xworm | hxxps://cdn[.]discordapp[.]com/attachments/1346963151010271362/1347580437962297447/Vortex_Gen_PATCHED[.]rar?ex=67cc5795&is=67cb0615&hm=04e78c446805c34ea3ea8fffb3fa41588263cfda15ace273b5d2be96826f1495&

Analysis

max time kernel
200s
max time network
182s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250217-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07/03/2025, 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1346963151010271362/1347580437962297447/Vortex_Gen_PATCHED.rar?ex=67cc5795&is=67cb0615&hm=04e78c446805c34ea3ea8fffb3fa41588263cfda15ace273b5d2be96826f1495&

Score

10^/10

xworm discovery execution rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:45776

unit-wellness.gl.at.ply.gg:45776

Attributes

install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000027ea9-52.dat	family_xworm
behavioral1/memory/4524-53-0x0000000000DF0000-0x0000000000E06000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
520	powershell.exe
4212	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1095212214-1383118828-1037266802-1000\Control Panel\International\Geo\Nation	XClient.exe

Executes dropped EXE 2 IoCs

pid	Process
4524	XClient.exe
4028	XClient.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133858324465936490"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1095212214-1383118828-1037266802-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
924	chrome.exe
924	chrome.exe
520	powershell.exe
520	powershell.exe
520	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4524	XClient.exe
4524	XClient.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
924	chrome.exe
924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeRestorePrivilege	3908	7zG.exe
Token: 35	3908	7zG.exe
Token: SeSecurityPrivilege	3908	7zG.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeSecurityPrivilege	3908	7zG.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeDebugPrivilege	4524	XClient.exe
Token: SeShutdownPrivilege	924	chrome.exe
Token: SeCreatePagefilePrivilege	924	chrome.exe
Token: SeDebugPrivilege	520	powershell.exe
Token: SeIncreaseQuotaPrivilege	520	powershell.exe
Token: SeSecurityPrivilege	520	powershell.exe
Token: SeTakeOwnershipPrivilege	520	powershell.exe
Token: SeLoadDriverPrivilege	520	powershell.exe
Token: SeSystemProfilePrivilege	520	powershell.exe
Token: SeSystemtimePrivilege	520	powershell.exe
Token: SeProfSingleProcessPrivilege	520	powershell.exe
Token: SeIncBasePriorityPrivilege	520	powershell.exe
Token: SeCreatePagefilePrivilege	520	powershell.exe
Token: SeBackupPrivilege	520	powershell.exe
Token: SeRestorePrivilege	520	powershell.exe
Token: SeShutdownPrivilege	520	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
3908	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4524	XClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 2724	924	chrome.exe	84
PID 924 wrote to memory of 2724	924	chrome.exe	84
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3752	924	chrome.exe	85
PID 924 wrote to memory of 3576	924	chrome.exe	86
PID 924 wrote to memory of 3576	924	chrome.exe	86
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87
PID 924 wrote to memory of 948	924	chrome.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1346963151010271362/1347580437962297447/Vortex_Gen_PATCHED.rar?ex=67cc5795&is=67cb0615&hm=04e78c446805c34ea3ea8fffb3fa41588263cfda15ace273b5d2be96826f1495&
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff94b2bcc40,0x7ff94b2bcc4c,0x7ff94b2bcc58
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,15725338114366142698,9043111099916159018,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1856,i,15725338114366142698,9043111099916159018,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,15725338114366142698,9043111099916159018,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,15725338114366142698,9043111099916159018,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3172,i,15725338114366142698,9043111099916159018,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4828,i,15725338114366142698,9043111099916159018,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5028,i,15725338114366142698,9043111099916159018,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5108,i,15725338114366142698,9043111099916159018,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4216

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Vortex Gen PATCHED\" -ad -an -ai#7zMap1171:98:7zEvent31182
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3908

C:\Users\Admin\Downloads\Vortex Gen PATCHED\Vortex Gen PATCHED\Vortex Gen\XClient.exe
"C:\Users\Admin\Downloads\Vortex Gen PATCHED\Vortex Gen PATCHED\Vortex Gen\XClient.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\Vortex Gen PATCHED\Vortex Gen PATCHED\Vortex Gen\XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4212

C:\Users\Admin\Downloads\Vortex Gen PATCHED\Vortex Gen PATCHED\Vortex Gen\XClient.exe
"C:\Users\Admin\Downloads\Vortex Gen PATCHED\Vortex Gen PATCHED\Vortex Gen\XClient.exe"
1⤵
- Executes dropped EXE
PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
4f337a0f6ebb352f781807980cef3fe9

SHA1
8b6d02e14af5c395f9f9a9d420587ba15be76ba0

SHA256
99113e7063a2cdc3df98eafa00b25167535b556424f6f0ee0f77a2ced13ee906

SHA512
0fa237982b532488c021dbbe2f70e7f61c09e65eeabe633bdfd39af682c8e80f1145cc76e88eaea11b3ee84d4e6d5b58833d60e4bb4a62922e67f5233875a6b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e6709420bed5d3289b72544b280b6d50

SHA1
7b25b08f408bbfa89f66927eab1c61f8f2bed830

SHA256
12b9c2694936fd783bd40023b52448468b15da11c59f495d4ee0606c6ec4a620

SHA512
3f9afb482741cc0481c74243566fdf6c206ee88d184a4b52d4c5f7db5dc6db4750947516ee3ff12ce32cc072cde4e368e68af063cfb8504c025e94e9954f3bf7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c329f1bf447169486413079eb7f4301b

SHA1
d61b8480fedd758d6e04bd91b2eca14ad9c73246

SHA256
a24c79dbbe5b8f602ec2e4d173712f45dc3cae309208af436dc06d6a88a48a7c

SHA512
1b1042779ce8756a952a2d13f222404529e23694341619ca8930d1e5789e12e3691f0f9ba52d2f06455b99356006d87fb1c0f181cfc3caebe83ef7f033d1b9d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
399046f255dada8798a5d1f739a4f35b

SHA1
00d81b4498d563a4a7ba925eee1cd427d41bb79f

SHA256
903ccb0c11172df9e7bf649e4f1be7d913845aa213b73a6aa4b120e120ae4baf

SHA512
9daee4954b4989fff1eafc71c09d923f9945bd79ace8e5f9dcf35d85ce37de2dbf3bec91c5648237a11598ff4fabc4a94052eeecaf3ae38ed4b545a3b4b55e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
d5be326b666ab029b06c2adb803e329a

SHA1
968092a5ceddfe667d9d336cc4a5283f973c2b1c

SHA256
3f6539babdb3b48377390ee86dbeb716972c4a9cb95bb552e31ab3fd3691d432

SHA512
90d6382d43cfcd9306e1901e0999b3e52a5148fd21156e9c49947f8f4ec4735224cf9c7d8c9638f44a1e19d11cc9533c80bbbcb39d37f38ed6211c183f5c349d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
f104204aabd4d82d38a5bd8a0031f904

SHA1
c2399ff49e9f11ef8bbcde86e70600ceabbdf156

SHA256
d9b21b9a4e22e153ca4018b8fbdfdb2ec8f4f86c373e56b689265797deb82049

SHA512
ed474cfedd628094b4760cafc82a4e02d5d05bdbde5d3e074a9c793a7e1533d2ee3aa9c972d6264b65afcf839cad39ef62334b13eb1c01d19338328c2a8ea98c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
9ed5ff12da3226ef9bc49da96fe625e8

SHA1
792aaf41e112b8050b74f048029251cdc5d67b5d

SHA256
3381b3da55d8520afb59d0df20ccd17351200d84df79df07530ae4c9cb9f3743

SHA512
fd4fd1bad5885c1080d8a62f2977a86305f24052a6b24f06d45bc34720b6a0efbf3cb2d1903ca81dcb70986336df108df126e7febb9f5de5b3bd817a9554bdfe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
2243d48bf4a5eb8323a70daf9607e1ad

SHA1
54159f46dee72accc1860aef1d1bec095fdd8102

SHA256
5859a31c940472c3673449755f00622b46e909f23c7a3b0c901b396e899cc07a

SHA512
3f9db382eabec1d997b53f4e89b9d0b44407aa9ca1e96aae07293878378aba8e18c3c05243c5c85b6c0507cfd98a8ceaf9dda0f0198bf99846021dbe3d2175bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
6fff1a263abf29651105b2b0c472ec76

SHA1
bc4a1f7dc707647c77d7024261e806a490032153

SHA256
3f1a0a449979f4c74e57729217a273179cfee3da1384d5307c11b4461570ca05

SHA512
cd93a643ad15d9638cb44e37a7b7e8fca9217fc0e38a45c2dc6377c590417c702b1d5b1df7e5d087e3172a1de1505a26db81fb534fb6a903c08038113c344777

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
9fda92d27e3eb72bb80572e3fdf86db2

SHA1
37cbafd578e49a839c6466dc964047128dc48c83

SHA256
41ebe0553cc03119eae9f5cb03c38893c1d77e253db8b3ea77e4cdd313d9ac38

SHA512
1b7ce8d0c29c6ec2214c365b3c9b1b741100c4a6e8c99212381d85f9bb0d4f32295c4b39912a98ccb831ee178b16b72d65958988ec7d46e8ad574899402b5e77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
4fb3ba424ab2d5f9fe56d44d367180ca

SHA1
a040646899be9e127fae196dc923f75296012598

SHA256
0a82dbd2201aefab3b6a6377b0b228b10b0b9b30640b382be330f6cdcf160b26

SHA512
cab22bbd2de13b4b3cd20e62fd4b632b7d4f76f394a344be2e8806653bb1db68b68f5ef1c93ebe09e84d94b9759d57da0cda2e04ea2e5202aab991bf4100b84d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
020d1cbef5aeb22088c0faff8d76af4e

SHA1
93e7f27b8fb57cfea4ae330bedcace1a8ce7c014

SHA256
cb283829df7f7ca2f7f8072ed014bebb7d424581e8672a9fa5683f3674726bb0

SHA512
1046228ed9d08e5296c02409b5aa460e8280a633f7f2022ec7dc7c1e750522260006844bd5114ec713593bce1d10b8932963a8630e6707e76b45a0cb8c8ff53d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0d9ee3fed6743bc341bbb3683125d066

SHA1
e39707e7ac64fddccad2c0a1c8fa88e5bfb50945

SHA256
fe35f71394332712438c468ca4032079fdfd19858ddf3e6b2450583ffc46741b

SHA512
bbb1d9c36130b60975e167cba532861a517d78c51223e535badb7a017c7af362fa94f9a77a0619363998f86d15f74ed5c9615552d3bc0746406df8db2762b10b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dvzehy40.5fj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Vortex Gen PATCHED.rar

Filesize
41KB

MD5
17102bf337d11ea6a579ac64075e1f9a

SHA1
5c2f70445364c1edf0b65e0415e8eacc2a3de4d9

SHA256
66fc2e8fc6315411b647ec2afcef025e4e600c28eca0b31294194e1bf9802b80

SHA512
3bdb07b4327ec739b0d1f090ede9f3d9f170700116af06be0c03bc2e270ede356ea9e058d03d4e87bee2c4af6069d39bd6850988fa841a541f4d378902bf7062

Download Submit
C:\Users\Admin\Downloads\Vortex Gen PATCHED\Vortex Gen PATCHED\Vortex Gen\XClient.exe

Filesize
66KB

MD5
da7e562583250093c142f23d6a669b29

SHA1
45883bbfe39e255393149d2a3ad896cf2c46e821

SHA256
afe308c1a49aa02b0b3c92e575746f21aa603dc6ed2d19ed9335c4bf2413de68

SHA512
e486f4632b0431854456cf66808622618d3064e743e0485ae5cf17ca958b44a4ede86376ff1daf185ce39272d97cac36c28d0e56ad341472d75ab82a5056e1bb

Download Submit
memory/520-63-0x000001DF919A0000-0x000001DF919C2000-memory.dmp

Filesize
136KB

Download
memory/4524-53-0x0000000000DF0000-0x0000000000E06000-memory.dmp

Filesize
88KB

Download