xworm | 238bd89de11cbe6b00e7bf57f13863394bed494b73d09570011f27b87270b51a

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-01-2025 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xworm V5.6.exe
Size

7.7MB
MD5

027ad6a104d074597068c1781cc0c90d
SHA1

b489c6f4d29db588ecfc65df7ea92d6c23de4a20
SHA256

238bd89de11cbe6b00e7bf57f13863394bed494b73d09570011f27b87270b51a
SHA512

0e3beecff23c8d426d859758b5c9aa4490e5d47ea69e4301c73fe499bd6535ec8dfe22dae552c8e14203d78768cd2ccfb70f78e876de2ba4b2532cf502b40e4f
SSDEEP

196608:xKLCFU/jHq/puROyhxeyOC7+oiRkbtejBe5:xmq/pkOYxehohbt

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:18194

soon-logical.gl.at.ply.gg:18194

Mutex

APoxCrOmNOvTLB4L

Attributes

Install_directory
%Userprofile%
install_file
chrome.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001225c-7.dat	family_xworm
behavioral1/memory/2836-9-0x0000000000220000-0x0000000000230000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2776	powershell.exe
2924	powershell.exe
2696	powershell.exe
2884	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.lnk	start.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.lnk	start.exe

Executes dropped EXE 64 IoCs

pid	Process
2836	start.exe
2720	start.exe
1788	start.exe
2012	start.exe
3064	start.exe
2096	start.exe
1568	start.exe
2244	start.exe
2080	start.exe
2692	start.exe
2908	start.exe
2596	start.exe
2316	start.exe
2840	start.exe
2964	start.exe
1052	start.exe
2460	start.exe
576	start.exe
3064	start.exe
1760	start.exe
1692	start.exe
888	start.exe
2756	start.exe
2692	start.exe
2608	start.exe
1812	start.exe
2892	start.exe
3000	start.exe
2860	start.exe
348	start.exe
1676	start.exe
2512	start.exe
1988	start.exe
892	start.exe
3024	start.exe
2380	start.exe
1804	start.exe
2600	start.exe
1680	start.exe
1812	start.exe
2892	start.exe
3000	start.exe
2492	start.exe
2172	start.exe
1544	start.exe
1720	start.exe
2544	start.exe
572	start.exe
2212	start.exe
2744	start.exe
2392	start.exe
924	start.exe
1156	start.exe
2940	start.exe
768	start.exe
2776	start.exe
3040	start.exe
2492	start.exe
1088	start.exe
2184	start.exe
1568	start.exe
2736	start.exe
2360	start.exe
2280	start.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "C:\\Users\\Admin\\chrome.exe"	start.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2776	powershell.exe
2924	powershell.exe
2696	powershell.exe
2884	powershell.exe
2836	start.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2836	start.exe
Token: SeDebugPrivilege	2720	start.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	1788	start.exe
Token: SeDebugPrivilege	2836	start.exe
Token: SeDebugPrivilege	2012	start.exe
Token: SeDebugPrivilege	3064	start.exe
Token: SeDebugPrivilege	2096	start.exe
Token: SeDebugPrivilege	1568	start.exe
Token: SeDebugPrivilege	2244	start.exe
Token: SeDebugPrivilege	2080	start.exe
Token: SeDebugPrivilege	2692	start.exe
Token: SeDebugPrivilege	2908	start.exe
Token: SeDebugPrivilege	2596	start.exe
Token: SeDebugPrivilege	2316	start.exe
Token: SeDebugPrivilege	2840	start.exe
Token: SeDebugPrivilege	2964	start.exe
Token: SeDebugPrivilege	1052	start.exe
Token: SeDebugPrivilege	2460	start.exe
Token: SeDebugPrivilege	576	start.exe
Token: SeDebugPrivilege	3064	start.exe
Token: SeDebugPrivilege	1760	start.exe
Token: SeDebugPrivilege	1692	start.exe
Token: SeDebugPrivilege	888	start.exe
Token: SeDebugPrivilege	2756	start.exe
Token: SeDebugPrivilege	2692	start.exe
Token: SeDebugPrivilege	2608	start.exe
Token: SeDebugPrivilege	1812	start.exe
Token: SeDebugPrivilege	2892	start.exe
Token: SeDebugPrivilege	3000	start.exe
Token: SeDebugPrivilege	2860	start.exe
Token: SeDebugPrivilege	348	start.exe
Token: SeDebugPrivilege	1676	start.exe
Token: SeDebugPrivilege	2512	start.exe
Token: SeDebugPrivilege	1988	start.exe
Token: SeDebugPrivilege	892	start.exe
Token: SeDebugPrivilege	3024	start.exe
Token: SeDebugPrivilege	2380	start.exe
Token: SeDebugPrivilege	1804	start.exe
Token: SeDebugPrivilege	2600	start.exe
Token: SeDebugPrivilege	1680	start.exe
Token: SeDebugPrivilege	1812	start.exe
Token: SeDebugPrivilege	2892	start.exe
Token: SeDebugPrivilege	3000	start.exe
Token: SeDebugPrivilege	2492	start.exe
Token: SeDebugPrivilege	2172	start.exe
Token: SeDebugPrivilege	1544	start.exe
Token: SeDebugPrivilege	1720	start.exe
Token: SeDebugPrivilege	2544	start.exe
Token: SeDebugPrivilege	572	start.exe
Token: SeDebugPrivilege	2212	start.exe
Token: SeDebugPrivilege	2744	start.exe
Token: SeDebugPrivilege	2392	start.exe
Token: SeDebugPrivilege	924	start.exe
Token: SeDebugPrivilege	1156	start.exe
Token: SeDebugPrivilege	2940	start.exe
Token: SeDebugPrivilege	768	start.exe
Token: SeDebugPrivilege	2776	start.exe
Token: SeDebugPrivilege	3040	start.exe
Token: SeDebugPrivilege	2492	start.exe
Token: SeDebugPrivilege	1088	start.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2836	start.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2792	3020	Xworm V5.6.exe	30
PID 3020 wrote to memory of 2792	3020	Xworm V5.6.exe	30
PID 3020 wrote to memory of 2792	3020	Xworm V5.6.exe	30
PID 3020 wrote to memory of 2836	3020	Xworm V5.6.exe	31
PID 3020 wrote to memory of 2836	3020	Xworm V5.6.exe	31
PID 3020 wrote to memory of 2836	3020	Xworm V5.6.exe	31
PID 2792 wrote to memory of 2228	2792	Xworm V5.6.exe	32
PID 2792 wrote to memory of 2228	2792	Xworm V5.6.exe	32
PID 2792 wrote to memory of 2228	2792	Xworm V5.6.exe	32
PID 2792 wrote to memory of 2720	2792	Xworm V5.6.exe	33
PID 2792 wrote to memory of 2720	2792	Xworm V5.6.exe	33
PID 2792 wrote to memory of 2720	2792	Xworm V5.6.exe	33
PID 2836 wrote to memory of 2776	2836	start.exe	34
PID 2836 wrote to memory of 2776	2836	start.exe	34
PID 2836 wrote to memory of 2776	2836	start.exe	34
PID 2836 wrote to memory of 2924	2836	start.exe	36
PID 2836 wrote to memory of 2924	2836	start.exe	36
PID 2836 wrote to memory of 2924	2836	start.exe	36
PID 2836 wrote to memory of 2696	2836	start.exe	38
PID 2836 wrote to memory of 2696	2836	start.exe	38
PID 2836 wrote to memory of 2696	2836	start.exe	38
PID 2836 wrote to memory of 2884	2836	start.exe	40
PID 2836 wrote to memory of 2884	2836	start.exe	40
PID 2836 wrote to memory of 2884	2836	start.exe	40
PID 2228 wrote to memory of 2984	2228	Xworm V5.6.exe	42
PID 2228 wrote to memory of 2984	2228	Xworm V5.6.exe	42
PID 2228 wrote to memory of 2984	2228	Xworm V5.6.exe	42
PID 2228 wrote to memory of 1788	2228	Xworm V5.6.exe	43
PID 2228 wrote to memory of 1788	2228	Xworm V5.6.exe	43
PID 2228 wrote to memory of 1788	2228	Xworm V5.6.exe	43
PID 2984 wrote to memory of 1684	2984	Xworm V5.6.exe	44
PID 2984 wrote to memory of 1684	2984	Xworm V5.6.exe	44
PID 2984 wrote to memory of 1684	2984	Xworm V5.6.exe	44
PID 2984 wrote to memory of 2012	2984	Xworm V5.6.exe	45
PID 2984 wrote to memory of 2012	2984	Xworm V5.6.exe	45
PID 2984 wrote to memory of 2012	2984	Xworm V5.6.exe	45
PID 1684 wrote to memory of 2312	1684	Xworm V5.6.exe	46
PID 1684 wrote to memory of 2312	1684	Xworm V5.6.exe	46
PID 1684 wrote to memory of 2312	1684	Xworm V5.6.exe	46
PID 1684 wrote to memory of 3064	1684	Xworm V5.6.exe	47
PID 1684 wrote to memory of 3064	1684	Xworm V5.6.exe	47
PID 1684 wrote to memory of 3064	1684	Xworm V5.6.exe	47
PID 2312 wrote to memory of 1204	2312	Xworm V5.6.exe	48
PID 2312 wrote to memory of 1204	2312	Xworm V5.6.exe	48
PID 2312 wrote to memory of 1204	2312	Xworm V5.6.exe	48
PID 2312 wrote to memory of 2096	2312	Xworm V5.6.exe	49
PID 2312 wrote to memory of 2096	2312	Xworm V5.6.exe	49
PID 2312 wrote to memory of 2096	2312	Xworm V5.6.exe	49
PID 1204 wrote to memory of 1532	1204	Xworm V5.6.exe	51
PID 1204 wrote to memory of 1532	1204	Xworm V5.6.exe	51
PID 1204 wrote to memory of 1532	1204	Xworm V5.6.exe	51
PID 1204 wrote to memory of 1568	1204	Xworm V5.6.exe	52
PID 1204 wrote to memory of 1568	1204	Xworm V5.6.exe	52
PID 1204 wrote to memory of 1568	1204	Xworm V5.6.exe	52
PID 1532 wrote to memory of 1952	1532	Xworm V5.6.exe	53
PID 1532 wrote to memory of 1952	1532	Xworm V5.6.exe	53
PID 1532 wrote to memory of 1952	1532	Xworm V5.6.exe	53
PID 1532 wrote to memory of 2244	1532	Xworm V5.6.exe	54
PID 1532 wrote to memory of 2244	1532	Xworm V5.6.exe	54
PID 1532 wrote to memory of 2244	1532	Xworm V5.6.exe	54
PID 1952 wrote to memory of 2216	1952	Xworm V5.6.exe	55
PID 1952 wrote to memory of 2216	1952	Xworm V5.6.exe	55
PID 1952 wrote to memory of 2216	1952	Xworm V5.6.exe	55
PID 1952 wrote to memory of 2080	1952	Xworm V5.6.exe	56

C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
"C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
  "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
    "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
      "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        10⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        11⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        12⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        13⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        14⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        15⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        16⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        17⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        18⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        19⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        20⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        21⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        22⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        23⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        24⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        25⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        26⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        27⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        28⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        29⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        30⤵
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        31⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        32⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        33⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        34⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        35⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        36⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        37⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        38⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        39⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        40⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        41⤵
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        42⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        43⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        44⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        45⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        46⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        47⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        48⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        49⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        50⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        51⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        52⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        53⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        54⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        55⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        56⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        57⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        58⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        59⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        60⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        61⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        62⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        63⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        64⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        65⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        66⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        67⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        67⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        66⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        65⤵
        Executes dropped EXE
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        64⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        63⤵
        Executes dropped EXE
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        62⤵
        Executes dropped EXE
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        61⤵
        Executes dropped EXE
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        60⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        59⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        58⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        57⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        56⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        55⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        54⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        52⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        51⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        50⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        48⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        46⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        44⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        42⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        40⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        38⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        36⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\start.exe
      "C:\Users\Admin\AppData\Local\Temp\start.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1788
- - C:\Users\Admin\AppData\Local\Temp\start.exe
    "C:\Users\Admin\AppData\Local\Temp\start.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
- C:\Users\Admin\AppData\Local\Temp\start.exe
  "C:\Users\Admin\AppData\Local\Temp\start.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\start.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'start.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\chrome.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'chrome.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\start.exe

Filesize
39KB

MD5
51e4348a35c9b40b0136fa204442f9c2

SHA1
aea47a3a717ca9cce49966093def7d8f5a53709a

SHA256
a8047efe920772b13508683a7d80de379b0cf2dc40b39a9cd37f949de6a90479

SHA512
f15353f1b29ead57efe865935ef0cbd9efa2f0e81e47a92993279a59ea4174fde1e9bb2546c35deda6cfa641cfa0ecd58f8a2f6006f0589ce95553d7debfa3bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a9bdaf3e66198c60bd213cf447239105

SHA1
a0b58be96823f7b287dfc4b74b46148f1c29921d

SHA256
a809146bdac5b285d88ad28b022f74658ff19974873a2f05bff6c7cd250c8735

SHA512
760544b27f6a8f3e1f9d6c6fa5b85fff6dbbbaf4bacfb50a1de6cd02f5616413d69b65065addf1478aab6f5fc2787488d02da2608ba7bf26c26769c289c2e1b0

Download Submit
memory/2776-18-0x00000000023C0000-0x00000000023C8000-memory.dmp

Filesize
32KB

Download
memory/2776-17-0x000000001B490000-0x000000001B772000-memory.dmp

Filesize
2.9MB

Download
memory/2792-5-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/2792-12-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/2836-9-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2924-24-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2924-25-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/3020-10-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/3020-0-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmp

Filesize
4KB

Download
memory/3020-2-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/3020-1-0x0000000000050000-0x0000000000806000-memory.dmp

Filesize
7.7MB

Download