Overview

overview

6

Static

static

1

xmodhubIns...1).exe

windows11-21h2-x64

6

xmodhubIns...1).exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 15:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    xmodhubInstaller__20260807_120311_channel100166 (1).exe
  • Size 2.3MB
  • Sample260930-se18nsvsfv
  • SHA256 c22c61b46a2387519ea92d9d397022a8dc62b42f64c56706f73f92c65f299bb2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryexecutionpersistencespywaretrojan

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Downloads MZ/PE file 2 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 47 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 9 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 48 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 6 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\xmodhubInstaller__20260807_120311_channel100166 (1).exe
    "C:\Users\Admin\AppData\Local\Temp\xmodhubInstaller__20260807_120311_channel100166 (1).exe"
    1⤵
    • Adds Run key to start application
    • Downloads MZ/PE file
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6128
    • C:\Users\Admin\AppData\Local\Temp\ChannelInstaller.exe
      -pipename=\\.\pipe\autoupdate_pipe_xmod_6128 -silent -auto-start -shell -install-path "C:\Program Files (x86)\xmodhub" C:\Users\Admin\AppData\Local\Temp\xmodhubInstaller__20260807_120311_channel100166 (1).exe
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1512
      • C:\Program Files (x86)\xmodhub\xmodhub.exe
        "C:\Program Files (x86)\xmodhub\xmodhub.exe" C:\Users\Admin\AppData\Local\Temp\xmodhubInstaller__20260807_120311_channel100166 (1).exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies trusted root certificate store through registry
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3556
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "chcp"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1756
          • C:\Windows\system32\chcp.com
            chcp
            5⤵
              PID:5068
          • C:\Program Files (x86)\xmodhub\xmodhub.exe
            "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\xmodhub /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\xmodhub\Crashpad --url=https://f.a.k/e --annotation=_productName=xmodhub --annotation=_version=2.5.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=21.4.4 --initial-client-data=0x5dc,0x5e4,0x5e8,0x5e0,0x5ec,0x7ff6d28a06e0,0x7ff6d28a06f0,0x7ff6d28a0700
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3484
          • C:\Program Files (x86)\xmodhub\xmodhub.exe
            "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --enable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 --field-trial-handle=1880,i,11770040631890988229,14967245514582273274,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:2
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:6120
          • C:\Program Files (x86)\xmodhub\xmodhub.exe
            "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2312 --field-trial-handle=1880,i,11770040631890988229,14967245514582273274,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:8
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            PID:5408
          • C:\Program Files (x86)\xmodhub\xmodhub.exe
            "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Program Files (x86)\xmodhub\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2832 --field-trial-handle=1880,i,11770040631890988229,14967245514582273274,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:1
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2404
          • C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\remote-control-relay-local.exe
            "C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\remote-control-relay-local.exe" version
            4⤵
            • Executes dropped EXE
            PID:6332
          • C:\Program Files (x86)\xmodhub\cert\CertMgr.exe
            "C:\Program Files (x86)\xmodhub\cert\CertMgr.exe" -all -add "C:\Program Files (x86)\xmodhub\cert\squidV2.crt" -s -r localMachine Root
            4⤵
            • Executes dropped EXE
            • Modifies trusted root certificate store through registry
            • Modifies system certificate store
            PID:6412
    • C:\Program Files (x86)\xmodhub\xmodhub.exe
      "C:\Program Files (x86)\xmodhub\xmodhub.exe"
      1⤵
      • Downloads MZ/PE file
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies trusted root certificate store through registry
      • Reads the TCP/IP host and domain name from the registry
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1064
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "chcp"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5448
        • C:\Windows\system32\chcp.com
          chcp
          3⤵
            PID:5576
        • C:\Program Files (x86)\xmodhub\xmodhub.exe
          "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\xmodhub /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\xmodhub\Crashpad --url=https://f.a.k/e --annotation=_productName=xmodhub --annotation=_version=2.5.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=21.4.4 --initial-client-data=0x608,0x610,0x614,0x60c,0x618,0x7ff6d28a06e0,0x7ff6d28a06f0,0x7ff6d28a0700
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4160
        • C:\Program Files (x86)\xmodhub\xmodhub.exe
          "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --enable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1944,i,16115542228591239320,14813667962769843141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:2
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3388
        • C:\Program Files (x86)\xmodhub\xmodhub.exe
          "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --ignore-certificate-errors --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2376 --field-trial-handle=1944,i,16115542228591239320,14813667962769843141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:8
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          PID:4084
        • C:\Program Files (x86)\xmodhub\xmodhub.exe
          "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-path="C:\Program Files (x86)\xmodhub\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3188 --field-trial-handle=1944,i,16115542228591239320,14813667962769843141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:7120
        • C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\remote-control-relay-local.exe
          "C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\remote-control-relay-local.exe" version
          2⤵
          • Executes dropped EXE
          PID:5892
        • C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\remote-control-relay-local.exe
          "C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\remote-control-relay-local.exe" run --listen 0.0.0.0:52108 --auth-key-set-file "C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\remote-control\local-relay\auth-key-set.json" --auth-issuer xmod-bff --auth-audience remote-control-relay --auth-clock-skew-seconds 120 --allow-local-network
          2⤵
          • Executes dropped EXE
          PID:6476
        • C:\Program Files (x86)\xmodhub\cert\CertMgr.exe
          "C:\Program Files (x86)\xmodhub\cert\CertMgr.exe" -all -add "C:\Program Files (x86)\xmodhub\cert\squidV2.crt" -s -r localMachine Root
          2⤵
          • Executes dropped EXE
          • Modifies trusted root certificate store through registry
          • Modifies system certificate store
          PID:6080
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
          2⤵
          • Executes a command shell one-liner
          PID:6544
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
          2⤵
          • Enumerates connected drives
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4244
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
          2⤵
          • Enumerates connected drives
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:260
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
          2⤵
          • Enumerates connected drives
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4720
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
          2⤵
          • Executes a command shell one-liner
          PID:1744
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
          2⤵
          • Enumerates connected drives
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:6132
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
          2⤵
          • Enumerates connected drives
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2116
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
          2⤵
          • Enumerates connected drives
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4936
        • C:\Program Files (x86)\xmodhub\xmodhub.exe
          "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-user-model-id=weisuan.xmod --app-path="C:\Program Files (x86)\xmodhub\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4636 --field-trial-handle=1944,i,16115542228591239320,14813667962769843141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:1
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4028
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1752
          • C:\Windows\system32\findstr.exe
            findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
            3⤵
              PID:4068
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4856
            • C:\Windows\system32\findstr.exe
              findstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"
              3⤵
                PID:3220
            • C:\Program Files (x86)\xmodhub\xmodhub.exe
              "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-user-model-id=weisuan.xmod --app-path="C:\Program Files (x86)\xmodhub\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4700 --field-trial-handle=1944,i,16115542228591239320,14813667962769843141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:1
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:8016
            • C:\Program Files (x86)\xmodhub\xmodhub.exe
              "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-user-model-id=weisuan.xmod --app-path="C:\Program Files (x86)\xmodhub\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4860 --field-trial-handle=1944,i,16115542228591239320,14813667962769843141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:1
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:8084
            • C:\Program Files (x86)\xmodhub\xmodhub.exe
              "C:\Program Files (x86)\xmodhub\xmodhub.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\xmodhub" --standard-schemes --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --service-worker-schemes --streaming-schemes --app-user-model-id=weisuan.xmod --app-path="C:\Program Files (x86)\xmodhub\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4808 --field-trial-handle=1944,i,16115542228591239320,14813667962769843141,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,CrossOriginEmbedderPolicyCredentialless,OutOfProcessPdf,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand,WinUseBrowserSpellChecker /prefetch:1
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:8184

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                D3DCompiler_47.dll
                • Path C:\Program Files (x86)\xmodhub\D3DCompiler_47.dll
                • Size 4.7MB
                • SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CertMgr.exe
                • Path C:\Program Files (x86)\xmodhub\cert\CertMgr.exe
                • Size 84KB
                • SHA256 86f59a37724772c72e000289b062ec1960ac49d0602fbb8e5940b1b01b321d0f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_100_percent.pak
                • Path C:\Program Files (x86)\xmodhub\chrome_100_percent.pak
                • Size 126KB
                • SHA256 bca4401b578a6ac0fe793e8519fed82b5444972b7d6c176ec0369ed13beaad7b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_200_percent.pak
                • Path C:\Program Files (x86)\xmodhub\chrome_200_percent.pak
                • Size 175KB
                • SHA256 b2c25fb30fee5f04ccdb8bf3c937a667502d266e428425feeb5af964f6167d48
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ffmpeg.dll
                • Path C:\Program Files (x86)\xmodhub\ffmpeg.dll
                • Size 2.6MB
                • SHA256 d3a7984c69ece3a621c3a8b7d609ba162c2923bedf31d2ee69d2925c298f75da
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                icudtl.dat
                • Path C:\Program Files (x86)\xmodhub\icudtl.dat
                • Size 10.0MB
                • SHA256 8d8a74ca376338623170d59c455476218d5a667d5991a52556aa9c9a70ebc5e5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libegl.dll
                • Path C:\Program Files (x86)\xmodhub\libegl.dll
                • Size 475KB
                • SHA256 c638887477c59acc2642d786a4720ba8450dff15958d66ade362f6dfc2177c3c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libglesv2.dll
                • Path C:\Program Files (x86)\xmodhub\libglesv2.dll
                • Size 7.0MB
                • SHA256 fc6f4f60d2a666b941e85d59d2be4a7b8e74ff879e34b0659221a4f05d1a4a6a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                en-US.pak
                • Path C:\Program Files (x86)\xmodhub\locales\en-US.pak
                • Size 302KB
                • SHA256 a99bd31907bbdc12bdfbff7b9da6ddd850c273f3a6ece64ee8d1d9b6ef0c501c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                resources.pak
                • Path C:\Program Files (x86)\xmodhub\resources.pak
                • Size 5.2MB
                • SHA256 f7fdde9650504d8872a7aa2b68e1f5b3cedd100ded1e19e44c2b6282eb637813
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ndisrd_lwf.inf
                • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\AccModule\driver\lwf\win7\amd64\ndisrd_lwf.inf
                • Size 2KB
                • SHA256 9344e5652e449b4e722d8a00f666cda147d5305b913102195bd7255124a413bc
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                XAccNode.node
                • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\AccSdk\XAccNode.node
                • Size 192KB
                • SHA256 026872ad5ae6b1bad3c5084fc7d609d6a02f69f9f3637986ced995f999cb541c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VCRUNTIME140.dll
                • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\VCRUNTIME140.dll
                • Size 117KB
                • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                XGameNode.node
                • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\XGameNode.node
                • Size 807KB
                • SHA256 d2c97b86ce0dbabaf3def9029ab60180e621f83ea609164b6939e31b27e3b663
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                XModAddon.node
                • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\XModAddon.node
                • Size 3.6MB
                • SHA256 281557d62a7cfd75c047ebc05232fd8fc83706867bb17ffbbc62d052d6183cb4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msvcp140.dll
                • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\msvcp140.dll
                • Size 562KB
                • SHA256 b99eb28a471311113f5c4109cb3c463f39cfd9bdb3b07f706204dedddb4516a1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vcruntime140_1.dll
                • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\XMod\vcruntime140_1.dll
                • Size 48KB
                • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                en-us.json
                • Path C:\Program Files (x86)\xmodhub\resources\app.asar.unpacked\resources\locales\en-us.json
                • Size 52KB
                • SHA256 8fa0fda104f69df3d43d27ac602fca55f124bc50367d51de2c085c421a41c5b7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                koffi.node
                • Path C:\Program Files (x86)\xmodhub\resources\koffi\build\koffi\win32_x64\koffi.node
                • Size 1.5MB
                • SHA256 c6e5d31aefe5337fbf0f7ff89a3f5434d5974552314dece7890f00dcc2febcdb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                v8_context_snapshot.bin
                • Path C:\Program Files (x86)\xmodhub\v8_context_snapshot.bin
                • Size 710KB
                • SHA256 ea2ea0f97ac908fd127a423f505241ebf4acea0ba5d02635cae40f7cd9c2f464
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                0bf32b42-689c-4e31-812c-61c942d27866.tmp.js
                • Path C:\Users\Admin\AppData\Local\Temp\0bf32b42-689c-4e31-812c-61c942d27866.tmp.js
                • Size 1KB
                • SHA256 2bd96d6f5af98a990f6774f28a943a2126d98df3bd66e25eb5bc546ac12b7338
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                7z.dll
                • Path C:\Users\Admin\AppData\Local\Temp\7z.dll
                • Size 1.2MB
                • SHA256 3ecf0c1a718f41ece87fad7029daa2f5e604f2e94449a66e8bf54252850eea62
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                __PSScriptPolicyTest_2qo0be1c.pii.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2qo0be1c.pii.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                xmod_node.log
                • Path C:\Users\Admin\AppData\Local\X-mod\xmod_node.log
                • Size 101B
                • SHA256 fb730d553d21a674a15166e51fd271c3ac9a617caf9a0939a0eb588d68814abc
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                f_000001
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Cache\Cache_Data\f_000001
                • Size 441KB
                • SHA256 a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Code Cache\js\index-dir\the-real-index
                • Size 48B
                • SHA256 5c73fbc08be576181490cbf46c458fa46e2f0e95d574576794328e1a72c243c8
                • MD5 SHA1 SHA512
                Submit Download

                index
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Code Cache\wasm\index
                • Size 24B
                • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                • MD5 SHA1 SHA512
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Code Cache\wasm\index-dir\the-real-index
                • Size 48B
                • SHA256 e2147ffbf814f31904278ea7ad2a16049d8fd1e7a1374f7dc6f62bb4dc0e9921
                • MD5 SHA1 SHA512
                Submit Download

                settings.dat
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Crashpad\settings.dat
                • Size 40B
                • SHA256 b08b787f05a02ec1e72b0af895bc7814ecbc8601cd8ef7480b23a3f1ec3ff0c0
                • MD5 SHA1 SHA512
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Network\Network Persistent State
                • Size 2KB
                • SHA256 01f39851d49a1efe3a590f86718052f32a36c1f2fe4a3a22cbfd808c40a2e7d0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Network\Network Persistent State
                • Size 851B
                • SHA256 b06b7337890b0e488aa20134ae756218833060a594f20e1dd0d37c43e2d4e8c2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Network\TransportSecurity
                • Size 366B
                • SHA256 7a27b2e4d55a610872a14db9d464c0b63a413908a35153dcb4d197dd2918d890
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Network\TransportSecurity
                • Size 370B
                • SHA256 7522dce9d35374f0354e35f379943e5a4c03a5786d7ab7122bc54a5f59c69530
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                dcb437b8-2f56-4e57-93c2-3dc99cfe0f96.tmp
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Network\dcb437b8-2f56-4e57-93c2-3dc99cfe0f96.tmp
                • Size 59B
                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                data_0
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\GPUCache\data_0
                • Size 8KB
                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_1
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\GPUCache\data_1
                • Size 264KB
                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_2
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\GPUCache\data_2
                • Size 8KB
                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_3
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\GPUCache\data_3
                • Size 8KB
                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                CURRENT
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\Local Storage\leveldb\CURRENT
                • Size 16B
                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                • MD5 SHA1 SHA512
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\Network\Network Persistent State
                • Size 638B
                • SHA256 e883439a5b50c5803620baf34a50385d5179f5111bca6a52c3971679b5cc83e2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\Network\Network Persistent State
                • Size 1000B
                • SHA256 f431ed419345f271d63e3aae81792f8f083d160f42bbda5c11ab26694ca6d2cd
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\Network\TransportSecurity
                • Size 203B
                • SHA256 bd8dd84b7c9d3ccd1f10d05f8dfdb4286d8deb36300104ab174937465cdfd1ad
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\Network\TransportSecurity
                • Size 201B
                • SHA256 c39f7da54dbcf0c8c9a89ea3d3f4df08c8ff720287818a642e3732a5b128f845
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                MANIFEST-000001
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\renderer\Session Storage\MANIFEST-000001
                • Size 41B
                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                • MD5 SHA1 SHA512
                Submit Download

                3a49c44f-e32d-4ae9-8e2a-c0d348447f1b.tmp
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\webview\3a49c44f-e32d-4ae9-8e2a-c0d348447f1b.tmp
                • Size 57B
                • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\webview\Code Cache\js\index-dir\the-real-index
                • Size 432B
                • SHA256 1230974d1d2c64b22140c469ec9ef029360a9a03009cf6b724eb28b497429c91
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\webview\Network\Network Persistent State
                • Size 491B
                • SHA256 199bcae82150db2669d8c5f5ac8ff1152b99547236ab9cef0bcaf48299bd6d40
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\Partitions\webview\Network\TransportSecurity
                • Size 704B
                • SHA256 368e4297c90508e7f9dea5c286edc5e5ace2b6ef516bb449cfb9f7ec55705e6f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
                • Size 215B
                • SHA256 438c88384f3adbe4b471492f9b6cbfedd837c3c5514024f3284158598d9edcf0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
                • Size 2B
                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                • MD5 SHA1 SHA512
                Submit Download

                config.json
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
                • Size 169B
                • SHA256 7cc2b0ae57d20af905f361541c7ec9a0f8ff098f060348d658d43a728b25ac77
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json
                • Size 890B
                • SHA256 b503a9fa7c90daa6d1645d6fd52466bb09fc55ceb979d71353beeacf66f7e25d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json.tmp-078067486308ad4e
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-078067486308ad4e
                • Size 24B
                • SHA256 ebd830cd5ac9209423fe2104f8c54a24d8395ff14eb47e0d6eed476df39ce6ac
                • MD5 SHA1 SHA512
                Submit Download

                config.json.tmp-07806753148917fd
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-07806753148917fd
                • Size 49B
                • SHA256 be522923fa4893f78d80e9f4a65a94086f85afa53f9aecffdfbc47e6e5fb6b62
                • MD5 SHA1 SHA512
                Submit Download

                config.json.tmp-07806788676b302b
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-07806788676b302b
                • Size 48B
                • SHA256 0cf8bb2cc3e13728c363f2f4c024080de7d857f8a19661419e9baa87590bd335
                • MD5 SHA1 SHA512
                Submit Download

                config.json.tmp-0780678887144e6e
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-0780678887144e6e
                • Size 67B
                • SHA256 18d6d90b84160d464b40309d2f84b187a1c9ea55372fb10c11c6fec6a3c44c90
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json.tmp-07806789980b88df
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-07806789980b88df
                • Size 81B
                • SHA256 70f9a21caa18cd3112b0e3b357250f70b2d0a56b9bc20818bb3afcf2059fff58
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json.tmp-07806801926b88fd
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-07806801926b88fd
                • Size 82B
                • SHA256 166d62c0a531aa986d8a9b39cb089f2e09863bd493518019b464713ed347f9e0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json.tmp-07806821709b2b2d
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-07806821709b2b2d
                • Size 193B
                • SHA256 6eff9078ac3fa9d55cd7c79088c41db0a4babcc990938834f9b33467045f1d4d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json.tmp-07806985289ae202
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-07806985289ae202
                • Size 1KB
                • SHA256 cd7310e24af86f975b0b07d833146a1bfb0ee769ee5f3b423262fdf7b17c2934
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json.tmp-0780700735985845
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-0780700735985845
                • Size 1KB
                • SHA256 118aac661480745ab5dbda1e9a393fe4c9a80b6941eedc440a8d612930a64c0e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                config.json.tmp-07807063734b075c
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\config.json.tmp-07807063734b075c
                • Size 1KB
                • SHA256 261e5a3f0342b22338d7f0bae41a994841f050c9cdf7d66ec545b2a031448ffa
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                main.log
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\logs\main.log
                • Size 5KB
                • SHA256 3b367aed414e313a6bf3a365aa638b013fb8d02f1d3c61e29cd84c95bdfc6c26
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                main.log
                • Path C:\Users\Admin\AppData\Roaming\xmodhub\logs\main.log
                • Size 1KB
                • SHA256 f3ed8c5118f0e425be64396b6e36c0ebcb44e113c66625fa8a6038bf2f1f6ec6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/260-3655-0x00000149B2290000-0x00000149B22B4000-memory.dmp
                Download

                memory/260-3654-0x00000149B2290000-0x00000149B22BA000-memory.dmp
                Download

                memory/260-3651-0x00000149B1CF0000-0x00000149B1CFA000-memory.dmp
                Download

                memory/260-3182-0x00000149B1CA0000-0x00000149B1CE8000-memory.dmp
                Download

                memory/4244-3638-0x000002DDFD730000-0x000002DDFD7E2000-memory.dmp
                Download

                memory/4244-3637-0x000002DDFD6B0000-0x000002DDFD6CE000-memory.dmp
                Download

                memory/4720-3176-0x0000018F73D70000-0x0000018F73D92000-memory.dmp
                Download