xworm | d8b9cfbc9e9d74face3b71ea92f31e7bca26d862d336b57b6310c9b8115f3e07

Analysis

max time kernel
66s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3.exe
Size 231KB
Sample260730-ry9hqazdnb
SHA256 d8b9cfbc9e9d74face3b71ea92f31e7bca26d862d336b57b6310c9b8115f3e07
MD5 73053e52fce5e4fe4f014300fe709c60
SHA1 6dbb1566d7d49781a4c4ce238eed2cddc256674d
SHA512 2863f0ee65e6f72d2c4f8bcec2231e6e2dd2c5d99d741fe6f13b53a84a6867ce28f3801754ccca64a39bf94180224732471f93809497bc099b69e7bdf192b327
SSDEEP 3072:Ud9konFE9jkOjIoLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQigx:UBE99/5bTgVziHzZnSKrCbYMh9b78tq
TLSH
T150343A66F6A000F6D4BA82758D636B02B7B2F0361721DBEF0B94495D7F637E04D29B90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

darkwebnjrat.ddns.net:7777

Attributes

install_file
Mason.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral2/memory/6004-1-0x000001A1652E0000-0x000001A165320000-memory.dmp	family_xworm
behavioral2/memory/5692-305-0x000001C0F6440000-0x000001C0F6480000-memory.dmp	family_xworm
behavioral2/memory/6004-468-0x000001A17FB10000-0x000001A17FB1E000-memory.dmp	family_xworm

Executes dropped EXE 2 IoCs

pid	Process
5588	xo01tyld.bvj.exe
2540	sqkfirw2.yl1.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2516	cmd.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2364	timeout.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={38D49882-515E-4823-B707-1F138A914AEF}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 29 Jul 2026 11:24:28 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1785422264"	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2844	SCHTASKS.exe
4408	SCHTASKS.exe
4136	SCHTASKS.exe
2336	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5588	xo01tyld.bvj.exe
5588	xo01tyld.bvj.exe
5588	xo01tyld.bvj.exe
5588	xo01tyld.bvj.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe
2540	sqkfirw2.yl1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2960	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6004	3.exe
Token: SeDebugPrivilege	5588	xo01tyld.bvj.exe
Token: SeDebugPrivilege	5692	3.exe
Token: SeDebugPrivilege	2540	sqkfirw2.yl1.exe
Token: SeShutdownPrivilege	2960	explorer.exe
Token: SeCreatePagefilePrivilege	2960	explorer.exe
Token: SeShutdownPrivilege	2960	explorer.exe
Token: SeCreatePagefilePrivilege	2960	explorer.exe
Token: SeShutdownPrivilege	2960	explorer.exe
Token: SeCreatePagefilePrivilege	2960	explorer.exe
Token: SeShutdownPrivilege	2960	explorer.exe
Token: SeCreatePagefilePrivilege	2960	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	3604	svchost.exe
Token: SeIncreaseQuotaPrivilege	3604	svchost.exe
Token: SeSecurityPrivilege	3604	svchost.exe
Token: SeTakeOwnershipPrivilege	3604	svchost.exe
Token: SeLoadDriverPrivilege	3604	svchost.exe
Token: SeSystemtimePrivilege	3604	svchost.exe
Token: SeBackupPrivilege	3604	svchost.exe
Token: SeRestorePrivilege	3604	svchost.exe
Token: SeShutdownPrivilege	3604	svchost.exe
Token: SeSystemEnvironmentPrivilege	3604	svchost.exe
Token: SeUndockPrivilege	3604	svchost.exe
Token: SeManageVolumePrivilege	3604	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3604	svchost.exe
Token: SeIncreaseQuotaPrivilege	3604	svchost.exe
Token: SeSecurityPrivilege	3604	svchost.exe
Token: SeTakeOwnershipPrivilege	3604	svchost.exe
Token: SeLoadDriverPrivilege	3604	svchost.exe
Token: SeSystemtimePrivilege	3604	svchost.exe
Token: SeBackupPrivilege	3604	svchost.exe
Token: SeRestorePrivilege	3604	svchost.exe
Token: SeShutdownPrivilege	3604	svchost.exe
Token: SeSystemEnvironmentPrivilege	3604	svchost.exe
Token: SeUndockPrivilege	3604	svchost.exe
Token: SeManageVolumePrivilege	3604	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3604	svchost.exe
Token: SeIncreaseQuotaPrivilege	3604	svchost.exe
Token: SeSecurityPrivilege	3604	svchost.exe
Token: SeTakeOwnershipPrivilege	3604	svchost.exe
Token: SeLoadDriverPrivilege	3604	svchost.exe
Token: SeSystemtimePrivilege	3604	svchost.exe
Token: SeBackupPrivilege	3604	svchost.exe
Token: SeRestorePrivilege	3604	svchost.exe
Token: SeShutdownPrivilege	3604	svchost.exe
Token: SeSystemEnvironmentPrivilege	3604	svchost.exe
Token: SeUndockPrivilege	3604	svchost.exe
Token: SeManageVolumePrivilege	3604	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3604	svchost.exe
Token: SeIncreaseQuotaPrivilege	3604	svchost.exe
Token: SeSecurityPrivilege	3604	svchost.exe
Token: SeTakeOwnershipPrivilege	3604	svchost.exe
Token: SeLoadDriverPrivilege	3604	svchost.exe
Token: SeSystemtimePrivilege	3604	svchost.exe
Token: SeBackupPrivilege	3604	svchost.exe
Token: SeRestorePrivilege	3604	svchost.exe
Token: SeShutdownPrivilege	3604	svchost.exe
Token: SeSystemEnvironmentPrivilege	3604	svchost.exe
Token: SeUndockPrivilege	3604	svchost.exe
Token: SeManageVolumePrivilege	3604	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3604	svchost.exe
Token: SeIncreaseQuotaPrivilege	3604	svchost.exe
Token: SeSecurityPrivilege	3604	svchost.exe
Token: SeTakeOwnershipPrivilege	3604	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6004 wrote to memory of 5588	6004	3.exe	89
PID 6004 wrote to memory of 2844	6004	3.exe	90
PID 5588 wrote to memory of 732	5588	xo01tyld.bvj.exe	5
PID 5588 wrote to memory of 984	5588	xo01tyld.bvj.exe	9
PID 5588 wrote to memory of 992	5588	xo01tyld.bvj.exe	10
PID 5588 wrote to memory of 1004	5588	xo01tyld.bvj.exe	11
PID 5588 wrote to memory of 856	5588	xo01tyld.bvj.exe	13
PID 5588 wrote to memory of 1124	5588	xo01tyld.bvj.exe	14
PID 5588 wrote to memory of 1176	5588	xo01tyld.bvj.exe	15
PID 5588 wrote to memory of 1224	5588	xo01tyld.bvj.exe	16
PID 5588 wrote to memory of 1268	5588	xo01tyld.bvj.exe	17
PID 5588 wrote to memory of 1320	5588	xo01tyld.bvj.exe	18
PID 5588 wrote to memory of 1384	5588	xo01tyld.bvj.exe	19
PID 5588 wrote to memory of 1536	5588	xo01tyld.bvj.exe	22
PID 5588 wrote to memory of 1568	5588	xo01tyld.bvj.exe	23
PID 5588 wrote to memory of 1604	5588	xo01tyld.bvj.exe	24
PID 5588 wrote to memory of 1688	5588	xo01tyld.bvj.exe	25
PID 5588 wrote to memory of 1728	5588	xo01tyld.bvj.exe	26
PID 5588 wrote to memory of 1772	5588	xo01tyld.bvj.exe	27
PID 5588 wrote to memory of 1904	5588	xo01tyld.bvj.exe	28
PID 5588 wrote to memory of 1576	5588	xo01tyld.bvj.exe	29
PID 5588 wrote to memory of 2072	5588	xo01tyld.bvj.exe	30
PID 5588 wrote to memory of 2100	5588	xo01tyld.bvj.exe	31
PID 5588 wrote to memory of 2116	5588	xo01tyld.bvj.exe	32
PID 5588 wrote to memory of 2252	5588	xo01tyld.bvj.exe	33
PID 5588 wrote to memory of 2324	5588	xo01tyld.bvj.exe	34
PID 5588 wrote to memory of 2380	5588	xo01tyld.bvj.exe	35
PID 5588 wrote to memory of 2496	5588	xo01tyld.bvj.exe	36
PID 5588 wrote to memory of 2544	5588	xo01tyld.bvj.exe	37
PID 5588 wrote to memory of 2564	5588	xo01tyld.bvj.exe	38
PID 5588 wrote to memory of 2636	5588	xo01tyld.bvj.exe	39
PID 5588 wrote to memory of 2692	5588	xo01tyld.bvj.exe	40
PID 5588 wrote to memory of 2904	5588	xo01tyld.bvj.exe	41
PID 5588 wrote to memory of 2916	5588	xo01tyld.bvj.exe	42
PID 5588 wrote to memory of 2968	5588	xo01tyld.bvj.exe	43
PID 5588 wrote to memory of 3060	5588	xo01tyld.bvj.exe	44
PID 5588 wrote to memory of 3088	5588	xo01tyld.bvj.exe	46
PID 5588 wrote to memory of 3132	5588	xo01tyld.bvj.exe	47
PID 6004 wrote to memory of 4136	6004	3.exe	93
PID 5588 wrote to memory of 3228	5588	xo01tyld.bvj.exe	48
PID 5588 wrote to memory of 3476	5588	xo01tyld.bvj.exe	50
PID 5588 wrote to memory of 3512	5588	xo01tyld.bvj.exe	51
PID 5588 wrote to memory of 3520	5588	xo01tyld.bvj.exe	52
PID 5588 wrote to memory of 3540	5588	xo01tyld.bvj.exe	53
PID 5588 wrote to memory of 3596	5588	xo01tyld.bvj.exe	54
PID 5588 wrote to memory of 3604	5588	xo01tyld.bvj.exe	55
PID 5588 wrote to memory of 3612	5588	xo01tyld.bvj.exe	56
PID 5588 wrote to memory of 3308	5588	xo01tyld.bvj.exe	57
PID 5588 wrote to memory of 1104	5588	xo01tyld.bvj.exe	58
PID 5588 wrote to memory of 4388	5588	xo01tyld.bvj.exe	59
PID 5588 wrote to memory of 4448	5588	xo01tyld.bvj.exe	60
PID 5588 wrote to memory of 4504	5588	xo01tyld.bvj.exe	61
PID 5588 wrote to memory of 4640	5588	xo01tyld.bvj.exe	62
PID 5588 wrote to memory of 4824	5588	xo01tyld.bvj.exe	63
PID 5588 wrote to memory of 4232	5588	xo01tyld.bvj.exe	64
PID 5588 wrote to memory of 3956	5588	xo01tyld.bvj.exe	65
PID 5588 wrote to memory of 5196	5588	xo01tyld.bvj.exe	66
PID 5588 wrote to memory of 5440	5588	xo01tyld.bvj.exe	69
PID 5588 wrote to memory of 3468	5588	xo01tyld.bvj.exe	71
PID 5588 wrote to memory of 5652	5588	xo01tyld.bvj.exe	72
PID 5588 wrote to memory of 1168	5588	xo01tyld.bvj.exe	74
PID 5588 wrote to memory of 2532	5588	xo01tyld.bvj.exe	77
PID 5588 wrote to memory of 4988	5588	xo01tyld.bvj.exe	78
PID 5588 wrote to memory of 6048	5588	xo01tyld.bvj.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:732
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:984
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1176

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:992

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3b5a0dc0-4745-40b3-838c-e8552a62a1a6 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-6779076b-202a-4c7b-8777-51c042a1faf2 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a084675e-7778-4efa-95c9-ed2c9488853d -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7515c10d-fa3c-4414-a2fb-76b1a575008d -LifetimeId:9f9f2ecc-db2c-4245-bf5c-662b739dc00b -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:1124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1904
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1064
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\3.exe
      "C:\Users\Admin\AppData\Local\Temp\3.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\xo01tyld.bvj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xo01tyld.bvj.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5588
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Mason3.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\3.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2844
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Mason3.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\3.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4136
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1824
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAF47.tmp.bat""
        5⤵
        Executes a command shell one-liner
        
        PID:2516
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:2364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2564
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:4232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2968

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3228

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1104

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4388

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4640

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4824

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:3956

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:3468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2532

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4988

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:6048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
PID:4740

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4572

C:\Users\Admin\AppData\Local\Temp\3.exe
"C:\Users\Admin\AppData\Local\Temp\3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5692
- C:\Users\Admin\AppData\Local\Temp\sqkfirw2.yl1.exe
  "C:\Users\Admin\AppData\Local\Temp\sqkfirw2.yl1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Mason3.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\3.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4408
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4320
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Mason3.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\3.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2336
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2624

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks processor information in registry
PID:2424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpAF47.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpAF47.tmp.bat
Size 153B
SHA256 989a7dbe60ea8d1ace51ac0742fe5a0eb7b95355972222b5daf16034aa74a7af
MD5 801d36d0d4d3aec12093ac8618ed4e95
SHA1 f9622e5c70984fa12bb6804e085580e09c27f796
SHA512 7da442c7f8c0e9766a8aa91a10ac9eab1660b45d31431f43021e57efd8aed75272ed88dcc63c252e322109af2cff4c0dc6187aaadf20cad48eec7c54e5ffc063
TLSH
T137C02B41A8CFFB5A190A342701B6C18EC0735C0E3F407F109758C40828C04ACF4F4305
MD5 SHA1 SHA512 TLSH

Submit Download

xo01tyld.bvj.exe

Path C:\Users\Admin\AppData\Local\Temp\xo01tyld.bvj.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 14b2dcea419e93e34f6d1a7392a70b9e33fcf7a31610ce939287231deb1249bd
MD5 7ef7c2a6b184dfbcffbe175cfe3cfea9
SHA1 4536e0f4eb156ea9d4a4941601c83cff87487f42
SHA512 9916fc5b447caa61ec6f5f5e13be944aa600ef5c454c8445dfae8b78a0c618acbebe13cee61b0aad8ee42750d437ce69081b8f67e149a5d58ac678dbdd884699
TLSH
T126E08C117AE84208E6730A3C697368449E37B26AAB02CAAD0734409D0C29FA28C3231D
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 d6cf1c9c2580512a177a33f3e848a72b310741b21395d5f0627d50ba47579943
MD5 3afc917bf26f133b9ce7b112116f5039
SHA1 71ddcb83bb63379b8a08657b7a099c0466a65b5c
SHA512 299a7a1b85e3d3a1df9dca9fcb34e4303adc8c5478e65fa38e304fc9c049d828938ca960bf8bfb10280bc75409589ea39fc548c8aaa880f65f7e285fd767aee3
TLSH
T147E0C02411FF405DF0E4D0798BD56A2147A9F0310449B2B91BE057046202D00EC12D34
MD5 SHA1 SHA512 TLSH

Submit Download

memory/732-17-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/732-16-0x000002AB09730000-0x000002AB0975B000-memory.dmp

Download

memory/732-60-0x000002AB09730000-0x000002AB0975B000-memory.dmp

Download

memory/732-499-0x000002AB09730000-0x000002AB0975B000-memory.dmp

Download

memory/732-15-0x000002AB09700000-0x000002AB09725000-memory.dmp

Download

memory/856-69-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/856-68-0x000001FD838E0000-0x000001FD8390B000-memory.dmp

Download

memory/856-500-0x000001FD838E0000-0x000001FD8390B000-memory.dmp

Download

memory/856-74-0x000001FD838E0000-0x000001FD8390B000-memory.dmp

Download

memory/984-518-0x000001BFA7CA0000-0x000001BFA7CCB000-memory.dmp

Download

memory/984-59-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/984-171-0x000001BFA7CA0000-0x000001BFA7CCB000-memory.dmp

Download

memory/984-58-0x000001BFA7CA0000-0x000001BFA7CCB000-memory.dmp

Download

memory/992-519-0x00000246771B0000-0x00000246771DB000-memory.dmp

Download

memory/992-63-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/992-62-0x00000246771B0000-0x00000246771DB000-memory.dmp

Download

memory/992-172-0x00000246771B0000-0x00000246771DB000-memory.dmp

Download

memory/1004-65-0x00000285CF660000-0x00000285CF68B000-memory.dmp

Download

memory/1004-173-0x00000285CF660000-0x00000285CF68B000-memory.dmp

Download

memory/1004-520-0x00000285CF660000-0x00000285CF68B000-memory.dmp

Download

memory/1004-66-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/1124-71-0x000001B7782B0000-0x000001B7782DB000-memory.dmp

Download

memory/1124-72-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/1124-521-0x000001B7782B0000-0x000001B7782DB000-memory.dmp

Download

memory/1124-174-0x000001B7782B0000-0x000001B7782DB000-memory.dmp

Download

memory/1176-498-0x00000212612A0000-0x00000212612CB000-memory.dmp

Download

memory/1176-61-0x00000212612A0000-0x00000212612CB000-memory.dmp

Download

memory/1176-25-0x00000212612A0000-0x00000212612CB000-memory.dmp

Download

memory/1176-26-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/1224-76-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/1224-501-0x000001FD77FC0000-0x000001FD77FEB000-memory.dmp

Download

memory/1224-154-0x000001FD77FC0000-0x000001FD77FEB000-memory.dmp

Download

memory/1224-75-0x000001FD77FC0000-0x000001FD77FEB000-memory.dmp

Download

memory/1268-79-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/1268-78-0x0000023A9ED70000-0x0000023A9ED9B000-memory.dmp

Download

memory/1268-155-0x0000023A9ED70000-0x0000023A9ED9B000-memory.dmp

Download

memory/1268-502-0x0000023A9ED70000-0x0000023A9ED9B000-memory.dmp

Download

memory/1320-503-0x0000019290F30000-0x0000019290F5B000-memory.dmp

Download

memory/1320-82-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/1320-81-0x0000019290F30000-0x0000019290F5B000-memory.dmp

Download

memory/1320-156-0x0000019290F30000-0x0000019290F5B000-memory.dmp

Download

memory/1536-170-0x0000015BE8750000-0x0000015BE877B000-memory.dmp

Download

memory/1536-33-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/1536-517-0x0000015BE8750000-0x0000015BE877B000-memory.dmp

Download

memory/1536-32-0x0000015BE8750000-0x0000015BE877B000-memory.dmp

Download

memory/1568-157-0x0000023C2BA20000-0x0000023C2BA4B000-memory.dmp

Download

memory/1568-85-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/1568-84-0x0000023C2BA20000-0x0000023C2BA4B000-memory.dmp

Download

memory/1568-504-0x0000023C2BA20000-0x0000023C2BA4B000-memory.dmp

Download

memory/1576-163-0x0000016000030000-0x000001600005B000-memory.dmp

Download

memory/1576-103-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/1576-102-0x0000016000030000-0x000001600005B000-memory.dmp

Download

memory/1576-510-0x0000016000030000-0x000001600005B000-memory.dmp

Download

memory/1604-158-0x000002A4F8510000-0x000002A4F853B000-memory.dmp

Download

memory/1604-505-0x000002A4F8510000-0x000002A4F853B000-memory.dmp

Download

memory/1604-88-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/1604-87-0x000002A4F8510000-0x000002A4F853B000-memory.dmp

Download

memory/1688-90-0x000001C7E33B0000-0x000001C7E33DB000-memory.dmp

Download

memory/1688-91-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/1688-159-0x000001C7E33B0000-0x000001C7E33DB000-memory.dmp

Download

memory/1688-506-0x000001C7E33B0000-0x000001C7E33DB000-memory.dmp

Download

memory/1728-94-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/1728-93-0x000002A01DB80000-0x000002A01DBAB000-memory.dmp

Download

memory/1728-160-0x000002A01DB80000-0x000002A01DBAB000-memory.dmp

Download

memory/1728-507-0x000002A01DB80000-0x000002A01DBAB000-memory.dmp

Download

memory/1772-96-0x0000014F398E0000-0x0000014F3990B000-memory.dmp

Download

memory/1772-97-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/1772-161-0x0000014F398E0000-0x0000014F3990B000-memory.dmp

Download

memory/1772-508-0x0000014F398E0000-0x0000014F3990B000-memory.dmp

Download

memory/1904-100-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/1904-509-0x0000025B65180000-0x0000025B651AB000-memory.dmp

Download

memory/1904-99-0x0000025B65180000-0x0000025B651AB000-memory.dmp

Download

memory/1904-162-0x0000025B65180000-0x0000025B651AB000-memory.dmp

Download

memory/2072-511-0x000002245D840000-0x000002245D86B000-memory.dmp

Download

memory/2072-106-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/2072-105-0x000002245D840000-0x000002245D86B000-memory.dmp

Download

memory/2072-164-0x000002245D840000-0x000002245D86B000-memory.dmp

Download

memory/2100-512-0x00000270B9B50000-0x00000270B9B7B000-memory.dmp

Download

memory/2100-108-0x00000270B9B50000-0x00000270B9B7B000-memory.dmp

Download

memory/2100-165-0x00000270B9B50000-0x00000270B9B7B000-memory.dmp

Download

memory/2100-109-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/2116-166-0x0000018D0CFA0000-0x0000018D0CFCB000-memory.dmp

Download

memory/2116-111-0x0000018D0CFA0000-0x0000018D0CFCB000-memory.dmp

Download

memory/2116-513-0x0000018D0CFA0000-0x0000018D0CFCB000-memory.dmp

Download

memory/2116-112-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/2252-114-0x00000135ADD80000-0x00000135ADDAB000-memory.dmp

Download

memory/2252-115-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/2252-514-0x00000135ADD80000-0x00000135ADDAB000-memory.dmp

Download

memory/2252-167-0x00000135ADD80000-0x00000135ADDAB000-memory.dmp

Download

memory/2324-118-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/2324-515-0x000001DF4E980000-0x000001DF4E9AB000-memory.dmp

Download

memory/2324-168-0x000001DF4E980000-0x000001DF4E9AB000-memory.dmp

Download

memory/2324-117-0x000001DF4E980000-0x000001DF4E9AB000-memory.dmp

Download

memory/2380-169-0x000002582BEB0000-0x000002582BEDB000-memory.dmp

Download

memory/2380-120-0x000002582BEB0000-0x000002582BEDB000-memory.dmp

Download

memory/2380-121-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/2380-516-0x000002582BEB0000-0x000002582BEDB000-memory.dmp

Download

memory/2496-123-0x000001C0E7F00000-0x000001C0E7F2B000-memory.dmp

Download

memory/2496-124-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/2544-126-0x000001E37A910000-0x000001E37A93B000-memory.dmp

Download

memory/2544-127-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/2564-129-0x000001D484100000-0x000001D48412B000-memory.dmp

Download

memory/2564-130-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/2636-133-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/2636-132-0x000001B356D90000-0x000001B356DBB000-memory.dmp

Download

memory/2692-135-0x0000025620D00000-0x0000025620D2B000-memory.dmp

Download

memory/2692-136-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/2904-139-0x00007FFBAEB80000-0x00007FFBAEB90000-memory.dmp

Download

memory/2904-138-0x0000022728E70000-0x0000022728E9B000-memory.dmp

Download

memory/2916-141-0x000002438C390000-0x000002438C3BB000-memory.dmp

Download

memory/5588-13-0x00007FFBEEA40000-0x00007FFBEECA3000-memory.dmp

Download

memory/5588-14-0x00007FFBEDFC0000-0x00007FFBEE087000-memory.dmp

Download

memory/5692-305-0x000001C0F6440000-0x000001C0F6480000-memory.dmp

Download

memory/6004-497-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-493-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-491-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-492-0x000001A17FB30000-0x000001A17FB40000-memory.dmp

Download

memory/6004-468-0x000001A17FB10000-0x000001A17FB1E000-memory.dmp

Download

memory/6004-1-0x000001A1652E0000-0x000001A165320000-memory.dmp

Download

memory/6004-5-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-532-0x000001A17FB30000-0x000001A17FB40000-memory.dmp

Download

memory/6004-4-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-2-0x000001A166F50000-0x000001A166F7C000-memory.dmp

Download

memory/6004-555-0x00007FFBCBBE0000-0x00007FFBCC584000-memory.dmp

Download

memory/6004-0-0x00007FFBCBD6F000-0x00007FFBCBD70000-memory.dmp

Download