hxxps://www[.]mediafire[.]com/file/54o4sz1rl0qr2jk/XWorm_V3[.]0[.]rar/file

Analysis

user interaction
yes
max time kernel
458s
max time network
463s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/54o4sz1rl0qr2jk/XWorm_V3.0.rar/file
Sample261024-pkgvfabx4r

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1376	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
2208	chrome.exe
2208	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
2068	XWorm V3.0.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
2068	XWorm V3.0.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 4632	1296	chrome.exe	88
PID 1296 wrote to memory of 1376	1296	chrome.exe	90
PID 1296 wrote to memory of 4048	1296	chrome.exe	91
PID 1296 wrote to memory of 4048	1296	chrome.exe	91
PID 1296 wrote to memory of 2928	1296	chrome.exe	92
PID 1296 wrote to memory of 2928	1296	chrome.exe	92
PID 1296 wrote to memory of 4536	1296	chrome.exe	93
PID 1296 wrote to memory of 5588	1296	chrome.exe	94
PID 1296 wrote to memory of 4536	1296	chrome.exe	93
PID 1296 wrote to memory of 5588	1296	chrome.exe	94
PID 1296 wrote to memory of 4460	1296	chrome.exe	96
PID 1296 wrote to memory of 4460	1296	chrome.exe	96
PID 1296 wrote to memory of 4848	1296	chrome.exe	97
PID 1296 wrote to memory of 4848	1296	chrome.exe	97
PID 1296 wrote to memory of 3900	1296	chrome.exe	98
PID 1296 wrote to memory of 3900	1296	chrome.exe	98
PID 1296 wrote to memory of 4812	1296	chrome.exe	99
PID 1296 wrote to memory of 3092	1296	chrome.exe	100
PID 1296 wrote to memory of 1372	1296	chrome.exe	103
PID 1296 wrote to memory of 4532	1296	chrome.exe	104
PID 1296 wrote to memory of 4532	1296	chrome.exe	104
PID 1296 wrote to memory of 1372	1296	chrome.exe	103
PID 1296 wrote to memory of 2536	1296	chrome.exe	107
PID 1296 wrote to memory of 2536	1296	chrome.exe	107
PID 1296 wrote to memory of 5880	1296	chrome.exe	108
PID 1296 wrote to memory of 5880	1296	chrome.exe	108
PID 1296 wrote to memory of 1136	1296	chrome.exe	109
PID 1296 wrote to memory of 1136	1296	chrome.exe	109
PID 1296 wrote to memory of 2424	1296	chrome.exe	110
PID 1296 wrote to memory of 2424	1296	chrome.exe	110
PID 1296 wrote to memory of 964	1296	chrome.exe	111
PID 1296 wrote to memory of 964	1296	chrome.exe	111
PID 1296 wrote to memory of 3528	1296	chrome.exe	112
PID 1296 wrote to memory of 3528	1296	chrome.exe	112
PID 1296 wrote to memory of 3692	1296	chrome.exe	115
PID 1296 wrote to memory of 4948	1296	chrome.exe	116
PID 1296 wrote to memory of 1628	1296	chrome.exe	117
PID 1296 wrote to memory of 2208	1296	chrome.exe	119
PID 1296 wrote to memory of 5716	1296	chrome.exe	120
PID 1296 wrote to memory of 5716	1296	chrome.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/54o4sz1rl0qr2jk/XWorm_V3.0.rar/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff6fe6c728,0x7fff6fe6c734,0x7fff6fe6c740
  2⤵
  PID:4632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,14956765516022463373,14022487766186251505,524288 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,13692678479996721315,1135526480511849706,262144 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1976,i,1524170301457633391,8442626385798038583,524288 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,1610083217012390871,17599626642047557679,2097152 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,10230421135606714122,11394084046301984034,2097152 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4724,i,455844668455159290,10518016532109068730,2097152 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4936,i,292048085174210809,8177752217405157202,2097152 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5108,i,7961444781952526378,18139202517088545507,2097152 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,12980609179954837145,11322089076760446744,524288 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5008,i,14868468655906479446,3658526578265992742,524288 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6436,i,13235411729014597075,16285109740702273678,2097152 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6456,i,16257141609360693306,2575414605817258301,2097152 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6620,i,707443890321151349,5461836599404891056,2097152 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5528,i,415062202366867639,877583984774194809,2097152 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6868,i,9785710954968338572,11938948166516329297,2097152 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6860,i,1852850834927566678,11069586809854725221,2097152 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6660,i,10429962112893708551,14643654129730995912,2097152 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6304,i,17537332408710451461,13033761972314550429,2097152 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4968,i,3341695880213468445,1909042315823725910,524288 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,7184408843543366806,7563951468609230704,524288 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,11879100102998906936,3931233334699711898,524288 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4580,i,73788757222792294,10922554465808690674,262144 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,12186770247979983917,7201219849342606710,524288 --field-trial-handle=2360,i,4601314797648887538,16761319955937863316,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
  2⤵
  PID:5716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3924

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4520

C:\Users\Admin\Downloads\XWorm V3.0\XWorm V3.0\XWorm V3.0.exe
"C:\Users\Admin\Downloads\XWorm V3.0\XWorm V3.0\XWorm V3.0.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5a55f40d-2598-4ac7-bc2e-9d159bba34da.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5a55f40d-2598-4ac7-bc2e-9d159bba34da.tmp
Size 4KB
SHA256 b36aeb14ece8d816842fada4f03055541f8211182a0d03528e5283a5abdee55c
MD5 5fa64fd9d4f6186fda435b6df0409b74
SHA1 b58cac5bd9afec8cf75be92cfabd5a06fdc3686d
SHA512 11e015d3f65bba2a658a1e70c5915850580a47a08d2b0d079d9f32dd7245900ea23d896066d9ed11699352d40abb88f515af2d60187716d6ece2bb5986d05b8f
SSDEEP 96:lC0d+hK2ilc3fBgqho/LyVRDotok5VRED7B6iGyvFrGqFbmWav4a:lC0L2ilYgm0QDUDPyFyeGqFbvE
TLSH
T1D1A12C32E5A999BB54F39584B0437E43CF68B1AB5562AF84E9DD2E0C11B71F80343927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c2cb9c9-e107-4623-bf81-038af2d02dac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5c2cb9c9-e107-4623-bf81-038af2d02dac.tmp
Size 5KB
SHA256 c864216747b077bb5ac71ed29853f77826e64c99589b8376b0a7d910a7db9afe
MD5 b48cfd3ce5f8bf9cae47a18d07c7cacb
SHA1 2be153dfda51859dcd009fb6ac61da37d87f8be3
SHA512 99c1d4e74d833ee3a314fb73401bc4bf6888ba2ab7cb3ebc47b1b77aa0b8cf319ff7c392f60822c5edc7058272815c74d66d928db3f6a7aaafb1b9ad145ff74e
SSDEEP 96:iC0d+hK2ilc3fBgqho/LyeSl8h4otop5VRRD7B6EGyvFx/n1Qzbte1nqR0j9IYB0:iC0L2ilYgm0LiU2PhFsm/WE1nqRUtS
TLSH
T1A7C10A32B4ACAD7718E3E590B0033E87CEB4A0AF99506F90DADA1B1C11E30E81387527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6eb99e18-d267-4c5f-9629-7b8b3951f98a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6eb99e18-d267-4c5f-9629-7b8b3951f98a.tmp
Size 61KB
SHA256 a9a7abf7d669f9350046af641b0cb33fe2471a640f93ad91579c8c820c940624
MD5 276f5a894d92c9fa7d0bd748ce271b29
SHA1 dcfe4a88497d029787586786a32553046f202c43
SHA512 b37d6dadf7cc545b957c8fcfe08cd0fe7bf2587297a5ae9f26a6c1f03a009a9f43d4a17f0a22023c7fb9b3b5fa953d23d3636e72ac0d633007a0ccd8ae655cfa
SSDEEP 768:quRuN1Ma/GOD7NICwLb3HY+iQamivjNnV7wr9eMxfUzPrLWI4PfDkTi1W5HZCFxA:jmG8+CwLLHriQ0NnVyeAcPry/KZHYg
TLSH
T132530232514CDEBF24263558B8675E4BCD6CF5553C1038ADCE79268930E25EE7782633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8cb67e69-8b0e-4020-95da-7e210cd78724.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8cb67e69-8b0e-4020-95da-7e210cd78724.tmp
Size 5KB
SHA256 85b8f562ec0b60bf67d6f337fafd5f685b72f4e78aba3453652374eb060028e0
MD5 558b96eb3e37c557692613b756a0dcce
SHA1 78e341f7bec8b07ac9244e6f2fa59a02520910c0
SHA512 553784039e716c1575de9544b1ea7150717fce41eb4fa4e219f44fc9f3875bf6ad207dbdf2360d2bb46c7ba60d6f8f69ac4bee6100ccba971d0d1a7285fb4d05
SSDEEP 96:gC0d+hK2ilc3fBgqho/LyeSl8h4otop5VRRD7B6EGyvFx/n1QzbtxKnqR0j9IYB0:gC0L2ilYgm0LiU2PhFsm/WjKnqRUtS
TLSH
T1BEC10A71B4ACAD7728E3E551B0033E87CEB460AF99516F90DADA1B1C11E71EC1387527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59e09261-0239-43da-9a85-88bd39176886.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\59e09261-0239-43da-9a85-88bd39176886.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6826ab12-f6db-4f69-b41d-8dfa4a6c3348.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6826ab12-f6db-4f69-b41d-8dfa4a6c3348.tmp
Size 11KB
SHA256 7e06dca140ff16b183c56eebd5219f7053b1f7619db4465c2261383c28b62ff9
MD5 f6b528d2074c1bf91c7678228b540c3a
SHA1 8a5e01dc2f3690bae163141ad6195ece718323c0
SHA512 c593282c4c93f126316781099b9bd4272aa4349ff5407af43019a632b7c6bd5f2bf420f651f89f85827e4e1879e0e57ef18325b2c20578db41a8c19e026a5aeb
SSDEEP 192:hRaJxxJv7/vAPRp2CQ9QHsb+WNnaGo842k8eW2CTCHEaQpMVyIsnAUgR:hRaJfJ76XESwbo2J2CTZawoR
TLSH
T11332A62AEE10793B5DDBC219FA667723E6F5202231D12E84E6FD993C20D75DC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 864B
SHA256 55e902c736d9b4dca9fecc08b21ae99d6114e70eafdfa7317f4ee3b21683ebfe
MD5 49c653f8257dc1173ac8f2fb6531e4fd
SHA1 12070b51d2b87e963bbeede352b51f833afe54bd
SHA512 a0664c467dc6bc1b14ee1028fadc0ca2f7a26a991b39d3d9fea7d28f1f5232731cdb0e63f9147315c71b980941fc578265e4d9070b8d773c92461e6c08bab2f3
TLSH
T1D4112C06A4F13603CB8A2B37ADE809117233B4E5409B5F26F4E0823AB03BBC31600A96
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a332d839-d49c-4b3b-9385-30035c33365a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a332d839-d49c-4b3b-9385-30035c33365a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ce0bc841-51e1-4735-bd5c-355d26473e9e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ce0bc841-51e1-4735-bd5c-355d26473e9e.tmp
Size 11KB
SHA256 673964a4a36b4d87337c7c45ff8170bb46aa2450237fe75b9e1a9861275936e3
MD5 ef86e5cf41d55927bf0d8b1a3dbea36a
SHA1 26b9432bae0c076e923d7cd9e777aa7725dfe93d
SHA512 135ffe0a5b982d02fcc0e4b241fa226cb61a5b2c8be92371e04d2d7f88e117ef323de8693e18f8520d406a6992e2f68e04ccc50baa3cb4f8cf9373eb85f4e1f7
SSDEEP 192:DJJBi5ZKEXJeOvef38aIaEdCN4PyKYSCn4F0YMEsaK9LpoYJNFhTdlf0JQ9RrJ/A:DJJBi5ZKEXJeOvef38aIaEdCN4PyKYST
TLSH
T1BB329CF783E5D52E891157F896106E1BCF1D0719432C3C2688D9EE8BE3E2472E16A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 88be791fc4386e23746aec699174c5789679a2eadfdb59897195fec13fbb5ce0
MD5 05788e27245f30a18dd56d65a672fa18
SHA1 c4b87d985d71d307d1b9298c25133599b61a0ca6
SHA512 b2d45fc8ec4bd70dc99b9a612619199a1e4fe6e608ef9387ae58e9823488225f8f4d31bfae8193d1903991a7ee13c3e8edd5edb9ef52a4a1fa91f7a9b24cad09
TLSH
T125A002E021DC5101C035667014C1816232157C60054212596FD05D768CA21424516540
MD5 SHA1 SHA512 TLSH

Submit Download

a7b7bd3c-895e-4f9f-a7eb-c747c8812091.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a7b7bd3c-895e-4f9f-a7eb-c747c8812091.tmp
Size 11KB
SHA256 002054b00c7deaffedfe4264b5f34d33c1445c21e9655f6fa55b5b5eefdbcd90
MD5 522e5bb903e9980a7382d0696788fbd1
SHA1 0463e2a8ee8bf9d2c79f39683932a732176a5769
SHA512 7d29c398bb3e8fb41d2fc1893b76bf66e91523a8cbba58ae92ce12a6a3e918c1e2164f7ee8c12a7462832fa97d55c2d28c05944858cc485c400bd6019831342c
SSDEEP 192:hRHJxxJv7/vAPRp2CQ9QHsb+WNnaGo842k8eW2CTCHEaQpMVyIsnAUge:hRHJfJ76XESwbo2J2CTZawoe
TLSH
T1D142B62AEE10793F5DDBC219FA667623E6F5202231D12E84E6FD993C20D75DD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb8336ca-0b29-42ed-97a9-642e9f51df92.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cb8336ca-0b29-42ed-97a9-642e9f51df92.tmp
Size 12KB
SHA256 4829d1a29054a45e5e65834c7f4be947b968bb575dc9f8143eb6fc5aa78e9345
MD5 272c870be588efb0fda3616344eb7790
SHA1 3fc7a25d9b8eb8262e84340ab925716ed49ade95
SHA512 25ab17b8770c17880e5e35f215c7a2f188da8d8276702af9b0034a8a5cfd9d9a14fbde782df70c2bec5cfd11d98ff3015112003f742c35071c9c58d156b1f417
SSDEEP 192:hRHJxxJv7/vHPRpFCQ9QHsb+WNnaGo84258eW2CTCHEaQtMVyIsnAUgE:hRHJfJ7HXBSwbo2+2CTZayoE
TLSH
T14B42C52AED10693B5DDBD619FA667B23E6F5202221D12E84F6FD893C20D75CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e35009ae-ee15-4cab-a234-afa6a10b1ff0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e35009ae-ee15-4cab-a234-afa6a10b1ff0.tmp
Size 11KB
SHA256 a0b2abcde11929c1ec002bf16aadf440f79632a2da7950c3f0eeec69e9d8c8e7
MD5 3199d3067427d1fc305dd8fb75358905
SHA1 d91ad56f2e588b2b9694a2542e908e2fd1c11ada
SHA512 720c52bfc561f5d80005a0533d81abb74fc0b94eae7514455ae6796441121c8fe08a220cb1d2dde7b5fc36d31a38e258bf1052b683d2fadb3629ba0cc9a1299c
SSDEEP 192:eb04K6pV7KxkXqK4I40pUZNCgVLHrKHfFKslEKzdXzKD/a1+ErUkKN9udOGIrv:+0jCV7KxkXqKf/pUZNCgVLH2Hfgsl3dY
TLSH
T1B332D727948DAA7F4FD8D50CCC566F8BADB5015372680D2892FF6C1803E97CA114A2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac845d60-6665-4002-a14a-8496c825a583.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ac845d60-6665-4002-a14a-8496c825a583.tmp
Size 5KB
SHA256 2fe77ec3cc157a65f92338330c1d6a645e5ed5a0e9ab6efebec126d6fa23cdf5
MD5 b70c73717160ddc98b82b63179ebdf29
SHA1 c4ea6ab14b411168d892750a4ae7a0c141954fb0
SHA512 12277756c0dce3a64d7594f01e5d5981f838a021340f0b25af6fa613dbb010d19054a5ee7a5bd1942d06a255650b48737b95659772c1b7350923623bf33bbc52
SSDEEP 96:gbJod+hK2ilc3fBgqho/LyeSl8h4otop5VRRD7B6EGyvFxxwnqVRNC39ISyVNPFp:gtoL2ilYgm0LiU2PhFsmxwnqVuC5H
TLSH
T175C1E771E4AC58BB18F3B985B0032D47CDA861AB69547E58EEEE6E0C00B30DC0393627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0a6f427-69c9-4f76-8b35-3e73424c8c28.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e0a6f427-69c9-4f76-8b35-3e73424c8c28.tmp
Size 5KB
SHA256 9439fa3edd383a4bc5f381c181c6994864c4e60b1a3598101a239f46127bd712
MD5 2c78a36e3c9d2253638b9d8d00f8f731
SHA1 79a5628039f46eda721af1adcfe211679dd72657
SHA512 680996cf091c21878e84ae394dfce64ec94739f8062cc65e37b4588ddbdc524c37ba5784a2d35457b13d451a600e63aca0b8891d5eeeeb3a4b57e781db165ef7
SSDEEP 96:gbJ0d+hK2ilc3fBgqho/LyeSl8h4otop5VRRD7B6EGyvFx/n1QzbtxKnqR0j9IYS:gt0L2ilYgm0LiU2PhFsm/WjKnqRUtS
TLSH
T176C10A71B4ACAD7718E3E551B0033A83CEB4A0AF95516F90DADA1B1C11E71EC1387527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XWorm V3.0.rar.crdownload

Path C:\Users\Admin\Downloads\XWorm V3.0.rar.crdownload
Size 25.1MB
SHA256 3e5e41d94f4d59ff7a0bf3e8680982b797f195e20aa782cd421edd26c2fa2425
MD5 5614d07ac634c4bf70af2ade2436796e
SHA1 8da19de2899ba7d982b78c70d1dc98dd7b5cdd62
SHA512 5a815d1818dff295acf6e3a30fbbb37e9904746cced20214b81122f0575a246b406bace0723bc6461f6c4e43102dd5526d41bf270541c345d39ab73a564d4007
SSDEEP 786432:nm3UFXFyc+LaQ2gK2IIKKBfUTbBBi85n/YPUbTyEl/kI:nm3UFFx+LaQfZIxEUTbf//YPaT9/b
TLSH
T1EA473347B761A65C3CE678ECFAC2C1E5CE049BB24E1AB43CA6288545AD15FD0F2C8357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2068-388-0x00007FFF5D210000-0x00007FFF5DBB4000-memory.dmp

Download

memory/2068-387-0x00007FFF5D210000-0x00007FFF5DBB4000-memory.dmp

Download

memory/2068-389-0x00007FFF5D210000-0x00007FFF5DBB4000-memory.dmp

Download

memory/2068-390-0x00007FFF5D210000-0x00007FFF5DBB4000-memory.dmp

Download

memory/2068-391-0x000001D6992E0000-0x000001D699DF6000-memory.dmp

Download

memory/2068-392-0x00007FFF5D210000-0x00007FFF5DBB4000-memory.dmp

Download

memory/2068-386-0x00007FFF5D210000-0x00007FFF5DBB4000-memory.dmp

Download

memory/2068-409-0x00007FFF5D210000-0x00007FFF5DBB4000-memory.dmp

Download

memory/2068-385-0x00007FFF5D210000-0x00007FFF5DBB4000-memory.dmp

Download

memory/2068-383-0x00007FFF5D39F000-0x00007FFF5D3A0000-memory.dmp

Download

memory/2068-415-0x00007FFF5D210000-0x00007FFF5DBB4000-memory.dmp

Download

memory/2068-384-0x000001D6FBAA0000-0x000001D6FC1CA000-memory.dmp

Download