xworm | 238bd89de11cbe6b00e7bf57f13863394bed494b73d09570011f27b87270b51a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-01-2025 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xworm V5.6.exe
Size

7.7MB
MD5

027ad6a104d074597068c1781cc0c90d
SHA1

b489c6f4d29db588ecfc65df7ea92d6c23de4a20
SHA256

238bd89de11cbe6b00e7bf57f13863394bed494b73d09570011f27b87270b51a
SHA512

0e3beecff23c8d426d859758b5c9aa4490e5d47ea69e4301c73fe499bd6535ec8dfe22dae552c8e14203d78768cd2ccfb70f78e876de2ba4b2532cf502b40e4f
SSDEEP

196608:xKLCFU/jHq/puROyhxeyOC7+oiRkbtejBe5:xmq/pkOYxehohbt

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:18194

soon-logical.gl.at.ply.gg:18194

Mutex

APoxCrOmNOvTLB4L

Attributes

Install_directory
%Userprofile%
install_file
chrome.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000012119-7.dat	family_xworm
behavioral1/memory/2384-9-0x00000000011E0000-0x00000000011F0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2808	powershell.exe
2908	powershell.exe
2616	powershell.exe
1256	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.lnk	start.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.lnk	start.exe

Executes dropped EXE 64 IoCs

pid	Process
2384	start.exe
2304	start.exe
3060	start.exe
1060	start.exe
2268	start.exe
2152	start.exe
1100	start.exe
1340	start.exe
336	start.exe
1604	start.exe
2544	start.exe
2760	start.exe
2620	start.exe
2660	start.exe
2584	start.exe
1752	start.exe
1676	start.exe
1848	start.exe
1000	start.exe
2224	start.exe
2412	start.exe
1756	start.exe
2964	start.exe
2272	start.exe
2820	start.exe
2860	start.exe
2668	start.exe
2664	start.exe
656	start.exe
996	start.exe
2056	start.exe
3028	start.exe
952	start.exe
1744	start.exe
1808	start.exe
1340	start.exe
1720	start.exe
2336	start.exe
1484	start.exe
2684	start.exe
2744	start.exe
2196	start.exe
2208	start.exe
2260	start.exe
2692	start.exe
1236	start.exe
1892	start.exe
1716	start.exe
568	start.exe
2328	start.exe
1804	start.exe
1720	start.exe
1344	start.exe
2340	start.exe
2940	start.exe
1304	start.exe
496	start.exe
2208	start.exe
1620	start.exe
2524	start.exe
1076	start.exe
1336	start.exe
2252	start.exe
1928	start.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "C:\\Users\\Admin\\chrome.exe"	start.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2808	powershell.exe
2908	powershell.exe
2616	powershell.exe
1256	powershell.exe
2384	start.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	start.exe
Token: SeDebugPrivilege	2304	start.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	3060	start.exe
Token: SeDebugPrivilege	2384	start.exe
Token: SeDebugPrivilege	1060	start.exe
Token: SeDebugPrivilege	2268	start.exe
Token: SeDebugPrivilege	2152	start.exe
Token: SeDebugPrivilege	1100	start.exe
Token: SeDebugPrivilege	1340	start.exe
Token: SeDebugPrivilege	336	start.exe
Token: SeDebugPrivilege	1604	start.exe
Token: SeDebugPrivilege	2544	start.exe
Token: SeDebugPrivilege	2760	start.exe
Token: SeDebugPrivilege	2620	start.exe
Token: SeDebugPrivilege	2660	start.exe
Token: SeDebugPrivilege	2584	start.exe
Token: SeDebugPrivilege	1752	start.exe
Token: SeDebugPrivilege	1676	start.exe
Token: SeDebugPrivilege	1848	start.exe
Token: SeDebugPrivilege	1000	start.exe
Token: SeDebugPrivilege	2224	start.exe
Token: SeDebugPrivilege	2412	start.exe
Token: SeDebugPrivilege	1756	start.exe
Token: SeDebugPrivilege	2964	start.exe
Token: SeDebugPrivilege	2272	start.exe
Token: SeDebugPrivilege	2820	start.exe
Token: SeDebugPrivilege	2860	start.exe
Token: SeDebugPrivilege	2668	start.exe
Token: SeDebugPrivilege	2664	start.exe
Token: SeDebugPrivilege	656	start.exe
Token: SeDebugPrivilege	996	start.exe
Token: SeDebugPrivilege	2056	start.exe
Token: SeDebugPrivilege	3028	start.exe
Token: SeDebugPrivilege	952	start.exe
Token: SeDebugPrivilege	1744	start.exe
Token: SeDebugPrivilege	1808	start.exe
Token: SeDebugPrivilege	1340	start.exe
Token: SeDebugPrivilege	1720	start.exe
Token: SeDebugPrivilege	2336	start.exe
Token: SeDebugPrivilege	1484	start.exe
Token: SeDebugPrivilege	2684	start.exe
Token: SeDebugPrivilege	2744	start.exe
Token: SeDebugPrivilege	2196	start.exe
Token: SeDebugPrivilege	2208	start.exe
Token: SeDebugPrivilege	2260	start.exe
Token: SeDebugPrivilege	2692	start.exe
Token: SeDebugPrivilege	1236	start.exe
Token: SeDebugPrivilege	1892	start.exe
Token: SeDebugPrivilege	1716	start.exe
Token: SeDebugPrivilege	568	start.exe
Token: SeDebugPrivilege	2328	start.exe
Token: SeDebugPrivilege	1804	start.exe
Token: SeDebugPrivilege	1720	start.exe
Token: SeDebugPrivilege	1344	start.exe
Token: SeDebugPrivilege	2340	start.exe
Token: SeDebugPrivilege	2940	start.exe
Token: SeDebugPrivilege	1304	start.exe
Token: SeDebugPrivilege	496	start.exe
Token: SeDebugPrivilege	2208	start.exe
Token: SeDebugPrivilege	1620	start.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2384	start.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2508	2516	Xworm V5.6.exe	30
PID 2516 wrote to memory of 2508	2516	Xworm V5.6.exe	30
PID 2516 wrote to memory of 2508	2516	Xworm V5.6.exe	30
PID 2516 wrote to memory of 2384	2516	Xworm V5.6.exe	31
PID 2516 wrote to memory of 2384	2516	Xworm V5.6.exe	31
PID 2516 wrote to memory of 2384	2516	Xworm V5.6.exe	31
PID 2508 wrote to memory of 2168	2508	Xworm V5.6.exe	32
PID 2508 wrote to memory of 2168	2508	Xworm V5.6.exe	32
PID 2508 wrote to memory of 2168	2508	Xworm V5.6.exe	32
PID 2508 wrote to memory of 2304	2508	Xworm V5.6.exe	33
PID 2508 wrote to memory of 2304	2508	Xworm V5.6.exe	33
PID 2508 wrote to memory of 2304	2508	Xworm V5.6.exe	33
PID 2384 wrote to memory of 2808	2384	start.exe	34
PID 2384 wrote to memory of 2808	2384	start.exe	34
PID 2384 wrote to memory of 2808	2384	start.exe	34
PID 2384 wrote to memory of 2908	2384	start.exe	36
PID 2384 wrote to memory of 2908	2384	start.exe	36
PID 2384 wrote to memory of 2908	2384	start.exe	36
PID 2384 wrote to memory of 2616	2384	start.exe	38
PID 2384 wrote to memory of 2616	2384	start.exe	38
PID 2384 wrote to memory of 2616	2384	start.exe	38
PID 2384 wrote to memory of 1256	2384	start.exe	40
PID 2384 wrote to memory of 1256	2384	start.exe	40
PID 2384 wrote to memory of 1256	2384	start.exe	40
PID 2168 wrote to memory of 2696	2168	Xworm V5.6.exe	42
PID 2168 wrote to memory of 2696	2168	Xworm V5.6.exe	42
PID 2168 wrote to memory of 2696	2168	Xworm V5.6.exe	42
PID 2168 wrote to memory of 3060	2168	Xworm V5.6.exe	43
PID 2168 wrote to memory of 3060	2168	Xworm V5.6.exe	43
PID 2168 wrote to memory of 3060	2168	Xworm V5.6.exe	43
PID 2696 wrote to memory of 484	2696	Xworm V5.6.exe	44
PID 2696 wrote to memory of 484	2696	Xworm V5.6.exe	44
PID 2696 wrote to memory of 484	2696	Xworm V5.6.exe	44
PID 2696 wrote to memory of 1060	2696	Xworm V5.6.exe	45
PID 2696 wrote to memory of 1060	2696	Xworm V5.6.exe	45
PID 2696 wrote to memory of 1060	2696	Xworm V5.6.exe	45
PID 484 wrote to memory of 852	484	Xworm V5.6.exe	47
PID 484 wrote to memory of 852	484	Xworm V5.6.exe	47
PID 484 wrote to memory of 852	484	Xworm V5.6.exe	47
PID 484 wrote to memory of 2268	484	Xworm V5.6.exe	48
PID 484 wrote to memory of 2268	484	Xworm V5.6.exe	48
PID 484 wrote to memory of 2268	484	Xworm V5.6.exe	48
PID 852 wrote to memory of 2120	852	Xworm V5.6.exe	49
PID 852 wrote to memory of 2120	852	Xworm V5.6.exe	49
PID 852 wrote to memory of 2120	852	Xworm V5.6.exe	49
PID 852 wrote to memory of 2152	852	Xworm V5.6.exe	50
PID 852 wrote to memory of 2152	852	Xworm V5.6.exe	50
PID 852 wrote to memory of 2152	852	Xworm V5.6.exe	50
PID 2120 wrote to memory of 2988	2120	Xworm V5.6.exe	51
PID 2120 wrote to memory of 2988	2120	Xworm V5.6.exe	51
PID 2120 wrote to memory of 2988	2120	Xworm V5.6.exe	51
PID 2120 wrote to memory of 1100	2120	Xworm V5.6.exe	52
PID 2120 wrote to memory of 1100	2120	Xworm V5.6.exe	52
PID 2120 wrote to memory of 1100	2120	Xworm V5.6.exe	52
PID 2988 wrote to memory of 296	2988	Xworm V5.6.exe	53
PID 2988 wrote to memory of 296	2988	Xworm V5.6.exe	53
PID 2988 wrote to memory of 296	2988	Xworm V5.6.exe	53
PID 2988 wrote to memory of 1340	2988	Xworm V5.6.exe	54
PID 2988 wrote to memory of 1340	2988	Xworm V5.6.exe	54
PID 2988 wrote to memory of 1340	2988	Xworm V5.6.exe	54
PID 296 wrote to memory of 1492	296	Xworm V5.6.exe	56
PID 296 wrote to memory of 1492	296	Xworm V5.6.exe	56
PID 296 wrote to memory of 1492	296	Xworm V5.6.exe	56
PID 296 wrote to memory of 336	296	Xworm V5.6.exe	57

C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
"C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
  "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
    "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
      "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:484
      - C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:296
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        10⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        11⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        12⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        13⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        14⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        15⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        16⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        17⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        18⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        19⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        20⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        21⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        22⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        23⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        24⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        25⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        26⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        27⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        28⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        29⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        30⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        31⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        32⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        33⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        34⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        35⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        36⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        37⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        38⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        39⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        40⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        41⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        42⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        43⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        44⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        45⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        46⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        47⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        48⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        49⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        50⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        51⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        52⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        53⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        54⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        55⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        56⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        57⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        58⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        59⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        60⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        61⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        62⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        63⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        64⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        65⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        66⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Xworm V5.6.exe"
        67⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        67⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        66⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        65⤵
        Executes dropped EXE
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        64⤵
        Executes dropped EXE
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        63⤵
        Executes dropped EXE
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        62⤵
        Executes dropped EXE
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        61⤵
        Executes dropped EXE
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        60⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        59⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        58⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:496
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        57⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        56⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        55⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        54⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        52⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        51⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        50⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        48⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        46⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        44⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        42⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        40⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        38⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        36⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:336
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\start.exe
        
        "C:\Users\Admin\AppData\Local\Temp\start.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\start.exe
      "C:\Users\Admin\AppData\Local\Temp\start.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3060
- - C:\Users\Admin\AppData\Local\Temp\start.exe
    "C:\Users\Admin\AppData\Local\Temp\start.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- C:\Users\Admin\AppData\Local\Temp\start.exe
  "C:\Users\Admin\AppData\Local\Temp\start.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\start.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'start.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\chrome.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'chrome.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\start.exe

Filesize
39KB

MD5
51e4348a35c9b40b0136fa204442f9c2

SHA1
aea47a3a717ca9cce49966093def7d8f5a53709a

SHA256
a8047efe920772b13508683a7d80de379b0cf2dc40b39a9cd37f949de6a90479

SHA512
f15353f1b29ead57efe865935ef0cbd9efa2f0e81e47a92993279a59ea4174fde1e9bb2546c35deda6cfa641cfa0ecd58f8a2f6006f0589ce95553d7debfa3bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d85e15801d480807b4dbee7bcacf9a20

SHA1
8b6c1da11c245eb0d34a5d843540e3dd431007b9

SHA256
671a605a87403254217b668ca37963430e4026d21c2f5d9e447d9d2ae8b6f2d1

SHA512
a135e013406d6148fa53806b8f213d4f9daaba59d5ae504a428b98dfa0722e07beb5042cb7bc91649581eeedb7f20607b46b5eabbe80713e51b35f487d4123bc

Download Submit
memory/2384-9-0x00000000011E0000-0x00000000011F0000-memory.dmp

Filesize
64KB

Download
memory/2508-8-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/2508-12-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/2516-2-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/2516-10-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/2516-0-0x000007FEF5103000-0x000007FEF5104000-memory.dmp

Filesize
4KB

Download
memory/2516-1-0x0000000000990000-0x0000000001146000-memory.dmp

Filesize
7.7MB

Download
memory/2808-17-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2808-18-0x0000000002010000-0x0000000002018000-memory.dmp

Filesize
32KB

Download
memory/2908-24-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2908-25-0x0000000001D20000-0x0000000001D28000-memory.dmp

Filesize
32KB

Download