xworm | 2ac1f77d4c19b7ffe889518899019669542ee32a5ed5d37bf2c043d23e6c65e9

Analysis

max time kernel
150s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/09/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IDE.exe
Size 541KB
Sample260910-rt1d9ahc86
SHA256 2ac1f77d4c19b7ffe889518899019669542ee32a5ed5d37bf2c043d23e6c65e9
MD5 89632a695c36a4c4958f82d80b5ee84e
SHA1 2ff9378f77551c867dbad62f4e8632deec7b1cf2
SHA512 189fa286a872e70b97adcbc2e16ac25ade2eb3b2bcceb85e39ce642441c9f9e8e2b6c00bef38dda3dfd9749b686a53196836487d576bf36df357aefa60858f5b
SSDEEP 6144:lHWRg7KvhVjhLUjCLUCdiQpbmtu7qD4wACiwmCBu3sFsxEX:lHWRg7ohzLUvCA3X/XyCBlFiE
TLSH
T14EC4CF552105A399E88B2076E7F4FC9979E39DF30B0A8CCE651233F91876D4297F0A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

31.6.50.206:2018

Attributes

install_file
Mason.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral3/memory/4348-62-0x000000001D3F0000-0x000000001D430000-memory.dmp	family_xworm
behavioral3/memory/4348-356-0x000000001D5E0000-0x000000001D5EE000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4684	powershell.exe
1572	powershell.exe
1016	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
2196	xnv1ua1t.w3d.exe
4192	IDE.exe
736	IDE.exe
3880	IDE.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe

ConfuserEx .NET packer 7 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral3/memory/4348-0-0x00000000005D0000-0x000000000065E000-memory.dmp	ConfuserEx
behavioral3/memory/4348-1-0x0000000002790000-0x0000000002816000-memory.dmp	ConfuserEx
behavioral3/files/0x002400000002b346-333.dat	ConfuserEx
behavioral3/memory/4192-343-0x0000000000050000-0x00000000000DE000-memory.dmp	ConfuserEx
behavioral3/memory/736-368-0x0000000000C00000-0x0000000000C8E000-memory.dmp	ConfuserEx
behavioral3/memory/736-371-0x000000001D050000-0x000000001D0D6000-memory.dmp	ConfuserEx
behavioral3/memory/3880-381-0x0000000000290000-0x000000000031E000-memory.dmp	ConfuserEx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1789050680"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Tue, 08 Sep 2026 04:38:30 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={829B24F3-B7FD-4735-BC3A-F7808D7BF3F9}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "577889346,5804129,17110992,7202269,9179409,24262478,41484365,17110988,7153487,508368333,17962391,17962392,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,7202265,507286179,41816131,20502174,6308191,18407617,39125643,539756558,504928405,504928410,24262477,25036127,24262473,9179410,6104718,9179411,51475283,41185282,39389248,539756557,528570079"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,944 15,943 6,1329 15,1329 100,1329 6,943 10,943 15,944 6,940 50,941 15,941 10,941 6,942 15,942 10,942 6,944 100,944 10,944 50,940 6,940 100,940 10,940 15"	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
752	schtasks.exe
1568	SCHTASKS.exe
3216	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4684	powershell.exe
4684	powershell.exe
1572	powershell.exe
1572	powershell.exe
1016	powershell.exe
1016	powershell.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe
2196	xnv1ua1t.w3d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3208	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4348	IDE.exe
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeDebugPrivilege	2196	xnv1ua1t.w3d.exe
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeDebugPrivilege	4192	IDE.exe
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeDebugPrivilege	736	IDE.exe
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4684	4348	IDE.exe	81
PID 4348 wrote to memory of 1572	4348	IDE.exe	83
PID 4348 wrote to memory of 1016	4348	IDE.exe	85
PID 4348 wrote to memory of 752	4348	IDE.exe	87
PID 4348 wrote to memory of 2196	4348	IDE.exe	89
PID 4348 wrote to memory of 1568	4348	IDE.exe	90
PID 2196 wrote to memory of 640	2196	xnv1ua1t.w3d.exe	5
PID 2196 wrote to memory of 692	2196	xnv1ua1t.w3d.exe	7
PID 2196 wrote to memory of 856	2196	xnv1ua1t.w3d.exe	11
PID 2196 wrote to memory of 420	2196	xnv1ua1t.w3d.exe	13
PID 2196 wrote to memory of 716	2196	xnv1ua1t.w3d.exe	14
PID 2196 wrote to memory of 952	2196	xnv1ua1t.w3d.exe	15
PID 2196 wrote to memory of 1080	2196	xnv1ua1t.w3d.exe	16
PID 2196 wrote to memory of 1124	2196	xnv1ua1t.w3d.exe	17
PID 2196 wrote to memory of 1132	2196	xnv1ua1t.w3d.exe	18
PID 2196 wrote to memory of 1196	2196	xnv1ua1t.w3d.exe	19
PID 2196 wrote to memory of 1256	2196	xnv1ua1t.w3d.exe	21
PID 2196 wrote to memory of 1288	2196	xnv1ua1t.w3d.exe	22
PID 2196 wrote to memory of 1304	2196	xnv1ua1t.w3d.exe	23
PID 2196 wrote to memory of 1420	2196	xnv1ua1t.w3d.exe	24
PID 2196 wrote to memory of 1472	2196	xnv1ua1t.w3d.exe	25
PID 2196 wrote to memory of 1640	2196	xnv1ua1t.w3d.exe	26
PID 2196 wrote to memory of 1684	2196	xnv1ua1t.w3d.exe	27
PID 2196 wrote to memory of 1752	2196	xnv1ua1t.w3d.exe	28
PID 2196 wrote to memory of 1764	2196	xnv1ua1t.w3d.exe	29
PID 2196 wrote to memory of 1824	2196	xnv1ua1t.w3d.exe	30
PID 2196 wrote to memory of 1872	2196	xnv1ua1t.w3d.exe	31
PID 2196 wrote to memory of 1920	2196	xnv1ua1t.w3d.exe	32
PID 2196 wrote to memory of 1976	2196	xnv1ua1t.w3d.exe	33
PID 2196 wrote to memory of 2028	2196	xnv1ua1t.w3d.exe	34
PID 2196 wrote to memory of 2088	2196	xnv1ua1t.w3d.exe	35
PID 2196 wrote to memory of 2096	2196	xnv1ua1t.w3d.exe	36
PID 2196 wrote to memory of 2180	2196	xnv1ua1t.w3d.exe	37
PID 2196 wrote to memory of 2228	2196	xnv1ua1t.w3d.exe	38
PID 2196 wrote to memory of 2280	2196	xnv1ua1t.w3d.exe	39
PID 2196 wrote to memory of 2360	2196	xnv1ua1t.w3d.exe	41
PID 2196 wrote to memory of 2528	2196	xnv1ua1t.w3d.exe	42
PID 2196 wrote to memory of 2536	2196	xnv1ua1t.w3d.exe	43
PID 2196 wrote to memory of 2552	2196	xnv1ua1t.w3d.exe	44
PID 2196 wrote to memory of 2600	2196	xnv1ua1t.w3d.exe	45
PID 2196 wrote to memory of 2632	2196	xnv1ua1t.w3d.exe	46
PID 2196 wrote to memory of 2640	2196	xnv1ua1t.w3d.exe	47
PID 2196 wrote to memory of 2700	2196	xnv1ua1t.w3d.exe	48
PID 2196 wrote to memory of 2716	2196	xnv1ua1t.w3d.exe	49
PID 2196 wrote to memory of 428	2196	xnv1ua1t.w3d.exe	51
PID 2196 wrote to memory of 2592	2196	xnv1ua1t.w3d.exe	52
PID 2196 wrote to memory of 2880	2196	xnv1ua1t.w3d.exe	53
PID 2196 wrote to memory of 3208	2196	xnv1ua1t.w3d.exe	54
PID 2196 wrote to memory of 3336	2196	xnv1ua1t.w3d.exe	55
PID 2196 wrote to memory of 3368	2196	xnv1ua1t.w3d.exe	56
PID 2196 wrote to memory of 3720	2196	xnv1ua1t.w3d.exe	59
PID 2196 wrote to memory of 3780	2196	xnv1ua1t.w3d.exe	60
PID 2196 wrote to memory of 3836	2196	xnv1ua1t.w3d.exe	61
PID 2196 wrote to memory of 3888	2196	xnv1ua1t.w3d.exe	62
PID 2196 wrote to memory of 4180	2196	xnv1ua1t.w3d.exe	64
PID 2196 wrote to memory of 4440	2196	xnv1ua1t.w3d.exe	65
PID 2196 wrote to memory of 3000	2196	xnv1ua1t.w3d.exe	69
PID 2196 wrote to memory of 1072	2196	xnv1ua1t.w3d.exe	70
PID 2196 wrote to memory of 576	2196	xnv1ua1t.w3d.exe	71
PID 2196 wrote to memory of 2780	2196	xnv1ua1t.w3d.exe	72
PID 2196 wrote to memory of 4904	2196	xnv1ua1t.w3d.exe	73
PID 2196 wrote to memory of 4392	2196	xnv1ua1t.w3d.exe	74
PID 2196 wrote to memory of 4616	2196	xnv1ua1t.w3d.exe	75
PID 2196 wrote to memory of 3180	2196	xnv1ua1t.w3d.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:952

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c216dc90-7037-4e32-8845-bc26adf7f64b -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b33a3bcb-0fcb-420b-b3bb-8d5b85be7cac -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c1748515-3873-4c59-86bf-350bd3416b53 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-271619de-43cf-4a04-85f1-006d6cfab009 -LifetimeId:07f61735-8f5e-4c22-8547-798895921ae8 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1256
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2880
- C:\ProgramData\IDE.exe
  C:\ProgramData\IDE.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:736
- C:\ProgramData\IDE.exe
  C:\ProgramData\IDE.exe
  2⤵
  - Executes dropped EXE
  PID:3880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1640
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2228

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2592

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3208
- C:\Users\Admin\AppData\Local\Temp\IDE.exe
  "C:\Users\Admin\AppData\Local\Temp\IDE.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'IDE.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\IDE.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\IDE.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1016
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "IDE" /tr "C:\ProgramData\IDE.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:752
- - C:\Users\Admin\AppData\Local\Temp\xnv1ua1t.w3d.exe
    "C:\Users\Admin\AppData\Local\Temp\xnv1ua1t.w3d.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2196
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonIDE.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\IDE.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1568
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonIDE.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\IDE.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3216
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3368

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3720

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3780

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3888

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4440

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3000

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4392

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:944

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4716

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4200

C:\ProgramData\IDE.exe
C:\ProgramData\IDE.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IDE.exe

Path C:\ProgramData\IDE.exe
Size 541KB
SHA256 2ac1f77d4c19b7ffe889518899019669542ee32a5ed5d37bf2c043d23e6c65e9
MD5 89632a695c36a4c4958f82d80b5ee84e
SHA1 2ff9378f77551c867dbad62f4e8632deec7b1cf2
SHA512 189fa286a872e70b97adcbc2e16ac25ade2eb3b2bcceb85e39ce642441c9f9e8e2b6c00bef38dda3dfd9749b686a53196836487d576bf36df357aefa60858f5b
SSDEEP 6144:lHWRg7KvhVjhLUjCLUCdiQpbmtu7qD4wACiwmCBu3sFsxEX:lHWRg7ohzLUvCA3X/XyCBlFiE
TLSH
T14EC4CF552105A399E88B2076E7F4FC9979E39DF30B0A8CCE651233F91876D4297F0A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IDE.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\IDE.exe.log
Size 1KB
SHA256 744cf26c0641b62c0daa1d5508613d6f1417778c242d3d79220121f70f9515b5
MD5 94aaadf8fa4c31d238b961fcb2a519d5
SHA1 608175ecf723861c59796d3989fee3dfdf3bb6d2
SHA512 574d80ffabd249da41a8c4618123aa2e88595cf3ac55b9e3e4c2dd2a3c2cee52c954119f5ed54d36941da78a4bc1963cdaa7dfdd4f19d3c1e954ced86deafecf
TLSH
T14E118C302376A0D889263F421C1D268557AF476AB654EE0C7598635DDD260575B213F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b79f569e6c453b33139dcd90442a80e59ac882a1e272a8e4a322d295bfac3ab0
MD5 e60feda9a7e775a7d83cc6ec30a00f68
SHA1 b258b886f3cba5a97922f2695ebeaedafe3638ef
SHA512 51dae2882602a7ef7b3e43cc8745cc6fd974beae26a17730c928d4e82dc19dbb66287d9431cc6bd1990a7278c546cd3f9a51eeb6debd73eacf2803ee303c70e2
TLSH
T153218633B7ACC234C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 20b8c9379d9e4a009d672cb4ecdd23668aa2e81213f13659c315ed4560633d51
MD5 a89b3236c36e284ce60afa70aeb91017
SHA1 a912ea8a1863c3faa0ec58a3632930278dd17c3d
SHA512 adaab2ec226a9fb3b21cbb0d32104a9d2862e1e816d6b2ebbab2f3ac0e95c836aa5bc8e14da3a2b5d1641e4a3a59f9b1832dbcf04dd85f69776628f3481eb631
TLSH
T1A121AB33B79CC134C8C9117A108DAD01B2B5C3C7449ECE8B7BC4C528A57F899DF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_w24x2uvz.v1c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w24x2uvz.v1c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

xnv1ua1t.w3d.exe

Path C:\Users\Admin\AppData\Local\Temp\xnv1ua1t.w3d.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/420-87-0x000001E101310000-0x000001E10133B000-memory.dmp

Download

memory/420-88-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/640-75-0x0000024185050000-0x000002418507B000-memory.dmp

Download

memory/640-76-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/640-74-0x0000024184DC0000-0x0000024184DE5000-memory.dmp

Download

memory/692-80-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/692-79-0x000001C9CAF90000-0x000001C9CAFBB000-memory.dmp

Download

memory/716-96-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/716-95-0x0000016F2DA90000-0x0000016F2DABB000-memory.dmp

Download

memory/736-368-0x0000000000C00000-0x0000000000C8E000-memory.dmp

Download

memory/736-371-0x000000001D050000-0x000000001D0D6000-memory.dmp

Download

memory/856-84-0x0000029F81B60000-0x0000029F81B8B000-memory.dmp

Download

memory/856-85-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/952-92-0x000002A0CA050000-0x000002A0CA07B000-memory.dmp

Download

memory/952-93-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1080-100-0x000001DF97490000-0x000001DF974BB000-memory.dmp

Download

memory/1080-101-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1124-103-0x00000249F4BD0000-0x00000249F4BFB000-memory.dmp

Download

memory/1124-104-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1132-109-0x00000246BE340000-0x00000246BE36B000-memory.dmp

Download

memory/1132-110-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1196-113-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1196-112-0x000001DB22560000-0x000001DB2258B000-memory.dmp

Download

memory/1256-116-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1256-115-0x0000020FCCB20000-0x0000020FCCB4B000-memory.dmp

Download

memory/1288-121-0x000001AEEF150000-0x000001AEEF17B000-memory.dmp

Download

memory/1288-122-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1304-124-0x000001F07E000000-0x000001F07E02B000-memory.dmp

Download

memory/1304-125-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1420-128-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1420-127-0x000001A1CDB30000-0x000001A1CDB5B000-memory.dmp

Download

memory/1472-137-0x0000024A02B30000-0x0000024A02B5B000-memory.dmp

Download

memory/1472-138-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1640-141-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1640-140-0x000001EE5F550000-0x000001EE5F57B000-memory.dmp

Download

memory/1684-143-0x000001D5C2E00000-0x000001D5C2E2B000-memory.dmp

Download

memory/1684-144-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1752-147-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1752-146-0x0000014486A70000-0x0000014486A9B000-memory.dmp

Download

memory/1764-149-0x0000023532960000-0x000002353298B000-memory.dmp

Download

memory/1764-150-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1824-152-0x0000026587DC0000-0x0000026587DEB000-memory.dmp

Download

memory/1824-153-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1872-156-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1872-155-0x000002D524F70000-0x000002D524F9B000-memory.dmp

Download

memory/1920-172-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1920-171-0x00000293F5D40000-0x00000293F5D6B000-memory.dmp

Download

memory/1976-175-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/1976-174-0x0000027263D70000-0x0000027263D9B000-memory.dmp

Download

memory/2028-177-0x0000025A07B50000-0x0000025A07B7B000-memory.dmp

Download

memory/2028-178-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/2088-180-0x000001C832DB0000-0x000001C832DDB000-memory.dmp

Download

memory/2088-181-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/2096-184-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/2096-183-0x000001FC9A400000-0x000001FC9A42B000-memory.dmp

Download

memory/2180-186-0x000001DA6CF20000-0x000001DA6CF4B000-memory.dmp

Download

memory/2180-187-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/2196-73-0x00007FF9B4FB0000-0x00007FF9B506D000-memory.dmp

Download

memory/2196-72-0x00007FF9B5D60000-0x00007FF9B5F69000-memory.dmp

Download

memory/2228-189-0x000001E73E180000-0x000001E73E1AB000-memory.dmp

Download

memory/2228-190-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/2280-192-0x0000000000F50000-0x0000000000F7B000-memory.dmp

Download

memory/2280-193-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/2360-195-0x000001D46D360000-0x000001D46D38B000-memory.dmp

Download

memory/2360-196-0x00007FF975DF0000-0x00007FF975E00000-memory.dmp

Download

memory/2528-198-0x000001D876700000-0x000001D87672B000-memory.dmp

Download

memory/3880-381-0x0000000000290000-0x000000000031E000-memory.dmp

Download

memory/4192-343-0x0000000000050000-0x00000000000DE000-memory.dmp

Download

memory/4348-63-0x000000001D430000-0x000000001D45C000-memory.dmp

Download

memory/4348-62-0x000000001D3F0000-0x000000001D430000-memory.dmp

Download

memory/4348-61-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

Download

memory/4348-0-0x00000000005D0000-0x000000000065E000-memory.dmp

Download

memory/4348-1-0x0000000002790000-0x0000000002816000-memory.dmp

Download

memory/4348-360-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

Download

memory/4348-356-0x000000001D5E0000-0x000000001D5EE000-memory.dmp

Download

memory/4684-28-0x00000204B6C30000-0x00000204B6C40000-memory.dmp

Download

memory/4684-22-0x00000204B6F60000-0x00000204B6F7C000-memory.dmp

Download

memory/4684-21-0x00000204B6E50000-0x00000204B6E5A000-memory.dmp

Download

memory/4684-20-0x00000204B6E80000-0x00000204B6F33000-memory.dmp

Download

memory/4684-19-0x00000204B6E60000-0x00000204B6E7C000-memory.dmp

Download

memory/4684-12-0x00007FF4377C0000-0x00007FF4377D0000-memory.dmp

Download

memory/4684-11-0x00000204B6C30000-0x00000204B6C40000-memory.dmp

Download

memory/4684-10-0x000002049D140000-0x000002049D162000-memory.dmp

Download

memory/4684-23-0x00000204B6F40000-0x00000204B6F4A000-memory.dmp

Download

memory/4684-24-0x00000204B6FA0000-0x00000204B6FBA000-memory.dmp

Download

memory/4684-25-0x00000204B6F50000-0x00000204B6F58000-memory.dmp

Download

memory/4684-2-0x00000204B6C30000-0x00000204B6C40000-memory.dmp

Download

memory/4684-3-0x00000204B6C30000-0x00000204B6C40000-memory.dmp

Download

memory/4684-26-0x00000204B6F80000-0x00000204B6F86000-memory.dmp

Download

memory/4684-27-0x00000204B6F90000-0x00000204B6F9A000-memory.dmp

Download