Overview

overview

10

Static

static

3

XwormLoader.exe

windows7-x64

10

XwormLoader.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2025 15:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XwormLoader.exe

  • Size

    293KB

  • MD5

    67b572b8fed9bb8e91b26c6bd9fec2a3

  • SHA1

    91dd3124155f24c31ba86c6ccd3a13b4d6f6ddab

  • SHA256

    2a304826f36a9edb28ae07a7da5479f58c0599ef95113467c3cbd5727407aa1e

  • SHA512

    6f7edc4c8438b5730cc2b118160266423cba857d9ca8ed0bb16bee40fc84f2e8a1f98b028e50ffaa4f8a3bf67c33da9abcd932bdc2d001b665ef030880f61357

  • SSDEEP

    6144:6bs68FnNynbfZoOzbEWGSHVXWC8lCk1SHM70v9:6bs6anNi3bEWGSHdWCvFM70v9

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:18194

soon-logical.gl.at.ply.gg:18194
Mutex

APoxCrOmNOvTLB4L

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    chrome.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Users\Admin\AppData\Local\Temp\start.exe
      "C:\Users\Admin\AppData\Local\Temp\start.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1524
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\start.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1272
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'start.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1776
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\chrome.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3248
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'chrome.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3532
    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4964
      • C:\Users\Admin\AppData\Local\Temp\start.exe
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3556
      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:2832
        • C:\Users\Admin\AppData\Local\Temp\start.exe
          "C:\Users\Admin\AppData\Local\Temp\start.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1324
        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:3032
          • C:\Users\Admin\AppData\Local\Temp\start.exe
            "C:\Users\Admin\AppData\Local\Temp\start.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2188
          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:3264
            • C:\Users\Admin\AppData\Local\Temp\start.exe
              "C:\Users\Admin\AppData\Local\Temp\start.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1908
            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
              6⤵
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:4236
              • C:\Users\Admin\AppData\Local\Temp\start.exe
                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1988
              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                7⤵
                • Checks computer location settings
                • Suspicious use of WriteProcessMemory
                PID:2296
                • C:\Users\Admin\AppData\Local\Temp\start.exe
                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1728
                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                  8⤵
                  • Checks computer location settings
                  • Suspicious use of WriteProcessMemory
                  PID:3944
                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3336
                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                    9⤵
                    • Checks computer location settings
                    • Suspicious use of WriteProcessMemory
                    PID:1760
                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1252
                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                      10⤵
                      • Checks computer location settings
                      • Suspicious use of WriteProcessMemory
                      PID:4040
                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2300
                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                        11⤵
                        • Checks computer location settings
                        • Suspicious use of WriteProcessMemory
                        PID:3664
                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                          12⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5080
                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                          12⤵
                          • Checks computer location settings
                          • Suspicious use of WriteProcessMemory
                          PID:4028
                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3520
                          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                            13⤵
                            • Checks computer location settings
                            • Suspicious use of WriteProcessMemory
                            PID:4956
                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4572
                            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                              14⤵
                              • Checks computer location settings
                              • Suspicious use of WriteProcessMemory
                              PID:3552
                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2928
                              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                15⤵
                                • Checks computer location settings
                                PID:4852
                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5000
                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                  16⤵
                                  • Checks computer location settings
                                  PID:3820
                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:824
                                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                    17⤵
                                    • Checks computer location settings
                                    PID:1272
                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5008
                                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                      18⤵
                                      • Checks computer location settings
                                      PID:4808
                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4416
                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                        19⤵
                                        • Checks computer location settings
                                        PID:1968
                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                          20⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1464
                                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                          20⤵
                                            PID:1820
                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                              21⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3028
                                            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                              21⤵
                                              • Checks computer location settings
                                              PID:220
                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                22⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4348
                                              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                22⤵
                                                • Checks computer location settings
                                                PID:2232
                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                  23⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3948
                                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                  23⤵
                                                  • Checks computer location settings
                                                  PID:3280
                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                    24⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1364
                                                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                    24⤵
                                                    • Checks computer location settings
                                                    PID:3076
                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                      25⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2020
                                                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                      25⤵
                                                      • Checks computer location settings
                                                      PID:4924
                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                        26⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2432
                                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                        26⤵
                                                        • Checks computer location settings
                                                        PID:212
                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4992
                                                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                          27⤵
                                                          • Checks computer location settings
                                                          PID:776
                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                            28⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3708
                                                          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                            28⤵
                                                            • Checks computer location settings
                                                            PID:4556
                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                              29⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2852
                                                            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                              29⤵
                                                              • Checks computer location settings
                                                              PID:1972
                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                30⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4372
                                                              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                30⤵
                                                                • Checks computer location settings
                                                                PID:5056
                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                  31⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1988
                                                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                  31⤵
                                                                  • Checks computer location settings
                                                                  PID:2880
                                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                    32⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:528
                                                                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                    32⤵
                                                                    • Checks computer location settings
                                                                    PID:5068
                                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                      33⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:3336
                                                                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                      33⤵
                                                                      • Checks computer location settings
                                                                      PID:4044
                                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                        34⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:220
                                                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                        34⤵
                                                                        • Checks computer location settings
                                                                        PID:4700
                                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                          35⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4480
                                                                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                          35⤵
                                                                          • Checks computer location settings
                                                                          PID:4040
                                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                            36⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:3280
                                                                          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                            36⤵
                                                                              PID:5080
                                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                37⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2636
                                                                              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                37⤵
                                                                                • Checks computer location settings
                                                                                PID:4696
                                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                  38⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:408
                                                                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                  38⤵
                                                                                  • Checks computer location settings
                                                                                  PID:3520
                                                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                    39⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:5116
                                                                                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                    39⤵
                                                                                    • Checks computer location settings
                                                                                    PID:628
                                                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                      40⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:4444
                                                                                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                      40⤵
                                                                                      • Checks computer location settings
                                                                                      PID:5064
                                                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                        41⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2828
                                                                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                        41⤵
                                                                                        • Checks computer location settings
                                                                                        PID:4948
                                                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                          42⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:1224
                                                                                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                          42⤵
                                                                                            PID:4244
                                                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                              43⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:4716
                                                                                            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                              43⤵
                                                                                              • Checks computer location settings
                                                                                              PID:2112
                                                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                44⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4760
                                                                                              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                44⤵
                                                                                                • Checks computer location settings
                                                                                                PID:4884
                                                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                  45⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:4668
                                                                                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                  45⤵
                                                                                                  • Checks computer location settings
                                                                                                  PID:4036
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                    46⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:528
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                    46⤵
                                                                                                    • Checks computer location settings
                                                                                                    PID:456
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                      47⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:980
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                      47⤵
                                                                                                      • Checks computer location settings
                                                                                                      PID:4912
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                        48⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:4496
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                        48⤵
                                                                                                        • Checks computer location settings
                                                                                                        PID:3716
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                          49⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:548
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                          49⤵
                                                                                                          • Checks computer location settings
                                                                                                          PID:3948
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                            50⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:3260
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                            50⤵
                                                                                                            • Checks computer location settings
                                                                                                            PID:3968
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                              51⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:4572
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                              51⤵
                                                                                                                PID:3520
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                  52⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:1696
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                  52⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  PID:3720
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                    53⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:5000
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                    53⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    PID:228
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                      54⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:1792
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                      54⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      PID:3820
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                        55⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:4548
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                        55⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        PID:8
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                          56⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:5044
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                          56⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          PID:4980
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                            57⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:4716
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                            57⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:2296
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                              58⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:4772
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                              58⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              PID:4064
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                59⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:3796
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                59⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                PID:4336
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                  60⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:3212
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                  60⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  PID:4584
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                    61⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:1328
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                    61⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    PID:4936
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                      62⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:2224
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                      62⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      PID:4084
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                        63⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:1476
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                        63⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        PID:832
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                          64⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:2588
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                          64⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          PID:2020
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                            65⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:3760
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                            65⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            PID:4068
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                              66⤵
                                                                                                                                                PID:4564
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                                66⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                PID:1432
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                                  67⤵
                                                                                                                                                    PID:3100
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                                    67⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    PID:2076
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                                      68⤵
                                                                                                                                                        PID:3988
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                                        68⤵
                                                                                                                                                          PID:1212

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XwormLoader.exe.log
                    Filesize

                    654B

                    MD5

                    2ff39f6c7249774be85fd60a8f9a245e

                    SHA1

                    684ff36b31aedc1e587c8496c02722c6698c1c4e

                    SHA256

                    e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                    SHA512

                    1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                    Filesize

                    2KB

                    MD5

                    d85ba6ff808d9e5444a4b369f5bc2730

                    SHA1

                    31aa9d96590fff6981b315e0b391b575e4c0804a

                    SHA256

                    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                    SHA512

                    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    944B

                    MD5

                    6d42b6da621e8df5674e26b799c8e2aa

                    SHA1

                    ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                    SHA256

                    5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                    SHA512

                    53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    944B

                    MD5

                    ce4540390cc4841c8973eb5a3e9f4f7d

                    SHA1

                    2293f30a6f4c9538bc5b06606c10a50ab4ecef8e

                    SHA256

                    e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105

                    SHA512

                    2a3e466cb5a81d2b65256053b768a98321eb3e65ff46353eefc9864f14a391748116f050e7482ddd73a51575bf0a6fc5c673023dade62dbd8b174442bae1cc6b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    944B

                    MD5

                    34f595487e6bfd1d11c7de88ee50356a

                    SHA1

                    4caad088c15766cc0fa1f42009260e9a02f953bb

                    SHA256

                    0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

                    SHA512

                    10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1hapjmdi.03j.ps1
                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                    Filesize

                    39KB

                    MD5

                    51e4348a35c9b40b0136fa204442f9c2

                    SHA1

                    aea47a3a717ca9cce49966093def7d8f5a53709a

                    SHA256

                    a8047efe920772b13508683a7d80de379b0cf2dc40b39a9cd37f949de6a90479

                    SHA512

                    f15353f1b29ead57efe865935ef0cbd9efa2f0e81e47a92993279a59ea4174fde1e9bb2546c35deda6cfa641cfa0ecd58f8a2f6006f0589ce95553d7debfa3bd

                    Download Submit

                  • memory/1144-1-0x0000000000220000-0x0000000000270000-memory.dmp

                    Filesize

                    320KB

                    Download

                  • memory/1144-10-0x00007FFD22060000-0x00007FFD22B21000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/1144-0-0x00007FFD22063000-0x00007FFD22065000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/1144-18-0x00007FFD22060000-0x00007FFD22B21000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/1272-30-0x00000238BE260000-0x00000238BE282000-memory.dmp

                    Filesize

                    136KB

                    Download

                  • memory/1524-15-0x00007FFD22060000-0x00007FFD22B21000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/1524-14-0x0000000000A30000-0x0000000000A40000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/1524-75-0x00007FFD22060000-0x00007FFD22B21000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/1524-78-0x00007FFD22060000-0x00007FFD22B21000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/1524-83-0x00007FFD22060000-0x00007FFD22B21000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/1524-92-0x000000001B6E0000-0x000000001B6EC000-memory.dmp

                    Filesize

                    48KB

                    Download

                  • memory/1524-104-0x000000001D280000-0x000000001D330000-memory.dmp

                    Filesize

                    704KB

                    Download

                  • memory/1524-108-0x000000001E4E0000-0x000000001EA08000-memory.dmp

                    Filesize

                    5.2MB

                    Download

                  • memory/4964-22-0x00007FFD22060000-0x00007FFD22B21000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/4964-20-0x00007FFD22060000-0x00007FFD22B21000-memory.dmp

                    Filesize

                    10.8MB

                    Download

                  • memory/4964-19-0x00007FFD22060000-0x00007FFD22B21000-memory.dmp

                    Filesize

                    10.8MB

                    Download