
10.8MB

Download
memory/4780-930-0x0000029675D90000-0x0000029675F2B000-memory.dmp

Filesize
1.6MB

Download
memory/4780-244-0x00000296505A0000-0x0000029651488000-memory.dmp

Filesize
14.9MB

Download
memory/4780-243-0x00007FFAD1303000-0x00007FFAD1305000-memory.dmp

Filesize
8KB

Download
memory/4780-597-0x000002966C0D0000-0x000002966C152000-memory.dmp

Filesize
520KB

Download
memory/4780-601-0x0000029675510000-0x00000296757F2000-memory.dmp

Filesize
2.9MB

Download
memory/4780-603-0x0000029674D80000-0x0000029674E32000-memory.dmp

Filesize
712KB

Download
memory/4780-830-0x000002966C1C0000-0x000002966C21A000-memory.dmp

Filesize
360KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads