rhadamanthys | hxxps://github[.]com/QZwaRT/XWorm-Remote-Access-Tool

Analysis

max time kernel
125s
max time network
126s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
01-12-2024 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/QZwaRT/XWorm-Remote-Access-Tool

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Extracted

Family

rhadamanthys

https://195.3.223.126:4287/9d0dc091285eb9fbf2e/o8f3c8oj.8rdif

Signatures

Detect rhadamanthys stealer shellcode 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4400-464-0x00000000023C0000-0x00000000027C0000-memory.dmp	family_rhadamanthys
behavioral1/memory/4400-465-0x00000000023C0000-0x00000000027C0000-memory.dmp	family_rhadamanthys
behavioral1/memory/2888-470-0x0000000002180000-0x0000000002580000-memory.dmp	family_rhadamanthys
behavioral1/memory/4536-473-0x00000000022D0000-0x00000000026D0000-memory.dmp	family_rhadamanthys
behavioral1/memory/1492-477-0x0000000002300000-0x0000000002700000-memory.dmp	family_rhadamanthys
behavioral1/memory/2736-481-0x00000000023A0000-0x00000000027A0000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Executes dropped EXE 5 IoCs

Processes:

XWorm.exeXWorm.exeXWorm.exeXWorm.exeXWorm.exe

pid	Process
4400	XWorm.exe
2888	XWorm.exe
4536	XWorm.exe
1492	XWorm.exe
2736	XWorm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

Processes:

flow	ioc
42	camo.githubusercontent.com
43	camo.githubusercontent.com
44	camo.githubusercontent.com
45	camo.githubusercontent.com
46	camo.githubusercontent.com

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\0ad1e13d-7705-4294-a48e-e62fe037640d.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241201192248.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

XWorm.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWorm.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exeXWorm.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	XWorm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	XWorm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	XWorm.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	XWorm.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	XWorm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exeXWorm.exeXWorm.exeXWorm.exeXWorm.exeXWorm.exetaskmgr.exe

pid	Process
220	msedge.exe
220	msedge.exe
236	msedge.exe
236	msedge.exe
4220	identity_helper.exe
4220	identity_helper.exe
3396	msedge.exe
3396	msedge.exe
4400	XWorm.exe
4400	XWorm.exe
2888	XWorm.exe
2888	XWorm.exe
4536	XWorm.exe
4536	XWorm.exe
1492	XWorm.exe
1492	XWorm.exe
2736	XWorm.exe
2736	XWorm.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid	Process
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

7zG.exeXWorm.exetaskmgr.exe

description	pid	Process
Token: SeRestorePrivilege	1064	7zG.exe
Token: 35	1064	7zG.exe
Token: SeSecurityPrivilege	1064	7zG.exe
Token: SeSecurityPrivilege	1064	7zG.exe
Token: SeShutdownPrivilege	4400	XWorm.exe
Token: SeCreatePagefilePrivilege	4400	XWorm.exe
Token: SeDebugPrivilege	2700	taskmgr.exe
Token: SeSystemProfilePrivilege	2700	taskmgr.exe
Token: SeCreateGlobalPrivilege	2700	taskmgr.exe
Token: 33	2700	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2700	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	Process
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	Process
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe
2700	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 236 wrote to memory of 1928	236	msedge.exe	80
PID 236 wrote to memory of 1928	236	msedge.exe	80
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 328	236	msedge.exe	81
PID 236 wrote to memory of 220	236	msedge.exe	82
PID 236 wrote to memory of 220	236	msedge.exe	82
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83
PID 236 wrote to memory of 3836	236	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/QZwaRT/XWorm-Remote-Access-Tool
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffbf81246f8,0x7ffbf8124708,0x7ffbf8124718
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1864
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6daf65460,0x7ff6daf65470,0x7ff6daf65480
    3⤵
    PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17327730610231167749,3934686388739999839,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1748

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2756

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap29401:68:7zEvent6407
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Users\Admin\Desktop\XWorm.exe
"C:\Users\Admin\Desktop\XWorm.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Users\Admin\Desktop\XWorm.exe
"C:\Users\Admin\Desktop\XWorm.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2888

C:\Users\Admin\Desktop\XWorm.exe
"C:\Users\Admin\Desktop\XWorm.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4536

C:\Users\Admin\Desktop\XWorm.exe
"C:\Users\Admin\Desktop\XWorm.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1492

C:\Users\Admin\Desktop\XWorm.exe
"C:\Users\Admin\Desktop\XWorm.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2736

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6dda6e078b56bc17505e368f3e845302

SHA1
45fbd981fbbd4f961bf72f0ac76308fc18306cba

SHA256
591bf3493eb620a3851c0cd65bff79758a09c61e9a22ea113fa0480404a38b15

SHA512
9e460013fd043cee9bdbcdaf96ac2f7e21a08e88ddb754dddbd8378ee2288d50271e66b42092d84a12e726469465185be11a6fafab6ed4236a244524bd60f502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6126b3cef466f7479c4f176528a9348

SHA1
87855913d0bfe2c4559dd3acb243d05c6d7e4908

SHA256
588138bf57e937e1dec203a5073c3edb1e921c066779e893342e79e3d160e0b4

SHA512
ef622b26c8cee1f767def355b2d7bffb2b28e7a653c09b7e2d33f6468a453fff39fd120cacbffd79ce35722592af0f3fb7d5054e2dca06310e44dc460533f3d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
dd1e7322c49cd47dedb033cca4f050bf

SHA1
11aefe044a924b72339645e83c93b5a3ca5235bd

SHA256
933c74c282592cce7d2b1a51dd8b1420a7bf7ee332b3c9c4f07ce2bcb9fb7829

SHA512
ba9f4b29fae14fede0f47ff558b077f6badf1540fcb51e4fc943b648d1576cb2f894c4578ec9bd3c38b740b2927e4e49ff1ae104e8e28ed802a13d33f0ff108a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ce5e188fc83e1622188ef85dc981eabb

SHA1
94c73ee63121776abd7d797915e9afadcc383fdf

SHA256
5bba11041b64cfd750f2b9f5b49072e1dd58e3b4514ceeae27544566f4f6568c

SHA512
7a5369bb30fb02fbb3ad1fcb0ac6a7a1fa272ffb1808b24156876e40da8b6952eb2ee177b71fd8f36ccfb561f95f7e5f0542c84627c86d7929ae39985080cce1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
580B

MD5
29465d2ff67d8a226acbba80847ff947

SHA1
5e508884a4886cfe3abe3891b2767b896b29bd7e

SHA256
7e43b1113c64371a0bf0332d7c1f8ea829209da158a9be17a724b60b2b289843

SHA512
89c819585698085cb16228f367c54fc030cc710a9633f65768c24cae1dc56a84f8b6f9268a43912d223555bf816c994d5c20745f21b5d46bf13075c722221ac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58b0ad.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
94d9ac73a7252ca0f08c5790218510fb

SHA1
4a95809bf3403e9ad7bd3b7304c01b1175b9d292

SHA256
571631ba47a9796b6052125b815cdcd42a6144d2e1dfec7edb2d4cb48386b554

SHA512
6758fe75d34506bd7ed8d7842d9b125a6af604893d39df9768d22058b4ca199baa4a8200a213422cc74a8158215b7fd96678c9e8e72b3b0f8c3c0612b10df840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4802cdd14c395638e2887f2a0263d21f

SHA1
10bce8a3da3f11897328569be8c1c727ac2d5878

SHA256
349ffda8a83cb0c57c524cbf4216a556a789914fbfea80e1b85adabbae7d0571

SHA512
e4b009601905e6f8acb53e2a428a610ad4ed4d68deca90c1db9fa58c572b66091b6956ca4aa92bf7a0147e0e1355e42484af31f78412c30ca00769f303a22208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fcc969641ecaef6377084253ea2c3c82

SHA1
e06960d91b492591f02a7b010b3bae2e91124bcd

SHA256
da06d00a2bb28820e7d6fdea38d6e62c8316ff5e8ad6984ea9a81daafc6be503

SHA512
0090df7df2baff586b04dd32eacf177b6ba0b142f0f39314167a87af73d6633fb86e667245cc8b86de610fddfe60a3f3507d2a1bbfe0b052de40478e95c81479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
83e7b28e75d377ca20e9f92b6dc6e078

SHA1
0135b6ea5fa64b8d490138dbbe0d18c787177d9b

SHA256
9370d537a3ca0aefe30a48509bade54c510ff55775ab1014e2401aa671608237

SHA512
0962ebc3165587ae7d553991ccd7eb2a5798381a00cfd1bbe67806c1d764f30330028bcaebf79d687fcba8cb03765d77c5a72e319d128ec855c75370ac7f58eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
90cc75707c7f427e9bbc8e0553500b46

SHA1
9034bdd7e7259406811ec8b5b7ce77317b6a2b7e

SHA256
f5d76f8630779de1fe82f8802d6d144861e3487171e4b32e3f8fffd2a57725fb

SHA512
7ad692bce11aee08bf65bb7c578b89a4a3024211ee1deaf671c925d65cc016943f2caad3d57b365e16d1764c78c36cae35c3c45cef0928dd611a565b0313e511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0d8c8c98295f59eade1d8c5b0527a5c2

SHA1
038269c6a2c432c6ecb5b236d08804502e29cde0

SHA256
9148e2a2ba2a3b765c088dc8a1bdcc9b07b129e5e48729a61ebc321cb7b8b721

SHA512
885a734a97a6f8c4a8fb5f0efa9fe55742f0685210472ed376466e67f928e82ddf91ba1211389d9c55dd1e03dc064aa7a81d1fca3cf429fbaf8f60db8b1348c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9562e76e0097d486e8554d14ffa20521

SHA1
8cbfc50ab7ed8256595c2c034924f6b2f1bb4af9

SHA256
712ba766b8a95ae88a9ae9ee532ad6a611e1f37ededf956c5b9412779b2f469c

SHA512
28778d20448d856c770b52228fd6ff3f400a251a5fc15a15a5d3817ee38aee6a74e01080d6b9e1b68a066e1b3e5d7bb3992ebbaa8502c13b3737b307450b6c0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9fe41e73427bbd9c092536726b81c9eb

SHA1
a79d454ceadf19081184635049f012a680af8d00

SHA256
075e23e4cbf831f24f409a54f54b2fbd0a5c14bab9a21293b79f187a827a7a74

SHA512
eb916592be15958a170e76929febe72c69592c54280e1357d03740b577e14616b172064ab6d031437ee56b13b9ae710f788b705a921d86581409a5bf15fc618c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
92a90a4867d663ff59767e1f46fffb96

SHA1
7a58644c003c8859c27b62bd13eacbfc73da3565

SHA256
894efb3ee031e3f19c3afa6e93d37c5332fceef1ac3a437bd9ac7a54f8e0cc3d

SHA512
a3a3c19431ff4ab425cfe6aa7dbeb727e0f97a5d97330aa2f8be79529cff8ce2448f81ee4a524c0dadf9bc517219c959545cea2ccdc850b1a107c90cf9af8bf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f126.TMP

Filesize
1KB

MD5
2e00a92513812cbe001880c7e27e0502

SHA1
557bf2c2a391bdc8ae8f9517b80c25b412d601ae

SHA256
6d5868d993075c770b52d11b96f5b4959c4c429a951eda7901d70051d3ba6e56

SHA512
5dbfc5fa0035c847643732cd2e690fea8f89b1179d57765853206edf28285b836a5ba0c9eca0b41051fe425fd6e222ef39571e0f702b29980d568cafa38c87fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
a6c764950c299ae8ed5318cc9b698656

SHA1
fb9043af46069d7d8c8490021b759ae353707e00

SHA256
6e249c7b6df31a0643be4b81a7d320ab46790d2e527b508a98c07b9f882e2b1f

SHA512
9c6c03357a771e53baf86463805d6072fa3e77e2351c9ef9123f2a5a29d6c4af016d9df583964932ad30620df0cc96487ef26def4c18020445a679f533334b51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ae0da85e-4d2c-4ab8-9181-dcd885e94b0d.tmp

Filesize
11KB

MD5
e89f5caa6ae8bf28911217126980ccae

SHA1
784a07db4118c38143d07f8cbbba6d2ff0a8b578

SHA256
11e6a023b34f6a179cdd1e8698fdead35a69bc25d9e9c75614fee37e8b2caac3

SHA512
cbac2e90a443f45ad7aa99f20b1b3dde0bc43a27c746eb19bb260f71a30368a34aada257a976cc8314d9437d92f4145bd7ec66d4cf542a59224fe3305a157056

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
f16b9d1682e60d2de9e36d07a7a16bcc

SHA1
b8603d845f093e79fe272cbbaaf2577ba42e5505

SHA256
c6edd86b0f08933a25940423f6364d336855bb8d2504a74a20684b0d66df49fa

SHA512
f46cd469fb5b3ba240cfaf49f307fee69419b50a6cfae0aa32d6f03d45a9c805f43b4b1ca5b821db1b23cc0cade9a743dafd5412f653c7c9b9b29de0614fe931

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
addf663f0f6d250519d0272493300167

SHA1
c40b2d47cf794c848cf7aafb5c2e55c9768f9735

SHA256
4c223ff9f1a9130e5e39647327d1c792a912bf7057c8f21f51af57eed1ff8a52

SHA512
efbecf1f08c12e1bebb0bc80cdf1bb535135cb976f4fe3382961452baf9dcecfed4b63a5f9dde75be0c2b807a52a6376a9bbcb9edb99e7ad683d90c8cb99e40a

Download Submit
C:\Users\Admin\Desktop\XWorm.exe

Filesize
456KB

MD5
515a0c8be21a5ba836e5687fc2d73333

SHA1
c52be9d0d37ac1b8d6bc09860e68e9e0615255ab

SHA256
9950788284df125c7359aeb91435ed24d59359fac6a74ed73774ca31561cc7ae

SHA512
4e2bd7ce844bba25aff12e2607c4281b59f7579b9407139ef6136ef09282c7afac1c702adebc42f8bd7703fac047fd8b5add34df334bfc04d3518ea483225522

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 388902.crdownload

Filesize
3.8MB

MD5
72ed99d6168329b94021eaf282af0552

SHA1
0be0ad479efa7b5d3021b06ab5f6b71f858ba08f

SHA256
463eb31b863993ffc7ebd1e67a593c0fc01bfcef367a988191926facfb93d93a

SHA512
b11c5657389e8e6f5af5bdbef2b22daef62e26484117c9a30de184a63980e6108cd804e43db7494f24057eaeec32ced7ab5ebd6f7aedb6467a207a209a2bd2a7

Download Submit
\??\pipe\LOCAL\crashpad_236_QGRFHMBJRDEEMFGT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1492-477-0x0000000002300000-0x0000000002700000-memory.dmp

Filesize
4.0MB

Download
memory/2700-484-0x000001FA60B50000-0x000001FA60B51000-memory.dmp

Filesize
4KB

Download
memory/2700-493-0x000001FA60B50000-0x000001FA60B51000-memory.dmp

Filesize
4KB

Download
memory/2700-488-0x000001FA60B50000-0x000001FA60B51000-memory.dmp

Filesize
4KB

Download
memory/2700-489-0x000001FA60B50000-0x000001FA60B51000-memory.dmp

Filesize
4KB

Download
memory/2700-490-0x000001FA60B50000-0x000001FA60B51000-memory.dmp

Filesize
4KB

Download
memory/2700-491-0x000001FA60B50000-0x000001FA60B51000-memory.dmp

Filesize
4KB

Download
memory/2700-482-0x000001FA60B50000-0x000001FA60B51000-memory.dmp

Filesize
4KB

Download
memory/2700-483-0x000001FA60B50000-0x000001FA60B51000-memory.dmp

Filesize
4KB

Download
memory/2700-492-0x000001FA60B50000-0x000001FA60B51000-memory.dmp

Filesize
4KB

Download
memory/2700-494-0x000001FA60B50000-0x000001FA60B51000-memory.dmp

Filesize
4KB

Download
memory/2736-481-0x00000000023A0000-0x00000000027A0000-memory.dmp

Filesize
4.0MB

Download
memory/2888-470-0x0000000002180000-0x0000000002580000-memory.dmp

Filesize
4.0MB

Download
memory/4400-465-0x00000000023C0000-0x00000000027C0000-memory.dmp

Filesize
4.0MB

Download
memory/4400-463-0x00000000021D0000-0x00000000021D7000-memory.dmp

Filesize
28KB

Download
memory/4400-464-0x00000000023C0000-0x00000000027C0000-memory.dmp

Filesize
4.0MB

Download
memory/4536-473-0x00000000022D0000-0x00000000026D0000-memory.dmp

Filesize
4.0MB

Download