Overview

overview

6

Static

static

1

xmodhubIns...1).exe

windows11-21h2-x64

6

xmodhubIns...1).exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    140s
  • max time network
    144s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    30/09/2026, 15:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    xmodhubInstaller__20260807_120311_channel100166 (1).exe
  • Size 2.3MB
  • Sample260930-se18nsvsfv
  • SHA256 c22c61b46a2387519ea92d9d397022a8dc62b42f64c56706f73f92c65f299bb2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryexecutionpersistencespywaretrojan

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file 3 IoCs
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 32 IoCs
  • Loads dropped DLL 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 19 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 7 IoCs
  • Modifies system certificate store 2 TTPs 14 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 61 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\xmodhubInstaller__20260807_120311_channel100166 (1).exe
    "C:\Users\Admin\AppData\Local\Temp\xmodhubInstaller__20260807_120311_channel100166 (1).exe"
    1⤵
    • Adds Run key to start application
    • Downloads MZ/PE file
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4432
    • C:\Users\Admin\AppData\Local\Temp\ChannelInstaller.exe
      -pipename=\\.\pipe\autoupdate_pipe_xmod_4432 -silent -auto-start -shell -install-path "C:\Program Files (x86)\xmodhub" C:\Users\Admin\AppData\Local\Temp\xmodhubInstaller__20260807_120311_channel100166 (1).exe
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Program Files (x86)\xmodhub\xmodhub.exe
        "C:\Program Files (x86)\xmodhub\xmodhub.exe" C:\Users\Admin\AppData\Local\Temp\xmodhubInstaller__20260807_120311_channel100166 (1).exe
        3⤵
        • Downloads MZ/PE file
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies trusted root certificate store through registry
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2000
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "chcp"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4212
          • C:\Windows\system32\chcp.com
            chcp
            5⤵
              PID:644
          • C:\Program Files (x86)\xmodhub\xmodhub.exe
            "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\xmodhub /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\xmodhub\Crashpad --url=https://f.a.k/e --annotation=_productName=xmodhub --annotation=_version=2.5.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=21.4.4 --initial-client-data=0x5f0,0x5e8,0x5f4,0x5ec,0x5f8,0x7ff7080806e0,0x7ff7080806f0,0x7ff708080700
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3836
          • C:\Program Files (x86)\xmodhub\xmodhub.exe
            "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --enable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1944,i,14002750614574548312,12412028168713706859,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:2
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3332
          • C:\Program Files (x86)\xmodhub\xmodhub.exe
            "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2364 --field-trial-handle=1944,i,14002750614574548312,12412028168713706859,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:8
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            PID:1552
          • C:\Program Files (x86)\xmodhub\xmodhub.exe
            "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Program Files (x86)\xmodhub\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3300 --field-trial-handle=1944,i,14002750614574548312,12412028168713706859,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5236
          • C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\remote-control-relay-local.exe
            "C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\remote-control-relay-local.exe" version
            4⤵
            • Executes dropped EXE
            PID:5260
          • C:\Program Files (x86)\xmodhub\cert\CertMgr.exe
            "C:\Program Files (x86)\xmodhub\cert\CertMgr.exe" -all -add "C:\Program Files (x86)\xmodhub\cert\squidV2.crt" -s -r localMachine Root
            4⤵
            • Executes dropped EXE
            • Modifies trusted root certificate store through registry
            • Modifies system certificate store
            PID:9716
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
            4⤵
            • Executes a command shell one-liner
            PID:5396
          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            4⤵
            • Enumerates connected drives
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5456
          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            4⤵
            • Enumerates connected drives
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5464
          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
            4⤵
            • Enumerates connected drives
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:900
          • C:\Program Files (x86)\xmodhub\xmodhub.exe
            "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-user-model-id=weisuan.xmod --app-path="C:\Program Files (x86)\xmodhub\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1944,i,14002750614574548312,12412028168713706859,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6488
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:8596
            • C:\Windows\system32\findstr.exe
              findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
              5⤵
                PID:8480
            • C:\Program Files (x86)\xmodhub\xmodhub.exe
              "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-user-model-id=weisuan.xmod --app-path="C:\Program Files (x86)\xmodhub\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4756 --field-trial-handle=1944,i,14002750614574548312,12412028168713706859,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:1
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:9272
            • C:\Program Files (x86)\xmodhub\xmodhub.exe
              "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-user-model-id=weisuan.xmod --app-path="C:\Program Files (x86)\xmodhub\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4636 --field-trial-handle=1944,i,14002750614574548312,12412028168713706859,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:1
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:9352
      • C:\Program Files (x86)\xmodhub\xmodhub.exe
        "C:\Program Files (x86)\xmodhub\xmodhub.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies trusted root certificate store through registry
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3360
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "chcp"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3152
          • C:\Windows\system32\chcp.com
            chcp
            3⤵
              PID:2624
          • C:\Program Files (x86)\xmodhub\xmodhub.exe
            "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\xmodhub /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\xmodhub\Crashpad --url=https://f.a.k/e --annotation=_productName=xmodhub --annotation=_version=2.5.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=21.4.4 --initial-client-data=0x614,0x60c,0x618,0x610,0x61c,0x7ff7080806e0,0x7ff7080806f0,0x7ff708080700
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5732
          • C:\Program Files (x86)\xmodhub\xmodhub.exe
            "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --enable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1996,i,805070902479080379,5131824606246762653,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:2
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5828
          • C:\Program Files (x86)\xmodhub\xmodhub.exe
            "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2420 --field-trial-handle=1996,i,805070902479080379,5131824606246762653,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:8
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            PID:5852
          • C:\Program Files (x86)\xmodhub\xmodhub.exe
            "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Program Files (x86)\xmodhub\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3296 --field-trial-handle=1996,i,805070902479080379,5131824606246762653,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:1
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4384
          • C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\remote-control-relay-local.exe
            "C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\remote-control-relay-local.exe" version
            2⤵
            • Executes dropped EXE
            PID:1760
          • C:\Program Files (x86)\xmodhub\cert\CertMgr.exe
            "C:\Program Files (x86)\xmodhub\cert\CertMgr.exe" -all -add "C:\Program Files (x86)\xmodhub\cert\squidV2.crt" -s -r localMachine Root
            2⤵
            • Executes dropped EXE
            • Modifies trusted root certificate store through registry
            • Modifies system certificate store
            PID:9276
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:3140
        • C:\Program Files (x86)\xmodhub\xmodhub.exe
          "C:\Program Files (x86)\xmodhub\xmodhub.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies trusted root certificate store through registry
          • Reads the TCP/IP host and domain name from the registry
          • Checks processor information in registry
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:10060
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "chcp"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:10156
            • C:\Windows\system32\chcp.com
              chcp
              3⤵
                PID:10200
            • C:\Program Files (x86)\xmodhub\xmodhub.exe
              "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\xmodhub /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\xmodhub\Crashpad --url=https://f.a.k/e --annotation=_productName=xmodhub --annotation=_version=2.5.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=21.4.4 --initial-client-data=0x5f4,0x5f0,0x5f8,0x5ec,0x5fc,0x7ff7080806e0,0x7ff7080806f0,0x7ff708080700
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:10216
            • C:\Program Files (x86)\xmodhub\xmodhub.exe
              "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --enable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=2148,i,8214233163833084147,3571505346765494060,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:2
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:3068
            • C:\Program Files (x86)\xmodhub\xmodhub.exe
              "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2364 --field-trial-handle=2148,i,8214233163833084147,3571505346765494060,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:8
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Reads the TCP/IP host and domain name from the registry
              PID:5920
            • C:\Program Files (x86)\xmodhub\xmodhub.exe
              "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Program Files (x86)\xmodhub\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3248 --field-trial-handle=2148,i,8214233163833084147,3571505346765494060,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:1
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:7316
            • C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\remote-control-relay-local.exe
              "C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\remote-control-relay-local.exe" version
              2⤵
              • Executes dropped EXE
              PID:7356
            • C:\Program Files (x86)\xmodhub\cert\CertMgr.exe
              "C:\Program Files (x86)\xmodhub\cert\CertMgr.exe" -all -add "C:\Program Files (x86)\xmodhub\cert\squidV2.crt" -s -r localMachine Root
              2⤵
              • Executes dropped EXE
              • Modifies trusted root certificate store through registry
              • Modifies system certificate store
              PID:8032
          • C:\Program Files (x86)\xmodhub\xmodhub.exe
            "C:\Program Files (x86)\xmodhub\xmodhub.exe"
            1⤵
            • Executes dropped EXE
            • Modifies trusted root certificate store through registry
            • Reads the TCP/IP host and domain name from the registry
            • Checks processor information in registry
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4968
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "chcp"
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:572
              • C:\Windows\system32\chcp.com
                chcp
                3⤵
                  PID:6184
              • C:\Program Files (x86)\xmodhub\xmodhub.exe
                "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\xmodhub /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\xmodhub\Crashpad --url=https://f.a.k/e --annotation=_productName=xmodhub --annotation=_version=2.5.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=21.4.4 --initial-client-data=0x54c,0x5e8,0x5e4,0x5ec,0x5f0,0x7ff7080806e0,0x7ff7080806f0,0x7ff708080700
                2⤵
                • Executes dropped EXE
                PID:6284
              • C:\Program Files (x86)\xmodhub\xmodhub.exe
                "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --enable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1916,i,18379277884433031884,17081734747062265152,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:2
                2⤵
                • Executes dropped EXE
                PID:5712
              • C:\Program Files (x86)\xmodhub\xmodhub.exe
                "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2348 --field-trial-handle=1916,i,18379277884433031884,17081734747062265152,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:8
                2⤵
                • Executes dropped EXE
                • Reads the TCP/IP host and domain name from the registry
                PID:2520
              • C:\Program Files (x86)\xmodhub\xmodhub.exe
                "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Program Files (x86)\xmodhub\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3184 --field-trial-handle=1916,i,18379277884433031884,17081734747062265152,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:1
                2⤵
                • Executes dropped EXE
                PID:4668
              • C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\remote-control-relay-local.exe
                "C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\remote-control-relay-local.exe" version
                2⤵
                • Executes dropped EXE
                PID:8452
              • C:\Program Files (x86)\xmodhub\cert\CertMgr.exe
                "C:\Program Files (x86)\xmodhub\cert\CertMgr.exe" -all -add "C:\Program Files (x86)\xmodhub\cert\squidV2.crt" -s -r localMachine Root
                2⤵
                • Executes dropped EXE
                • Modifies trusted root certificate store through registry
                • Modifies system certificate store
                PID:10532

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  CertMgr.exe
                  • Path C:\Program Files (x86)\xmodhub\cert\CertMgr.exe
                  • Size 84KB
                  • SHA256 86f59a37724772c72e000289b062ec1960ac49d0602fbb8e5940b1b01b321d0f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_100_percent.pak
                  • Path C:\Program Files (x86)\xmodhub\chrome_100_percent.pak
                  • Size 126KB
                  • SHA256 bca4401b578a6ac0fe793e8519fed82b5444972b7d6c176ec0369ed13beaad7b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  chrome_200_percent.pak
                  • Path C:\Program Files (x86)\xmodhub\chrome_200_percent.pak
                  • Size 175KB
                  • SHA256 b2c25fb30fee5f04ccdb8bf3c937a667502d266e428425feeb5af964f6167d48
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  d3dcompiler_47.dll
                  • Path C:\Program Files (x86)\xmodhub\d3dcompiler_47.dll
                  • Size 4.7MB
                  • SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ffmpeg.dll
                  • Path C:\Program Files (x86)\xmodhub\ffmpeg.dll
                  • Size 2.6MB
                  • SHA256 d3a7984c69ece3a621c3a8b7d609ba162c2923bedf31d2ee69d2925c298f75da
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icudtl.dat
                  • Path C:\Program Files (x86)\xmodhub\icudtl.dat
                  • Size 10.0MB
                  • SHA256 8d8a74ca376338623170d59c455476218d5a667d5991a52556aa9c9a70ebc5e5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libEGL.dll
                  • Path C:\Program Files (x86)\xmodhub\libEGL.dll
                  • Size 475KB
                  • SHA256 c638887477c59acc2642d786a4720ba8450dff15958d66ade362f6dfc2177c3c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libglesv2.dll
                  • Path C:\Program Files (x86)\xmodhub\libglesv2.dll
                  • Size 7.0MB
                  • SHA256 fc6f4f60d2a666b941e85d59d2be4a7b8e74ff879e34b0659221a4f05d1a4a6a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  en-US.pak
                  • Path C:\Program Files (x86)\xmodhub\locales\en-US.pak
                  • Size 302KB
                  • SHA256 a99bd31907bbdc12bdfbff7b9da6ddd850c273f3a6ece64ee8d1d9b6ef0c501c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  resources.pak
                  • Path C:\Program Files (x86)\xmodhub\resources.pak
                  • Size 5.2MB
                  • SHA256 f7fdde9650504d8872a7aa2b68e1f5b3cedd100ded1e19e44c2b6282eb637813
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ndisrd_lwf.inf
                  • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\lwf\win7\amd64\ndisrd_lwf.inf
                  • Size 2KB
                  • SHA256 9344e5652e449b4e722d8a00f666cda147d5305b913102195bd7255124a413bc
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  XAccNode.node
                  • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\XAccNode.node
                  • Size 192KB
                  • SHA256 026872ad5ae6b1bad3c5084fc7d609d6a02f69f9f3637986ced995f999cb541c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  InGameplugin.dll_tmp
                  • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XGame\InGameplugin.dll_tmp
                  • Size 2.4MB
                  • SHA256 a89cbdf35ddcecc003a45a2c408378b59bb0ec12a11a962b5f597a0f9168cd38
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  InGameplugin64.dll
                  • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XGame\InGameplugin64.dll
                  • Size 3.0MB
                  • SHA256 5ea2051ca1dff7718e80832faed0b5733a6f531a18c6206fadd442c9df9e938c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VCRUNTIME140_1.dll
                  • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\VCRUNTIME140_1.dll
                  • Size 48KB
                  • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  XGameNode.node
                  • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\XGameNode.node
                  • Size 807KB
                  • SHA256 d2c97b86ce0dbabaf3def9029ab60180e621f83ea609164b6939e31b27e3b663
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  XModAddon.node
                  • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\XModAddon.node
                  • Size 3.6MB
                  • SHA256 281557d62a7cfd75c047ebc05232fd8fc83706867bb17ffbbc62d052d6183cb4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msvcp140.dll
                  • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\msvcp140.dll
                  • Size 562KB
                  • SHA256 b99eb28a471311113f5c4109cb3c463f39cfd9bdb3b07f706204dedddb4516a1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vcruntime140.dll
                  • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\vcruntime140.dll
                  • Size 117KB
                  • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icon.png
                  • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\icon.png
                  • Size 528KB
                  • SHA256 1f96d3a64acf3e71f4b351656130937ffb63844de6f8bbc48cce07fbd9f0be60
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  en-us.json
                  • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\locales\en-us.json
                  • Size 52KB
                  • SHA256 8fa0fda104f69df3d43d27ac602fca55f124bc50367d51de2c085c421a41c5b7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  koffi.node
                  • Path C:\Program Files (x86)\xmodhub\resources\koffi\build\koffi\win32_x64\koffi.node
                  • Size 1.5MB
                  • SHA256 c6e5d31aefe5337fbf0f7ff89a3f5434d5974552314dece7890f00dcc2febcdb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  v8_context_snapshot.bin
                  • Path C:\Program Files (x86)\xmodhub\v8_context_snapshot.bin
                  • Size 710KB
                  • SHA256 ea2ea0f97ac908fd127a423f505241ebf4acea0ba5d02635cae40f7cd9c2f464
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader.dll
                  • Path C:\Program Files (x86)\xmodhub\vk_swiftshader.dll
                  • Size 4.8MB
                  • SHA256 fc18ab89e28ab31ea1d0b868cd7d2389d62c85f3532ed6326642156e4c97e4b4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  vk_swiftshader_icd.json
                  • Path C:\Program Files (x86)\xmodhub\vk_swiftshader_icd.json
                  • Size 106B
                  • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  vulkan-1.dll
                  • Path C:\Program Files (x86)\xmodhub\vulkan-1.dll
                  • Size 870KB
                  • SHA256 3cfb173123faf709530b178018ef10b9c9befedf07b533c4bf62d3efd7395a4d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SearchHoverUnifiedTileModelCache.dat
                  • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                  • Size 21KB
                  • SHA256 2d85a2c3a5709575e606a707e565e8c01bd92d76f02791727586980bd8852bb4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  7z.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\7z.dll
                  • Size 1.2MB
                  • SHA256 3ecf0c1a718f41ece87fad7029daa2f5e604f2e94449a66e8bf54252850eea62
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_0hfb4nlz.jd0.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0hfb4nlz.jd0.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  cc7d39e2-1a45-4679-822f-3972aa5376a9.tmp.js
                  • Path C:\Users\Admin\AppData\Local\Temp\cc7d39e2-1a45-4679-822f-3972aa5376a9.tmp.js
                  • Size 1KB
                  • SHA256 2bd96d6f5af98a990f6774f28a943a2126d98df3bd66e25eb5bc546ac12b7338
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  xmod_node.log
                  • Path C:\Users\Admin\AppData\Local\X-mod\xmod_node.log
                  • Size 202B
                  • SHA256 be56a4a33a67478189912d7d88922632fd8b3f9dd94248d185551716e0e602fc
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  f_000001
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Cache\Cache_Data\f_000001
                  • Size 441KB
                  • SHA256 a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Crashpad\settings.dat
                  • Size 40B
                  • SHA256 3386a8cbca380235513d187ec217744627447cc131b88992612b06b8bc342867
                  • MD5 SHA1 SHA512
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Local State
                  • Size 389B
                  • SHA256 a8dcec2718ea3bf413556383a306cc289d6083519d9970487e53ba2cb871c612
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Network\Network Persistent State
                  • Size 59B
                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Network\Network Persistent State
                  • Size 323B
                  • SHA256 ef3f87b405556f704453e6fd8fc8117eaf760009626dbff7748a420327ddc86b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Network\Network Persistent State
                  • Size 2KB
                  • SHA256 1da20aa21042db1e6c0db9e07aca62f07304e1d4191db603c6deece4609aa58b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Network\Network Persistent State
                  • Size 2KB
                  • SHA256 2840e483f276344de9fc03db76a2b19eb082b1090b52b7c2c00c551ee2d3eb68
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TransportSecurity
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Network\TransportSecurity
                  • Size 370B
                  • SHA256 ae8da62d0700f15a7cfacd58367b71bfaabaeab2b43556a900ed5472c61fd7b5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TransportSecurity
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Network\TransportSecurity
                  • Size 370B
                  • SHA256 517c96b28e2426a5ce499dd5f019d7ae632c2d7f1b996d1fff4294f6b4d9d60d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TransportSecurity
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Network\TransportSecurity
                  • Size 370B
                  • SHA256 66598249a3dac8cc4aff11e800ea5456c99b374dbe4139827703909afe085048
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TransportSecurity
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Network\TransportSecurity
                  • Size 370B
                  • SHA256 87f7cce3f05884235b3770efa258d5d5cb0f025bb8bcba59b2f068d2f6c342ff
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TransportSecurity
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Network\TransportSecurity
                  • Size 370B
                  • SHA256 db69843d484b5d89b731e08e1bff8b7bb1d0fe093ae0a22f6a39debdd1c226e3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  data_0
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\GPUCache\data_0
                  • Size 8KB
                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_1
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\GPUCache\data_1
                  • Size 264KB
                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_2
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\GPUCache\data_2
                  • Size 8KB
                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  data_3
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\GPUCache\data_3
                  • Size 8KB
                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  CURRENT
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\Local Storage\leveldb\CURRENT
                  • Size 16B
                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                  • MD5 SHA1 SHA512
                  Submit Download

                  9edfdc49-3381-4e00-871e-5e5c5644210f.tmp
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\Network\9edfdc49-3381-4e00-871e-5e5c5644210f.tmp
                  • Size 111B
                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\Network\Network Persistent State
                  • Size 999B
                  • SHA256 399bc2eaa9a898752f4f2ce4914a95733ba0f8f63dbd73662bb42cdfbfad00a7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TransportSecurity
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\Network\TransportSecurity
                  • Size 203B
                  • SHA256 1053bbbc382b49e985618c352f7b2219bfe2adba7adc539f72a2d684f3811552
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TransportSecurity~RFe59795c.TMP
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\Network\TransportSecurity~RFe59795c.TMP
                  • Size 203B
                  • SHA256 1b22876213ab5bf2327311f4e0398fba18697b9e4139000864f91b8eeb871b6d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  index
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\webview\Code Cache\js\index
                  • Size 24B
                  • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                  • MD5 SHA1 SHA512
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\webview\Code Cache\js\index-dir\the-real-index
                  • Size 408B
                  • SHA256 89d3dbd839006aebd3746978451d921e608b06e05dee1878b3fce4c382f132bf
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  MANIFEST-000001
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\webview\Local Storage\leveldb\MANIFEST-000001
                  • Size 41B
                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                  • MD5 SHA1 SHA512
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\webview\Network\Network Persistent State
                  • Size 2KB
                  • SHA256 2df6394d1fec0315a6b3c58af68b3d3d8e2c5b2d9e051d947d0032cf846a069c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  TransportSecurity
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\webview\Network\TransportSecurity
                  • Size 537B
                  • SHA256 ba0d13127295a0ede3ccac31abc7e7347395512e8ec2631f47fb5ae013f063fb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\Preferences
                  • Size 57B
                  • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
                  • Size 165B
                  • SHA256 590a1f9fd3cdfc83175e3bee2f1a9a744ca8d9726241cb9a5a459549aaeaa856
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
                  • Size 1KB
                  • SHA256 1a6b4cb2bb5cd12a8890d34e507090ac126b045d906f4f4b599ddd2254d3ace0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
                  • Size 2B
                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                  • MD5 SHA1 SHA512
                  Submit Download

                  config.json
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
                  • Size 1KB
                  • SHA256 45865a7885591469c6a7ac8ea988a283196bf396f226993c1e87aaf8a49a99cc
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
                  • Size 56B
                  • SHA256 398d6bb5a02c3f458ee0c92a6e31a4d65c902ab056044a54e0ba53da6e35bc3a
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
                  • Size 1KB
                  • SHA256 e6359cc18faecc64703466ad8ab7cc661d6b5279f615dd7a25219041ddbec72f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
                  • Size 1KB
                  • SHA256 730f9028ace07adbb314c98d08e7df118123c21c9f0ed516ee655df78cd70c92
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
                  • Size 143B
                  • SHA256 3dcb5d4c210c989d563890a412eac728d03f2f53e5cbdd6d00faf86d89fea3a0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json.tmp-0780645139142584
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-0780645139142584
                  • Size 24B
                  • SHA256 ebd830cd5ac9209423fe2104f8c54a24d8395ff14eb47e0d6eed476df39ce6ac
                  • MD5 SHA1 SHA512
                  Submit Download

                  config.json.tmp-0780649592e9ebdf
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-0780649592e9ebdf
                  • Size 49B
                  • SHA256 be522923fa4893f78d80e9f4a65a94086f85afa53f9aecffdfbc47e6e5fb6b62
                  • MD5 SHA1 SHA512
                  Submit Download

                  config.json.tmp-0780649736c3c091
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-0780649736c3c091
                  • Size 111B
                  • SHA256 918582b364372bd252963233bf383263e4a57496994b1eed24095654e0c33c15
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json.tmp-078064983783c40c
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-078064983783c40c
                  • Size 48B
                  • SHA256 0cf8bb2cc3e13728c363f2f4c024080de7d857f8a19661419e9baa87590bd335
                  • MD5 SHA1 SHA512
                  Submit Download

                  config.json.tmp-0780651286482a3f
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-0780651286482a3f
                  • Size 57B
                  • SHA256 6a5ba6da5577db1c3488e16ca7f32e70bfacff72d8e77cf169cd463ececd08fd
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json.tmp-07806515084eeeef
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-07806515084eeeef
                  • Size 167B
                  • SHA256 e5e8251fac1ee1df8cd6e7f543e9bc912d31adbf03cf326ad4335bc48b4c0805
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json.tmp-0780655958b7961d
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-0780655958b7961d
                  • Size 840B
                  • SHA256 36975afa0a24e072c673461ef221a03d49f89b6026d381539f0a434db82e79fe
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json.tmp-0780660588f0a60e
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-0780660588f0a60e
                  • Size 1KB
                  • SHA256 c1a77826abcabfcc7003afefb166fd4b3b81afe580635b15b925f51df765f82f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json.tmp-0780714080777e63
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-0780714080777e63
                  • Size 419B
                  • SHA256 16d073fe8e7aa883dc6d688361d6de287da7d0d7febb399a3b31b0d66801ddf0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json.tmp-07807369846e615e
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-07807369846e615e
                  • Size 444B
                  • SHA256 0a4a41903c046e7523cd00ec44bc186022357faabac4b27c4d2beee60edb3ee4
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  config.json.tmp-0780737297710f34
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-0780737297710f34
                  • Size 1KB
                  • SHA256 3f8857a39cbcf40339aca36f76a287d55e6b2d3757dc4f060a93b8b3a61a1102
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  main.log
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\logs\main.log
                  • Size 2KB
                  • SHA256 418872710626ed01a7864fb98f3bc272d0e3934dbbafb56bab93caae04f71633
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  main.log
                  • Path C:\Users\Admin\AppData\Roaming\xmodhub\logs\main.log
                  • Size 5KB
                  • SHA256 4e009912becd1e9b8ae161ae45748882314e35ba9fb23f954a74928953cb907a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  xmodhub.lnk
                  • Path C:\Users\Admin\Desktop\xmodhub.lnk
                  • Size 1KB
                  • SHA256 a84bac2c32393888515a4bf213bd6c69d09076ea1a400dce88857c331ca4add1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/900-4544-0x000001BF26160000-0x000001BF26182000-memory.dmp
                  Download

                  memory/900-5365-0x000001BF0D620000-0x000001BF0E0E2000-memory.dmp
                  Download

                  memory/5456-5355-0x000001D7386D0000-0x000001D738783000-memory.dmp
                  Download

                  memory/5456-5371-0x000001D71F200000-0x000001D71FCC2000-memory.dmp
                  Download

                  memory/5456-5354-0x000001D7386B0000-0x000001D7386CC000-memory.dmp
                  Download

                  memory/5456-4878-0x000001D738560000-0x000001D7385A6000-memory.dmp
                  Download

                  memory/5464-5366-0x00000218C6EA0000-0x00000218C6ECA000-memory.dmp
                  Download

                  memory/5464-5364-0x00000218C6DE0000-0x00000218C6DEA000-memory.dmp
                  Download

                  memory/5464-5369-0x00000218ADE30000-0x00000218AE8F2000-memory.dmp
                  Download

                  memory/5464-5367-0x00000218C6EA0000-0x00000218C6EC4000-memory.dmp
                  Download