Overview
overview
10Static
static
10XWormClient.exe
windows10-ltsc_2021-x64
XWormClient.exe
windows10-2004-x64
XWormClient.exe
windows11-21h2-x64
XWormClient.exe
windows11-ltsc_2024-x64
XWormClient.exe
android-10-x64
XWormClient.exe
android-11-x64
XWormClient.exe
android-13-x64
XWormClient.exe
android-14-x64
XWormClient.exe
android-15-x64
XWormClient.exe
android-9-x86
XWormClient.exe
macos-10.15-amd64
1XWormClient.exe
debian-12-armhf
XWormClient.exe
debian-12-mipsel
XWormClient.exe
debian-9-armhf
XWormClient.exe
debian-9-mips
XWormClient.exe
debian-9-mipsel
XWormClient.exe
ubuntu-18.04-amd64
XWormClient.exe
ubuntu-20.04-amd64
XWormClient.exe
ubuntu-22.04-amd64
XWormClient.exe
ubuntu-24.04-amd64
Analysis
- max time kernel
92s - max time network
128s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/09/2026, 19:34
Behavioral task
behavioral1
Sample
XWormClient.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
XWormClient.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral3
Sample
XWormClient.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
XWormClient.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral5
Sample
XWormClient.exe
Resource
android-x64-20260325-en
android-10-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
XWormClient.exe
Resource
android-x64-arm64-20260325-en
android-11-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
XWormClient.exe
Resource
android-33-x64-arm64-20260708-en
android-13-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
XWormClient.exe
Resource
android-34-x64-arm64-20260325.1-en
android-14-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
XWormClient.exe
Resource
android-35-x64-arm64-20260325-en
android-15-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
XWormClient.exe
Resource
android-x86-arm-20260325-en
android-9-x86
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
XWormClient.exe
Resource
macos-20250619-en
macos-10.15-amd64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
XWormClient.exe
Resource
debian12-armhf-20260513-en
debian-12-armhf
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
XWormClient.exe
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
XWormClient.exe
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
XWormClient.exe
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
XWormClient.exe
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
XWormClient.exe
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
XWormClient.exe
Resource
ubuntu2004-amd64-20260513-en
ubuntu-20.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
XWormClient.exe
Resource
ubuntu2204-amd64-20260513-en
ubuntu-22.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
XWormClient.exe
Resource
ubuntu2404-amd64-20260126-en
ubuntu-24.04-amd64
0 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target XWormClient.exe
- Size 32KB
- Sample260905-yacbmsff49
- SHA256 cf14244fb788ca119fbc290c434897e7e928cd8b7bec19e501b92f8cabde38ae
- MD5 cbc28d047ec88a5170010676d6d275db
- SHA1 3361e48376b4ada8310a7ccded47e7f2a776bf37
- SHA512 53545d8aada0c72097e6316e9a87b17f66ded2657489149dbb33cbe85723262d2bd2e2b22d73c2d0eb191fb7b40537affe3e88faa65dce2df4a02c7db229c4a4
- SSDEEP 384:oYaJWq4Ava7Rm32oDuuw3+q5XwYeLBEwvh0FbOKTCOQS+RApkFTBLTAOZwpGd2v9:gxC3fOJ5ywvGFbO75S+VFo9jrOjhZbO
- TLSH T16CE24C4877E44312D9FEAFF02DF2710A1675E11B9823EF5E0CD4C99A2B63AC146507EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
89.190.158.167:911
Mutex
-
x90mfbG7q12JM7dT
Attributes
-
install_file
USB.exe
aes.plain
Signatures
- Detect Xworm Payload 1 IoCs
resource yara_rule behavioral3/memory/4616-0-0x0000000000380000-0x000000000038E000-memory.dmp family_xworm - Executes dropped EXE 1 IoCs
pid Process 1888 zrxtxc.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 zrxtxc.exe - Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\System32\ntoskrnl.exe zrxtxc.exe File opened for modification C:\Windows\System32\services.exe zrxtxc.exe File opened for modification C:\Windows\System32\svchost.exe zrxtxc.exe File opened for modification C:\Windows\System32\shell32.dll zrxtxc.exe File opened for modification C:\Windows\System32\csrss.exe zrxtxc.exe File opened for modification C:\Windows\System32\smss.exe zrxtxc.exe File opened for modification C:\Windows\System32\wininit.exe zrxtxc.exe File opened for modification C:\Windows\System32\dllhost.exe zrxtxc.exe File opened for modification C:\Windows\System32\ntdll.dll zrxtxc.exe File opened for modification C:\Windows\System32\user32.dll zrxtxc.exe File opened for modification C:\Windows\System32\gdi32.dll zrxtxc.exe File opened for modification C:\Windows\System32\lsass.exe zrxtxc.exe File opened for modification C:\Windows\System32\dwm.exe zrxtxc.exe File opened for modification C:\Windows\System32\kernel32.dll zrxtxc.exe File opened for modification C:\Windows\System32\advapi32.dll zrxtxc.exe File opened for modification C:\Windows\System32\winlogon.exe zrxtxc.exe File opened for modification C:\Windows\System32\spoolsv.exe zrxtxc.exe File opened for modification C:\Windows\System32\ole32.dll zrxtxc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1316 cmd.exe 4908 cmd.exe 4160 cmd.exe 4004 cmd.exe 2668 cmd.exe - Checks processor information in registry 2 TTPs 28 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe - Enumerates system info in registry 2 TTPs 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe - Modifies registry key 1 TTPs 2 IoCs
pid Process 2444 reg.exe 3768 reg.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4616 XWormClient.exe Token: SeDebugPrivilege 1888 zrxtxc.exe Token: 33 4404 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4404 AUDIODG.EXE - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4616 wrote to memory of 1888 4616 XWormClient.exe 82 PID 1888 wrote to memory of 4160 1888 zrxtxc.exe 84 PID 1888 wrote to memory of 4004 1888 zrxtxc.exe 86 PID 1888 wrote to memory of 2668 1888 zrxtxc.exe 88 PID 1888 wrote to memory of 1316 1888 zrxtxc.exe 90 PID 1888 wrote to memory of 4908 1888 zrxtxc.exe 92 PID 4160 wrote to memory of 3432 4160 cmd.exe 94 PID 4004 wrote to memory of 2444 4004 cmd.exe 95 PID 2668 wrote to memory of 3768 2668 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWormClient.exe"C:\Users\Admin\AppData\Local\Temp\XWormClient.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\zrxtxc.exe"C:\Users\Admin\AppData\Local\Temp\zrxtxc.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\system32\reg.exereg delete HKCR /f4⤵PID:3432
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCU /f3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\system32\reg.exereg delete HKCU /f4⤵
- Modifies registry key
PID:2444
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKLM /f3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\system32\reg.exereg delete HKLM /f4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry key
PID:3768
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKU /f3⤵
- Executes a command shell one-liner
PID:1316 -
C:\Windows\system32\reg.exereg delete HKU /f4⤵PID:4504
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCC /f3⤵
- Executes a command shell one-liner
PID:4908 -
C:\Windows\system32\reg.exereg delete HKCC /f4⤵PID:4436
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E81⤵
- Suspicious use of AdjustPrivilegeToken
PID:4404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\zrxtxc.exe
- Size 11KB
- SHA256 1a7610cd29d915c7f4ad68d5238e4dd3cfc973de57ad81a177ba8ae5cb9a86c5
- MD5 5870c114ead5c7fe9c360e763f315824
- SHA1 86376c63ab2f442c21d1f59fa56e91c77ce9d55b
- SHA512 f6148e2041086d55a280e8540ad5c4ae563e025ca6339c3a2611a863d9a623c7cdfa97e260e7e1a46a1f5f2b9b2771aada8ab0772e0a1b3541eca2766ebb8958
- SSDEEP 192:9YJsjftImptoisXPebmjsTytSiV0zQGE6X:y6pK7ebQsetSiafH
- TLSH T10532E94CB7E84534D2BE4B3608B6D3125770F0038D27CB5E1DEE64EE2D2671569A2F90
- MD5 SHA1 SHA512 SSDEEP TLSH