Analysis
-
max time kernel
80s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
27/02/2025, 04:48
General
-
Target
fd2af290651593318f6181ffbbf227f8ae72c1ab1deb2a2ffae91d7a8988c8da.exe
-
Size
56.3MB
-
MD5
f21bab83ac325830cf3aab824cc1fadf
-
SHA1
0cab604f8e23814a0d9e43dc63e3bebce5336168
-
SHA256
fd2af290651593318f6181ffbbf227f8ae72c1ab1deb2a2ffae91d7a8988c8da
-
SHA512
6cfa5d269e041870ad38c6c162cc2090df296b056eb89bc7afb790342797cf983a6906733bb27acfcbca7674dd18366c24003818cd4b8dc34b141ddb9a802537
-
SSDEEP
1572864:5WWXtHc1Y6Iv97dZJl+T/pq5Z4vA9jtycxrSuICF98bh:5Lc1Y6IJfI/U5ZWotFnxSbh
Score
10/10
Malware Config
Extracted
Family
xred
C2
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
Family
xworm
C2
209.50.250.24:4562
Attributes
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 58 IoCs
-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Xworm
Xworm is a remote access trojan written in C#.
-
Xworm family
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 60 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd2af290651593318f6181ffbbf227f8ae72c1ab1deb2a2ffae91d7a8988c8da.exe"C:\Users\Admin\AppData\Local\Temp\fd2af290651593318f6181ffbbf227f8ae72c1ab1deb2a2ffae91d7a8988c8da.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"13⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"17⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"18⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"19⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"22⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"23⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"24⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"24⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"25⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"24⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"25⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"26⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"25⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"26⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"27⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"26⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"27⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"28⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"27⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"28⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"29⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"28⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"29⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"30⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"29⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"30⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"31⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"30⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"31⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"32⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"31⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"33⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"32⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"33⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"33⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"34⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"34⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"35⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"36⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"36⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"37⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"37⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"38⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"38⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"39⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"40⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"40⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"41⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"42⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"42⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"43⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"44⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"44⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"45⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"45⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"46⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"46⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"47⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"48⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"47⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"48⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"48⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"49⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"49⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"50⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"50⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"51⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"51⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"52⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"52⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"53⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"53⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"54⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"54⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"55⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"55⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"56⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"56⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"57⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"57⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"58⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"58⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"59⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"59⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"60⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"60⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"61⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"61⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"62⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"63⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"62⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"63⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"64⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"63⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"64⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"65⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"64⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"65⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"66⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"65⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"66⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"67⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"66⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"68⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"67⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"69⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"68⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"70⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"69⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"71⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"70⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"72⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"71⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"73⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"72⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"74⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"73⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"75⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"74⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"76⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"75⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"77⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"76⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"78⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"77⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"79⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"78⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"80⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"79⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"81⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"80⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"82⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"81⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"83⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"82⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"84⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"83⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"85⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"84⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"86⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"85⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"87⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"86⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"88⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"87⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"89⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"88⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"90⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"89⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"91⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"90⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"92⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"91⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"93⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"92⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"94⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"93⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"95⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"94⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"96⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"95⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"97⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"96⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"98⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"97⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"99⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"98⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"100⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"99⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"101⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"100⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"102⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"101⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"103⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"102⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"104⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"103⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"105⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"104⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"106⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"105⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"107⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"106⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"108⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"107⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"109⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"108⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"110⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"109⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"111⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"110⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"112⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"111⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"113⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"112⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"114⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"113⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"115⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"114⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"116⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"115⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"117⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"116⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"118⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"117⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"119⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"118⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"120⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"C:\Users\Admin\AppData\Roaming\Discord.Bot.Client.1.0.0.exe"119⤵
-
C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"C:\Users\Admin\AppData\Roaming\XWorm -V5.6.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"C:\Users\Admin\AppData\Local\Temp\._cache_XWorm -V5.6.exe"121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-