skuld | hxxps://gofile[.]io/d/wfUhrD

Resubmissions

02/03/2025, 17:25

250302-vy84qszmy7 3

01/03/2025, 16:32

250301-t14flav1g1 10

25/02/2025, 18:36

250225-w9dbwa1ks4 3

Analysis

max time kernel
956s
max time network
845s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250217-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
01/03/2025, 16:32

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://gofile.io/d/wfUhrD

Score

10^/10

skuld stormkitty xenarmor xworm agilenet collection discovery password persistence privilege_escalation rat recovery spyware stealer trojan upx

Malware Config

Extracted

Family

skuld

https://discord.com/api/webhooks/1314414095461777419/8hYVVlssdJOsLuwWhq5QQqRTlg-3pzMhiKB5tYVl8wS1FN6rDNu-iZ34u_-J5bahL4e7

Extracted

Family

xworm

127.0.0.1:7000

Attributes

install_file
USB.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/952-779-0x000000001C460000-0x000000001C46E000-memory.dmp	disable_win_def

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/952-502-0x0000000000230000-0x0000000000286000-memory.dmp	family_xworm

Skuld family
skuld
Skuld stealer
An info stealer written in Go lang.
stealer skuld
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/952-711-0x000000001CB70000-0x000000001CC8E000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
recovery password xenarmor
Xenarmor family
xenarmor
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000027fdd-565.dat	acprotect
behavioral1/files/0x0007000000027fdb-555.dat	acprotect
behavioral1/files/0x0007000000027fda-550.dat	acprotect
behavioral1/files/0x0007000000027fd9-545.dat	acprotect
behavioral1/files/0x0007000000027fdc-560.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Control Panel\International\Geo\Nation	steam.exe

Executes dropped EXE 5 IoCs

pid	Process
2956	start.exe
4004	XWorm V5.2.exe
2532	XWormLoader 5.2 x32.exe
952	steam.exe
2012	All-In-One.exe

Loads dropped DLL 35 IoCs

pid	Process
4004	XWorm V5.2.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
952	steam.exe
2012	All-In-One.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe

Obfuscated with Agile.Net obfuscator 3 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/files/0x0007000000027fb8-380.dat	agile_net
behavioral1/memory/4004-383-0x000002F8D0FB0000-0x000002F8D1BE8000-memory.dmp	agile_net
behavioral1/memory/2532-431-0x0000000005E30000-0x0000000006A68000-memory.dmp	agile_net

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	All-In-One.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	start.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	steam.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000027fb7-376.dat	upx
behavioral1/memory/2956-377-0x0000000000130000-0x000000000106C000-memory.dmp	upx
behavioral1/memory/2956-379-0x0000000000130000-0x000000000106C000-memory.dmp	upx
behavioral1/files/0x0007000000027fdd-565.dat	upx
behavioral1/files/0x0007000000027fdb-555.dat	upx
behavioral1/files/0x0007000000027fda-550.dat	upx
behavioral1/files/0x0007000000027fd9-545.dat	upx
behavioral1/files/0x0007000000027fdc-560.dat	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormLoader 5.2 x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	All-In-One.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2840	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	XWormLoader 5.2 x32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	XWormLoader 5.2 x32.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWormLoader 5.2 x32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWormLoader 5.2 x32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWorm V5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWormLoader 5.2 x32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWorm V5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWorm V5.2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	XWormLoader 5.2 x32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0 = 50003100000000006b57dc73100049636f6e73003c0009000400efbe615a3284615a35842e000000617f0200000007000000000000000000000000000000eb5e0a01490063006f006e007300000014000000	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	XWormLoader 5.2 x32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 56003100000000006b57e4731000506c7567696e7300400009000400efbe615a3284615a35842e000000627f02000000070000000000000000000000000000004b38260050006c007500670069006e007300000016000000	XWormLoader 5.2 x32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e8005398e082303024b98265d99428e115f0000	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	XWormLoader 5.2 x32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\NodeSlot = "4"	XWormLoader 5.2 x32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Pictures"	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "5"	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	XWormLoader 5.2 x32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	XWormLoader 5.2 x32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Downloads"	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	XWormLoader 5.2 x32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = ffffffff	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\MRUListEx = 00000000ffffffff	XWormLoader 5.2 x32.exe
Key created	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	XWormLoader 5.2 x32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	XWormLoader 5.2 x32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2472	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
3596	msedge.exe
3596	msedge.exe
1112	identity_helper.exe
1112	identity_helper.exe
2072	msedge.exe
2072	msedge.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2012	All-In-One.exe
2012	All-In-One.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe
952	steam.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2532	XWormLoader 5.2 x32.exe
2472	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeRestorePrivilege	5108	7zG.exe
Token: 35	5108	7zG.exe
Token: SeSecurityPrivilege	5108	7zG.exe
Token: SeSecurityPrivilege	5108	7zG.exe
Token: SeDebugPrivilege	2956	start.exe
Token: SeDebugPrivilege	4004	XWorm V5.2.exe
Token: SeDebugPrivilege	2532	XWormLoader 5.2 x32.exe
Token: 33	3224	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3224	AUDIODG.EXE
Token: SeDebugPrivilege	952	steam.exe
Token: SeDebugPrivilege	2012	All-In-One.exe
Token: 33	5032	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5032	AUDIODG.EXE
Token: SeShutdownPrivilege	952	steam.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
5108	7zG.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2472	vlc.exe
2472	vlc.exe
2472	vlc.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2532	XWormLoader 5.2 x32.exe
2472	vlc.exe
2012	All-In-One.exe
2012	All-In-One.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 2728	3596	msedge.exe	84
PID 3596 wrote to memory of 2728	3596	msedge.exe	84
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 3220	3596	msedge.exe	85
PID 3596 wrote to memory of 2276	3596	msedge.exe	86
PID 3596 wrote to memory of 2276	3596	msedge.exe	86
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87
PID 3596 wrote to memory of 2524	3596	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4328	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/wfUhrD
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff96c546f8,0x7fff96c54708,0x7fff96c54718
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11030099239806362889,17206711417415525577,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1120

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap12766:80:7zEvent9353
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\XWorm V5.2\start.bat" "
1⤵
PID:5056
- C:\Users\Admin\Downloads\XWorm V5.2\start.exe
  start.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\Downloads\XWorm V5.2\start.exe"
    3⤵
    - Views/modifies file attributes
    PID:4328
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1652

C:\Users\Admin\Downloads\XWorm V5.2\XWorm V5.2.exe
"C:\Users\Admin\Downloads\XWorm V5.2\XWorm V5.2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Users\Admin\Downloads\XWorm V5.2\XWormLoader 5.2 x32.exe
"C:\Users\Admin\Downloads\XWorm V5.2\XWormLoader 5.2 x32.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ewupcnjj\ewupcnjj.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2108
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD92B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7EF6D454B63F48DCAEC3B43E98BEC587.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4204

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1780

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d0 0x248
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:2480

C:\Users\Admin\Downloads\XWorm V5.2\steam.exe
"C:\Users\Admin\Downloads\XWorm V5.2\steam.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\aglcil.aifc"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2472
- C:\Windows\SYSTEM32\CMD.EXE
  "CMD.EXE"
  2⤵
  PID:4380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Cd %temp% && All-In-One.exe OutPut.json
  2⤵
  PID:3888
- - C:\Users\Admin\AppData\Local\Temp\All-In-One.exe
    All-In-One.exe OutPut.json
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2012
- C:\Windows\SYSTEM32\cmd.exe
  "cmd"
  2⤵
  PID:1256
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2840
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\io52k0f5\io52k0f5.cmdline"
  2⤵
  PID:4524
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF404.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6772E2A9415A40E8BCE43A7E46D41876.TMP"
    3⤵
    PID:2536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qvtnmqku\qvtnmqku.cmdline"
  2⤵
  PID:2664
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6FAC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3EB4A367FB540668DEABABC131D136.TMP"
    3⤵
    PID:1256
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies registry class
  PID:2472

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\XWorm V5.2\Fixer.bat
1⤵
PID:1708

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\XWorm V5.2\start.bat
1⤵
PID:5072

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\XWorm V5.2\ClientsFolder\D8F2A63DFF4483E6BB21\Recovery\All-In-One_03-01-2025 16;39;41;970.txt
1⤵
PID:4068

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d0 0x248
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\GMap.NET\DllCache\SQLite_v98_NET4_x86\System.Data.SQLite.DLL

Filesize
1.3MB

MD5
14393eb908e072fa3164597414bb0a75

SHA1
5e04e084ec44a0b29196d0c21213201240f11ba0

SHA256
59b9d95ae42e35525fc63f93168fe304409463ee070a3cf21a427a2833564b80

SHA512
f5fc3d9e98cca1fbbbe026707086a71f801016348d2355541d630879ad51a850f49eb4a5f7a94e12a844d7a7108d69fa6d762ee19f4805d6aafef16259b4330b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
44bece4054174f5a1281bf9f1787867a

SHA1
29b718ceb54e82ddcfeb11fa3e3b14dd8c43c8fe

SHA256
5b549271cd6e1685657d580831a3814628a27d3c38bb125de874198018d3aeea

SHA512
243128b08b7364ade001ac7b573253e5cf72121877e0446f30a771367aaa0ff5670b32d8e5c0c3fe7352e7c58800280527493b69c6d96b2598c55e43a78fbfaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
163560ee278e4fb0f0e40c4e62fcbda3

SHA1
c07749d80598d49d7e81b9ef84441f5364856021

SHA256
569f10950c9e39f1c34679ac6e45946dfee30e63e2629194e87c050158ae0755

SHA512
b8fecf30bf75e9dd80cda705547e47e44245b5c85a53a72f49e17baed9c42331e8c19476f9e312ded137b78e5507318bfc0627acdd2c0918913b2289a930c004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
390B

MD5
c32076132c7dff4904bbc16ccbfc46d8

SHA1
0328fe9cd5670d1e0d9c4a0b006ab1af1a3f5f56

SHA256
a9df8c86ec2a8537441e0836a3e115145d062c2dc5b6ccbe85c91a33f5241800

SHA512
c61ff661447b97ee860d13a7b5b036cbf68226e87ba9575774be9f062f580989e27ec28cab6c61fb27abda898bab47a65a2d6dcddc4fe65e8bf6e6f90384a99e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ec2d01e20c3dd7b67fd065637f5a1b26

SHA1
079499b3f0f22e15f79577f2ea6562117329aaee

SHA256
ab30a83155d0433e5502d774cee71280ddd4e8d0809fa76333ddbaab70ec451e

SHA512
1527f2b64c358e299d9580a5851ad931b5b4ee2846a03999bf75fa26dbb44488159d3e43bf358c08c952f08b0c24097f241fc375f2a5bfd2c3613b6c0bd47618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7d2b14e709182082b7da7aaeecf08775

SHA1
e45b11fdcf2822b2fb34bcc6999996b61b701d1c

SHA256
3047751c66656bf81f7da2293d79a8689a8a242cd04fd9e3e66b4a953344805d

SHA512
3fb13cfea60465d93f0476f19f1e42966d9bc385c60536575043508baf7db5c72ee4a85e77b6a158a68a92f512382ada41af47723c1d757f9e74918936f4e61a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
651f956fb3de1c0057f845a9daf57d8e

SHA1
bfe32a921845db1e98011139d6ceb3178e43b577

SHA256
9c620143a67a7efa693dc497e9df69a40f5fd37259dc451a9654675a85afd547

SHA512
c97ba00760c6651c7684860cf894b9524955498a7865a5b768fbdc2748908b78edc410c3e41361d4bf33127f3dae248dba45940abffd9f425b72bbfe1b07e26d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9222372b064d4bd1e1f15ebcfdb542c5

SHA1
75287918f31b4154e0bb6bac087f1d4a69f89c51

SHA256
429298e2027165387403aa5d39f318bd11b7ac847604a5745059538c72b0f2ad

SHA512
5b24bb2cd63e0458eae4fd74886e317b83d4555fb31912273fe31c4c228cc5fdedbec6e4ec0735e13f28b5229d425090c8cfbdee916ac8773db9c4ba2a6536f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0b8f2b90f1c7c323cf6edd552407b23c

SHA1
784b6f8825ddfdfc8a487e01af2f0304d0a37638

SHA256
8ab836ebdf79e31d56698e3867c6838866af2ef47c8a9f5fd9b60dcac8f436cd

SHA512
38581f17a05c636ceeb6b7a0a178ee5d38ba2d6408daa82014d945b853ad5d00b2eedb13c17437f567dcbfe49500c5ab1454559aff99fdde0d21c94597a91074

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
78ee77f32c713bdf4374774730cb117e

SHA1
7a96e08d5e2d61a220b1415e750f692a8d417903

SHA256
c5b1084d4cf703857898f110cbd94e90a675afa193572e818226b4013efbbee5

SHA512
9ae2946afce57712b07b69b1431cc0ebe6da04327d7b8d6b30cf2cf9f3d5f363fe9c7ab4d4df0c9d4902b632be348eac14410724dfefa3c78cbc538f50cc75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fb9ea1e5be13afd87eda9e3ac4cbb828

SHA1
28286261b5ba526e2e625f2c1ccf5504c4a1680d

SHA256
919266f8211205024a361afb53fce1da52a134e4a8bcd0fa92c7f6079707c7e7

SHA512
d5c90ef64aa1f3a727ef92042dd70bf7c68fc337c315e53fd2d939139300700a65aa97412a5ac6525d3824cefa3e737965922398f6bf0d76b75ae1bbaaa072fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fbaf6084be66149d1d553ee811d7504f

SHA1
a4e44881752e85202ff4e0848df36248ac509edf

SHA256
6a6fe330876e7432df2b18b7d90d42c91aa9f42d8b35d1d821eb6ca6d1d5aa70

SHA512
4c8c8e0aba3a993bdb1a5c983417b11f5a0d68dfb201dcac4ecdadf3892a505faa765028521ad67cbdee6f7b3b4906069c30e722f01497832b66c70fd7b93c51

Download Submit
C:\Users\Admin\AppData\Local\Temp\All-In-One.exe

Filesize
5.1MB

MD5
a48e3197ab0f64c4684f0828f742165c

SHA1
f935c3d6f9601c795f2211e34b3778fad14442b4

SHA256
baecc747370a4c396ef5403a3a2b286465d8fe4677bf1bfd23b8164ef5c22bbb

SHA512
e0b0b73c39850a30aac89f84f721c79f863612f596d6ff3df0860a9faf743a81364656773c99708e9c0656c74b6a278b6bf7e648f7ff1b9080f9a21e10515a59

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dll

Filesize
18KB

MD5
6ea692f862bdeb446e649e4b2893e36f

SHA1
84fceae03d28ff1907048acee7eae7e45baaf2bd

SHA256
9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2

SHA512
9661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-convert-l1-1-0.dll

Filesize
21KB

MD5
72e28c902cd947f9a3425b19ac5a64bd

SHA1
9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7

SHA256
3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1

SHA512
58ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
ac290dad7cb4ca2d93516580452eda1c

SHA1
fa949453557d0049d723f9615e4f390010520eda

SHA256
c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382

SHA512
b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
19KB

MD5
aec2268601470050e62cb8066dd41a59

SHA1
363ed259905442c4e3b89901bfd8a43b96bf25e4

SHA256
7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2

SHA512
0c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dll

Filesize
18KB

MD5
93d3da06bf894f4fa21007bee06b5e7d

SHA1
1e47230a7ebcfaf643087a1929a385e0d554ad15

SHA256
f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d

SHA512
72bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
a2f2258c32e3ba9abf9e9e38ef7da8c9

SHA1
116846ca871114b7c54148ab2d968f364da6142f

SHA256
565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33

SHA512
e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
8b0ba750e7b15300482ce6c961a932f0

SHA1
71a2f5d76d23e48cef8f258eaad63e586cfc0e19

SHA256
bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed

SHA512
fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
25KB

MD5
35fc66bd813d0f126883e695664e7b83

SHA1
2fd63c18cc5dc4defc7ea82f421050e668f68548

SHA256
66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735

SHA512
65f8397de5c48d3df8ad79baf46c1d3a0761f727e918ae63612ea37d96adf16cc76d70d454a599f37f9ba9b4e2e38ebc845df4c74fc1e1131720fd0dcb881431

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
41a348f9bedc8681fb30fa78e45edb24

SHA1
66e76c0574a549f293323dd6f863a8a5b54f3f9b

SHA256
c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b

SHA512
8c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
23KB

MD5
fefb98394cb9ef4368da798deab00e21

SHA1
316d86926b558c9f3f6133739c1a8477b9e60740

SHA256
b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7

SHA512
57476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dll

Filesize
22KB

MD5
404604cd100a1e60dfdaf6ecf5ba14c0

SHA1
58469835ab4b916927b3cabf54aee4f380ff6748

SHA256
73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c

SHA512
da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
849f2c3ebf1fcba33d16153692d5810f

SHA1
1f8eda52d31512ebfdd546be60990b95c8e28bfb

SHA256
69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d

SHA512
44dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
b52a0ca52c9c207874639b62b6082242

SHA1
6fb845d6a82102ff74bd35f42a2844d8c450413b

SHA256
a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0

SHA512
18834d89376d703bd461edf7738eb723ad8d54cb92acc9b6f10cbb55d63db22c2a0f2f3067fe2cc6feb775db397030606608ff791a46bf048016a1333028d0a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\freebl3.dll

Filesize
324KB

MD5
04a2ba08eb17206b7426cb941f39250b

SHA1
731ac2b533724d9f540759d84b3e36910278edba

SHA256
8e5110ce03826f680f30013985be49ebd8fc672de113fc1d9a566eced149b8c4

SHA512
e6e90b4becf472b2e8f716dbb962cd7de61676fcce342c735fccdc01268b5a221139bc9be0e0c9722e9978aefaae79c10bc49c43392aa05dd12244b3147aeffc

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\mozglue.dll

Filesize
135KB

MD5
591533ca4655646981f759d95f75ae3d

SHA1
b4a02f18e505a1273f7090a9d246bc953a2cb792

SHA256
4434f4223d24fb6e2f5840dd6c1eedef2875e11abe24e4b0e9bc1507f8f6fd47

SHA512
915b124ad595ee78feab8f3c9be7e80155445e58ed4c88b89665df5fb7e0a04e973374a01f97bb67aaa733a8ce2e91a9f92605ec96251906e0fb2750a719b579

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\msvcp140.dll

Filesize
429KB

MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\nss3.dll

Filesize
1.2MB

MD5
fc57d044bfd635997415c5f655b5fffa

SHA1
1b5162443d985648ef64e4aab42089ad4c25f856

SHA256
17f8c55eba797bbc80c8c32ca1a3a7588415984386be56f4b4cdefd4176fb4c3

SHA512
f5a944230000730bc0aad10e6607e3389d9d82a0a4ab1b72a19d32e94e8572789d46fb4acd75ad48f17e2bbc27389d432086696f2ccc899850ff9177d6823efb

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\softokn3.dll

Filesize
140KB

MD5
1b304dad157edc24e397629c0b688a3e

SHA1
ae151af384675125dfbdc96147094cff7179b7da

SHA256
8f0c9ac7134773d11d402e49daa90958fe00205e83a7389f7a58da03892d20cb

SHA512
2dc625dbdf2aae4ade600cca688eb5280200e8d7c2dfc359590435afe0926b3a7446cc56a66023ee834366132a68ae68da51a5079e4f107201e2050f5c5512ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\vcruntime140.dll

Filesize
81KB

MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\Components\nspr4.dll

Filesize
72KB

MD5
72414dfb0b112c664d2c8d1215674e09

SHA1
50a1e61309741e92fe3931d8eb606f8ada582c0a

SHA256
69e73fea2210adc2ae0837ac98b46980a09fe91c07f181a28fda195e2b9e6b71

SHA512
41428624573b4a191b33657ed9ad760b500c5640f3d62b758869a17857edc68f90bc10d7a5e720029519c0d49b5ca0fa8579743e80b200ef331e41efde1dc8c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\Components\nss3.dll

Filesize
172KB

MD5
7ddbd64d87c94fd0b5914688093dd5c2

SHA1
d49d1f79efae8a5f58e6f713e43360117589efeb

SHA256
769703fb1ba6c95fb6c889e8a9baaea309e62d0f3ca444d01cc6b495c0f722d1

SHA512
60eaad58c3c4894f1673723eb28ddb42b681ff7aafe7a29ff8bf87a2da6595c16d1f8449096accdb89bd6cda6454eb90470e71dde7c5bd16abd0f80e115cfa2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\Components\plc4.dll

Filesize
8KB

MD5
c73ec58b42e66443fafc03f3a84dcef9

SHA1
5e91f467fe853da2c437f887162bccc6fd9d9dbe

SHA256
2dc0171b83c406db6ec9389b438828246b282862d2b8bdf2f5b75aec932a69f7

SHA512
6318e831d8f38525e2e49b5a1661440cd8b1f3d2afc6813bb862c21d88d213c4675a8ec2a413b14fbdca896c63b65a7da6ec9595893b352ade8979e7e86a7fcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\Components\plds4.dll

Filesize
6KB

MD5
ee44d5d780521816c906568a8798ed2f

SHA1
2da1b06d5de378cbfc7f2614a0f280f59f2b1224

SHA256
50b2735318233d6c87b6efccccc23a0e3216d2870c67f2f193cc1c83c7c879fc

SHA512
634a1cd2baaef29b4fe7c7583c04406bb2ea3a3c93294b31f621652844541e7c549da1a31619f657207327604c261976e15845571ee1efe5416f1b021d361da8

Download Submit
C:\Users\Admin\AppData\Local\Temp\External\Components\softokn3.dll

Filesize
155KB

MD5
e846285b19405b11c8f19c1ed0a57292

SHA1
2c20cf37394be48770cd6d396878a3ca70066fd0

SHA256
251f0094b6b6537df3d3ce7c2663726616f06cfb9b6de90efabd67de2179a477

SHA512
b622ff07ae2f77e886a93987a9a922e80032e9041ed41503f0e38abb8c344eb922d154ade29e52454d0a1ad31596c4085f4bd942e4412af9f0698183acd75db7

Download Submit
C:\Users\Admin\AppData\Local\Temp\License.XenArmor

Filesize
104B

MD5
774a9a7b72f7ed97905076523bdfe603

SHA1
946355308d2224694e0957f4ebf6cdba58327370

SHA256
76e56835b1ac5d7a8409b7333826a2353401cf67f3bd95c733adc6aa8d9fec81

SHA512
c5c77c6827c72901494b3a368593cb9a990451664b082761294a845c0cd9441d37e5e9ac0e82155cb4d97f29507ffc8e26d6ff74009666c3075578aa18b28675

Download Submit
C:\Users\Admin\AppData\Local\Temp\TMzpx\TMzpx.dll

Filesize
112KB

MD5
2f1a50031dcf5c87d92e8b2491fdcea6

SHA1
71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f

SHA256
47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed

SHA512
1c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\XenManager.dll

Filesize
2.0MB

MD5
7a5c53a889c4bf3f773f90b85af5449e

SHA1
25b2928c310b3068b629e9dca38c7f10f6adc5b6

SHA256
baa9c3a0d0524263c4f848056b3f1da3b4bb913162362cbcabe77ce76a39870c

SHA512
f5943687d7e098790581bf56ac6fec3b7e9b83d0e29301077a8bc48768c5a0e9f54f53d926f9847885f6035a2b31e456e4e45ccf1c70be27229c46e79876e2ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\aPjMR\aPjMR.dll

Filesize
84KB

MD5
0b0e63957367e620b8697c5341af35b9

SHA1
69361c2762b2d1cada80667cd55bc5082e60af86

SHA256
bd9cdcfaa0edecdb89a204965d20f4a896c6650d4840e28736d9bd832390e1c5

SHA512
07d0e52c863f52ecb3d12fab9e71c7a18d54cbedb47250bee7e4297ff72ed793c23a2735c48090c261fe4633d53d03e305c1338dfc881bb86874d1633ff6ecee

Download Submit
C:\Users\Admin\AppData\Local\Temp\aglcil.aifc

Filesize
465KB

MD5
a1054a2e74c613cc43c6f11d2d58860c

SHA1
45fb8778f00ecc8a978954167d7060c2e46d816d

SHA256
ec3dd373399172114551f0f4f5735d1a5008c61215ddb063e6b03df31744c2df

SHA512
69617043ac37d607178f7b105bfa2dcc1d09744454d3139ae3940a76e4a70bafff384a06ad8aa048d71be6f57cdbfcb91751601e1d376ff4ee6f81ffcd92e5b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\settings.db

Filesize
20KB

MD5
56b941f65d270f2bf397be196fcf4406

SHA1
244f2e964da92f7ef7f809e5ce0b3191aeab084a

SHA256
00c020ba1cce022364976f164c575993cb3b811c61b5b4e05a8a0c3d1b560c0c

SHA512
52ad8c7ed497a5b8eed565b3abcbf544841f3c8c9ec3ca8f686846a2afd15ac4ac8b16abf1cb14aeca1a2fb31f3086ad17206ec4af28e77bae600dca15e8deab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_3A408FB3861647298E03EEA5CDD9EF4B.dat

Filesize
940B

MD5
612f4fc5d7708d238b71b1ec40e74a8e

SHA1
ec26c86e5e3fbd50048bff64fa037548a6b0873b

SHA256
68b82f384b3ae5d9393d3c66294f35259c77df67fe9b7621975fe3f90822e9c4

SHA512
fdd4ded0be2e546b2d9f3fba740e803a033c6ab40e170499fe05d11f8616146be079f6adde69501f34901afffbd0a58e2b0515ca7ab0e9352fdb6662184719a8

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2.7z

Filesize
36.3MB

MD5
8e391f6618b90ddcefb8048b768c20c8

SHA1
5ba1ee1aad993c5b76ba722706c146e3456e16d6

SHA256
5730c3bf3e6bc163dee6bab4660722c55eb1a4d878faa1f5b2a1c3e5929a0528

SHA512
b1358fc3f0694b84a12b1e50e049777ea2b89dc5ac3b12ac852b0e5929d8a51ed53479c2ea0e2e194faa570c370ed61bbc654cc4625d0aeb8514b44bbef08df9

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\GeoIP.dat

Filesize
1.2MB

MD5
8ef41798df108ce9bd41382c9721b1c9

SHA1
1e6227635a12039f4d380531b032bf773f0e6de0

SHA256
bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

SHA512
4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Guna.UI2.dll

Filesize
1.9MB

MD5
bcc0fe2b28edd2da651388f84599059b

SHA1
44d7756708aafa08730ca9dbdc01091790940a4f

SHA256
c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

SHA512
3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Icons\icon (1).ico

Filesize
97KB

MD5
4f409511e9f93f175cd18187379e94cb

SHA1
598893866d60cd3a070279cc80fda49ee8c06c9b

SHA256
115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f

SHA512
0d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Icons\icon (11).ico

Filesize
9KB

MD5
1c2cea154deedc5a39daec2f1dadf991

SHA1
6b130d79f314fa9e4015758dea5f331bbe1e8997

SHA256
3b64b79e4092251ebf090164cd2c4815390f34849bbd76fb51085b6a13301b6d

SHA512
dceebc1e6fdfe67afebaef1aff11dd23eda6fae79eb6b222de16edebdfebd8e45de896e501608254fb041824080cb41c81ac972032638407efc6bfeb930bfd00

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Icons\icon (12).ico

Filesize
9KB

MD5
4ea9ab789f5ae96766e3f64c8a4e2480

SHA1
423cb762ce81fab3b2b4c9066fe6ea197d691770

SHA256
84b48ca52dfcd7c74171cf291d2ef1247c3c7591a56b538083834d82857fee50

SHA512
f917059b6f85e4a25909a27cad38b1ef0659161c32df54860226ff3d858127d8da592ea9072ad41d5a9986dd8c04a37e9ad34e2251883a8c2f0933e6aa201414

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Icons\icon (2).ico

Filesize
112KB

MD5
f1463f4e1a6ef6cc6e290d46830d2da1

SHA1
bda0d74a53c3f7aaf0da0f375d0c1b5aca2a7aaf

SHA256
142b529799268a753f5214265c53a26a7a6f8833b31640c90a69a4ff94cee5ec

SHA512
0fa93d009cc2f007d19e6fdda7ebe44c7ed77f30b49a6ef65c319133c0570ab84f2d86e8282b5069d7f2e238547722ac3966d2fa2fae4504133f0001a0387ae2

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Icons\icon (3).ico

Filesize
131KB

MD5
a512719efc9e6ecc5e2375abceb1669a

SHA1
51fae98edfab7cd6b6baac6df5ecbda082eeb1db

SHA256
b2f7fb22cd5b935cf19a2f58f7fef9db99db40772ff4bb331a73c345161c2574

SHA512
e0153dbc8f3fdda8d1a7082bc30a3895d7f4b3bc2982b4b4ece55653d1b4c293eba3ba6d4a0a581f0f7db95ab287d6616ef7bf03af4485904111798bf9d9e625

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Icons\icon (4).ico

Filesize
125KB

MD5
9c053bef57c4a7b575a0726af0e26dae

SHA1
47148d30bc9a6120a1d92617bf1f3e1ba6ca1a2c

SHA256
5bb21d6c04ed64a1368dace8f44aff855860e69f235492a5dc8b642a9ea88e41

SHA512
482d639ba60f57827d8a343f807f4f914289c45643307efaa666b584a085fe01ac7892252f41b7756fde93d215b4f3fed16e608bc45102d320d77239fa93146a

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Icons\icon (5).ico

Filesize
100KB

MD5
9dbdd6972e129d31568661a89c81d8f9

SHA1
747399af62062598120214cef29761c367cfd28a

SHA256
45c85bdaaf0e0c30678d8d77e2585871ea6d1298ee0d30037745bacea6338484

SHA512
e52572de3f0d57d24a24d65eca4ff638890ccc9c5aca3f213ff885eda3c40de115849eb64c341f557d601f566ce21f8fc0df25cc4b13aaad5e941449a6b7f87d

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Icons\icon (6).ico

Filesize
106KB

MD5
d7c9666d30936e29ce156a2e04807863

SHA1
845e805d55156372232e0110e5dc80380e2cb1e5

SHA256
6ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5

SHA512
3cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Icons\icon (7).ico

Filesize
164KB

MD5
7891c91d1761dc8a8846d362e6e31869

SHA1
0229bb01b7b4a0fca305eb521ec5dfbaa53674ea

SHA256
29d38c75af79aa0554f34cdfecb311f88f8dd02b02facaa299b9700841806ab8

SHA512
ed14614a706da985566853dc13df0d1128a718f39ec9957320813803fe07e59de337d51033970e2f57d9f56da3546c506f5f0f3becfa91ce741576855be14ba7

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Icons\icon (8).ico

Filesize
108KB

MD5
af1739a9b1a1bf72e7072ad9551c6eea

SHA1
8da0a34c3a8040c4b7c67d7143c853c71b3d208d

SHA256
a65cbbdc2ca671a9edd7edac0c6737b3b116e357727e003e5fdeff163c6c21ab

SHA512
eeeac307371c38b75e256083c55a3fe4ab096c1c7520a4b7acb40fad3af5a0d6c88aaf85f2c3e418034abee422c2a3ba13731adf7ee6078016da4dd2e989b120

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Icons\icon (9).ico

Filesize
264KB

MD5
3e24e40b41ecc59750c9231d8f8da40b

SHA1
91a701cf25aea2984f75846b6c83865d668ccad6

SHA256
bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80

SHA512
fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Mono.Cecil.dll

Filesize
350KB

MD5
de69bb29d6a9dfb615a90df3580d63b1

SHA1
74446b4dcc146ce61e5216bf7efac186adf7849b

SHA256
f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc

SHA512
6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\MonoMod.Backports.dll

Filesize
138KB

MD5
dd43356f07fc0ce082db4e2f102747a2

SHA1
aa0782732e2d60fa668b0aadbf3447ef70b6a619

SHA256
e375b83a3e242212a2ed9478e1f0b8383c1bf1fdfab5a1cf766df740b631afd6

SHA512
284d64b99931ed1f2e839a7b19ee8389eefaf6c72bac556468a01f3eb17000252613c01dbae88923e9a02f3c84bcab02296659648fad727123f63d0ac38d258e

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\MonoMod.Core.dll

Filesize
216KB

MD5
b808181453b17f3fc1ab153bf11be197

SHA1
bce86080b7eb76783940d1ff277e2b46f231efe9

SHA256
da00cdfab411f8f535f17258981ec51d1af9b0bfcee3a360cbd0cb6f692dbcdd

SHA512
a2d941c6e69972f99707ade5c5325eb50b0ec4c5abf6a189eb11a46606fed8076be44c839d83cf310b67e66471e0ea3f6597857a8e2c7e2a7ad6de60c314f7d3

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\MonoMod.ILHelpers.dll

Filesize
6KB

MD5
6512e89e0cb92514ef24be43f0bf4500

SHA1
a039c51f89656d9d5c584f063b2b675a9ff44b8e

SHA256
1411e4858412ded195f0e65544a4ec8e8249118b76375050a35c076940826cd0

SHA512
9ffb2ff050cce82dbfbbb0e85ab5f976fcd81086b3d8695502c5221c23d14080f0e494a33e0092b4feb2eda12e2130a2f02df3125733c2f5ec31356e92dea00b

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\MonoMod.Utils.dll

Filesize
319KB

MD5
79f1c4c312fdbb9258c2cdde3772271f

SHA1
a143434883e4ef2c0190407602b030f5c4fdf96f

SHA256
f22a4fa1e8b1b70286ecf07effb15d2184454fa88325ce4c0f31ffadb4bef50a

SHA512
b28ed3c063ae3a15cd52e625a860bbb65f6cd38ccad458657a163cd927c74ebf498fb12f1e578e869bcea00c6cd3f47ede10866e34a48c133c5ac26b902ae5d9

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\RVGLib.dll

Filesize
241KB

MD5
d34c13128c6c7c93af2000a45196df81

SHA1
664c821c9d2ed234aea31d8b4f17d987e4b386f1

SHA256
aaf9fb0158bd40ab562a4212c2a795cb40ef6864042dc12f3a2415f2446ba1c7

SHA512
91f4e0e795f359b03595b01cbf29188a2a0b52ab9d64eadd8fb8b3508e417b8c7a70be439940975bf5bdf26493ea161aa45025beb83bc95076ed269e82d39689

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\Sounds\Intro.wav

Filesize
238KB

MD5
ad3b4fae17bcabc254df49f5e76b87a6

SHA1
1683ff029eebaffdc7a4827827da7bb361c8747e

SHA256
e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf

SHA512
3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\XWorm V5.2.exe

Filesize
12.2MB

MD5
8b7b015c1ea809f5c6ade7269bdc5610

SHA1
c67d5d83ca18731d17f79529cfdb3d3dcad36b96

SHA256
7fc9c7002b65bc1b33f72e019ed1e82008cc7b8e5b8eaf73fc41a3e6a246980e

SHA512
e652913f73326f9d8461ac2a631e1e413719df28c7938b38949c005fda501d9e159554c3e17a0d5826d279bb81efdef394f7fb6ff7289cf296c19e92fd924180

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\XWorm V5.2.exe.config

Filesize
183B

MD5
66f09a3993dcae94acfe39d45b553f58

SHA1
9d09f8e22d464f7021d7f713269b8169aed98682

SHA256
7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

SHA512
c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\XWormLoader 5.2 x32.exe

Filesize
109KB

MD5
f3b2ec58b71ba6793adcc2729e2140b1

SHA1
d9e93a33ac617afe326421df4f05882a61e0a4f2

SHA256
2d74eb709aea89a181cf8dfcc7e551978889f0d875401a2f1140487407bf18ae

SHA512
473edcaba9cb8044e28e30fc502a08a648359b3ed0deba85e559fe76b484fc8db0fc2375f746851623e30be33da035cec1d6038e1fcf4842a2afb6f9cd397495

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\XWormLoader 5.2 x32.exe.config

Filesize
187B

MD5
15c8c4ba1aa574c0c00fd45bb9cce1ab

SHA1
0dad65a3d4e9080fa29c42aa485c6102d2fa8bc8

SHA256
f82338e8e9c746b5d95cd2ccc7bf94dd5de2b9b8982fffddf2118e475de50e15

SHA512
52baac63399340427b94bfdeb7a42186d5359ce439c3d775497f347089edfbf72a6637b23bb008ab55b8d4dd3b79a7b2eb7c7ef922ea23d0716d5c3536b359d4

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\start.bat

Filesize
59B

MD5
81a88df17e5b73e1836599034aa6cbe4

SHA1
ab48c97c37ed395bfa507ec1c14176e67ecab398

SHA256
f11af0fc77260978bd5c542172fd3f21a9ebd7bc8d5cab766cba4a480fa2c307

SHA512
c8fa430bf7c0036ea7230d49b525ee87b8d15e4e73b3417efe8816b82161df0a18214dca21777efd4fe25fae012ce4819521c5763a021b8099ed0bc703fb64ec

Download Submit
C:\Users\Admin\Downloads\XWorm V5.2\start.exe

Filesize
7.5MB

MD5
2e62e776b7eeac3dd713f1a6da5f942d

SHA1
6516d9ef1212939a12a84a396b3c64ecea878c11

SHA256
68b1696d3c76eedc131349ecd65a23372082feb83bb66d9d9be296916910e7ea

SHA512
04c73c5505e56fd21f1a25c085c99a1c1cc19cbac8004ce3e974e05f9754c5d07051fdfa53f5a0f0b8a89c16412757b1a29cf487c552212531bcac42ead849bb

Download Submit
memory/952-724-0x000000001CC90000-0x000000001CC9A000-memory.dmp

Filesize
40KB

Download
memory/952-776-0x000000001C470000-0x000000001C47A000-memory.dmp

Filesize
40KB

Download
memory/952-508-0x0000000002410000-0x000000000241C000-memory.dmp

Filesize
48KB

Download
memory/952-710-0x000000001DF90000-0x000000001E2E0000-memory.dmp

Filesize
3.3MB

Download
memory/952-711-0x000000001CB70000-0x000000001CC8E000-memory.dmp

Filesize
1.1MB

Download
memory/952-530-0x000000001C880000-0x000000001C930000-memory.dmp

Filesize
704KB

Download
memory/952-531-0x000000001DA60000-0x000000001DF88000-memory.dmp

Filesize
5.2MB

Download
memory/952-532-0x000000001B2D0000-0x000000001B2DA000-memory.dmp

Filesize
40KB

Download
memory/952-533-0x000000001B350000-0x000000001B38A000-memory.dmp

Filesize
232KB

Download
memory/952-538-0x000000001CE50000-0x000000001CEDE000-memory.dmp

Filesize
568KB

Download
memory/952-539-0x000000001E520000-0x000000001E9F4000-memory.dmp

Filesize
4.8MB

Download
memory/952-779-0x000000001C460000-0x000000001C46E000-memory.dmp

Filesize
56KB

Download
memory/952-778-0x000000001C580000-0x000000001C58C000-memory.dmp

Filesize
48KB

Download
memory/952-502-0x0000000000230000-0x0000000000286000-memory.dmp

Filesize
344KB

Download
memory/952-770-0x000000001C660000-0x000000001C66A000-memory.dmp

Filesize
40KB

Download
memory/952-769-0x000000001C680000-0x000000001C692000-memory.dmp

Filesize
72KB

Download
memory/952-712-0x000000001CDE0000-0x000000001CE02000-memory.dmp

Filesize
136KB

Download
memory/952-751-0x000000001C650000-0x000000001C65A000-memory.dmp

Filesize
40KB

Download
memory/952-749-0x000000001C640000-0x000000001C648000-memory.dmp

Filesize
32KB

Download
memory/952-738-0x000000001C620000-0x000000001C628000-memory.dmp

Filesize
32KB

Download
memory/952-727-0x000000001C610000-0x000000001C61A000-memory.dmp

Filesize
40KB

Download
memory/952-726-0x000000001C600000-0x000000001C60A000-memory.dmp

Filesize
40KB

Download
memory/952-725-0x000000001C5D0000-0x000000001C606000-memory.dmp

Filesize
216KB

Download
memory/952-723-0x000000001CD90000-0x000000001CD9A000-memory.dmp

Filesize
40KB

Download
memory/2472-527-0x00007FFF9F2D0000-0x00007FFF9F304000-memory.dmp

Filesize
208KB

Download
memory/2472-529-0x00007FFF7B860000-0x00007FFF7C910000-memory.dmp

Filesize
16.7MB

Download
memory/2472-528-0x00007FFF947D0000-0x00007FFF94A86000-memory.dmp

Filesize
2.7MB

Download
memory/2472-526-0x00007FF701C50000-0x00007FF701D48000-memory.dmp

Filesize
992KB

Download
memory/2532-425-0x00000000051A0000-0x00000000051BA000-memory.dmp

Filesize
104KB

Download
memory/2532-754-0x000000001A120000-0x000000001A26B000-memory.dmp

Filesize
1.3MB

Download
memory/2532-506-0x000000001AD30000-0x000000001B012000-memory.dmp

Filesize
2.9MB

Download
memory/2532-440-0x0000000002590000-0x000000000259A000-memory.dmp

Filesize
40KB

Download
memory/2532-433-0x0000000005690000-0x0000000005722000-memory.dmp

Filesize
584KB

Download
memory/2532-432-0x0000000006A70000-0x0000000007016000-memory.dmp

Filesize
5.6MB

Download
memory/2532-505-0x000000000F770000-0x000000000F79C000-memory.dmp

Filesize
176KB

Download
memory/2532-504-0x000000000F8A0000-0x000000000F922000-memory.dmp

Filesize
520KB

Download
memory/2532-445-0x000000000F3E0000-0x000000000F446000-memory.dmp

Filesize
408KB

Download
memory/2532-431-0x0000000005E30000-0x0000000006A68000-memory.dmp

Filesize
12.2MB

Download
memory/2532-397-0x0000000000660000-0x0000000000680000-memory.dmp

Filesize
128KB

Download
memory/2532-401-0x0000000002600000-0x0000000002642000-memory.dmp

Filesize
264KB

Download
memory/2532-402-0x0000000004F40000-0x0000000004FDC000-memory.dmp

Filesize
624KB

Download
memory/2532-406-0x0000000004EA0000-0x0000000004EC8000-memory.dmp

Filesize
160KB

Download
memory/2532-713-0x0000000005340000-0x0000000005362000-memory.dmp

Filesize
136KB

Download
memory/2532-714-0x000000001A8E0000-0x000000001AC37000-memory.dmp

Filesize
3.3MB

Download
memory/2532-410-0x0000000004C30000-0x0000000004C36000-memory.dmp

Filesize
24KB

Download
memory/2532-487-0x000000001A770000-0x000000001A8D8000-memory.dmp

Filesize
1.4MB

Download
memory/2532-414-0x0000000004FE0000-0x000000000503E000-memory.dmp

Filesize
376KB

Download
memory/2532-441-0x0000000005D90000-0x0000000005DE6000-memory.dmp

Filesize
344KB

Download
memory/2532-418-0x0000000005040000-0x0000000005096000-memory.dmp

Filesize
344KB

Download
memory/2532-728-0x0000000009CC0000-0x0000000009D1A000-memory.dmp

Filesize
360KB

Download
memory/2532-419-0x0000000004F00000-0x0000000004F06000-memory.dmp

Filesize
24KB

Download
memory/2532-420-0x00000000050A0000-0x00000000050A6000-memory.dmp

Filesize
24KB

Download
memory/2532-424-0x0000000005120000-0x000000000515C000-memory.dmp

Filesize
240KB

Download
memory/2532-507-0x0000000019670000-0x0000000019722000-memory.dmp

Filesize
712KB

Download
memory/2532-444-0x000000000C730000-0x000000000C924000-memory.dmp

Filesize
2.0MB

Download
memory/2532-768-0x000000000D160000-0x000000000D1AC000-memory.dmp

Filesize
304KB

Download
memory/2532-426-0x0000000005110000-0x0000000005120000-memory.dmp

Filesize
64KB

Download
memory/2956-377-0x0000000000130000-0x000000000106C000-memory.dmp

Filesize
15.2MB

Download
memory/2956-379-0x0000000000130000-0x000000000106C000-memory.dmp

Filesize
15.2MB

Download
memory/4004-383-0x000002F8D0FB0000-0x000002F8D1BE8000-memory.dmp

Filesize
12.2MB

Download
memory/4004-391-0x000002F8ED040000-0x000002F8EDC2C000-memory.dmp

Filesize
11.9MB

Download
memory/4004-393-0x000002F8EE830000-0x000002F8EEA24000-memory.dmp

Filesize
2.0MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads