xworm | 1381fa3fc79389ad8e9c2f4acffda477c4b5c6e45a07fec9de523de30ee9efa8

Resubmissions

02/09/2024, 19:47

240902-yhtwnawbqm 8

02/09/2024, 19:44

02/09/2024, 16:42

02/09/2024, 04:27

02/09/2024, 04:25

02/09/2024, 04:23

02/09/2024, 04:20

24/08/2024, 02:54

Analysis

max time kernel
298s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
24/08/2024, 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sticking-out-your-gyatt-for-the-rizzler.mp3
Size

175KB
MD5

27b535b4401ff51e152ef5f6fdaa2b5c
SHA1

eec3bba56eae9ff73d527c3638f3515d1c60da9b
SHA256

1381fa3fc79389ad8e9c2f4acffda477c4b5c6e45a07fec9de523de30ee9efa8
SHA512

9e322aef6c0c41f16fd0e101b89766032240570addba1a3be77b48207bc60c50a9ec3fbe82da9925d8d878ef111b625e629c05ee3dc23e30df10f8c523c8515e
SSDEEP

3072:nU/Sk+yOMHjhLbJdTJ/ffFFxEuy1hqFXNQlPgoTzS+GpQE4pCUW4hkFTMRsHeV8L:nUK1yTdLbJrXPxEuy1jFJkpaxBV6

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

next-screening.at.ply.gg:48590

Attributes

Install_directory
%AppData%
install_file
chrome.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000100000002abe8-2382.dat	family_xworm
behavioral1/memory/2940-2383-0x00000000005C0000-0x00000000005DA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1568	powershell.exe
236	powershell.exe
3196	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\host.lnk	host.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\host.lnk	host.exe

Executes dropped EXE 4 IoCs

pid	Process
2940	host.exe
3176	XWorm V3.1.exe
3676	host.exe
3464	host.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Windows\CurrentVersion\Run\host = "C:\\Users\\Admin\\AppData\\Roaming\\host.exe"	host.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4016	2388	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-131918955-2378418313-883382443-1000\{DAD6BB59-88C7-478B-89D2-BFDD0436F245}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-131918955-2378418313-883382443-1000\{68760320-4ADB-4EB4-8C39-13C740B478DA}	wmplayer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\XWorm-3.1-XWorm.zip:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
3572	msedge.exe
3572	msedge.exe
3132	identity_helper.exe
3132	identity_helper.exe
3184	msedge.exe
3184	msedge.exe
2620	msedge.exe
2620	msedge.exe
3460	msedge.exe
3460	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
236	powershell.exe
236	powershell.exe
236	powershell.exe
3196	powershell.exe
3196	powershell.exe
3196	powershell.exe
2940	host.exe
2940	host.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe
3176	XWorm V3.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2388	wmplayer.exe
Token: SeCreatePagefilePrivilege	2388	wmplayer.exe
Token: SeShutdownPrivilege	4672	unregmp2.exe
Token: SeCreatePagefilePrivilege	4672	unregmp2.exe
Token: 33	3024	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3024	AUDIODG.EXE
Token: SeShutdownPrivilege	2388	wmplayer.exe
Token: SeCreatePagefilePrivilege	2388	wmplayer.exe
Token: SeShutdownPrivilege	2388	wmplayer.exe
Token: SeCreatePagefilePrivilege	2388	wmplayer.exe
Token: SeDebugPrivilege	2940	host.exe
Token: SeDebugPrivilege	3176	XWorm V3.1.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	236	powershell.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	2940	host.exe
Token: SeDebugPrivilege	3676	host.exe
Token: SeDebugPrivilege	3464	host.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
2388	wmplayer.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
3176	XWorm V3.1.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
3176	XWorm V3.1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2940	host.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 4016	2388	wmplayer.exe	81
PID 2388 wrote to memory of 4016	2388	wmplayer.exe	81
PID 2388 wrote to memory of 4016	2388	wmplayer.exe	81
PID 4016 wrote to memory of 4672	4016	unregmp2.exe	82
PID 4016 wrote to memory of 4672	4016	unregmp2.exe	82
PID 2284 wrote to memory of 1308	2284	msedge.exe	93
PID 2284 wrote to memory of 1308	2284	msedge.exe	93
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3740	2284	msedge.exe	94
PID 2284 wrote to memory of 3572	2284	msedge.exe	95
PID 2284 wrote to memory of 3572	2284	msedge.exe	95
PID 2284 wrote to memory of 4220	2284	msedge.exe	96
PID 2284 wrote to memory of 4220	2284	msedge.exe	96
PID 2284 wrote to memory of 4220	2284	msedge.exe	96
PID 2284 wrote to memory of 4220	2284	msedge.exe	96
PID 2284 wrote to memory of 4220	2284	msedge.exe	96
PID 2284 wrote to memory of 4220	2284	msedge.exe	96
PID 2284 wrote to memory of 4220	2284	msedge.exe	96
PID 2284 wrote to memory of 4220	2284	msedge.exe	96
PID 2284 wrote to memory of 4220	2284	msedge.exe	96
PID 2284 wrote to memory of 4220	2284	msedge.exe	96
PID 2284 wrote to memory of 4220	2284	msedge.exe	96
PID 2284 wrote to memory of 4220	2284	msedge.exe	96
PID 2284 wrote to memory of 4220	2284	msedge.exe	96
PID 2284 wrote to memory of 4220	2284	msedge.exe	96
PID 2284 wrote to memory of 4220	2284	msedge.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\sticking-out-your-gyatt-for-the-rizzler.mp3"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 3924
  2⤵
  - Program crash
  PID:4016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1492

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004B4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 2388 -ip 2388
1⤵
PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ff8fc8d3cb8,0x7ff8fc8d3cc8,0x7ff8fc8d3cd8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=qrcode_generator.mojom.QRCodeGeneratorService --field-trial-handle=1884,70979535049310990,3176440166364150455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:1448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2024

C:\Users\Admin\Downloads\XWorm-3.1-XWorm\XWorm-3.1-XWorm\XWorm V3.1.exe
"C:\Users\Admin\Downloads\XWorm-3.1-XWorm\XWorm-3.1-XWorm\XWorm V3.1.exe"
1⤵
PID:4380
- C:\Users\Admin\AppData\Roaming\host.exe
  "C:\Users\Admin\AppData\Roaming\host.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\host.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'host.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\host.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3196
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "host" /tr "C:\Users\Admin\AppData\Roaming\host.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1344
- C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe
  "C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3176

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2552

C:\Users\Admin\AppData\Roaming\host.exe
C:\Users\Admin\AppData\Roaming\host.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Users\Admin\AppData\Roaming\host.exe
C:\Users\Admin\AppData\Roaming\host.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XWorm V3.1.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f081a02d8bbd5d800828ed8c769f5d9

SHA1
978d807096b7e7a4962a001b7bba6b2e77ce419a

SHA256
a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e

SHA512
7f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e681bda746d695b173a54033103efa8

SHA1
ae07be487e65914bb068174b99660fb8deb11a1d

SHA256
fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2

SHA512
0f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
ed124bdf39bbd5902bd2529a0a4114ea

SHA1
b7dd9d364099ccd4e09fd45f4180d38df6590524

SHA256
48232550940208c572ebe487aa64ddee26e304ba3e310407e1fc31a5c9deed44

SHA512
c4d180292afa484ef9556d15db1d3850416a85ad581f6f4d5eb66654991fa90f414029b4ce13ed142271a585b46b3e53701735ee3e0f45a78b67baa9122ba532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
41KB

MD5
60f8cd04587a51e31b51d1570d6f889a

SHA1
88574c41d0ab81721b275252464da5c7927a4835

SHA256
27cb4390e32a97375dd4987ae000406933bceba5199f17893711e782333b81cb

SHA512
84c12448ac55dd819749fef9be9919111a3df4bc51e66d2fa9f7376c11c101ed1349cb36aa119aa873cdd6c0c91027e201fbe23c2c83b89bc900a4d9077bcc52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.2MB

MD5
038c1f469deb6932520d09a340856ebc

SHA1
8b361a8c0489b69e9ef4e132e36f20c161c5ec1e

SHA256
5fafae77cfdc093baea4dd31485ced7dc4ab8e734311b3c2aaac1dc2ed95f451

SHA512
fc3123f11323a9f18f5e1bb31c61fa229e0de8b6d07bb01b220605cfd9ba499ed63e76be0b7146e096412cc94486bdba0ee102982b38b258958c6327fc6bb6c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
18KB

MD5
5ce258f4a680527d0deae0f47ffbb352

SHA1
c202921ffaebc04afd9662363b8be281928c83b3

SHA256
e6426bd2f9ae314619e22f0f5e5f7896163ebdbcd770bd64e6ea769deedb3267

SHA512
09ee7984eb637e4eb60ac2767a4ba840e3dc9ef865dfcc39b23a6e3942c04b67e81b728544e9b9a8bb1357cb13c10527d4f5e628eb58b1a49ae390b81ad31c3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
fe88617d113acb2c92a5cc8bf8870c00

SHA1
08693332faa6d23f77ffc6375e34a03b767d0ba5

SHA256
94478ee0df109f4ff36cefb4adb866ee53eaef3435f4d214cfa431f3f7bff211

SHA512
7711f2126050bb7b03d0845813286e25c5f08cd641e24a70c5ad3b3c948941bbeac318dd6c9870250268cad2b4782b2197016f902d58b85cad4d78f7e18d6ad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
864B

MD5
452118f56ce5e05639d97130e746e805

SHA1
6f3c72ae73853b8a95f5ab60e64b25e973e55714

SHA256
8033f7861bdbdcefad5a17f50242ea5aa5eadea258b7e373e00b2acad245ab83

SHA512
87679586d4ddd7f1120a90b06dd364beb1ff59ccd18e683aeebccf67d418db0b458f935922f66b9429fff86360f8fed435e272647734240adcd74b8ccb36ccac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
787B

MD5
38ae953c8d015b05e49bd259ee572576

SHA1
b25d34671107acce7646ec79b3241840263edb33

SHA256
ae39844a5b512be74241ff9e6f86bc60155a0708eff4b9b75fc5603b5044266f

SHA512
dc0c2e30bbc0f7a146854bf651d230ebe1aa3fe4f4e807092f005993c1d0881971bbd169f92687cf54771dad4396e27792c7334c277fac33696a8023de1d7170

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3c11e8ba573ef74387b2e9b5b4362251

SHA1
c13f45830c34b8735724ef947d28f6316e2db543

SHA256
80c3690b637aaa574a9331f4a52f65093c27a01358e021970f17d1c46ac32362

SHA512
206f36c81213ab21df4f6c52f244745c792c93f30242660e06eaad95681a34057e6310eaf18051ce09164aca39ad3d958852f0fdb436c496e03b7cd56b423587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b48c8b1d593e334bfc1a4817b9024c8b

SHA1
6174a9c524691173e56390b13af684c3d7aca98a

SHA256
028b12d8fb0e82921a39f835a0a0edf71b52747106eef56902fdce63930f47a1

SHA512
0a11c9268d6ce2cda0065a9eaa4113b8c9994379198402b5c9bcf17657378c5281a1b518f3b06e2e1ca0362c6bb52db9901e35c0163046bfd731a7ea5b0e769f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31c2827e725314bdbd6e663d6f8940ce

SHA1
57e905510514bb7c3fda4140791b78ef98ba8e50

SHA256
4b88c07abcbf441af8c7004fef72f83e1ac7256df5787454b8f80be09e2119bf

SHA512
81228825e79509bd7bfe4fbd48b8edc921000902a781216cf901a2c0a252066ff3de4c3745bc1e59beca52b82fd3579e0fa35db09560d059291d1b53c4ffed36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47c7f4fee4f68e1a6cc6d0caed2d256c

SHA1
ebdc67e8cb935d5155385d92c844123b400d7979

SHA256
0f56431ee4cc7bb6766c826703eb19624cb300a93ed537d9060ff5bdf423b1ec

SHA512
a358aba0c112415bff1dc2cc0740516f3b8bb22caba7cdefe3b6aa3c90d68a5717decfa8724dafd8a989044ae5472ea4073d17ced23585dffdc123863b26a58a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
832c487d9598148f41f6cf2c9addc9a9

SHA1
85e2ca69715ee3702d5ef8b3df5e7bb6309e5e1a

SHA256
284a91600f95e8adebc5603840c0054ba3a7451968a10c997135ffd4ace63b4d

SHA512
7cfb588d519eea41889575f94802fec11881c2e75c6a1eade6c60c8f98b246a3d04175438a171ceab0e9a99225b5e43df2d53d8fcabf05b4e5674232c741b7dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
baddc5a926b9e0eefd6a9836969eba32

SHA1
e959c624c7be060f7f6b3ebfe11e9172a2136184

SHA256
a123f106a863aa0826472197be91352ffdc8a9aaca8d2e1e822f6b96e818bcc3

SHA512
222151ade7b816bdde4ac028245240f64509ada0eb93be3d72bd475e15727f94eebc3de9ed654db397b9b2862605542eaa575c43490129ce534db74dc72d7f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f6a26668555e3ef991341b0dde0ee06a

SHA1
6ed7a3079f3cf150e4bd5e8c92a5f546a1572614

SHA256
5b5543851428489a92699e318e5aff730b3a8c65683f29623923549c9ef630a4

SHA512
936c6e683fa11f9038eae9ed068cb084a0154b5d693ba60731ed56f76c80eccbe9f978933c37ad34d936e9f9697ddafe1710fe490082c252fa8df365969a8aca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e74a9bfa45d7dc5511faca371ea4957d

SHA1
26f0307785a71ca31599a1be7c856ec5b97cf81c

SHA256
cbfa9fdec8eb5afa6fcc4254f36d3edad473acf3ce3e92c26778b36289d6aca4

SHA512
7e9400558a09cf205f72e4eabacf8fc9b3a34bc4afcdd9bb1ed1217631eb1fb80804d5fcdca89f34447dc897fdb52ae4ce7edbe25a60749d448cf6d53a5d22de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2882b0987a975b58f2701dd6d52faeb4

SHA1
8ec366573f4de562fd0c95182d59d8f69ce798a9

SHA256
669d917b7a4cf47876a50bd4df1239afa7ee1f7b7fe3c663bc29f9ff317117bc

SHA512
d25cba44c6b5a276f11846a6fc9fbcbab09ffcff5f530d02241bc41907d6405b4f971af584d9f10eb1f557f06dc186ad465cb168678b7edc026d7b1a0f51e3bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ae4c.TMP

Filesize
538B

MD5
98c0cb40712e0f6a950f0991e0dadb32

SHA1
58f0963a93200f56f63b607a81cae5d798489ac6

SHA256
1d84daf2fcd3134534a5f2d45afeaf79f7b093fc26a74435ac8ac1c8b8b6bce7

SHA512
d069382a8f7c57d47fd7f3c711c2ec3f55dc2d81804fc8594850cfeba7fabbddc4d22489c1529480b76c0eaf467d12190841832d914fa9e83e5e298665a14a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
de64594ea5d794a9f759c2544da18553

SHA1
e12842303edcd33842eefb4c7ec537f02165ea53

SHA256
9908b377156a3e2cdb24f6a5abb9b0e5d313678d65e57af7efed4e84d0540d7b

SHA512
d8d52496d4fb4c6e49019186967143c6c3e4e69c56f556ebd87f1491602c2be19af3d4926da21f74084fe6cc62ba6937770973a19b79acb5564734298eb78475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
46943a1efa8cdc720d00873a13a9becd

SHA1
97fda2029cea9c861a8521b90fb94969336b7d1f

SHA256
7bd309e9dbbbce8b86c84de5d9c46e9e73a59a46cc050e668c6d7ca04387d650

SHA512
bf7ff1865890c04359b12ee5a39a9a4dbbad14878a9c011af356e59db91235709b739225a07416ed67104a5ef950140db4a8cca2da8bdc8d9debc360787e0e2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ff4b321189c96f2577dd9a34672c1def

SHA1
84eeb21e02ba68bfe417eb38f8a4a353cfcee724

SHA256
b3d7fe5aef43390dffdee8234f6b9de217d556c7d1a3f6bccd5ea1737199b943

SHA512
e24fd99c7202a244d5a6bf9ca680022748db3b35e518beb8baa1f10b20c00aaae0cc0efe7e209844e28ee7b54ca370c72478599ffd118ce32b988bcb355867c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2bf05985c93534ccb0d39f051403cea8

SHA1
84413c10e83ccb95501c1f12dade8cf5a19e6671

SHA256
7ab5cb0eeb1340ef0638b208ff43af99458443084f3909590a1e6bf28c855df9

SHA512
ad4b839adde0bdf1c502b86d862e3ee6a69dc339a47d92e81473af772076104353ea11588d27b410857ea25c69b6b4fccb103e02a4074b4748395e560cea46c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
19d78b1eae63fd95e33c36ae0cad7aa8

SHA1
52bbbd1abf5e05fd11b19462a54685e7ccfc2d4b

SHA256
50c2e86388d63a5a5a2052f9866083e8784c3eed266f9b947b4f5772e5fbcf80

SHA512
34d6dd06fc41e2a3bf026cc58e461cf12064eab6969225d118b786aaacfabaac8bd7cbc6c26ad2c985faa04f0a07a4134119d4780c9189ded6db3d0fe9b59454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
ea16af300d7912b113ed41e7d8ae861b

SHA1
c089bcce2824cb2f297dd52eb3ba8495b4e51374

SHA256
f31de2509dedac25c3901fd0f6e533dc3db8ec207ae75c5beb59c142e2fc513b

SHA512
e3af9b15eb7ed66f80806fb87630295c483365e4051dd4704d9d08e20b5472fb6fda1ae5fccd615fefbb5edb78adbae1295b264acaa23f70562530c1e1700488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
54ace1f9618b9db0e517b37be2f5b7de

SHA1
e033c3f477e6b57a2792b6421cb0e808136d8fe2

SHA256
fd153546e6be5cbacd2717de75bb7a48ba67f3d51ccf5ce641f3d0b82b11a273

SHA512
adee4b40704b97c2ad2d1f1c42bef41b370e7269fbbbd4032591be4b395dd13b4cdbd283eddc3b85d10c27bab6b1b78268295fce65751cbeab154cc4d7968b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
5433eab10c6b5c6d55b7cbd302426a39

SHA1
c5b1604b3350dab290d081eecd5389a895c58de5

SHA256
23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131

SHA512
207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
82e0bc65978707ca1681653f02d74e92

SHA1
bceeda880509438b244a69ff98515e4a008dee60

SHA256
8629e86456345045444dfeedf43349908d53b6c60fd22b177566d82a0294be4e

SHA512
03e9b9ac93a8c0b562458b06f1cec12c7d07d2fcb92d0c1997ab7f71b05867c6e56f803a3f5064e5f4138fd586808b1d6a5071ebf54d1baa70b3a01a1c8160a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bygroj3r.cpy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
7c8bc0f8b1ca18f3defffc3579a2ccf3

SHA1
115563a33b60974491d7e567f2f164447ef6f67c

SHA256
d49b619dcc0e3c100a2c752ab8ff298846ac614be63bea71d3eab908c540db1a

SHA512
90bca72bff47fa6bd87487b946393543b2238566ef43b537ba8e8644ba2bd23e6f388416ca5731da31c7ed6e30a3a8a1261ec72b190cd79900908ecdf9c9cfda

Download Submit
C:\Users\Admin\AppData\Roaming\XWorm V3.1.exe

Filesize
6.9MB

MD5
37a9fdc56e605d2342da88a6e6182b4b

SHA1
20bc3df33bbbb676d2a3c572cff4c1d58c79055d

SHA256
422ba689937e3748a4b6bd3c5af2dce0211e8a48eb25767e6d1d2192d27f1f58

SHA512
f556805142b77b549845c0fa2206a4cb29d54752dc5650d9db58c1bbe1f7d0fc15ce04551853fb6454873877dbb88bebd15d81b875b405cdcc2fd21a515820d3

Download Submit
C:\Users\Admin\AppData\Roaming\host.exe

Filesize
77KB

MD5
7ade421a4759874f3edbd351490d2405

SHA1
b9f73f15595f042ca86314dc52f655c99d2fab71

SHA256
9906c3009cd5590b15abc938d24d64e4d54b2518cf05b46ec5987d3d14697695

SHA512
7242d26f0ba665575004606b302b192f82433603aaef42e6254d714ed4c66866db5f78abad7ac59f0b064fa7c4f1fb48e3e8f5eecf7ae2b26d9383ddfd90b446

Download Submit
C:\Users\Admin\Downloads\XWorm-3.1-XWorm.zip

Filesize
26.6MB

MD5
502680d4cd26f2b132efff5e572ca617

SHA1
5c75227d6d75e97d2e70f39834f5993e1110d853

SHA256
b86062804ff72d3f68bd370f2041eda8fae506dc4330ba34eb93922437ccddde

SHA512
b07992a76dc3700348c2de04199d2971efa2048fcb88ed0ad4745a97252199ce8f03d46c827f1e79fea6706c420260144e6b3faf885c37b0c23a0a916d76ec00

Download Submit
C:\Users\Admin\Downloads\XWorm-3.1-XWorm.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/1568-2398-0x000001D6F7690000-0x000001D6F76B2000-memory.dmp

Filesize
136KB

Download
memory/2388-65-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-74-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-85-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-86-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-87-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-89-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-90-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-88-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-91-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-92-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-93-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-94-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-95-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-97-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-96-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-98-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/2388-99-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-101-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-100-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-102-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-103-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-104-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-105-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-83-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-84-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-81-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-80-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-78-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-79-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-77-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-75-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-76-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-70-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-82-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-71-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-73-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/2388-72-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-69-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-68-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-67-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-66-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-61-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-64-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-62-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-63-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-60-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-59-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-58-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-57-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-55-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-56-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-54-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-31-0x0000000004470000-0x0000000004480000-memory.dmp

Filesize
64KB

Download
memory/2388-53-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-29-0x0000000004470000-0x0000000004480000-memory.dmp

Filesize
64KB

Download
memory/2388-52-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-51-0x0000000006AA0000-0x0000000006AB0000-memory.dmp

Filesize
64KB

Download
memory/2388-30-0x0000000004470000-0x0000000004480000-memory.dmp

Filesize
64KB

Download
memory/2388-28-0x0000000004470000-0x0000000004480000-memory.dmp

Filesize
64KB

Download
memory/2388-50-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-49-0x00000000066F0000-0x0000000006700000-memory.dmp

Filesize
64KB

Download
memory/2388-48-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/2388-32-0x0000000004470000-0x0000000004480000-memory.dmp

Filesize
64KB

Download
memory/2388-33-0x0000000004470000-0x0000000004480000-memory.dmp

Filesize
64KB

Download
memory/2940-2383-0x00000000005C0000-0x00000000005DA000-memory.dmp

Filesize
104KB

Download
memory/3176-2395-0x000000001CD90000-0x000000001D8FA000-memory.dmp

Filesize
11.4MB

Download
memory/3176-2394-0x0000000000080000-0x0000000000776000-memory.dmp

Filesize
7.0MB

Download
memory/4380-2371-0x0000000000C10000-0x000000000131C000-memory.dmp

Filesize
7.0MB

Download