6b8d2fec75b375cb812a008853ade87db1f03ee3e82a56270de6cb1894d17490

Analysis

user interaction
yes
max time kernel
151s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xmodhubInstaller__20260722_192800_channel100163.exe
Size 123.7MB
Sample260731-tpye7sdb98
SHA256 6b8d2fec75b375cb812a008853ade87db1f03ee3e82a56270de6cb1894d17490
MD5 8cfbba61d70c379018696f622d0f2406
SHA1 0773b7ac0b4a0ee0983c7a0f474e0f777a5f473f
SHA512 cb80b8d1c3b34c0980c2a1213ff4c6d43c999f4a35225b05a12c1206d7feb22b1a20970bb5220e78e7c3bc86f4ed35e95fae582822694c171ce7a9b75d2727b4
SSDEEP 1572864:fI0EtJY1+AmvFqbtcvXUMsUsDbh8uSO3ANVo4ryuHbHFH8w/gDJSGHkpDkHc5WGK:fD76FAtieSO3Akeb+9VSGHSkHc5E0YJr
TLSH
T1B45833107AA2C0B4D94502F23A3877A158A9ABE43774F4E767C03D9C3F728E1A6356F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
27	2600	xmodhub.exe
32	2600	xmodhub.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\04501a970ffa3b.dat	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\cert\CertMgrV1.exe	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\processProxy.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\vulkan-1.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\driver_x64\processFilter8.sys	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\driver_x64\Win7	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\cert\squidV2.key	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\db7f644fc60.dat	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\locales\es-es.json	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\lwf\win10\i386\ndisrd_lwf.inf	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\cert\squidV2.key	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\tools\api-ms-win-crt-math-l1-1-0.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\ChromeBase.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\CommunitWapper.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\driver_x64\processFilter7.sys	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\win64\old	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\lwf\win8	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\df95fd4b8da1.dat	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\icon.icns	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\driver_x64\Winbak\OemWin2k.inf	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\locales\ko-kr.json	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\plugin\LogicLib.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\lwf\win10\amd64\ndisrd.sys	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XGame\InGameplugin.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\autorun\dlls\MonoDataCollector32.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\tools\rlottie.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\locales\zh-TW.pak	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\driver_x64\Win7\tap0901.cat	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\cert\CertMgrV1.exe	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\Network.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\tools\HttpLib.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\tools\LogicLib.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\LICENSE.electron.txt	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\api-ms-win-crt-math-l1-1-0.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\tools\api-ms-win-crt-runtime-l1-1-0.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\locales\vi.pak	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\driver_x86\win7\tap0901.cat	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\locales\zh-cn.json	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\api-ms-win-crt-utility-l1-1-0.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\d3dcompiler_47.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\driver_x86\win10\QMTAP_tap0924.sys	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\73d44d85ff.dat	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\InJHelper64.exe	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\tools\api-ms-win-crt-string-l1-1-0.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\tools\api-ms-win-crt-time-l1-1-0.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\tools\concrt140.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\driver_x64\Winbak\tap0901.sys	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\lwf\win8\i386\ndisrd.cat	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\driver_x64\Win10\QMTAP_tap0924.inf	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\classwrapper.lua	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\api-ms-win-crt-heap-l1-1-0.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\CrashRpt1403.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\trlib\stub\TrainerLib_x86.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\locales\id-id.json	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\ce-lib64.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XGame\JYRedirector.sys	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\tools\api-ms-win-crt-stdio-l1-1-0.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\HttpLib.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\wiresockapi.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\tools\paho-mqtt3a.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\lwf\win10\i386\ndisrd.sys	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\tools\msvcp120.dll	xmodhubInstaller__20260722_192800_channel100163.exe
File opened for modification	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\CrashSender1403.exe	xmodhubInstaller__20260722_192800_channel100163.exe
File created	C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\driver_x64\Winbak\OemWin2k.inf	xmodhubInstaller__20260722_192800_channel100163.exe

Executes dropped EXE 5 IoCs

pid	Process
2600	xmodhub.exe
1360	xmodhub.exe
3508	xmodhub.exe
724	xmodhub.exe
4900	xmodhub.exe

Loads dropped DLL 20 IoCs

pid	Process
5076	xmodhubInstaller__20260722_192800_channel100163.exe
5076	xmodhubInstaller__20260722_192800_channel100163.exe
2600	xmodhub.exe
2600	xmodhub.exe
2600	xmodhub.exe
2600	xmodhub.exe
2600	xmodhub.exe
2600	xmodhub.exe
2600	xmodhub.exe
2600	xmodhub.exe
2600	xmodhub.exe
1360	xmodhub.exe
3508	xmodhub.exe
3508	xmodhub.exe
3508	xmodhub.exe
3508	xmodhub.exe
3508	xmodhub.exe
724	xmodhub.exe
3508	xmodhub.exe
4900	xmodhub.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4584	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xmodhubInstaller__20260722_192800_channel100163.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	xmodhub.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	xmodhub.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	xmodhub.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	xmodhub.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	xmodhub.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	xmodhub.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	xmodhub.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	xmodhub.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	xmodhub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	xmodhub.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmodhub\shell\open\command	xmodhubInstaller__20260722_192800_channel100163.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmodhub\shell	xmodhubInstaller__20260722_192800_channel100163.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmodhub\shell\open	xmodhubInstaller__20260722_192800_channel100163.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmodhub\shell\open\command\ = "C:\\Program Files (x86)\\xmodhub\\xmodhub.exe \"%1\""	xmodhubInstaller__20260722_192800_channel100163.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xmodhub	xmodhubInstaller__20260722_192800_channel100163.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xmodhub\URL Protocol	xmodhubInstaller__20260722_192800_channel100163.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5076	xmodhubInstaller__20260722_192800_channel100163.exe
5076	xmodhubInstaller__20260722_192800_channel100163.exe
5076	xmodhubInstaller__20260722_192800_channel100163.exe
5076	xmodhubInstaller__20260722_192800_channel100163.exe
5076	xmodhubInstaller__20260722_192800_channel100163.exe
5076	xmodhubInstaller__20260722_192800_channel100163.exe
5076	xmodhubInstaller__20260722_192800_channel100163.exe
5076	xmodhubInstaller__20260722_192800_channel100163.exe
2600	xmodhub.exe
2600	xmodhub.exe
2600	xmodhub.exe
2600	xmodhub.exe
2600	xmodhub.exe
2600	xmodhub.exe
2600	xmodhub.exe
2600	xmodhub.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeBackupPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeDebugPrivilege	2600	xmodhub.exe
Token: 33	2600	xmodhub.exe
Token: SeLockMemoryPrivilege	2600	xmodhub.exe
Token: SeManageVolumePrivilege	2600	xmodhub.exe
Token: SeSecurityPrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeTakeOwnershipPrivilege	2600	xmodhub.exe
Token: SeRestorePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe
Token: SeShutdownPrivilege	2600	xmodhub.exe
Token: SeCreatePagefilePrivilege	2600	xmodhub.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2600	5076	xmodhubInstaller__20260722_192800_channel100163.exe	93
PID 2600 wrote to memory of 4584	2600	xmodhub.exe	94
PID 4584 wrote to memory of 2916	4584	cmd.exe	96
PID 2600 wrote to memory of 1360	2600	xmodhub.exe	97
PID 2600 wrote to memory of 3508	2600	xmodhub.exe	98
PID 2600 wrote to memory of 724	2600	xmodhub.exe	99
PID 2600 wrote to memory of 4900	2600	xmodhub.exe	100

C:\Users\Admin\AppData\Local\Temp\xmodhubInstaller__20260722_192800_channel100163.exe
"C:\Users\Admin\AppData\Local\Temp\xmodhubInstaller__20260722_192800_channel100163.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files (x86)\xmodhub\xmodhub.exe
  "C:\Program Files (x86)\xmodhub\xmodhub.exe" C:\Users\Admin\AppData\Local\Temp\xmodhubInstaller__20260722_192800_channel100163.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "chcp"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:2916
- - C:\Program Files (x86)\xmodhub\xmodhub.exe
    "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\xmodhub /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\xmodhub\Crashpad --url=https://f.a.k/e --annotation=_productName=xmodhub --annotation=_version=2.2.2 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=21.4.4 --initial-client-data=0x5e4,0x5ec,0x5f0,0x5e8,0x5f4,0x7ff77c3d06e0,0x7ff77c3d06f0,0x7ff77c3d0700
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1360
- - C:\Program Files (x86)\xmodhub\xmodhub.exe
    "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --enable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 --field-trial-handle=1912,i,15970583326684798142,1212184202792335150,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3508
- - C:\Program Files (x86)\xmodhub\xmodhub.exe
    "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2312 --field-trial-handle=1912,i,15970583326684798142,1212184202792335150,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:724
- - C:\Program Files (x86)\xmodhub\xmodhub.exe
    "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Program Files (x86)\xmodhub\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3228 --field-trial-handle=1912,i,15970583326684798142,1212184202792335150,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47.dll

Path C:\Program Files (x86)\xmodhub\D3DCompiler_47.dll
Size 4.7MB
SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
MD5 cb9807f6cf55ad799e920b7e0f97df99
SHA1 bb76012ded5acd103adad49436612d073d159b29
SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
TLSH
T19E367D5673E940A9C1BBD138CE478213EBB1781403345BEB5191C669EF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Program Files (x86)\xmodhub\chrome_100_percent.pak
Size 126KB
SHA256 bca4401b578a6ac0fe793e8519fed82b5444972b7d6c176ec0369ed13beaad7b
MD5 44a69827d4aa75426f3c577af2f8618e
SHA1 7bdd115425b05414b64dcdb7d980b92ecd3f15b3
SHA512 5c7bdf1f1deb72c79b860bf48f16c19cb19b4d861c0b6beb585512ad58b1bc4b64e24edfcd97233e5b91dcd0f63ed1c7b278d22ec062fd0dfe28fe49cae52049
SSDEEP 3072:DKzwqCT4w/qzOovg6/Csp7O2o418Gb0+VRLf0ld0GY3cQ39Vm2I:DKzwt44yrgKpyK18Gb0OV8ld0GecQ3f2
TLSH
T1C4C3E0D7B3F5EDBDCA5355B3A12640B2ECB246351A92034A478FD8362A3674DD8C8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Program Files (x86)\xmodhub\chrome_200_percent.pak
Size 175KB
SHA256 b2c25fb30fee5f04ccdb8bf3c937a667502d266e428425feeb5af964f6167d48
MD5 9c379fc04a7bf1a853b14834f58c9f4b
SHA1 c105120fd00001c9ebdf2b3b981ecccb02f8eefb
SHA512 f28844dba7780e5f5c9d77ac3d29069dfcd6698447d5723886e510eadd51d6285e06adbda06bf4a69f841afc161c764cb2e5b9ad2c92f0a87176709b4acd2c13
SSDEEP 3072:oDQYaEQN6AJPgqzOovg6/Csp7rfR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNN:oDQYaNN68gyrgKpngx5GMRejnbdZnVEd
TLSH
T19804E1DB63B4DD7DC9630AB3A22901F1ECB1123559B6425B53DFEC353A56B8988CC283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Program Files (x86)\xmodhub\ffmpeg.dll
Size 2.6MB
SHA256 65b4aceb9f4bd81d3331671c99549876a7ed0da6d2dadd3dca8f2afdde557884
MD5 cd8057297794b31ed6e6fadd6089c095
SHA1 5453e58edb64d5ddfe68258059eb7daf0c719567
SHA512 b88e3b914476ccc56909efd7277a7fea9645ef3682a1272ae026276d46c1bd437b53cbc52b3d5ab0c2474ba4fd7698422d265e4e23468469e20a910d5a9109a5
SSDEEP 49152:+YuqVaqc35GHXVNtcZ44yODvSEbO/1o/GRRpYN4MJ8eIknusyUUjkU+jLtyTzQVm:+YLVl54yODvH/ySJUiLtyTzQVkU5qkJE
TLSH
T19DD59E13E6D644DDC01EC27487AF9233F93138468724A5EF2A9196252F3AFD06E7E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files (x86)\xmodhub\icudtl.dat
Size 10.0MB
SHA256 8d8a74ca376338623170d59c455476218d5a667d5991a52556aa9c9a70ebc5e5
MD5 cf9421b601645bda331c7136a0a9c3f8
SHA1 9950d66df9022f1caa941ab0e9647636f7b7a286
SHA512 bc9601e2b4ab28130bfadfd6f61b3ed500deb0bd235dc5ca94999c09f59d10bdcbf278869a9802f918830041f620c88e2c3b506608ade661db48ccd84c1977eb
SSDEEP 196608:j5zwSv9AAyse6liXUxCGZHa93Whlw6ZCnG0:jyKlysTliXUxCGZHa93Whlw6ZCnr
TLSH
T134B62907A2FB4DC2F9F7AF30D8F552679567BD496E32805A01442F3B1C337A08661BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Program Files (x86)\xmodhub\libegl.dll
Size 475KB
SHA256 89b0806fff9c4fbbdbd6cbf5e0990b130827e700bc8bcd5a767efe7a3835b217
MD5 ff06af01257a7d46a7e5f8f7b56ed979
SHA1 2377b597fab1892d3c77633c98ba2677587860a1
SHA512 c48d5e0e0efe9391b8cba776f9c297b1cd36a3e90102de1fdecc9f7e6c9a3ac8ae0f7d2fddbd4d341edddbcf2d6599d9df163d5bdf8a370d527d5a7f91184a46
SSDEEP 6144:J3rGS+e87yDqHfFetvM/jvtGgJ53B6Zj8s1al2zl0ovk1Su7emD:pGS+e87A6eZM/jvtGgJZB6ZirSU
TLSH
T1F3A48D16779844A9D03AC074CA538612DE72B8920F25F7EF12A4927D2F77BF45B3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Program Files (x86)\xmodhub\libglesv2.dll
Size 7.0MB
SHA256 317e3ca767c32fcc5e2aa4013cecaeb28998813e47dcf7026ee8366d1560040e
MD5 b11e1a9745f55a0bdaffe68fae4941e8
SHA1 0917b1adefca9d6aabd98212fde92d0284ce65f2
SHA512 e9987204b1bf5ce761ec2d78a38223a453cb259a9e93365125bfb2bc74c5cbca717baaa88dc2e440b6c2946903d606bf7f057d1de2f76f953472cc2eda28f643
SSDEEP 49152:BeVuXb3YA7G9pc1VFcghzu1nkSUvSZZ54xzSDXUJV76dLLeEyet6r2ehnWJ6TQVH:EWZ7+CmV1L/zvWXtKZHWJvlP1HQ
TLSH
T117766B07E695409DC05DD2B88B5BA222FA70BC490724B2DF269473152FB7BF46BBE710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Program Files (x86)\xmodhub\locales\en-US.pak
Size 302KB
SHA256 a99bd31907bbdc12bdfbff7b9da6ddd850c273f3a6ece64ee8d1d9b6ef0c501c
MD5 3fef69b20e6f9599e9c2369398e571c0
SHA1 92be2b65b62938e6426ab333c82d70d337666784
SHA512 3057edfb719c07972fd230514ac5e02f88b04c72356fa4a5e5291677dcbab03297942d5ecdc62c8e58d0088aed4d6ea53806c01f0ea622942feb06584241ad2d
SSDEEP 6144:yoaiWmH9xPN6DacNMP9elahdQfaYejDJDsN5ySMZswS:taiWF+cNMbhd7jDJi5ySEswS
TLSH
T15E645D1FE784226A069352627F05A5A2FB36C06DA35112573CBC812C33B7B66C3777E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Program Files (x86)\xmodhub\resources.pak
Size 5.2MB
SHA256 f7fdde9650504d8872a7aa2b68e1f5b3cedd100ded1e19e44c2b6282eb637813
MD5 f6dd61d802bfe64545deaf4c93eb6db9
SHA1 96be1ec4723a6dc2b1dc6e073a7dab026443b1fb
SHA512 33585e7f19222e43926bad8cdbf36bfd395feb4d043f524f82053920405afd933eec4d294b6558409ee9419c977553e513549470638532dc19bb93296387cf76
SSDEEP 98304:lLFhuX3bm18oDS6qdKVFzh1s3U7sHCMvrwrfinPF1GZW+extMVUAkWZkm:lL/mbm18ov5hqU7sH3krfAPfGZMkHkm
TLSH
T10B463310F2946C32D5C993B6E8A890272B38D54319E1785CF4CD651ECFADAAB05387BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ndisrd_lwf.inf

Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\lwf\win7\amd64\ndisrd_lwf.inf
Size 2KB
SHA256 9344e5652e449b4e722d8a00f666cda147d5305b913102195bd7255124a413bc
MD5 594d8fca1306a345056e4ee299d3ca98
SHA1 86332a69361ec9676eb07f33fbf841f9e057a70f
SHA512 ad01e07cb158c16ce88aa8e5636e3056d61dd295dce35db36cfc766b4518fe00a98f10064b99bffb691b701ff522f9bc1571d825fdbb8049cabdbc4ce3f2c64a
TLSH
T1E6510F3C4EC53A3414A3D39BB74E2CC2E42C6084959D1248B3EE44A2D78F9DDB22C969
MD5 SHA1 SHA512 TLSH

Submit Download

XAccNode.node

Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\XAccNode.node
Size 192KB
SHA256 026872ad5ae6b1bad3c5084fc7d609d6a02f69f9f3637986ced995f999cb541c
MD5 fd258fee82bbef56dcd5a09daf2d4445
SHA1 ec549c3f27dadda5304cfa7786e8c30f85aaba74
SHA512 6694f72db41c34039020a97cb7c76556999c339c8cf5bf7a35d53429e5f2e869231c45a8e3c2892ed3a5408843301a27a6885f70774d531c4aca433b6404dbd0
SSDEEP 3072:NpclFNRvdGSNRaUo4xy5LxatIKiqLhGWXnnXA/kOofl/8N0uheg:NCFNRV1UWUflKfLErOk3kg
TLSH
T1B0147C1BF765007AE9778938C9530D02EFB278414BA0AADF47500AF69F6B7E05A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InGameplugin.dll

Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XGame\InGameplugin.dll
Size 2.4MB
SHA256 8f7d7119b4b3b1e4cf81e94b9cd426625fb63f20446e1ca78a35fc694b855c1d
MD5 c9f2a1d762e225b3a4684ec3b65cc972
SHA1 1c7c1d0d065d199057e3802d2ed067b247df9a3d
SHA512 3022e24d896250feae8dca81fd1d8aac7da26d7748616416d568f699c770fb872e3a4b1cddd91fce94cd8cc8ba35b8784078c27d93ae2fe698cad8d77d38f8b5
SSDEEP 49152:X5fnv0CYOPsmnBkDM/GXmk8087tc+tUORn39:X5fnLlEiBkiGXs0Atn
TLSH
T1E4C53B126509903AE96B0271C6AE9E7F959C9FE0035852CB83DD0D8F6A694F37F3B143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InGameplugin64.dll

Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XGame\InGameplugin64.dll
Size 3.0MB
SHA256 1f7c6b2771241f3a3e3700fb3a66036e92aa224f7741c6518a8968e7a2bdab2e
MD5 06c1141ad3d1d7692f3282221cdadd71
SHA1 47931d69b69228a9c03d816c6a8710915f086e20
SHA512 b839caec29e66075e31bf454334fa5af8e9553745a07263dea015ef581c24ff2c4f8b5b015ea59f151bbce1f19ed1633cd60b1c749062112645900ef5e76cb01
SSDEEP 49152:jIfUgsN5Or5p9uoNj76UOarAD80D/I+DgygS47SMer3Omp:jIxR99ZOarAv5Y5Opp
TLSH
T1E4E52A17A66A51E8C0BAC1348647353FF9B07491437293CB87A20A4B6F177F6AA3F741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\MSVCP140.dll
Size 562KB
SHA256 b99eb28a471311113f5c4109cb3c463f39cfd9bdb3b07f706204dedddb4516a1
MD5 7acbc57d268a691247b4a94fecfa42b4
SHA1 67bd76111b4ab8f4c0692919153dde2e7c8070f1
SHA512 b08140ce86ea78b481b78644f086359326616a56fb3a3953da16a7fc2bd15a493652f22d4d2fcba3675c668b9832fdb7d5f17a8aa6ccdb74e7b746a79df60b88
SSDEEP 12288:O9zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVhEU9:O4wPrALhAYvogQEKZm+jWodEE7p
TLSH
T139C41923B74905E0E195E3B891878306D7F1BC4A8312A3C792EBD69D2F677D1673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XGameNode.node

Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\XGameNode.node
Size 807KB
SHA256 d2c97b86ce0dbabaf3def9029ab60180e621f83ea609164b6939e31b27e3b663
MD5 c2581b7e625083e7e271ecbf072fbcd6
SHA1 b818ff75cf6ed668e7c406956702ecb2a9dcfbaf
SHA512 dbf520d22030889d81f440863ec5b077d8e585695fe9991d3b86dcfce6a471dc64d20b9e2de5deafe01d70b5658cd07143e457716ef6b6a7d3fb5d2560cd8f56
SSDEEP 12288:oG/z93F9dRup7jQ+e2KRE5dN7JeLKf3XOQ:fp3F9dRUA+uRYJeLKf3XOQ
TLSH
T16405F75AEA3551D4D4BED1788643652BFDB1385E8374A7CB8BA14B861B23BE0F53E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XModAddon.node

Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\XModAddon.node
Size 3.6MB
SHA256 50ac22c6d72347bafabe6bbd8505189aa87880172e37f9a18313831c814adba6
MD5 bc01287b891647730e27cc2678e5a8a9
SHA1 ed20dbda8d2b357641554e2c766e356e14305d1f
SHA512 a8b186edafc236ce2b15ec67c227f773cd4865cd073104b6d8521d719f7175af25b7eba78fe732a6ca85654ea8f88154f2d42938bb173d0196cee58a0055eba2
SSDEEP 49152:cLOozd1oTdQ0NppFPwR3SYD6+mtQOh5PIKWwbB45gnm47tPBooT2bN8vtqP3ni8:OGdYR3qyKTbHZHop8vt+ni8
TLSH
T151062856EA7511D5C4BEC1788257A627FDB17C5E8334A7DB8BA08B460F22BE0B53E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\vcruntime140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon.png

Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\icon.png
Size 528KB
SHA256 1f96d3a64acf3e71f4b351656130937ffb63844de6f8bbc48cce07fbd9f0be60
MD5 fe83a7f4054b7c3b23d723f15022727e
SHA1 4be199f79f2d4fc0be6ed5f98ce766595c04a767
SHA512 48d6e57c1c344479a96a4e52ca6793b06486342fde64f8afef3c71b9e65ea477cc49a5daf332a6a27e80ef37a43f208da102e39f39cdc3e2ff525456b62f8e48
SSDEEP 12288:0jSZRIFFUtUwv+zAAvQrk+qU0V0H6UwvHOBrN4nckL:JkUKwv+UAOEV0aTvDfL
TLSH
T123B423A5BA3A93EFFD7D8D1C4B1781C4E4F412500296ED3D202C7D4C61DA4A0EAAF5E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-us.json

Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\locales\en-us.json
Size 50KB
SHA256 84e863dbeed13e40434172636b0766221f9a86834b93f04027603928ed6c2de6
MD5 436ad0e18448686ec1c6c3918bdb145e
SHA1 1334d023d0f831a47247d365cbf80ed8265341d8
SHA512 ad14ee8ed0c790b7478fc2623582c923b1b03235cd22b4242cf86e17a60f809fea121793476e767034d9e3027fb2623e4b7a65b283b341fbb511dba63c39a34d
SSDEEP 768:FfzC+kHGtBO1tNEBpsX/n50OG3sQmtxvdMuOaLKSKGvbp2Cm:FfzrkH/nEBpa/n50CNOaLkGvl2Cm
TLSH
T1DD33832BA25544B75CB44291E56EF9A336410FDF03B0BE5FF6BF8058298B51932AB343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

koffi.node

Path C:\Program Files (x86)\xmodhub\resources\koffi\build\koffi\win32_x64\koffi.node
Size 1.5MB
SHA256 c6e5d31aefe5337fbf0f7ff89a3f5434d5974552314dece7890f00dcc2febcdb
MD5 b1260c5258e42ea35e6136159095e1ef
SHA1 e2369987e2a05d27e21950b0b973f3414ec7cb9c
SHA512 3c6b0bdbe651a200ee9d6ded2ecf8a970fef581882472e9145d6685a9af14a5b39b64ffed96f07ad46991747303986077f2ab764caff13f221e37bb1323dceee
SSDEEP 12288:jzlZYkFrYoBU7A4WONVMhFaBpfmrytFNXrfKh4ICXoEuBN2vo2Jb0afMhpCcSBUV:v7NONVSFsOOt3rKi7oEur2JTk4ytjt7F
TLSH
T17A752815F75981E9C06ED2344F72C716B9A4E811437E69CBD29DFEE82E025BD903A2F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Program Files (x86)\xmodhub\v8_context_snapshot.bin
Size 710KB
SHA256 ea2ea0f97ac908fd127a423f505241ebf4acea0ba5d02635cae40f7cd9c2f464
MD5 4d582d568efb15b489a15be358d9a68f
SHA1 295393f0707d04ed60ebda8ea7c0297c411c7f33
SHA512 ed8a6af3d51904020abc8e8f3e734ccbf1663d8bd3c0f526e1d69ebfdf47b6061fcf3660b70239ba755f1273f6c608054d6dccd3721a4bcd81e7e9f3a3c7daf9
SSDEEP 6144:4dxIaCPBHaXAqTOLhzTRQsLRgBoGngm9R4T8kfS7eTTId5r1q5:4dxIdhaXAqEKGGg6Tkfdwd5r14
TLSH
T183F4A539F719CA2AEB03ADFD09C2D94531B1B948AF56152BB1E9072F71EBB581C70390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Program Files (x86)\xmodhub\vk_swiftshader.dll
Size 4.8MB
SHA256 47bc40c94aad116abad0bb5d6ebf15e7c0b705aeb70f0694b4449d1dfadb8b4e
MD5 ea215eaff18511332b8a60ad6bf0b008
SHA1 d5ff9eeccced2106c1c827aa8ce3a18e221386e0
SHA512 66ada972480633d498167b9135aac28f0ac3a94ba0533d59da5c0729a5e8e3ce269c08fb7c0109bc7b663d0ac4e327f8af7c49de015c3c6f766f0a1da2545782
SSDEEP 49152:+veyoM/h2BPSjPJEvoSNxxJanAf9dX2kcngUkomWPG2pu6n9MT5F9AZCeqx7l1Zb:8QM/agZaHt7A4P/5
TLSH
T12E364B03F6458199F06ED17D875BA622E671BC811B7276EF12A02F062E77BE06B3D704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Program Files (x86)\xmodhub\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Program Files (x86)\xmodhub\vulkan-1.dll
Size 870KB
SHA256 7c4306b93cd576d7e4e6086fb8398e6cd799e75a17252d1108227b94e9d51c27
MD5 2eb26a9e57d9fd4fa3f700a3648ac9e0
SHA1 67ad8cc1f357c937e65134100076aef6ff7b883d
SHA512 a15838592cfda30f4692a522043036e3003285538f5a6126780c631e71d229039f9bfdf6dfc7a8ffd0ff1c63fbf1f3adf3bd1e49e23e71013ae6c77083e9ebef
SSDEEP 12288:pefVW1lX8MvG9E0wsYox2Nmp6yWEaAT6bJUQzH3To+/AEir1iS9:pOcTX8p20wsYHmXaATmXjyF9
TLSH
T15C156D27AB948566E476C035D9C28603CAB17C921B26B6CF03685718BF6FBF4273D724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\7z.dll
Size 1.2MB
SHA256 3ecf0c1a718f41ece87fad7029daa2f5e604f2e94449a66e8bf54252850eea62
MD5 0aa22aa245beaaef61a6b14277979016
SHA1 1a800f32b05b12cbbfdb0766ce08c61e7019509d
SHA512 ec8a93cac566366b95af807167426c67a7dc837a8401e7b552584037d3d24275f34559ee478a60c5c843ad1fcd2c592b80d37b19813bf9e1aaee60bf9f893a28
SSDEEP 24576:J9B/D4ANS6guGJyYQwOGbRCVV+peJYm3nYnXXZK50ILm:7BL4A8PZbRCy4Ym8ZK50ILm
TLSH
T113558D06E7B188B4D98E51304B3DBB65616DFB088790D8DBA3907D5E3F318D1E638E89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\DawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\webview\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\webview\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\webview\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\webview\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

fb0e1645-5046-4552-8508-2381def528e9.tmp

Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\webview\Network\fb0e1645-5046-4552-8508-2381def528e9.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
Size 24B
SHA256 ebd830cd5ac9209423fe2104f8c54a24d8395ff14eb47e0d6eed476df39ce6ac
MD5 0e730e7e6236c02e4fc10559d8831556
SHA1 e8773568cb6b9645d5598d4fb7b11bab62433c65
SHA512 44bb9e1ac364887b4be4045b27a28312e7d8f0934d27242071c011cc69c4fc09e978817f608c503c0d3a77308d4f4cf0ce0425a5e67da1e515b5fa36228f6b91
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
Size 112B
SHA256 f6126b730286d100b275719195366c4f7373d7129efcd30ffb59be085cae0c8f
MD5 46a5866661f85c3d65a2f1ee00af45c0
SHA1 47f98d9b2abee27810b3809c9d74e4e44920fd8b
SHA512 6cdb28ea4a37416c01461d536ae72593650a0d1691c75882dc6e5818b3ff86c5f0969a1cd1f85a9bb2fb5bd8fae5a17f833de9a38c3d0be51a6a71ba3b8f17fd
TLSH
T1AEB02202EA20C3EEAC800B3BBC8E2003C2008388330B0808C22000CCFC000B3E002E83
MD5 SHA1 SHA512 TLSH

Submit Download

config.json.tmp-55147830777be866

Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-55147830777be866
Size 49B
SHA256 be522923fa4893f78d80e9f4a65a94086f85afa53f9aecffdfbc47e6e5fb6b62
MD5 2773e6af520b0e26163ce897b8bff74c
SHA1 2446a05138da166415a1781bdcb730126f687bcc
SHA512 ae2b9990c5f76fe886abf51fdd0d3ad23b82a9787f811b1b79bc4e0741064861c4d3513cd84afe6d50ca3123be9b9d7b4e45b9ed6700147e933183858d0b3c6b
MD5 SHA1 SHA512

Submit Download

config.json.tmp-55147834286f454f

Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-55147834286f454f
Size 136B
SHA256 b9d3446a740021db6c019c35959bd539722d95433a209b4e47045337e5b3f69c
MD5 6470a619c8040b61ee911899a2e225de
SHA1 3eb83229b8d13b8ac633881eb424a5e123442489
SHA512 c80ebfe0fad83660804b015416a52d7a508cf2e7add1191d70ec56db7c942bec3ac74cec61254ced15ba099737822b6b7edb82e4aad2d2a3439735352c114550
TLSH
T164C02B01D520C3DE7C500FBBBDCF10428508278C77070444824500C8F841273E003D43
MD5 SHA1 SHA512 TLSH

Submit Download