xworm | 3ac3efee88adab86a250a53dd9448453fcc4223662f5c6c21453606b6eb91b77

Analysis

max time kernel
126s
max time network
143s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/11/2024, 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SAMXCHEATcrack1.exe
Size

3.1MB
MD5

82a95b30418e5c4c3cba62b7805b09c9
SHA1

4921781362aae55b41c03f9aafd9e38e4555e5e3
SHA256

3ac3efee88adab86a250a53dd9448453fcc4223662f5c6c21453606b6eb91b77
SHA512

5775e02245ee0158f8f99796edc448a79f580f9c8c6c4188b491084eb9cecf48a341c3231ece8be43e005882a05dfe24dea98aeafbebe3bde0c2ef30cca9dc8b
SSDEEP

49152:opVFMHivibdm/rr3TxQrl18gOCNWofUNRvO3NwSS3Br+BT/KrqqXVbCuuTQjMk4P:KV4K2GTpCNJXWMxKrrlvsQRG9AmB

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

147.185.221.23:58112

Attributes

Install_directory
%AppData%
install_file
Realtek HD Audio Universal Service.exe

Extracted

Family

xworm

Version

5.0

147.185.221.20:65300

Mutex

RMe1pa1UgjNcB2Un

Attributes

Install_directory
%AppData%
install_file
Windows Shell Experience Host.exe

aes.plain

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012280-4.dat	family_xworm
behavioral1/files/0x0008000000015d0e-8.dat	family_xworm
behavioral1/memory/1728-20-0x0000000000CE0000-0x0000000000CF4000-memory.dmp	family_xworm
behavioral1/memory/1500-19-0x0000000000A90000-0x0000000000AAA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1120	powershell.exe
2020	powershell.exe
1236	powershell.exe
1568	powershell.exe
3004	powershell.exe
1044	powershell.exe
768	powershell.exe
1652	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Shell Experience Host.lnk	Windows Shell Experience Host.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Shell Experience Host.lnk	Windows Shell Experience Host.exe

Executes dropped EXE 4 IoCs

pid	Process
1728	Realtek HD Audio Universal Service.exe
1500	Windows Shell Experience Host.exe
2448	SAM X CHEAT crack1.exe
1196	Process not Found

Loads dropped DLL 4 IoCs

pid	Process
3032	SAMXCHEATcrack1.exe
3032	SAMXCHEATcrack1.exe
3032	SAMXCHEATcrack1.exe
2060	Process not Found

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Shell Experience Host = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Shell Experience Host.exe"	Windows Shell Experience Host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Realtek HD Audio Universal Service.exe"	Realtek HD Audio Universal Service.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
18	discord.com
19	discord.com
20	discord.com
23	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com
6	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SAMXCHEATcrack1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	SAM X CHEAT crack1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SAM X CHEAT crack1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SAM X CHEAT crack1.exe

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf0000000002000000000010660000000100002000000096eb093989f472d959ec911a8a3c6280f5875c0c8c529c2b2a2b375f0dd1c1d4000000000e8000000002000020000000134d0c6a27b9d6fe406812a4c33a3bb77d05a1ab0e824a23c363f535d710e50d20000000fde1fc5f75bbbad612666837c2a9c7f9d2e65e5bac7ca43b22d46525062afbf540000000cc7c835ef35162e80186216aa8f5c0eccd383014eaab81ee608475c81716636333b5402592d72cc95e14ed5959ec4897e7116f28961abba261d8482ffc9ccb43	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438463705"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DOMStorage\discord.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60eaf46d103ddb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf00000000020000000000106600000001000020000000a3a65105393b17ac9c0b8b9f8f6768b7d01cab1a12331c91e1a1d87863f6e3ca000000000e8000000002000020000000298f029c7bc7b2bfb1b1c53e85714ba1c3e7dc25c84da67716d7782c284e219b900000005a9f611550dcdcef4c0184acddcd1bb238e969137cf1b1ba92d9f8a71630ca03deb75d431f8b1de4cfbeebaf813870e9a7d671cc0e12f3810941f38bfbec620aa857e2dc6907c62c9cb2296f9d52d99d98579d4e17db50b9c83bc1d6a657dce508469b94dc860cf911baeba41a4de626f0a9757742fd7df6ae5a875fd15e7443238e8833d88d977a7ee89d3b38e1c70640000000f280c80198b36113e5f9206bf30487fd93d1112f5107688cd258e14dd4680dc50800e562480a42a9eb13d571da9b87ceab01fe1e2fd5b30839f21511178845c4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95CC6861-A903-11EF-ABAC-EE705CD14931} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1120	powershell.exe
2020	powershell.exe
1236	powershell.exe
1568	powershell.exe
3004	powershell.exe
1044	powershell.exe
768	powershell.exe
1652	powershell.exe
1728	Realtek HD Audio Universal Service.exe
1500	Windows Shell Experience Host.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	Realtek HD Audio Universal Service.exe
Token: SeDebugPrivilege	1500	Windows Shell Experience Host.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	768	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1432	iexplore.exe
1432	iexplore.exe
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE
1728	Realtek HD Audio Universal Service.exe
1500	Windows Shell Experience Host.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 1728	3032	SAMXCHEATcrack1.exe	30
PID 3032 wrote to memory of 1728	3032	SAMXCHEATcrack1.exe	30
PID 3032 wrote to memory of 1728	3032	SAMXCHEATcrack1.exe	30
PID 3032 wrote to memory of 1728	3032	SAMXCHEATcrack1.exe	30
PID 3032 wrote to memory of 1500	3032	SAMXCHEATcrack1.exe	31
PID 3032 wrote to memory of 1500	3032	SAMXCHEATcrack1.exe	31
PID 3032 wrote to memory of 1500	3032	SAMXCHEATcrack1.exe	31
PID 3032 wrote to memory of 1500	3032	SAMXCHEATcrack1.exe	31
PID 3032 wrote to memory of 2448	3032	SAMXCHEATcrack1.exe	32
PID 3032 wrote to memory of 2448	3032	SAMXCHEATcrack1.exe	32
PID 3032 wrote to memory of 2448	3032	SAMXCHEATcrack1.exe	32
PID 3032 wrote to memory of 2448	3032	SAMXCHEATcrack1.exe	32
PID 2448 wrote to memory of 1432	2448	SAM X CHEAT crack1.exe	36
PID 2448 wrote to memory of 1432	2448	SAM X CHEAT crack1.exe	36
PID 2448 wrote to memory of 1432	2448	SAM X CHEAT crack1.exe	36
PID 1432 wrote to memory of 1304	1432	iexplore.exe	37
PID 1432 wrote to memory of 1304	1432	iexplore.exe	37
PID 1432 wrote to memory of 1304	1432	iexplore.exe	37
PID 1432 wrote to memory of 1304	1432	iexplore.exe	37
PID 1500 wrote to memory of 1120	1500	Windows Shell Experience Host.exe	38
PID 1500 wrote to memory of 1120	1500	Windows Shell Experience Host.exe	38
PID 1500 wrote to memory of 1120	1500	Windows Shell Experience Host.exe	38
PID 1728 wrote to memory of 2020	1728	Realtek HD Audio Universal Service.exe	40
PID 1728 wrote to memory of 2020	1728	Realtek HD Audio Universal Service.exe	40
PID 1728 wrote to memory of 2020	1728	Realtek HD Audio Universal Service.exe	40
PID 1500 wrote to memory of 1236	1500	Windows Shell Experience Host.exe	42
PID 1500 wrote to memory of 1236	1500	Windows Shell Experience Host.exe	42
PID 1500 wrote to memory of 1236	1500	Windows Shell Experience Host.exe	42
PID 1728 wrote to memory of 1568	1728	Realtek HD Audio Universal Service.exe	44
PID 1728 wrote to memory of 1568	1728	Realtek HD Audio Universal Service.exe	44
PID 1728 wrote to memory of 1568	1728	Realtek HD Audio Universal Service.exe	44
PID 1500 wrote to memory of 3004	1500	Windows Shell Experience Host.exe	46
PID 1500 wrote to memory of 3004	1500	Windows Shell Experience Host.exe	46
PID 1500 wrote to memory of 3004	1500	Windows Shell Experience Host.exe	46
PID 1728 wrote to memory of 1044	1728	Realtek HD Audio Universal Service.exe	48
PID 1728 wrote to memory of 1044	1728	Realtek HD Audio Universal Service.exe	48
PID 1728 wrote to memory of 1044	1728	Realtek HD Audio Universal Service.exe	48
PID 1728 wrote to memory of 768	1728	Realtek HD Audio Universal Service.exe	50
PID 1728 wrote to memory of 768	1728	Realtek HD Audio Universal Service.exe	50
PID 1728 wrote to memory of 768	1728	Realtek HD Audio Universal Service.exe	50
PID 1500 wrote to memory of 1652	1500	Windows Shell Experience Host.exe	52
PID 1500 wrote to memory of 1652	1500	Windows Shell Experience Host.exe	52
PID 1500 wrote to memory of 1652	1500	Windows Shell Experience Host.exe	52

C:\Users\Admin\AppData\Local\Temp\SAMXCHEATcrack1.exe
"C:\Users\Admin\AppData\Local\Temp\SAMXCHEATcrack1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe
  "C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek HD Audio Universal Service.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Realtek HD Audio Universal Service.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Realtek HD Audio Universal Service.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:768
- C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Shell Experience Host.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Shell Experience Host.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Shell Experience Host.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe
  "C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://discord.gg/BNXa5rYFXM
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1432 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f7edd5692d2dbaf356697a0cf8aae211

SHA1
c2f08dee331027d18044129d663e939a9956c55f

SHA256
3f03b90e65911541857f63c1b8448f8fbaea67587941f8af26951ab7cbabbd30

SHA512
df9be99ba9f394a75f228c17d7d4ea67938b09e2fa9cd82889ebe2ae9f8eb888324990784f8cac44394057a3245e3c621c8b92efb3a1c8f3fa6c5a9d700cdf88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c1e647a97c82ba1acea2f88c1e2e678

SHA1
20a401137183367ee260cf0420fa2f71575ac7df

SHA256
7bae33fe890fef5ab0cfa6ce97f44cf5565411bb838468b8139d04ffd011ff9b

SHA512
eba8cc867de95b9165cfbc304e9ef83b672aa22ef65dcec939ae90dfd404a8f7073a9b5f1055a0f0c131db7f8baa93fec9ebcdc9de20875375529822d20a0940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90a1cb3283cd98d4d2705d4b1e9457ad

SHA1
783147c87bd9ec033f07f4ad25f8639b0c451f45

SHA256
badadde716d2507239628bbed17e8876deb14fc1a8fe9df2f9d0efdccb9c559f

SHA512
2abdb328df913b10e92b858b202ac9ba763f5f2fac553e4bdbf64106a1999ef5004b78aa9cdec8647c999098666d4860c8828fc3ac654a68c278bafb8d0d9cb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f6319c598d4a46f307e5fb687437fa3

SHA1
332f3d1f2b541e382bcc5664fd08cf0a150a3c7e

SHA256
043e110a95eaf72beb29544662de0e430ca54d83c877301c3783ae1c97f7a25f

SHA512
a98e16e7fea80279c67520c6bf51190ff00f4e3ecec20727b38ce213cf9e5fc09cbcb3df1abb5c6e1530a710ba33d153b5dd07af4d6b8960cbe76675aa8fa137

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00c67555842047c5df4b744deb7ef90b

SHA1
d397cff78fb6aa1f6413fccacc11678513bceac4

SHA256
33b0d70de8df17dfbf2e81dce79566b2ba3a4f3305b177897fbfa2cfbb18887c

SHA512
3a3109d9af25077a9be6f527636096938b85a66faa665788510d9af789232a8fbed0ee70e84f48060c5f93d4399ea7085790ea13ffc9e333387a957e21c83e28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d0d644ee24aae5ab1fd11202323cb4c

SHA1
69400f5f82b22714cd6223d75a0efba64b2d1005

SHA256
eb61409671ba9c495558f4e7aa6eb7d286884fe9b6dfc54d84aa867d3781437f

SHA512
6a6b670fbaf12c7aa07dd0fcda698c566261fe9f4b632a0d5f1bc792cb6ce4c86cb880d1dc2da259c91f4271adb7b43e74c759aa1f1b7f9a8cf5d7e3df2de18a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18e4837608cf0274ebab658eeebad31e

SHA1
330ee8c26209d00254b47838878991b754475028

SHA256
72b629417205ea9979cf11198e19380c2f7d85fd0827108f5ec3ae1e11bfaa0d

SHA512
6a4125a7a96892fa93a58bd05266676b23fcd07a67d7b9f571689557222dab129eacb7adfaf95a0102230034a60426aa767f938f815f6d50ea3e35a7ffbcf139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ce543d27cc06cb39457e9fc17625d21

SHA1
1f347979bd14b2bcf7bc06efd415b153b4caf5cd

SHA256
a4f690f82f1eae9d544feb66e8298aa5096698bc138b99994a8d6a400406e9db

SHA512
0b6bc71e89bc09d70f98da851c18af7b146f965a9a2400a09157b9d3db88f79fa74f547de2596d2ac55f5fbb298485410d7cac8f229e7faa92407cbe382dddfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86f680e81fab431a5613f8d5dde1fde2

SHA1
d537d6c21e081ca06058dce53afb8c7eee4f9dca

SHA256
6b293250c18ceca47cbd30a3085bb72a9e068a3bb5801ee21950d84149e366bc

SHA512
5bfec915a983ac9a3e71fd15e62c78dcf426ca31487bcd920deeb17808b910edfda5b36ecb2f6341a9e51270fe2f7c70367932a1ff4340dd82d14dfb02ecb4eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
180b9fc4728f4edc17a9c5f0f1fe86e1

SHA1
ff9ca338ccf50f496a98a14976b3ca1266fcc368

SHA256
405c7eb777c48eec389ea46dfee4f6aed7eb7b6dc915f81f96545b19d0750119

SHA512
85723369b2b3fba9f80f4e153dc3e1557b4a4e50ca69d56c7335304d0087e62dac6f1c896630c26d76cbc5819d20e568c170c3a5191f0f3099826af302b167f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d190e5cca3f13db7d1385d9fca239b8

SHA1
c402cd2429f7d762951d6948e433740e44301d1f

SHA256
2f88ae8099d176d5ac6aed71b7e7628bca026bfa34c51521739ebe157e51f16a

SHA512
7dbacefe38a2e6f9b93694d828c32d4a93417f390caae4725573c2a3b0d9f96605d5a3a380c0800c8d97f3611764a603e5c3a9969547721964368b54a9767da7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc2797c8a08df331a3688fadf24ee17c

SHA1
05c4768fa3b77480dbee60d5b78e07b64e20d860

SHA256
4e4f6e71bbd009f1e70c0c1440b54f7117f47f35c86ef1ccd7a60c3330e2496e

SHA512
f4e23cc2f8aef96313902e1a4466f33a6879bebc28437714d57eb94f810aa00eb7bd65d95aa07eab7f9144baf77dd05d935574f689ee44d7d5360ce4349a2af7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2755c2e5915d0b63fd6a498be23968c

SHA1
2761761422eb25f1a865654ac2e67f33063d5e28

SHA256
0732d821e3cee454b0f82928ba55ad6ee60ad69cb50376838886bbde86fcc33b

SHA512
e24e5dda404104a52408881365688b2f93fc268cbca4fa2b5638c2c612755bf5d1b6cb531cc5dbc3256b3051b83b3c8b69ba8d4eec97ac16f69cda217ce7e5f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9349b90f6b37679f8676628b0005e339

SHA1
22185cde2c2613e01bcdb4cbe394f55da6596881

SHA256
488b267cbf27ddcc86304364c05e2c499eb72d2d3ba0e79e8113816ef56095f3

SHA512
25131a1f645144b87c90f29c50c1208c69dfdac3bd9321bc295f0cd93363cd27bbac418eea1aee271a2e6cdbf858438f9154cd01ad0bb740d971d8b6b601eb57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26e5171248995d48a7dbbce048b489fb

SHA1
6f4baebd270f47115e7148b36dabad605229c2ce

SHA256
aee037613a17cef37c30d9249a066adbec8979594691c9b68c82860755d1b1bb

SHA512
693efb1b05f61a278cca475d55ac7d90924ff59f405b7b96c2da89fb145c027538ef42f92e50f77f846046b188158e14bce8889e354c816f4f842ae5170d4b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d3916f33eebccef81694f82d843dbe5

SHA1
5c4184f2f0c443488891167a3209fc80d73e9435

SHA256
94937d67820c0f27d3a19f19c1a0f0967d08e2ad52fe0598ee610affd5e4d332

SHA512
207754ddd3028436775d4c689418652eb356f886d1a52c8b61028a026c09658bdfb3d5676de412f23045b07e4fbec7793f6bc569db8da47f1221f73b60bb9410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
843c9807522a2d484233fd6e5387977c

SHA1
7fa1cf53f3b81a89f9b49854e4a656b130f94f8e

SHA256
cb98e67312b40b07c34c176d6bd13dd90665e97cafd13613fea70dfac378ff3f

SHA512
3842df0e96b9d601849cd4dad2d2d070b453372d8152d9b0b3485a413ed14c27493a754f6b1e2d2a89b568def4e6200ea488b037dc08e190d10149f3fe22e724

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5227d402d24a88bd68a04b7ff7f5e46e

SHA1
726806f88a63a2b9117995ffa55b8ea2e4e33229

SHA256
52fdbe5886e0546228217546b4d17541c1c5c7454f6c0eaeab35b9d4877bdd9d

SHA512
e0d29b127c23f580637056aface77d8f83223cb7cac04dac896d49e805702c37ffc0c5280e179b8b57144fc41411f8b7e3b0cd6208681204b78ca3b235e71b7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0f238e978b9768e4a65a6501dcefa4f

SHA1
2a01c62d200f0f9192b065072c8a2964587d52b4

SHA256
38223ab05704079920fcebbd1647df415ea50b0155e03962d4dbf597709af0d7

SHA512
2a6dc42329ac5f2b4d279ed004a53fc972b47d6eddcab9020f27cb08297c371c62f67a44588ef1956fa0790936bf551dca1f9d5dffc225bf1df1dd62df957da6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80fc75217adf26691984f196906434ec

SHA1
8f0340162d1c2d13d3a930bd875ba0322598bc9a

SHA256
f6eeeb5c46b06ae6fcd117df6ad719aec0eff6e61453ec9be5bf02d5e92bbd27

SHA512
5a4e039af6b4ec4f62dc99c57142376d92e4fbffad122942fa4e9528dde8ad59556ec6772828e017b8e3d9bf05a22c822c1592dabef08f826cc717375fe32f45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b76dc328dc02b3428304ae4f9db44aa

SHA1
b2ed80212fd273a5ef09871ab16aea7ed71e2502

SHA256
9bfa356e4a190595e3066b51e7aebaeecc0650c783d799ad4c78e4393fbfe5a2

SHA512
896973c4a40810be5a72c661f27badb17c7706e6553b3425a663439b04bdf80013ed5f1691e0b761133b4b6408e889ca88e2f49abcb6d202b39e24219c005a75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
083440b9411cbe88166462c065522150

SHA1
c187743e3aaecfc1cf278deda82577c63d93d875

SHA256
ee9c8fcc9bee0598241a2572f38192b1d680cdbad5257426b031e9b165dcd03d

SHA512
9e2d569b507ceb2f4dc68975b7f80adfa87655c76cf719a1979e2fb8033019b798785a5e55f15f3dcae8b726f5c8ed3ff1db10ca03c6b6c8a6eb98e20f6a904c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ebc19c6d010a9ffe96f732346748b4f3

SHA1
7c0b10260f000c6bed1777d264fccfbd992feca7

SHA256
1b4573fceb85f1ffc9335578669d7a0e9b1bee78d5a2ed63be849bc43ebb3d04

SHA512
e846c38cff8f7b533ecbc5f66d4546707f45c09c08f4688f1d0346eb4de40d4905565324a927138e807a7c71aa6beedd48e1becfe385d919dc921dffe569098a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\78076te\imagestore.dat

Filesize
24KB

MD5
b6ea2a05c655bcb608980673354ab7e7

SHA1
0b1e985ed3f1aef7b9015501074f7444f29a2dc4

SHA256
45f7b834409e706598fd8263b09d818fe43e357bc57a249206a6fdc03af0f9ef

SHA512
c2ef5fe8b62827304092471dc901f6d675e6c705aba8248ba3d1d368373150bb3ffdfb85325d97997afeac2b60355f70bb3adc113db287f741ba2fbdee5c5123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BQ20K5D\favicon[1].ico

Filesize
23KB

MD5
ec2c34cadd4b5f4594415127380a85e6

SHA1
e7e129270da0153510ef04a148d08702b980b679

SHA256
128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

SHA512
c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDCF9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\SAM X CHEAT crack1.exe

Filesize
3.6MB

MD5
38023663c5bba5e8d46cee0612e57a51

SHA1
fd21a4aafa31ee8ebd851590e0ec79f7996725ac

SHA256
a02b92ae36ca6fdc300a95a3e29d5a824f2f12a91e0bb6a6f499808ac12c816c

SHA512
c8ab8e304d5e224153d8c7822646e9127520929cec32f655b69ea299540e6d824b9b7e57e6dc3c17ce97d6aaf71cda6dd499f9c7f6e59237276f5832a13573f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD94.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
39fc0468bdf438932a49eb5f57496937

SHA1
4676a5f357a8e3d88cd2327387f0370bd0134e6b

SHA256
df8360c132c4c9230d36b463510b81cda9be87cb864f1242c915bbad3ccea991

SHA512
29e629607ef42f92b5e0e92f271620d99013f8fbf15bca205be4e21fd8e666f59cecb2937ef307e05870a3a9dca22a4a8fa2d3227b3b7c72bad81894f9ab9318

Download Submit
\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe

Filesize
53KB

MD5
ce3e5f8613ea049b651549eba3e3aa28

SHA1
1197375be314ae5a69f3b742f0f539b881aca09a

SHA256
9385116a4a3874548ffa027f4cd448d860ef8dc13fc687ce87790a01ede8e73a

SHA512
ab1428177b5ec71447003ac01f5f99d9c7f2af634f17ef53d6f6be196714faac856b0bc3f62b6fad9975dad970ec247d35f56615c62b9ad483426f4ecaae71c2

Download Submit
\Users\Admin\AppData\Local\Temp\Windows Shell Experience Host.exe

Filesize
86KB

MD5
17f122079462e212871a1e2eb20eaff9

SHA1
349e4b54323acce835916a2bbe40dc9c5d30931f

SHA256
f483197df60b8767d23fa820efaab0c6bcc3a4b02ebee3c8f1290ef699f6697e

SHA512
95548cb30e9e45c4024be181253200d2188b622754158f6268fa09e41327dbb8468399a1b5ddd9d868413638bf1b9b18f6814586530f2c6a0a6cbd6311234e94

Download Submit
memory/1120-37-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/1120-38-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/1236-48-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/1236-47-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/1500-19-0x0000000000A90000-0x0000000000AAA000-memory.dmp

Filesize
104KB

Download
memory/1500-75-0x000007FEF55E3000-0x000007FEF55E4000-memory.dmp

Filesize
4KB

Download
memory/1500-14-0x000007FEF55E3000-0x000007FEF55E4000-memory.dmp

Filesize
4KB

Download
memory/1728-20-0x0000000000CE0000-0x0000000000CF4000-memory.dmp

Filesize
80KB

Download
memory/1728-102-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/1728-23-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2448-26-0x000000001C7A0000-0x000000001C9B4000-memory.dmp

Filesize
2.1MB

Download
memory/2448-25-0x0000000000910000-0x000000000092A000-memory.dmp

Filesize
104KB

Download
memory/2448-24-0x00000000006F0000-0x0000000000702000-memory.dmp

Filesize
72KB

Download
memory/2448-22-0x0000000000D40000-0x00000000010D2000-memory.dmp

Filesize
3.6MB

Download