xworm | 2ac1f77d4c19b7ffe889518899019669542ee32a5ed5d37bf2c043d23e6c65e9

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IDE.exe
Size 541KB
Sample260910-rt1d9ahc86
SHA256 2ac1f77d4c19b7ffe889518899019669542ee32a5ed5d37bf2c043d23e6c65e9
MD5 89632a695c36a4c4958f82d80b5ee84e
SHA1 2ff9378f77551c867dbad62f4e8632deec7b1cf2
SHA512 189fa286a872e70b97adcbc2e16ac25ade2eb3b2bcceb85e39ce642441c9f9e8e2b6c00bef38dda3dfd9749b686a53196836487d576bf36df357aefa60858f5b
SSDEEP 6144:lHWRg7KvhVjhLUjCLUCdiQpbmtu7qD4wACiwmCBu3sFsxEX:lHWRg7ohzLUvCA3X/XyCBlFiE
TLSH
T14EC4CF552105A399E88B2076E7F4FC9979E39DF30B0A8CCE651233F91876D4297F0A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

31.6.50.206:2018

Attributes

install_file
Mason.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral4/memory/6732-44-0x000000001B180000-0x000000001B1C0000-memory.dmp	family_xworm
behavioral4/memory/6732-356-0x0000000002890000-0x000000000289E000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1128	powershell.exe
4216	powershell.exe
6624	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
6816	yq5xfr4g.h4s.exe
3460	IDE.exe
1868	IDE.exe
3332	IDE.exe

ConfuserEx .NET packer 7 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral4/memory/6732-1-0x0000000000300000-0x000000000038E000-memory.dmp	ConfuserEx
behavioral4/memory/6732-3-0x0000000002600000-0x0000000002686000-memory.dmp	ConfuserEx
behavioral4/memory/3460-337-0x0000000000170000-0x00000000001FE000-memory.dmp	ConfuserEx
behavioral4/memory/3460-338-0x0000000002920000-0x00000000029A6000-memory.dmp	ConfuserEx
behavioral4/files/0x001300000001c612-333.dat	ConfuserEx
behavioral4/memory/1868-365-0x0000000000520000-0x00000000005AE000-memory.dmp	ConfuserEx
behavioral4/memory/3332-375-0x0000000000140000-0x00000000001CE000-memory.dmp	ConfuserEx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "504928405,17110992,7153487,17110988,7202265,507286179,41816131,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,940 15,943 10,944 50,940 6,1329 15,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5092	schtasks.exe
1584	SCHTASKS.exe
5740	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1128	powershell.exe
1128	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
6624	powershell.exe
6624	powershell.exe
6624	powershell.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe
6816	yq5xfr4g.h4s.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2240	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6732	IDE.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeIncreaseQuotaPrivilege	1128	powershell.exe
Token: SeSecurityPrivilege	1128	powershell.exe
Token: SeTakeOwnershipPrivilege	1128	powershell.exe
Token: SeLoadDriverPrivilege	1128	powershell.exe
Token: SeSystemProfilePrivilege	1128	powershell.exe
Token: SeSystemtimePrivilege	1128	powershell.exe
Token: SeProfSingleProcessPrivilege	1128	powershell.exe
Token: SeIncBasePriorityPrivilege	1128	powershell.exe
Token: SeCreatePagefilePrivilege	1128	powershell.exe
Token: SeBackupPrivilege	1128	powershell.exe
Token: SeRestorePrivilege	1128	powershell.exe
Token: SeShutdownPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeSystemEnvironmentPrivilege	1128	powershell.exe
Token: SeRemoteShutdownPrivilege	1128	powershell.exe
Token: SeUndockPrivilege	1128	powershell.exe
Token: SeManageVolumePrivilege	1128	powershell.exe
Token: 33	1128	powershell.exe
Token: 34	1128	powershell.exe
Token: 35	1128	powershell.exe
Token: 36	1128	powershell.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeIncreaseQuotaPrivilege	4216	powershell.exe
Token: SeSecurityPrivilege	4216	powershell.exe
Token: SeTakeOwnershipPrivilege	4216	powershell.exe
Token: SeLoadDriverPrivilege	4216	powershell.exe
Token: SeSystemProfilePrivilege	4216	powershell.exe
Token: SeSystemtimePrivilege	4216	powershell.exe
Token: SeProfSingleProcessPrivilege	4216	powershell.exe
Token: SeIncBasePriorityPrivilege	4216	powershell.exe
Token: SeCreatePagefilePrivilege	4216	powershell.exe
Token: SeBackupPrivilege	4216	powershell.exe
Token: SeRestorePrivilege	4216	powershell.exe
Token: SeShutdownPrivilege	4216	powershell.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeSystemEnvironmentPrivilege	4216	powershell.exe
Token: SeRemoteShutdownPrivilege	4216	powershell.exe
Token: SeUndockPrivilege	4216	powershell.exe
Token: SeManageVolumePrivilege	4216	powershell.exe
Token: 33	4216	powershell.exe
Token: 34	4216	powershell.exe
Token: 35	4216	powershell.exe
Token: 36	4216	powershell.exe
Token: SeDebugPrivilege	6624	powershell.exe
Token: SeIncreaseQuotaPrivilege	6624	powershell.exe
Token: SeSecurityPrivilege	6624	powershell.exe
Token: SeTakeOwnershipPrivilege	6624	powershell.exe
Token: SeLoadDriverPrivilege	6624	powershell.exe
Token: SeSystemProfilePrivilege	6624	powershell.exe
Token: SeSystemtimePrivilege	6624	powershell.exe
Token: SeProfSingleProcessPrivilege	6624	powershell.exe
Token: SeIncBasePriorityPrivilege	6624	powershell.exe
Token: SeCreatePagefilePrivilege	6624	powershell.exe
Token: SeBackupPrivilege	6624	powershell.exe
Token: SeRestorePrivilege	6624	powershell.exe
Token: SeShutdownPrivilege	6624	powershell.exe
Token: SeDebugPrivilege	6624	powershell.exe
Token: SeSystemEnvironmentPrivilege	6624	powershell.exe
Token: SeRemoteShutdownPrivilege	6624	powershell.exe
Token: SeUndockPrivilege	6624	powershell.exe
Token: SeManageVolumePrivilege	6624	powershell.exe
Token: 33	6624	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4964	Conhost.exe
2208	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6732 wrote to memory of 1128	6732	IDE.exe	88
PID 6732 wrote to memory of 4216	6732	IDE.exe	91
PID 6732 wrote to memory of 6624	6732	IDE.exe	93
PID 6732 wrote to memory of 5092	6732	IDE.exe	95
PID 6732 wrote to memory of 6816	6732	IDE.exe	97
PID 6732 wrote to memory of 1584	6732	IDE.exe	98
PID 6816 wrote to memory of 740	6816	yq5xfr4g.h4s.exe	5
PID 6816 wrote to memory of 960	6816	yq5xfr4g.h4s.exe	9
PID 6816 wrote to memory of 968	6816	yq5xfr4g.h4s.exe	10
PID 6816 wrote to memory of 1004	6816	yq5xfr4g.h4s.exe	11
PID 6816 wrote to memory of 472	6816	yq5xfr4g.h4s.exe	13
PID 6816 wrote to memory of 1088	6816	yq5xfr4g.h4s.exe	14
PID 6816 wrote to memory of 1108	6816	yq5xfr4g.h4s.exe	15
PID 6816 wrote to memory of 1132	6816	yq5xfr4g.h4s.exe	16
PID 6816 wrote to memory of 1284	6816	yq5xfr4g.h4s.exe	17
PID 6816 wrote to memory of 1316	6816	yq5xfr4g.h4s.exe	19
PID 6816 wrote to memory of 1428	6816	yq5xfr4g.h4s.exe	21
PID 6816 wrote to memory of 1460	6816	yq5xfr4g.h4s.exe	22
PID 6816 wrote to memory of 1468	6816	yq5xfr4g.h4s.exe	23
PID 6816 wrote to memory of 1508	6816	yq5xfr4g.h4s.exe	24
PID 6816 wrote to memory of 1588	6816	yq5xfr4g.h4s.exe	25
PID 6816 wrote to memory of 1728	6816	yq5xfr4g.h4s.exe	27
PID 6816 wrote to memory of 1856	6816	yq5xfr4g.h4s.exe	28
PID 6816 wrote to memory of 1960	6816	yq5xfr4g.h4s.exe	29
PID 6816 wrote to memory of 1544	6816	yq5xfr4g.h4s.exe	30
PID 6816 wrote to memory of 1600	6816	yq5xfr4g.h4s.exe	31
PID 6816 wrote to memory of 2092	6816	yq5xfr4g.h4s.exe	32
PID 6816 wrote to memory of 2212	6816	yq5xfr4g.h4s.exe	33
PID 6816 wrote to memory of 2264	6816	yq5xfr4g.h4s.exe	34
PID 6816 wrote to memory of 2368	6816	yq5xfr4g.h4s.exe	35
PID 6816 wrote to memory of 2428	6816	yq5xfr4g.h4s.exe	36
PID 6816 wrote to memory of 2540	6816	yq5xfr4g.h4s.exe	37
PID 6816 wrote to memory of 2560	6816	yq5xfr4g.h4s.exe	38
PID 6816 wrote to memory of 2664	6816	yq5xfr4g.h4s.exe	39
PID 6816 wrote to memory of 2736	6816	yq5xfr4g.h4s.exe	40
PID 6816 wrote to memory of 2780	6816	yq5xfr4g.h4s.exe	41
PID 6816 wrote to memory of 2852	6816	yq5xfr4g.h4s.exe	42
PID 6816 wrote to memory of 2928	6816	yq5xfr4g.h4s.exe	43
PID 6816 wrote to memory of 712	6816	yq5xfr4g.h4s.exe	44
PID 6816 wrote to memory of 3128	6816	yq5xfr4g.h4s.exe	46
PID 6816 wrote to memory of 3152	6816	yq5xfr4g.h4s.exe	47
PID 6816 wrote to memory of 3240	6816	yq5xfr4g.h4s.exe	48
PID 6816 wrote to memory of 3476	6816	yq5xfr4g.h4s.exe	50
PID 6816 wrote to memory of 3580	6816	yq5xfr4g.h4s.exe	51
PID 6816 wrote to memory of 3592	6816	yq5xfr4g.h4s.exe	52
PID 6816 wrote to memory of 3632	6816	yq5xfr4g.h4s.exe	53
PID 6816 wrote to memory of 3640	6816	yq5xfr4g.h4s.exe	54
PID 6816 wrote to memory of 3660	6816	yq5xfr4g.h4s.exe	55
PID 6816 wrote to memory of 3684	6816	yq5xfr4g.h4s.exe	56
PID 6816 wrote to memory of 3320	6816	yq5xfr4g.h4s.exe	57
PID 6816 wrote to memory of 1292	6816	yq5xfr4g.h4s.exe	58
PID 6816 wrote to memory of 4400	6816	yq5xfr4g.h4s.exe	59
PID 6816 wrote to memory of 4468	6816	yq5xfr4g.h4s.exe	60
PID 6816 wrote to memory of 4512	6816	yq5xfr4g.h4s.exe	61
PID 6816 wrote to memory of 4604	6816	yq5xfr4g.h4s.exe	62
PID 6816 wrote to memory of 4236	6816	yq5xfr4g.h4s.exe	63
PID 6816 wrote to memory of 4212	6816	yq5xfr4g.h4s.exe	64
PID 6816 wrote to memory of 5140	6816	yq5xfr4g.h4s.exe	65
PID 6816 wrote to memory of 5204	6816	yq5xfr4g.h4s.exe	66
PID 6816 wrote to memory of 5244	6816	yq5xfr4g.h4s.exe	67
PID 6816 wrote to memory of 5456	6816	yq5xfr4g.h4s.exe	69
PID 6816 wrote to memory of 6244	6816	yq5xfr4g.h4s.exe	71
PID 6816 wrote to memory of 6616	6816	yq5xfr4g.h4s.exe	72
PID 6816 wrote to memory of 2960	6816	yq5xfr4g.h4s.exe	74

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:740
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:968
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1132

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:960

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e964a45f-916d-499c-bf4c-9731b70292d3 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e820509b-a383-4b75-b0b7-f356cb6ef08e -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a3d1d64d-ae2b-428f-8936-202f5da5a0c1 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5c1e5e87-638b-4be8-ae44-5e7573105322 -LifetimeId:26f9cf9f-3279-4ff9-84e6-3c166fda9778 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:1088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1428
- C:\ProgramData\IDE.exe
  "C:\ProgramData\IDE.exe"
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\ProgramData\IDE.exe
  "C:\ProgramData\IDE.exe"
  2⤵
  - Executes dropped EXE
  PID:3332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1856
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2840
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\IDE.exe
      "C:\Users\Admin\AppData\Local\Temp\IDE.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:6732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'IDE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\IDE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\IDE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6624
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "IDE" /tr "C:\ProgramData\IDE.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\yq5xfr4g.h4s.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yq5xfr4g.h4s.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:6816
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "MasonIDE.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\IDE.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1584
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "MasonIDE.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\IDE.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5740
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2540
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:4212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2928

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3240

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1292

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4400

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4604

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4236

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5140

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5204

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:6244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:6616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5340

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:4988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5068

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5620

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:2208

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4964

C:\ProgramData\IDE.exe
C:\ProgramData\IDE.exe
1⤵
- Executes dropped EXE
PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IDE.exe

Path C:\ProgramData\IDE.exe
Size 541KB
SHA256 2ac1f77d4c19b7ffe889518899019669542ee32a5ed5d37bf2c043d23e6c65e9
MD5 89632a695c36a4c4958f82d80b5ee84e
SHA1 2ff9378f77551c867dbad62f4e8632deec7b1cf2
SHA512 189fa286a872e70b97adcbc2e16ac25ade2eb3b2bcceb85e39ce642441c9f9e8e2b6c00bef38dda3dfd9749b686a53196836487d576bf36df357aefa60858f5b
SSDEEP 6144:lHWRg7KvhVjhLUjCLUCdiQpbmtu7qD4wACiwmCBu3sFsxEX:lHWRg7ohzLUvCA3X/XyCBlFiE
TLSH
T14EC4CF552105A399E88B2076E7F4FC9979E39DF30B0A8CCE651233F91876D4297F0A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1599754af315bf45fc5c21a5d9d6289ee5d77b66ecc79c44b56e93a2e4a258b3
MD5 921a478d4b661d5dbabaa5056c375995
SHA1 0f636740ac1adb46315e7380dca2d29c333d0456
SHA512 ed439021bbee12984ea7fdfc5f2d78a2599748df67ecbfb6d92a78314e76ba9019d6971e78ea0a8bd0567d40a124483f0d48e7d42afd2f730e81614fe36b565f
TLSH
T1B8216833B3DD8614C89A413A10CEAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 656ea55f858f0218c06238fd887f5351d2b2913fa11eb429ec057b12ef4e085c
MD5 2f1b4e8c53255bed78b8d7510351ace1
SHA1 ca69d7fac182fbd1439a3e1ebde0516136c4051e
SHA512 1697bc35d01c99a4091fc12b2dadcba85797fc4fecce2712b04459bdf5bac830b9da14f015852fafd39496592d655e6c7a04cf08f84c545f97e2f0a25cc5f75e
TLSH
T1FF216833B3DD8624CC9A413A10CDAC1036B6D7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_l5hdr3r1.vog.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l5hdr3r1.vog.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

yq5xfr4g.h4s.exe

Path C:\Users\Admin\AppData\Local\Temp\yq5xfr4g.h4s.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-113-0x00000171579D0000-0x00000171579FB000-memory.dmp

Download

memory/472-115-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/740-58-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/740-56-0x0000024C2DBA0000-0x0000024C2DBC5000-memory.dmp

Download

memory/740-57-0x0000024C2DBD0000-0x0000024C2DBFB000-memory.dmp

Download

memory/960-79-0x0000028002EA0000-0x0000028002ECB000-memory.dmp

Download

memory/960-81-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/968-94-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/968-92-0x000002C7561E0000-0x000002C75620B000-memory.dmp

Download

memory/1004-105-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/1004-103-0x0000011D5C4F0000-0x0000011D5C51B000-memory.dmp

Download

memory/1088-152-0x000002414B730000-0x000002414B75B000-memory.dmp

Download

memory/1088-153-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/1108-156-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/1108-155-0x0000021C4A7F0000-0x0000021C4A81B000-memory.dmp

Download

memory/1128-20-0x0000010EE8990000-0x0000010EE8A42000-memory.dmp

Download

memory/1128-16-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/1128-26-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/1128-27-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/1128-29-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/1128-24-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/1128-19-0x0000010ED04D0000-0x0000010ED04EE000-memory.dmp

Download

memory/1128-25-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/1128-23-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/1128-13-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/1128-22-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/1128-15-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/1128-21-0x0000010EE8940000-0x0000010EE894A000-memory.dmp

Download

memory/1128-12-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/1128-14-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/1128-11-0x0000010ED0450000-0x0000010ED0472000-memory.dmp

Download

memory/1132-68-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/1132-67-0x0000019088100000-0x000001908812B000-memory.dmp

Download

memory/1284-159-0x0000020171F70000-0x0000020171F9B000-memory.dmp

Download

memory/1284-162-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/1316-158-0x00000284A3BB0000-0x00000284A3BDB000-memory.dmp

Download

memory/1316-160-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/1428-164-0x0000021697C00000-0x0000021697C2B000-memory.dmp

Download

memory/1428-165-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/1460-167-0x000001F1C2C40000-0x000001F1C2C6B000-memory.dmp

Download

memory/1460-168-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/1468-75-0x000001D46E040000-0x000001D46E06B000-memory.dmp

Download

memory/1468-76-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/1508-170-0x0000017210F50000-0x0000017210F7B000-memory.dmp

Download

memory/1508-171-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/1544-184-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/1544-183-0x000001F753370000-0x000001F75339B000-memory.dmp

Download

memory/1588-174-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/1588-173-0x000001F515940000-0x000001F51596B000-memory.dmp

Download

memory/1600-186-0x0000020F97D30000-0x0000020F97D5B000-memory.dmp

Download

memory/1728-177-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/1728-176-0x000001E65C740000-0x000001E65C76B000-memory.dmp

Download

memory/1856-179-0x000001FDC2220000-0x000001FDC224B000-memory.dmp

Download

memory/1856-180-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/1868-365-0x0000000000520000-0x00000000005AE000-memory.dmp

Download

memory/2092-187-0x000001EFA7FA0000-0x000001EFA7FCB000-memory.dmp

Download

memory/2092-188-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/2212-191-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/2212-190-0x000001D023B90000-0x000001D023BBB000-memory.dmp

Download

memory/2240-143-0x0000000003CF0000-0x0000000003D1B000-memory.dmp

Download

memory/2240-144-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/2264-194-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/2264-193-0x00000292F75A0000-0x00000292F75CB000-memory.dmp

Download

memory/2368-196-0x000002442DF90000-0x000002442DFBB000-memory.dmp

Download

memory/2428-198-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/2428-197-0x000001DA3A7E0000-0x000001DA3A80B000-memory.dmp

Download

memory/2540-200-0x000001BB41BB0000-0x000001BB41BDB000-memory.dmp

Download

memory/2540-201-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/2560-203-0x000001B160D50000-0x000001B160D7B000-memory.dmp

Download

memory/2560-204-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/2664-206-0x00000214E6F20000-0x00000214E6F4B000-memory.dmp

Download

memory/2664-207-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/2736-209-0x000001A832650000-0x000001A83267B000-memory.dmp

Download

memory/2736-210-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/2780-213-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/2780-212-0x0000019E3AFB0000-0x0000019E3AFDB000-memory.dmp

Download

memory/2928-216-0x0000028D15050000-0x0000028D1507B000-memory.dmp

Download

memory/3332-375-0x0000000000140000-0x00000000001CE000-memory.dmp

Download

memory/3460-338-0x0000000002920000-0x00000000029A6000-memory.dmp

Download

memory/3460-337-0x0000000000170000-0x00000000001FE000-memory.dmp

Download

memory/4212-129-0x00007FFB687E0000-0x00007FFB687F0000-memory.dmp

Download

memory/4212-128-0x0000020FE66C0000-0x0000020FE66EB000-memory.dmp

Download

memory/6732-2-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/6732-44-0x000000001B180000-0x000000001B1C0000-memory.dmp

Download

memory/6732-8-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/6732-45-0x0000000002880000-0x00000000028AC000-memory.dmp

Download

memory/6732-43-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/6732-7-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/6732-5-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/6732-4-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/6732-3-0x0000000002600000-0x0000000002686000-memory.dmp

Download

memory/6732-6-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/6732-0-0x00007FFB859DF000-0x00007FFB859E0000-memory.dmp

Download

memory/6732-1-0x0000000000300000-0x000000000038E000-memory.dmp

Download

memory/6732-348-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/6732-356-0x0000000002890000-0x000000000289E000-memory.dmp

Download

memory/6732-359-0x00007FFB85850000-0x00007FFB861F4000-memory.dmp

Download

memory/6816-55-0x00007FFBA7E40000-0x00007FFBA7F07000-memory.dmp

Download

memory/6816-54-0x00007FFBA86A0000-0x00007FFBA8903000-memory.dmp

Download