xworm | 37cfc128f60c2c2ede7ffb2db6b9873480e53ecac6184334a2308df477b65be6

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2024 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xSpoofer-ReleaseNew2.0/xSpoofer-new.exe
Size

7.0MB
MD5

6b47add2cf208a988c57c8f00461de0b
SHA1

cf9518f4bd3cf94ab7225423e4365f4a262a9c61
SHA256

b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07
SHA512

e2f5eb2e82ab1951e0bfe0994219ed676a71ccb9804be7ebbea42d9ad9596922c16600a101caccbbfd161b98fcc2d7b3e9591afb66e1878627f6cee0918b6a35
SSDEEP

196608:oA+bmZgkjTKD4C4+e4YcJE4AcnPmP99j+zE/k:oAEGZjTvC4EtAcPmPJ/

Score

10^/10

xworm evasion rat themida trojan

Malware Config

Extracted

Family

xworm

210.246.215.82:7000

Attributes

Install_directory
%ProgramData%
install_file
WindowsNT.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\XClient.exe	family_xworm
behavioral25/memory/2236-13-0x0000000000E50000-0x0000000000E6C000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

xSpoofer-new.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ xSpoofer-new.exe
Drops file in Drivers directory 1 IoCs

Processes:

xSpoofer-new.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts xSpoofer-new.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	xSpoofer-new.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	xSpoofer-new.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

xSpoofer-new.exexSpoofer-new.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xSpoofer-new.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xSpoofer-new.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xSpoofer-new.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xSpoofer-new.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

xSpoofer-new.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	xSpoofer-new.exe

Executes dropped EXE 19 IoCs

Processes:

XClient.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exexSpoofer-new.exe

pid	process
2236	XClient.exe
4244	xSpoofer-new.exe
1896	xSpoofer-new.exe
3240	xSpoofer-new.exe
4996	xSpoofer-new.exe
1368	xSpoofer-new.exe
4304	xSpoofer-new.exe
808	xSpoofer-new.exe
60	xSpoofer-new.exe
1952	xSpoofer-new.exe
4832	xSpoofer-new.exe
4672	xSpoofer-new.exe
1732	xSpoofer-new.exe
4044	xSpoofer-new.exe
1184	xSpoofer-new.exe
3240	xSpoofer-new.exe
3844	xSpoofer-new.exe
2708	xSpoofer-new.exe
2300	xSpoofer-new.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral25/memory/2300-182-0x0000000140000000-0x0000000140AE7000-memory.dmp	themida
behavioral25/memory/2300-201-0x0000000140000000-0x0000000140AE7000-memory.dmp	themida
behavioral25/memory/2300-205-0x0000000140000000-0x0000000140AE7000-memory.dmp	themida
behavioral25/memory/2300-206-0x0000000140000000-0x0000000140AE7000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

xSpoofer-new.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xSpoofer-new.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

xSpoofer-new.exe

pid process

2300 xSpoofer-new.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

xSpoofer-new.exe

pid process

2300 xSpoofer-new.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xSpoofer-new.exe

flow	ioc
15	ip-api.com

pid	process
2300	xSpoofer-new.exe

pid	process
2300	xSpoofer-new.exe

Suspicious use of SetThreadContext 17 IoCs

Processes:

xSpoofer-new.exe

description	pid	process	target process
PID 4244 set thread context of 1896	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 3240	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 4996	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 1368	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 4304	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 808	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 60	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 1952	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 4832	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 4672	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 1732	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 4044	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 1184	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 3240	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 3844	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 2708	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 set thread context of 2300	4244	xSpoofer-new.exe	xSpoofer-new.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

xSpoofer-new.exe

pid process

2708 xSpoofer-new.exe
2708 xSpoofer-new.exe
2708 xSpoofer-new.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

XClient.exexSpoofer-new.exexSpoofer-new.exe

description pid process

Token: SeDebugPrivilege 2236 XClient.exe
Token: SeDebugPrivilege 4244 xSpoofer-new.exe
Token: SeDebugPrivilege 2708 xSpoofer-new.exe

pid	process
2708	xSpoofer-new.exe
2708	xSpoofer-new.exe
2708	xSpoofer-new.exe

description	pid	process
Token: SeDebugPrivilege	2236	XClient.exe
Token: SeDebugPrivilege	4244	xSpoofer-new.exe
Token: SeDebugPrivilege	2708	xSpoofer-new.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

xSpoofer-new.exexSpoofer-new.exe

description	pid	process	target process
PID 4672 wrote to memory of 2236	4672	xSpoofer-new.exe	XClient.exe
PID 4672 wrote to memory of 2236	4672	xSpoofer-new.exe	XClient.exe
PID 4672 wrote to memory of 4244	4672	xSpoofer-new.exe	xSpoofer-new.exe
PID 4672 wrote to memory of 4244	4672	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1896	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1896	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1896	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1896	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1896	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1896	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1896	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1896	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1896	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1896	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1896	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 3240	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 3240	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 3240	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 3240	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 3240	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 3240	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 3240	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 3240	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 3240	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 3240	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 3240	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4996	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4996	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4996	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4996	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4996	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4996	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4996	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4996	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4996	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4996	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4996	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1368	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1368	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1368	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1368	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1368	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1368	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1368	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1368	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1368	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1368	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 1368	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4304	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4304	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4304	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4304	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4304	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4304	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4304	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4304	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4304	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4304	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 4304	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 808	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 808	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 808	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 808	4244	xSpoofer-new.exe	xSpoofer-new.exe
PID 4244 wrote to memory of 808	4244	xSpoofer-new.exe	xSpoofer-new.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xSpoofer-ReleaseNew2.0\xSpoofer-new.exe
"C:\Users\Admin\AppData\Local\Temp\xSpoofer-ReleaseNew2.0\xSpoofer-new.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4672

C:\Users\Admin\AppData\Roaming\XClient.exe
"C:\Users\Admin\AppData\Roaming\XClient.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
"C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe"
2⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XblAuthManager
3⤵
- Executes dropped EXE
PID:1896

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XblGameSave
3⤵
- Executes dropped EXE
PID:3240

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XboxGipSvc
3⤵
- Executes dropped EXE
PID:4996

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XboxNetApiSvc
3⤵
- Executes dropped EXE
PID:1368

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop xboxgip
3⤵
- Executes dropped EXE
PID:4304

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XblAuthManager
3⤵
- Executes dropped EXE
PID:808

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XblGameSave
3⤵
- Executes dropped EXE
PID:60

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XboxNetApiSvc
3⤵
- Executes dropped EXE
PID:1952

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XboxGipSvc
3⤵
- Executes dropped EXE
PID:4832

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete xboxgip
3⤵
- Executes dropped EXE
PID:4672

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop vgk
3⤵
- Executes dropped EXE
PID:1732

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\xbgm" /f
3⤵
- Executes dropped EXE
PID:4044

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v AllowGameDVR /t REG_DWORD /d 0 /f
3⤵
- Executes dropped EXE
PID:1184

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe /Change /TN "Microsoft\XblGameSave\XblGameSaveTask" /disable
3⤵
- Executes dropped EXE
PID:3240

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe /Change /TN "Microsoft\XblGameSave\XblGameSaveTaskLogon" /disableL
3⤵
- Executes dropped EXE
PID:3844

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe -Command "& {Get-AppxPackage -allusers *xbox* | Remove-AppxPackage}"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xSpoofer-new.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5llzzqug.wcd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\XClient.exe

Filesize
87KB

MD5
626eb43e3611e3217f8602f7b8206889

SHA1
358935565a0a495a62559b204b7b41cbc365d8d9

SHA256
3c468ad439464cebe619052e06cf797b296ab0d9bcf88d475fb5c9b42b489573

SHA512
f4bf30eeadb557501362de71d4b6d58ab498d98e52b453f6e20309da36fe288d098dab9bb08cfcecf12787536ff20f0e649401ab6b0ff75e6671a4f3ebc4cd29

Download Submit
C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe

Filesize
6.8MB

MD5
233320478ce264f9e08d249244dc4fdb

SHA1
af46758a7c39b4edf4b5b0819f732abb5ad19e17

SHA256
edb57df920f62e6f1241695f8a46e420f104455a54fe91431db545834fd8d5ba

SHA512
b1c06e96cbabd58f8489a18c8c270718cea634a9bbd4fd67786cd5d31cfa475d4f97e2389f1ce2b5ddf10db9687b5cb5361e878d29427f9670f59343468d5967

Download Submit
memory/60-87-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/60-91-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/60-92-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/60-89-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/808-84-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/808-83-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/808-82-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/808-79-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1184-134-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/1184-133-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/1368-67-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1368-60-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1368-65-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1368-64-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1368-63-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1732-121-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1732-119-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1732-117-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1732-122-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1896-37-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1896-38-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1896-30-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1896-32-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1896-34-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1896-35-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1896-36-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1952-100-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1952-99-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1952-98-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/1952-95-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/2236-80-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/2236-40-0x0000000002F00000-0x0000000002F10000-memory.dmp

Filesize
64KB

Download
memory/2236-13-0x0000000000E50000-0x0000000000E6C000-memory.dmp

Filesize
112KB

Download
memory/2236-14-0x00007FFF5F7B0000-0x00007FFF60271000-memory.dmp

Filesize
10.8MB

Download
memory/2236-90-0x00007FFF5F7B0000-0x00007FFF60271000-memory.dmp

Filesize
10.8MB

Download
memory/2236-61-0x00007FFF5F7B0000-0x00007FFF60271000-memory.dmp

Filesize
10.8MB

Download
memory/2300-201-0x0000000140000000-0x0000000140AE7000-memory.dmp

Filesize
10.9MB

Download
memory/2300-202-0x000001C3BD0A0000-0x000001C3BD0A1000-memory.dmp

Filesize
4KB

Download
memory/2300-206-0x0000000140000000-0x0000000140AE7000-memory.dmp

Filesize
10.9MB

Download
memory/2300-182-0x0000000140000000-0x0000000140AE7000-memory.dmp

Filesize
10.9MB

Download
memory/2300-205-0x0000000140000000-0x0000000140AE7000-memory.dmp

Filesize
10.9MB

Download
memory/2708-156-0x0000000140000000-0x0000000140071000-memory.dmp

Filesize
452KB

Download
memory/2708-176-0x00007FFF5F730000-0x00007FFF601F1000-memory.dmp

Filesize
10.8MB

Download
memory/2708-171-0x0000027637600000-0x000002763760A000-memory.dmp

Filesize
40KB

Download
memory/2708-173-0x0000027637620000-0x0000027637630000-memory.dmp

Filesize
64KB

Download
memory/2708-172-0x0000027637E70000-0x0000027637E96000-memory.dmp

Filesize
152KB

Download
memory/2708-168-0x0000027637620000-0x0000027637630000-memory.dmp

Filesize
64KB

Download
memory/2708-177-0x0000000140000000-0x0000000140071000-memory.dmp

Filesize
452KB

Download
memory/2708-159-0x0000027637580000-0x00000276375A2000-memory.dmp

Filesize
136KB

Download
memory/2708-157-0x00007FFF5F730000-0x00007FFF601F1000-memory.dmp

Filesize
10.8MB

Download
memory/2708-169-0x0000027637620000-0x0000027637630000-memory.dmp

Filesize
64KB

Download
memory/2708-170-0x0000027637DE0000-0x0000027637DF6000-memory.dmp

Filesize
88KB

Download
memory/3240-141-0x0000000140000000-0x000000014003E000-memory.dmp

Filesize
248KB

Download
memory/3240-140-0x0000000140000000-0x000000014003E000-memory.dmp

Filesize
248KB

Download
memory/3240-46-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/3240-48-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/3240-44-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/3240-42-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/3240-47-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/3844-147-0x0000000140000000-0x000000014003E000-memory.dmp

Filesize
248KB

Download
memory/4044-127-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/4044-128-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/4044-125-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/4044-126-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/4044-123-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/4244-66-0x00007FF6E89B0000-0x00007FF6E94A0000-memory.dmp

Filesize
10.9MB

Download
memory/4244-29-0x00007FFF7DE70000-0x00007FFF7E065000-memory.dmp

Filesize
2.0MB

Download
memory/4244-27-0x00007FF6E89B0000-0x00007FF6E94A0000-memory.dmp

Filesize
10.9MB

Download
memory/4244-71-0x00007FFF7DE70000-0x00007FFF7E065000-memory.dmp

Filesize
2.0MB

Download
memory/4244-96-0x00007FF6E89B0000-0x00007FF6E94A0000-memory.dmp

Filesize
10.9MB

Download
memory/4304-74-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4304-70-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4304-73-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4304-76-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4304-75-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4672-110-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4672-114-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4672-1-0x00007FFF5F7B0000-0x00007FFF60271000-memory.dmp

Filesize
10.8MB

Download
memory/4672-26-0x00007FFF5F7B0000-0x00007FFF60271000-memory.dmp

Filesize
10.8MB

Download
memory/4672-112-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4672-0-0x0000000000200000-0x000000000090E000-memory.dmp

Filesize
7.1MB

Download
memory/4832-103-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4832-107-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4832-105-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4996-56-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4996-55-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4996-53-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4996-51-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download
memory/4996-57-0x0000000140000000-0x0000000140017000-memory.dmp

Filesize
92KB

Download