xworm | 661a9e70489e80ee8fe41d184c5969d7d900149d56f8df1c949d6fedfa3c52ed

Analysis

user interaction
yes
max time kernel
273s
max time network
268s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
27/10/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XClient.exe
Size 81KB
Sample261027-xtvfwsec89
SHA256 661a9e70489e80ee8fe41d184c5969d7d900149d56f8df1c949d6fedfa3c52ed
MD5 bfc9736c8ed84ba2574ffe0a9d50b3bd
SHA1 b321409a6539375ad3416d6d35bc6021da4921d3
SHA512 42479e347181183a711ea7b178ae0f9471171d15f7a6209c044a5c71503187f7571585ac60175ad4073907f0d6ae6b25dfec353ad84f691dd5215191415f8e24
SSDEEP 1536:1mM/+76kM2hV3GdHfaa3XjhNztdYLjh79b74WCaDUackgOitOKt7L0g3SG/:dS6kthJG9RThdgjPb7d3Aac0OOKtL0K/
TLSH
T140837C2C37E94425E1FFEFB05DE57153CA39F7222803959F24D6028A1B27A88CD516FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V5.6

33.tcp.cpolar.top:12896

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2228-0-0x0000000000670000-0x000000000068A000-memory.dmp	family_xworm
behavioral1/files/0x00080000000283ea-6.dat	family_xworm
behavioral1/memory/5076-552-0x00000000008D0000-0x00000000008EA000-memory.dmp	family_xworm

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Control Panel\International\Geo\Nation	XClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Control Panel\International\Geo\Nation	dxiyal.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Control Panel\International\Geo\Nation	unmrcm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Control Panel\International\Geo\Nation	pzlzjm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\Control Panel\International\Geo\Nation	jtssub.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Executes dropped EXE 12 IoCs

pid	Process
2884	XClient.exe
2088	XClient.exe
4300	XClient.exe
3988	XClient.exe
3596	dxiyal.exe
3744	unmrcm.exe
4176	MasonMBR-SLEEP.exe
3940	MasonRootkit.exe
4768	MasonGDI.exe
1440	pzlzjm.exe
2164	jtssub.exe
5076	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	XClient.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\MasonMBR	svchost.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4516	cmd.exe
3976	cmd.exe
4716	cmd.exe
2580	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	XClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	XClient.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe

Delays execution with timeout.exe 4 IoCs

defense_evasion

pid	Process
3252	timeout.exe
5072	timeout.exe
3556	timeout.exe
4540	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4556	schtasks.exe
3820	schtasks.exe
1436	schtasks.exe
528	schtasks.exe
1592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2228	XClient.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe
3940	MasonRootkit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3364	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	XClient.exe
Token: SeDebugPrivilege	2228	XClient.exe
Token: SeDebugPrivilege	2884	XClient.exe
Token: SeDebugPrivilege	2088	XClient.exe
Token: SeDebugPrivilege	4300	XClient.exe
Token: SeDebugPrivilege	3988	XClient.exe
Token: SeDebugPrivilege	3940	MasonRootkit.exe
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE
Token: SeShutdownPrivilege	1156	dwm.exe
Token: SeCreatePagefilePrivilege	1156	dwm.exe
Token: SeDebugPrivilege	5076	XClient.exe
Token: SeShutdownPrivilege	3364	Explorer.EXE
Token: SeCreatePagefilePrivilege	3364	Explorer.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2228	XClient.exe
3580	Conhost.exe
2084	Conhost.exe
600	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 4556	2228	XClient.exe	88
PID 2228 wrote to memory of 3596	2228	XClient.exe	99
PID 2228 wrote to memory of 3744	2228	XClient.exe	100
PID 3596 wrote to memory of 4176	3596	dxiyal.exe	101
PID 3596 wrote to memory of 3940	3596	dxiyal.exe	102
PID 3596 wrote to memory of 4768	3596	dxiyal.exe	103
PID 3596 wrote to memory of 3820	3596	dxiyal.exe	104
PID 3596 wrote to memory of 4516	3596	dxiyal.exe	106
PID 4516 wrote to memory of 3556	4516	cmd.exe	108
PID 3940 wrote to memory of 608	3940	MasonRootkit.exe	5
PID 3940 wrote to memory of 684	3940	MasonRootkit.exe	7
PID 3940 wrote to memory of 884	3940	MasonRootkit.exe	11
PID 3940 wrote to memory of 1016	3940	MasonRootkit.exe	13
PID 3940 wrote to memory of 404	3940	MasonRootkit.exe	14
PID 3940 wrote to memory of 876	3940	MasonRootkit.exe	15
PID 3940 wrote to memory of 944	3940	MasonRootkit.exe	16
PID 3940 wrote to memory of 1060	3940	MasonRootkit.exe	17
PID 3940 wrote to memory of 1108	3940	MasonRootkit.exe	18
PID 3940 wrote to memory of 1156	3940	MasonRootkit.exe	19
PID 3940 wrote to memory of 1232	3940	MasonRootkit.exe	21
PID 3940 wrote to memory of 1372	3940	MasonRootkit.exe	22
PID 3940 wrote to memory of 1480	3940	MasonRootkit.exe	24
PID 3940 wrote to memory of 1492	3940	MasonRootkit.exe	25
PID 3940 wrote to memory of 1528	3940	MasonRootkit.exe	26
PID 3940 wrote to memory of 1560	3940	MasonRootkit.exe	27
PID 3940 wrote to memory of 1692	3940	MasonRootkit.exe	28
PID 3940 wrote to memory of 1728	3940	MasonRootkit.exe	29
PID 3940 wrote to memory of 1776	3940	MasonRootkit.exe	30
PID 3940 wrote to memory of 1800	3940	MasonRootkit.exe	31
PID 3940 wrote to memory of 1872	3940	MasonRootkit.exe	32
PID 3940 wrote to memory of 1908	3940	MasonRootkit.exe	33
PID 3940 wrote to memory of 2000	3940	MasonRootkit.exe	34
PID 3940 wrote to memory of 1316	3940	MasonRootkit.exe	35
PID 3940 wrote to memory of 1348	3940	MasonRootkit.exe	36
PID 3940 wrote to memory of 1392	3940	MasonRootkit.exe	37
PID 3940 wrote to memory of 2064	3940	MasonRootkit.exe	38
PID 3940 wrote to memory of 2148	3940	MasonRootkit.exe	39
PID 3940 wrote to memory of 2192	3940	MasonRootkit.exe	40
PID 3940 wrote to memory of 2352	3940	MasonRootkit.exe	42
PID 3940 wrote to memory of 2444	3940	MasonRootkit.exe	43
PID 3940 wrote to memory of 2560	3940	MasonRootkit.exe	44
PID 3940 wrote to memory of 2572	3940	MasonRootkit.exe	45
PID 3940 wrote to memory of 2672	3940	MasonRootkit.exe	46
PID 3940 wrote to memory of 2700	3940	MasonRootkit.exe	47
PID 3940 wrote to memory of 2732	3940	MasonRootkit.exe	48
PID 3940 wrote to memory of 2740	3940	MasonRootkit.exe	49
PID 3940 wrote to memory of 2912	3940	MasonRootkit.exe	50
PID 3940 wrote to memory of 2876	3940	MasonRootkit.exe	52
PID 3940 wrote to memory of 2860	3940	MasonRootkit.exe	53
PID 3940 wrote to memory of 3120	3940	MasonRootkit.exe	54
PID 3940 wrote to memory of 3160	3940	MasonRootkit.exe	55
PID 3940 wrote to memory of 3312	3940	MasonRootkit.exe	56
PID 3940 wrote to memory of 3364	3940	MasonRootkit.exe	57
PID 3940 wrote to memory of 3516	3940	MasonRootkit.exe	58
PID 3940 wrote to memory of 3788	3940	MasonRootkit.exe	60
PID 3940 wrote to memory of 4004	3940	MasonRootkit.exe	62
PID 3940 wrote to memory of 2760	3940	MasonRootkit.exe	63
PID 3940 wrote to memory of 4392	3940	MasonRootkit.exe	66
PID 3940 wrote to memory of 2956	3940	MasonRootkit.exe	68
PID 3940 wrote to memory of 716	3940	MasonRootkit.exe	69
PID 3940 wrote to memory of 2764	3940	MasonRootkit.exe	70
PID 3940 wrote to memory of 416	3940	MasonRootkit.exe	71
PID 3940 wrote to memory of 1068	3940	MasonRootkit.exe	72
PID 3940 wrote to memory of 2140	3940	MasonRootkit.exe	73

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1156

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a392de4f-87da-4ffb-a910-67c291648f07 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-0c54f2db-a87c-4dc9-be41-0bc6972fea6c -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-4cef382d-aef3-4e76-840c-8c99de908fbb -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e91fc562-61af-41ca-bcdf-1f222941d46e -LifetimeId:bcb06998-7afc-4a3c-b822-d8be0ec239da -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1480
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3120
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3988
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1800
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2000
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x480 0x4a8
  2⤵
  PID:4688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2148

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3312

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3364
- C:\Users\Admin\AppData\Local\Temp\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
  2⤵
  - Checks computer location settings
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4556
- - C:\Users\Admin\AppData\Local\Temp\dxiyal.exe
    "C:\Users\Admin\AppData\Local\Temp\dxiyal.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"
      4⤵
      Executes dropped EXE
      PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4768
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp509D.tmp.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4440
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:3556
- - C:\Users\Admin\AppData\Local\Temp\unmrcm.exe
    "C:\Users\Admin\AppData\Local\Temp\unmrcm.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3744
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1436
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp58AC.tmp.bat""
      4⤵
      Executes a command shell one-liner
      PID:3976
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2720
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4540
- - C:\Users\Admin\AppData\Local\Temp\pzlzjm.exe
    "C:\Users\Admin\AppData\Local\Temp\pzlzjm.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:1440
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:528
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6425.tmp.bat""
      4⤵
      Executes a command shell one-liner
      PID:4716
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1892
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:3252
- - C:\Users\Admin\AppData\Local\Temp\jtssub.exe
    "C:\Users\Admin\AppData\Local\Temp\jtssub.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:2164
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1592
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:600
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7193.tmp.bat""
      4⤵
      Executes a command shell one-liner
      PID:2580
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:564
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:5072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3516

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3788

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4004

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2760

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:716

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:416

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2140

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3332

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:1860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2408

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2044

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XClient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log
Size 654B
SHA256 d39a78fabca39532fcb85ce908781a75132e1bd01cc50a3b290dd87127837d63
MD5 11c6e74f0561678d2cf7fc075a6cc00c
SHA1 535ee79ba978554abcb98c566235805e7ea18490
SHA512 32c63d67bf512b42e7f57f71287b354200126cb417ef9d869c72e0b9388a7c2f5e3b61f303f1353baa1bf482d0f17e06e23c9f50b2f1babd4d958b6da19c40b0
TLSH
T136F0783432A2E1D5C9127F111C1D298452AF8386B6A0AF1C7A68935DD8261376F313F3
MD5 SHA1 SHA512 TLSH

Submit Download

jtssub.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\jtssub.exe.log
Size 1KB
SHA256 7bf24ff0f6791ef902937b3caba0de16814a2c898dfb103d922c48582b602379
MD5 2b4889ecb49120375fdf2bccb3c0966e
SHA1 fc1ee2f1161887e3f8b0cdd2453ae441739b993a
SHA512 8d737276620add4738d3cb484bca8e1efe23247955d37ebad199d2428f2f494e10dbee98721a77c7fa9d55f662c230acb206894538da9b8a9d0314166b5549a3
TLSH
T196116A7032B6A1D889163F011C1D69C403AF8366B690AE0C7AA8525DED260275F213F7
MD5 SHA1 SHA512 TLSH

Submit Download

MasonGDI.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
Size 61KB
SHA256 57eff2792a929b479b3e3bb9a25bbe750034dcba4213e2abb8865ff2268b53f6
MD5 2f9823efd49a6f8fc32ba52d75e620a4
SHA1 39f79bc2bba2f33f2e82da2dee4c8cf3be052b7e
SHA512 2f68ddb1d7d070f7d8675791f8ccc3b9d73236834f1bc787afdf1074d4d17601f77e53a98024a12e29119c5c38333cd7f6200a186e2ba96fc4186c86ca2cb6ad
SSDEEP 1536:PTynnng4PEIGZ5eqIXzgmYi/ZuPiDNG9j3+aOPw1WX6CjV9nu:9OFGfeZgmJ8POoOu1WX6CjS
TLSH
T13653F186E3B8C421D0F71333AD67E99413F5EAD69D56CA1F0A80935B6ED23464F21E1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonMBR-SLEEP.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe
Size 65KB
SHA256 de93250a0f249700407cd893e1b4d6b167c5e909b4b8f09cbefbbae473f4ad93
MD5 f006d2343d121bd2043925e87063fde7
SHA1 402799473ca52edb826a37e0042456032db121f3
SHA512 707c803508308fa0d002aa31187476cf1b000118f9b0d89982ab60a674de09f028ae860c3dbdad9fa902ee4e9d0771f8fa79e356bb2ae8bf4f2c57d61f3e68e0
SSDEEP 1536:ToHs+RMT9qQPhcm7V0vppY62kxt+nl5Hr1lo/u:MHssMT9qQPSmyvB2cKl5L3P
TLSH
T1FC63F1129FE8026AC35F47B25DE573910F2ADE44DE06775F809182A18F49AC88773B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonMBR.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonMBR.exe
Size 93KB
SHA256 b7af0a09eac02f06abd483920e860d68d83b1cf4007edff6551b3f60fe990415
MD5 dd216fcf116773c6a8c8e91b29751a1d
SHA1 637ed4cf29c66c7e72c25c032c1f0dd3448c51e1
SHA512 b41c5ac2884aa0fe5928c7cadc24517daf41854c61a27157a2d7b77f1a8dd984d9d66ab46fa882ba6731cf50b1746886a87410a18cf7fb51919ee462f6725c39
SSDEEP 1536:CmwoXyoci5SjY3SaRO7IPqifrJxdhGZCJjmGasWhQcdQ5/hO2owMiDXw:Tv5MYRIMPqiTJx+ZqreRQ5/hXojiDXw
TLSH
T1D3936B43B5D28CB2E5B21D3108B1CAA15A2FB9210F658E6B6794136E5F380D09E35FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxiyal.exe

Path C:\Users\Admin\AppData\Local\Temp\dxiyal.exe
Size 535KB
SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
MD5 82bf26203c5d76dfa3a591f1cb60d7b5
SHA1 93bf418f64ec701fd0d3232a00a167d04ba9a6d2
SHA512 6a896c274958467e18579affe68a2e0acb68ea633715920d244974765dbf577ce7558cb3dc467a69a656cb82c2f588565f71c4413b5dedc1005fba35303ed2f3
SSDEEP 6144:yrjS60VNKrDqa3pPvX0RQ/FwiSs8k//M4zVRslxX4ci0MAM0bCrvVFs47Xeeeeen:4jST2/l3Z8O7Ss8k//XzVRUX4fnr9
TLSH
T136C4CF61A103D6E2E38D4BB46152D478152E1FE6679A160DEFC13F8B7DF12A128239CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp509D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp509D.tmp.bat
Size 158B
SHA256 6b8421871060da7153a14132e5b75e0b4408ccec985851aa5b92675a6975d68d
MD5 456acc7e61a615a21d15db5506a832e8
SHA1 efc208ed28c5b294145373dbbcda062ece771d80
SHA512 c4e3c1a98db7d4c70630a82edb10672549dd11fecf358df18f225e3f6e13aa5c9d2b0f2488b5db60f176ab2cc99de58e0b8830b0bbeeb4ec62d3c5f2ad92c2c5
TLSH
T143C08C0259CAFA0A190A641726B6C58DC0A25C0E2E80AF10A7598108298145CE4B4709
MD5 SHA1 SHA512 TLSH

Submit Download

tmp58AC.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp58AC.tmp.bat
Size 158B
SHA256 d9d8fd29a6fae6e545f98570d39503aec72e6d9f5a4d4b1dada52ec5b195d35c
MD5 8353210c123b6fea4e19dc5fb29ef433
SHA1 436381060cad533adea49a85ce91ff20f965d243
SHA512 1beb797c5b9648f03d5f0af13d59c2d1606675b8f86447aff0541f91f75b2bd80058badca0846d6918371c62fb932ee3f36390f703209473178fa9e8812f2541
TLSH
T19EC08C0014CEFA0A294A241701B6C58DC0765C5E2E446B2093589418A88146DF4F4305
MD5 SHA1 SHA512 TLSH

Submit Download

tmp6425.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp6425.tmp.bat
Size 158B
SHA256 485903b20943fd0b285e44d4862e081fea3ecfc29b9be1cc4a62bba8da226a23
MD5 63243fde1739ea5071a2341e9449cdce
SHA1 e631072f2bcd570d9aa11e17c5aecbd496449605
SHA512 33d00b2fc4528958e6af11538309778c1fc0b64e5b2db89fe5ba23904ba7b232e689273ff56448c66a6f42e3ddb62c6164bfdacd0037da3d42006358d884c634
TLSH
T189C08C0028CEFB0A290A241B11B6C19EC0625C2A3E456B1093988408288049CE4F8305
MD5 SHA1 SHA512 TLSH

Submit Download

tmp7193.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp7193.tmp.bat
Size 158B
SHA256 a000ad9621c4b98899dd930ad5601cef922aadd64af79fa6943098fc99bdb03e
MD5 717bdc3e66a2eaa6f337e4ae60cc150e
SHA1 ea4e1160a708eae181ed978a4cc3efbcf850966b
SHA512 a50c27c136ab073468113997f9d7637a84c8f946abcaa5f55b8fd6c2f10cd964d27dbd8e887f37c271e5c882d0f5310b09e45d339832c0a0c5ff6ed61e569077
TLSH
T1ACC08C0114CAFA0A190A642702B6C18DD0A26C0E3F406B2097988608298046CF8B4305
MD5 SHA1 SHA512 TLSH

Submit Download

XClient.exe

Path C:\Users\Admin\AppData\Roaming\XClient.exe
Size 81KB
SHA256 661a9e70489e80ee8fe41d184c5969d7d900149d56f8df1c949d6fedfa3c52ed
MD5 bfc9736c8ed84ba2574ffe0a9d50b3bd
SHA1 b321409a6539375ad3416d6d35bc6021da4921d3
SHA512 42479e347181183a711ea7b178ae0f9471171d15f7a6209c044a5c71503187f7571585ac60175ad4073907f0d6ae6b25dfec353ad84f691dd5215191415f8e24
SSDEEP 1536:1mM/+76kM2hV3GdHfaa3XjhNztdYLjh79b74WCaDUackgOitOKt7L0g3SG/:dS6kthJG9RThdgjPb7d3Aac0OOKtL0K/
TLSH
T140837C2C37E94425E1FFEFB05DE57153CA39F7222803959F24D6028A1B27A88CD516FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-120-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/404-119-0x000001C72D3C0000-0x000001C72D3EB000-memory.dmp

Download

memory/608-104-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/608-102-0x000001C8A0060000-0x000001C8A0085000-memory.dmp

Download

memory/608-103-0x000001C8A0090000-0x000001C8A00BB000-memory.dmp

Download

memory/684-108-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/684-107-0x00000224F96B0000-0x00000224F96DB000-memory.dmp

Download

memory/876-124-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/876-123-0x0000023FA5F60000-0x0000023FA5F8B000-memory.dmp

Download

memory/884-112-0x0000025564A10000-0x0000025564A3B000-memory.dmp

Download

memory/884-113-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/944-136-0x000001BE00B40000-0x000001BE00B6B000-memory.dmp

Download

memory/944-137-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1016-115-0x0000024A78640000-0x0000024A7866B000-memory.dmp

Download

memory/1016-116-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1060-140-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1060-139-0x000002F34DB00000-0x000002F34DB2B000-memory.dmp

Download

memory/1108-143-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1108-142-0x0000029FFD780000-0x0000029FFD7AB000-memory.dmp

Download

memory/1156-130-0x000002A453890000-0x000002A4538BB000-memory.dmp

Download

memory/1156-131-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1232-146-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1232-145-0x000001DB33F70000-0x000001DB33F9B000-memory.dmp

Download

memory/1316-201-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1316-200-0x0000019CEA3D0000-0x0000019CEA3FB000-memory.dmp

Download

memory/1348-204-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1348-203-0x0000019768660000-0x000001976868B000-memory.dmp

Download

memory/1372-148-0x00000260CDB60000-0x00000260CDB8B000-memory.dmp

Download

memory/1372-149-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1392-206-0x0000017290B30000-0x0000017290B5B000-memory.dmp

Download

memory/1392-207-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1440-429-0x00000000017A0000-0x00000000017E2000-memory.dmp

Download

memory/1480-151-0x00000137313B0000-0x00000137313DB000-memory.dmp

Download

memory/1480-152-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1492-158-0x000001F49E9B0000-0x000001F49E9DB000-memory.dmp

Download

memory/1492-159-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1528-161-0x000001EDDBD90000-0x000001EDDBDBB000-memory.dmp

Download

memory/1528-162-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1560-165-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1560-164-0x000002087B4B0000-0x000002087B4DB000-memory.dmp

Download

memory/1692-168-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1692-167-0x000002318D0D0000-0x000002318D0FB000-memory.dmp

Download

memory/1728-173-0x0000027110690000-0x00000271106BB000-memory.dmp

Download

memory/1728-174-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1776-176-0x0000024384DA0000-0x0000024384DCB000-memory.dmp

Download

memory/1776-177-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1800-180-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1800-179-0x000002B8DD750000-0x000002B8DD77B000-memory.dmp

Download

memory/1872-191-0x000001A1C0290000-0x000001A1C02BB000-memory.dmp

Download

memory/1872-192-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/1908-194-0x0000024551D60000-0x0000024551D8B000-memory.dmp

Download

memory/1908-195-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/2000-197-0x0000018012370000-0x000001801239B000-memory.dmp

Download

memory/2000-198-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/2064-210-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/2064-209-0x000002A845BC0000-0x000002A845BEB000-memory.dmp

Download

memory/2148-213-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/2148-212-0x000001FB9B360000-0x000001FB9B38B000-memory.dmp

Download

memory/2164-499-0x0000000000EF0000-0x0000000000F7C000-memory.dmp

Download

memory/2192-215-0x0000000000E70000-0x0000000000E9B000-memory.dmp

Download

memory/2192-216-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/2228-5-0x000000001B4E0000-0x000000001B4F0000-memory.dmp

Download

memory/2228-9-0x000000001B4E0000-0x000000001B4F0000-memory.dmp

Download

memory/2228-0-0x0000000000670000-0x000000000068A000-memory.dmp

Download

memory/2352-226-0x00007FFD616B0000-0x00007FFD616C0000-memory.dmp

Download

memory/2352-225-0x00000223749B0000-0x00000223749DB000-memory.dmp

Download

memory/2444-228-0x000001B79B500000-0x000001B79B52B000-memory.dmp

Download

memory/3596-29-0x0000000000020000-0x00000000000AC000-memory.dmp

Download

memory/3596-30-0x0000000002230000-0x0000000002272000-memory.dmp

Download

memory/3744-89-0x0000000000AD0000-0x0000000000B12000-memory.dmp

Download

memory/3940-87-0x00007FFDA1630000-0x00007FFDA1828000-memory.dmp

Download

memory/3940-88-0x00007FFD9F7B0000-0x00007FFD9F86D000-memory.dmp

Download

memory/4176-91-0x0000000000370000-0x0000000000386000-memory.dmp

Download

memory/4768-93-0x0000000000D90000-0x0000000000DA6000-memory.dmp

Download

memory/4768-94-0x0000000005B00000-0x0000000005B92000-memory.dmp

Download

memory/5076-552-0x00000000008D0000-0x00000000008EA000-memory.dmp

Download