Overview

overview

10

Static

static

3

XwormLoader.exe

windows7-x64

10

XwormLoader.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2025 15:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XwormLoader.exe

  • Size

    293KB

  • MD5

    67b572b8fed9bb8e91b26c6bd9fec2a3

  • SHA1

    91dd3124155f24c31ba86c6ccd3a13b4d6f6ddab

  • SHA256

    2a304826f36a9edb28ae07a7da5479f58c0599ef95113467c3cbd5727407aa1e

  • SHA512

    6f7edc4c8438b5730cc2b118160266423cba857d9ca8ed0bb16bee40fc84f2e8a1f98b028e50ffaa4f8a3bf67c33da9abcd932bdc2d001b665ef030880f61357

  • SSDEEP

    6144:6bs68FnNynbfZoOzbEWGSHVXWC8lCk1SHM70v9:6bs6anNi3bEWGSHdWCvFM70v9

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:18194

soon-logical.gl.at.ply.gg:18194
Mutex

APoxCrOmNOvTLB4L

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    chrome.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Users\Admin\AppData\Local\Temp\start.exe
      "C:\Users\Admin\AppData\Local\Temp\start.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4724
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\start.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2164
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'start.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4112
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\chrome.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5048
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'chrome.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1824
    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\Users\Admin\AppData\Local\Temp\start.exe
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3384
      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:976
        • C:\Users\Admin\AppData\Local\Temp\start.exe
          "C:\Users\Admin\AppData\Local\Temp\start.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1704
        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:1924
          • C:\Users\Admin\AppData\Local\Temp\start.exe
            "C:\Users\Admin\AppData\Local\Temp\start.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3840
          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:4420
            • C:\Users\Admin\AppData\Local\Temp\start.exe
              "C:\Users\Admin\AppData\Local\Temp\start.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:4104
            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
              6⤵
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:4632
              • C:\Users\Admin\AppData\Local\Temp\start.exe
                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4520
              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                7⤵
                • Checks computer location settings
                • Suspicious use of WriteProcessMemory
                PID:448
                • C:\Users\Admin\AppData\Local\Temp\start.exe
                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:452
                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                  8⤵
                  • Checks computer location settings
                  • Suspicious use of WriteProcessMemory
                  PID:3436
                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:760
                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                    9⤵
                    • Checks computer location settings
                    • Suspicious use of WriteProcessMemory
                    PID:1540
                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3108
                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                      10⤵
                      • Checks computer location settings
                      • Suspicious use of WriteProcessMemory
                      PID:4316
                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1456
                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                        11⤵
                        • Checks computer location settings
                        • Suspicious use of WriteProcessMemory
                        PID:4636
                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                          12⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1464
                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                          12⤵
                          • Checks computer location settings
                          • Suspicious use of WriteProcessMemory
                          PID:3300
                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4808
                          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                            13⤵
                            • Checks computer location settings
                            • Suspicious use of WriteProcessMemory
                            PID:2020
                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4020
                            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                              14⤵
                              • Checks computer location settings
                              • Suspicious use of WriteProcessMemory
                              PID:4028
                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2908
                              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                15⤵
                                • Checks computer location settings
                                PID:372
                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:756
                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                  16⤵
                                  • Checks computer location settings
                                  PID:4252
                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1552
                                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                    17⤵
                                    • Checks computer location settings
                                    PID:4484
                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:912
                                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                      18⤵
                                      • Checks computer location settings
                                      PID:4104
                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3480
                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                        19⤵
                                        • Checks computer location settings
                                        PID:2504
                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                          20⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2160
                                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                          20⤵
                                          • Checks computer location settings
                                          PID:4660
                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2592
                                          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                            21⤵
                                            • Checks computer location settings
                                            PID:4360
                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                              22⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5104
                                            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                              22⤵
                                              • Checks computer location settings
                                              PID:5100
                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2288
                                              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                23⤵
                                                • Checks computer location settings
                                                PID:2492
                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1456
                                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                  24⤵
                                                    PID:2244
                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                      25⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1464
                                                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                      25⤵
                                                      • Checks computer location settings
                                                      PID:3372
                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                        26⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3944
                                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                        26⤵
                                                        • Checks computer location settings
                                                        PID:1200
                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:5072
                                                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                          27⤵
                                                          • Checks computer location settings
                                                          PID:2540
                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                            28⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1528
                                                          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                            28⤵
                                                            • Checks computer location settings
                                                            PID:4408
                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                              29⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2908
                                                            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                              29⤵
                                                              • Checks computer location settings
                                                              PID:1996
                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                30⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:460
                                                              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                30⤵
                                                                • Checks computer location settings
                                                                PID:4368
                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                  31⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3592
                                                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                  31⤵
                                                                  • Checks computer location settings
                                                                  PID:3540
                                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                    32⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:4772
                                                                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                    32⤵
                                                                    • Checks computer location settings
                                                                    PID:1412
                                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                      33⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:208
                                                                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                      33⤵
                                                                      • Checks computer location settings
                                                                      PID:400
                                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                        34⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3016
                                                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                        34⤵
                                                                        • Checks computer location settings
                                                                        PID:2352
                                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                          35⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2632
                                                                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                          35⤵
                                                                          • Checks computer location settings
                                                                          PID:2416
                                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                            36⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2564
                                                                          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                            36⤵
                                                                            • Checks computer location settings
                                                                            PID:1716
                                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                              37⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2384
                                                                            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                              37⤵
                                                                              • Checks computer location settings
                                                                              PID:4596
                                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                38⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4900
                                                                              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                38⤵
                                                                                • Checks computer location settings
                                                                                PID:436
                                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                  39⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1416
                                                                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                  39⤵
                                                                                  • Checks computer location settings
                                                                                  PID:3148
                                                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                    40⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:1236
                                                                                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                    40⤵
                                                                                      PID:4812
                                                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                        41⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2896
                                                                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                        41⤵
                                                                                        • Checks computer location settings
                                                                                        PID:1712
                                                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                          42⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:372
                                                                                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                          42⤵
                                                                                          • Checks computer location settings
                                                                                          PID:1172
                                                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                            43⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:4252
                                                                                          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                            43⤵
                                                                                            • Checks computer location settings
                                                                                            PID:3004
                                                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                              44⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:1796
                                                                                            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                              44⤵
                                                                                              • Checks computer location settings
                                                                                              PID:2300
                                                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                45⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4352
                                                                                              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                45⤵
                                                                                                • Checks computer location settings
                                                                                                PID:4364
                                                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                  46⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:4864
                                                                                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                  46⤵
                                                                                                  • Checks computer location settings
                                                                                                  PID:4396
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                    47⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2532
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                    47⤵
                                                                                                    • Checks computer location settings
                                                                                                    PID:3464
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                      48⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1272
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                      48⤵
                                                                                                      • Checks computer location settings
                                                                                                      PID:2276
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                        49⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:2572
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                        49⤵
                                                                                                          PID:2320
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                            50⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:3020
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                            50⤵
                                                                                                            • Checks computer location settings
                                                                                                            PID:4784
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                              51⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:3096
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                              51⤵
                                                                                                              • Checks computer location settings
                                                                                                              PID:5040
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                52⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:1716
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                52⤵
                                                                                                                • Checks computer location settings
                                                                                                                PID:4220
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                  53⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:444
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                  53⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  PID:2252
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                    54⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:1408
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                    54⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    PID:5092
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                      55⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:4700
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                      55⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      PID:4532
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                        56⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:4796
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                        56⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        PID:4112
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                          57⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1576
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                          57⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          PID:1016
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                            58⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:1856
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                            58⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:5116
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                              59⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2368
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                              59⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              PID:3376
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                60⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:1796
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                60⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                PID:4108
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                  61⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:3592
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                  61⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  PID:3528
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                    62⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:3440
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                    62⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    PID:3888
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                      63⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:2504
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                      63⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      PID:5036
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                        64⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:3840
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                        64⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        PID:4340
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                          65⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:4716
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                          65⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          PID:4652
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                            66⤵
                                                                                                                                              PID:216
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                              66⤵
                                                                                                                                              • Checks computer location settings
                                                                                                                                              PID:4684
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\start.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\start.exe"
                                                                                                                                                67⤵
                                                                                                                                                  PID:3680
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\XwormLoader.exe"
                                                                                                                                                  67⤵
                                                                                                                                                    PID:3652

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XwormLoader.exe.log
                Filesize

                654B

                MD5

                2ff39f6c7249774be85fd60a8f9a245e

                SHA1

                684ff36b31aedc1e587c8496c02722c6698c1c4e

                SHA256

                e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                SHA512

                1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                Filesize

                2KB

                MD5

                d85ba6ff808d9e5444a4b369f5bc2730

                SHA1

                31aa9d96590fff6981b315e0b391b575e4c0804a

                SHA256

                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                SHA512

                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                944B

                MD5

                6d42b6da621e8df5674e26b799c8e2aa

                SHA1

                ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                SHA256

                5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                SHA512

                53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                944B

                MD5

                3072fa0040b347c3941144486bf30c6f

                SHA1

                e6dc84a5bd882198583653592f17af1bf8cbfc68

                SHA256

                da8b533f81b342503c109e46b081b5c5296fdad5481f93fe5cc648e49ca6238e

                SHA512

                62df0eed621fe8ec340887a03d26b125429025c14ddcdfef82cb78ce1c9c6110c1d51ff0e423754d7966b6251363bf92833970eaf67707f8dd62e1549a79536c

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                944B

                MD5

                e3161f4edbc9b963debe22e29658050b

                SHA1

                45dbf88dadafe5dd1cfee1e987c8a219d3208cdb

                SHA256

                1359d6daeaed2f254b162914203c891b23139cc236a3bf75c2dfcbe26265c84a

                SHA512

                006ffb8f37d1f77f8ee79b22ffa413819f565d62773c632b70985759572121c6ab4743139d16d885f8c0ff9d0e0b136686741728b3e142ee54aea3bb733dffb2

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_js4w120j.gie.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\start.exe
                Filesize

                39KB

                MD5

                51e4348a35c9b40b0136fa204442f9c2

                SHA1

                aea47a3a717ca9cce49966093def7d8f5a53709a

                SHA256

                a8047efe920772b13508683a7d80de379b0cf2dc40b39a9cd37f949de6a90479

                SHA512

                f15353f1b29ead57efe865935ef0cbd9efa2f0e81e47a92993279a59ea4174fde1e9bb2546c35deda6cfa641cfa0ecd58f8a2f6006f0589ce95553d7debfa3bd

                Download Submit

              • memory/1260-1-0x0000000000C20000-0x0000000000C70000-memory.dmp

                Filesize

                320KB

                Download

              • memory/1260-10-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/1260-18-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/1260-0-0x00007FFD352C3000-0x00007FFD352C5000-memory.dmp

                Filesize

                8KB

                Download

              • memory/2164-29-0x000001EAFC7A0000-0x000001EAFC7C2000-memory.dmp

                Filesize

                136KB

                Download

              • memory/2416-22-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2416-20-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2416-19-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4724-16-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4724-17-0x0000000000430000-0x0000000000440000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4724-75-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4724-79-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4724-83-0x00007FFD352C0000-0x00007FFD35D81000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/4724-92-0x0000000000C40000-0x0000000000C4C000-memory.dmp

                Filesize

                48KB

                Download