xworm | a6b094f9c1be8409f686ea2dd3570332dfce0baa0c79025d9ed23aaf2dd06637

Analysis

max time kernel
125s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
23.exe
Size 231KB
Sample261102-c692ws119p
SHA256 a6b094f9c1be8409f686ea2dd3570332dfce0baa0c79025d9ed23aaf2dd06637
MD5 ab5d8b184ffe6a04f1d1ae4fe9fc9991
SHA1 320f777ffde0328467d7638bcca1a6951246eaf7
SHA512 6ad726c5df74be17d206e80527d28dee0c9bc45042a353f8846cd2bf91c66c436f6fdf5126e2d7a6851129771441387f5476f4ff5c8e44a1d7dc330d38aca8a3
SSDEEP 3072:Hd9K4jFE9jTOjUILD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQigj:HrE9Q/5bTgVziHzZnSKrCbYME4b/8tq
TLSH
T109343A66F6A000F6D4BA82758D636B02B7B2F0361721DBEF0B94495D7F637E04D29B90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

23.tcp.cpolar.top:10264

Attributes

install_file
Mason.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2052-0-0x00000272295B0000-0x00000272295F0000-memory.dmp	family_xworm
behavioral2/memory/2052-327-0x0000027243DB0000-0x0000027243DBE000-memory.dmp	family_xworm

Executes dropped EXE 1 IoCs

pid	Process
4676	ebmdrojv.h1i.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Mason23.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	23.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	23.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	23.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1793587382"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={927C4001-2B3F-442C-B364-013F3D31ABE2}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 30 Oct 2026 22:03:35 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2524	SCHTASKS.exe
524	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe
4676	ebmdrojv.h1i.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1548	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	23.exe
Token: SeDebugPrivilege	4676	ebmdrojv.h1i.exe
Token: SeShutdownPrivilege	1548	explorer.exe
Token: SeCreatePagefilePrivilege	1548	explorer.exe
Token: SeShutdownPrivilege	1548	explorer.exe
Token: SeCreatePagefilePrivilege	1548	explorer.exe
Token: SeShutdownPrivilege	1548	explorer.exe
Token: SeCreatePagefilePrivilege	1548	explorer.exe
Token: SeShutdownPrivilege	1548	explorer.exe
Token: SeCreatePagefilePrivilege	1548	explorer.exe
Token: SeShutdownPrivilege	1548	explorer.exe
Token: SeCreatePagefilePrivilege	1548	explorer.exe
Token: SeShutdownPrivilege	1548	explorer.exe
Token: SeCreatePagefilePrivilege	1548	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	3676	svchost.exe
Token: SeIncreaseQuotaPrivilege	3676	svchost.exe
Token: SeSecurityPrivilege	3676	svchost.exe
Token: SeTakeOwnershipPrivilege	3676	svchost.exe
Token: SeLoadDriverPrivilege	3676	svchost.exe
Token: SeSystemtimePrivilege	3676	svchost.exe
Token: SeBackupPrivilege	3676	svchost.exe
Token: SeRestorePrivilege	3676	svchost.exe
Token: SeShutdownPrivilege	3676	svchost.exe
Token: SeSystemEnvironmentPrivilege	3676	svchost.exe
Token: SeUndockPrivilege	3676	svchost.exe
Token: SeManageVolumePrivilege	3676	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3676	svchost.exe
Token: SeIncreaseQuotaPrivilege	3676	svchost.exe
Token: SeSecurityPrivilege	3676	svchost.exe
Token: SeTakeOwnershipPrivilege	3676	svchost.exe
Token: SeLoadDriverPrivilege	3676	svchost.exe
Token: SeSystemtimePrivilege	3676	svchost.exe
Token: SeBackupPrivilege	3676	svchost.exe
Token: SeRestorePrivilege	3676	svchost.exe
Token: SeShutdownPrivilege	3676	svchost.exe
Token: SeSystemEnvironmentPrivilege	3676	svchost.exe
Token: SeUndockPrivilege	3676	svchost.exe
Token: SeManageVolumePrivilege	3676	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3676	svchost.exe
Token: SeIncreaseQuotaPrivilege	3676	svchost.exe
Token: SeSecurityPrivilege	3676	svchost.exe
Token: SeTakeOwnershipPrivilege	3676	svchost.exe
Token: SeLoadDriverPrivilege	3676	svchost.exe
Token: SeSystemtimePrivilege	3676	svchost.exe
Token: SeBackupPrivilege	3676	svchost.exe
Token: SeRestorePrivilege	3676	svchost.exe
Token: SeShutdownPrivilege	3676	svchost.exe
Token: SeSystemEnvironmentPrivilege	3676	svchost.exe
Token: SeUndockPrivilege	3676	svchost.exe
Token: SeManageVolumePrivilege	3676	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3676	svchost.exe
Token: SeIncreaseQuotaPrivilege	3676	svchost.exe
Token: SeSecurityPrivilege	3676	svchost.exe
Token: SeTakeOwnershipPrivilege	3676	svchost.exe
Token: SeLoadDriverPrivilege	3676	svchost.exe
Token: SeSystemtimePrivilege	3676	svchost.exe
Token: SeBackupPrivilege	3676	svchost.exe
Token: SeRestorePrivilege	3676	svchost.exe
Token: SeShutdownPrivilege	3676	svchost.exe
Token: SeSystemEnvironmentPrivilege	3676	svchost.exe
Token: SeUndockPrivilege	3676	svchost.exe
Token: SeManageVolumePrivilege	3676	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3676	svchost.exe
Token: SeIncreaseQuotaPrivilege	3676	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4920	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 4676	2052	23.exe	89
PID 2052 wrote to memory of 2524	2052	23.exe	90
PID 4676 wrote to memory of 748	4676	ebmdrojv.h1i.exe	5
PID 4676 wrote to memory of 968	4676	ebmdrojv.h1i.exe	9
PID 4676 wrote to memory of 976	4676	ebmdrojv.h1i.exe	10
PID 4676 wrote to memory of 984	4676	ebmdrojv.h1i.exe	11
PID 4676 wrote to memory of 1040	4676	ebmdrojv.h1i.exe	13
PID 4676 wrote to memory of 1156	4676	ebmdrojv.h1i.exe	14
PID 4676 wrote to memory of 1176	4676	ebmdrojv.h1i.exe	15
PID 4676 wrote to memory of 1252	4676	ebmdrojv.h1i.exe	16
PID 4676 wrote to memory of 1308	4676	ebmdrojv.h1i.exe	17
PID 4676 wrote to memory of 1348	4676	ebmdrojv.h1i.exe	18
PID 4676 wrote to memory of 1384	4676	ebmdrojv.h1i.exe	19
PID 4676 wrote to memory of 1528	4676	ebmdrojv.h1i.exe	22
PID 4676 wrote to memory of 1572	4676	ebmdrojv.h1i.exe	23
PID 4676 wrote to memory of 1640	4676	ebmdrojv.h1i.exe	24
PID 4676 wrote to memory of 1656	4676	ebmdrojv.h1i.exe	25
PID 4676 wrote to memory of 1724	4676	ebmdrojv.h1i.exe	26
PID 4676 wrote to memory of 1876	4676	ebmdrojv.h1i.exe	27
PID 4676 wrote to memory of 1976	4676	ebmdrojv.h1i.exe	28
PID 4676 wrote to memory of 1444	4676	ebmdrojv.h1i.exe	29
PID 4676 wrote to memory of 1716	4676	ebmdrojv.h1i.exe	30
PID 4676 wrote to memory of 2056	4676	ebmdrojv.h1i.exe	31
PID 4676 wrote to memory of 2088	4676	ebmdrojv.h1i.exe	32
PID 4676 wrote to memory of 2208	4676	ebmdrojv.h1i.exe	33
PID 4676 wrote to memory of 2284	4676	ebmdrojv.h1i.exe	34
PID 4676 wrote to memory of 2336	4676	ebmdrojv.h1i.exe	35
PID 4676 wrote to memory of 2444	4676	ebmdrojv.h1i.exe	36
PID 4676 wrote to memory of 2556	4676	ebmdrojv.h1i.exe	37
PID 4676 wrote to memory of 2564	4676	ebmdrojv.h1i.exe	38
PID 4676 wrote to memory of 2696	4676	ebmdrojv.h1i.exe	39
PID 4676 wrote to memory of 2712	4676	ebmdrojv.h1i.exe	40
PID 4676 wrote to memory of 2772	4676	ebmdrojv.h1i.exe	41
PID 4676 wrote to memory of 2812	4676	ebmdrojv.h1i.exe	42
PID 4676 wrote to memory of 2940	4676	ebmdrojv.h1i.exe	43
PID 4676 wrote to memory of 2268	4676	ebmdrojv.h1i.exe	44
PID 4676 wrote to memory of 3124	4676	ebmdrojv.h1i.exe	46
PID 4676 wrote to memory of 3168	4676	ebmdrojv.h1i.exe	47
PID 4676 wrote to memory of 3256	4676	ebmdrojv.h1i.exe	48
PID 4676 wrote to memory of 3484	4676	ebmdrojv.h1i.exe	50
PID 4676 wrote to memory of 3580	4676	ebmdrojv.h1i.exe	51
PID 4676 wrote to memory of 3596	4676	ebmdrojv.h1i.exe	52
PID 4676 wrote to memory of 3648	4676	ebmdrojv.h1i.exe	53
PID 4676 wrote to memory of 3676	4676	ebmdrojv.h1i.exe	54
PID 4676 wrote to memory of 3684	4676	ebmdrojv.h1i.exe	55
PID 4676 wrote to memory of 3700	4676	ebmdrojv.h1i.exe	56
PID 4676 wrote to memory of 3644	4676	ebmdrojv.h1i.exe	57
PID 4676 wrote to memory of 1264	4676	ebmdrojv.h1i.exe	58
PID 4676 wrote to memory of 4408	4676	ebmdrojv.h1i.exe	59
PID 4676 wrote to memory of 4476	4676	ebmdrojv.h1i.exe	60
PID 4676 wrote to memory of 4516	4676	ebmdrojv.h1i.exe	61
PID 4676 wrote to memory of 4604	4676	ebmdrojv.h1i.exe	62
PID 4676 wrote to memory of 5000	4676	ebmdrojv.h1i.exe	63
PID 4676 wrote to memory of 4940	4676	ebmdrojv.h1i.exe	64
PID 4676 wrote to memory of 5192	4676	ebmdrojv.h1i.exe	65
PID 4676 wrote to memory of 5256	4676	ebmdrojv.h1i.exe	66
PID 4676 wrote to memory of 5296	4676	ebmdrojv.h1i.exe	67
PID 4676 wrote to memory of 5552	4676	ebmdrojv.h1i.exe	70
PID 4676 wrote to memory of 1696	4676	ebmdrojv.h1i.exe	73
PID 4676 wrote to memory of 5384	4676	ebmdrojv.h1i.exe	74
PID 4676 wrote to memory of 1908	4676	ebmdrojv.h1i.exe	75
PID 4676 wrote to memory of 1404	4676	ebmdrojv.h1i.exe	78
PID 4676 wrote to memory of 3036	4676	ebmdrojv.h1i.exe	79
PID 4676 wrote to memory of 5544	4676	ebmdrojv.h1i.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:748
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:968
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1176

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:976

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-904062e5-5f34-4544-984b-4c3794ab0445 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f9668d5a-6406-42ea-b11e-92ad55825bdd -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-bf025aa1-3cad-4572-b402-7bf741ec64a1 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2667bc17-e203-4c7c-8403-4c5773d2b755 -LifetimeId:3ec7e2e3-24fa-44fd-bb7a-28baf0d29771 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1444
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5544
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\23.exe
      "C:\Users\Admin\AppData\Local\Temp\23.exe"
      4⤵
      Enumerates video capture drivers
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\ebmdrojv.h1i.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ebmdrojv.h1i.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4676
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Mason23.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\23.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2524
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5512
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Mason23.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\23.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:524
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2556
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:000000000000026C;0000000000000270;
  2⤵
  PID:4940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2940

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3256

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1264

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4408

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4604

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:5000

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5192

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5256

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1404

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
PID:4896

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4920

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks processor information in registry
PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ebmdrojv.h1i.exe

Path C:\Users\Admin\AppData\Local\Temp\ebmdrojv.h1i.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mason23.exe

Path C:\Windows\System32\Tasks\Mason23.exe
Size 3KB
SHA256 87a74f1b2237bb1dcf313abc833120db544a6eff88c0f60cf57d44206a486566
MD5 6438db53aecbb86d1e9dc6fba4f36ebf
SHA1 44cba0a8b4ad8eb0c399259657358b506adaa1ca
SHA512 f12f1c1b2fddcc1a6d94742dff3d2c2bcfb71d8a2f1f4ea6989e101f153fccbcec9008f9a138c985a437878c75b5b1d81a7a88501c7344b409d249ba1feb571d
TLSH
T1D661554767EE1109F2F7AB2CAEB710228A67BD515939C46D00EC240DCBF3E2285607B7
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 9f3ce94ed6d5e73307fa26b1380d66c7b66a69d8ea6127b4ff94d5fb6fb15f54
MD5 e3716c4ea0bfabf97163fa9c6f9a6b8c
SHA1 e3399ef3310bdcab668bae416d26c91fe295674d
SHA512 6490414bba96163049bfb08343d4d972e2edd393092e9d0dba4be803a89fcab452fb2e2ac138600e5db9c8aca8c8f9b84353ce378385ed2a8cad89b46cd70181
TLSH
T1D8E0C2213BE91101E9331F3CBA7669C20A36F627B900CA8D0B79404C5D38B308D3361A
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 e52c855d66bc4b7850c51e6e81be7bf7e017e743b64740e846ed371bc3b27894
MD5 91964a27a7fceef4f5225c9e90a161b0
SHA1 593a7bc2551b1b9c50bb2a76b4cc4f2a01200a72
SHA512 a38c6a962f7b5bade81dc8361e1741b8569abd9a6c5777aa9dc891ccda040fb62a4508464e72fe96e7f85931be403896431e049bad4d792b3deee689f7bc0cbe
TLSH
T13FE0C01416FB506CF4E8D4348FE5752156AAF0302809F3FC1BD02700A21A540EC11B34
MD5 SHA1 SHA512 TLSH

Submit Download

memory/748-262-0x00000265A10C0000-0x00000265A10EB000-memory.dmp

Download

memory/748-16-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/748-15-0x00000265A10C0000-0x00000265A10EB000-memory.dmp

Download

memory/748-14-0x00000265A1090000-0x00000265A10B5000-memory.dmp

Download

memory/968-25-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/968-263-0x000001835FCF0000-0x000001835FD1B000-memory.dmp

Download

memory/968-21-0x000001835FCF0000-0x000001835FD1B000-memory.dmp

Download

memory/976-264-0x0000026720940000-0x000002672096B000-memory.dmp

Download

memory/976-23-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/976-22-0x0000026720940000-0x000002672096B000-memory.dmp

Download

memory/984-46-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/984-45-0x00000246EE350000-0x00000246EE37B000-memory.dmp

Download

memory/984-267-0x00000246EE350000-0x00000246EE37B000-memory.dmp

Download

memory/1040-268-0x00000210EDFD0000-0x00000210EDFFB000-memory.dmp

Download

memory/1040-49-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1040-48-0x00000210EDFD0000-0x00000210EDFFB000-memory.dmp

Download

memory/1156-269-0x000001F631AF0000-0x000001F631B1B000-memory.dmp

Download

memory/1156-51-0x000001F631AF0000-0x000001F631B1B000-memory.dmp

Download

memory/1156-52-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1176-32-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1176-265-0x0000019680C10000-0x0000019680C3B000-memory.dmp

Download

memory/1176-31-0x0000019680C10000-0x0000019680C3B000-memory.dmp

Download

memory/1252-58-0x000001CCD8110000-0x000001CCD813B000-memory.dmp

Download

memory/1252-270-0x000001CCD8110000-0x000001CCD813B000-memory.dmp

Download

memory/1252-69-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1308-60-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1308-274-0x000001ABA75F0000-0x000001ABA761B000-memory.dmp

Download

memory/1308-59-0x000001ABA75F0000-0x000001ABA761B000-memory.dmp

Download

memory/1348-62-0x00000201738D0000-0x00000201738FB000-memory.dmp

Download

memory/1348-275-0x00000201738D0000-0x00000201738FB000-memory.dmp

Download

memory/1348-63-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1384-66-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1384-276-0x0000027CE8AE0000-0x0000027CE8B0B000-memory.dmp

Download

memory/1384-65-0x0000027CE8AE0000-0x0000027CE8B0B000-memory.dmp

Download

memory/1444-145-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1444-144-0x0000017330910000-0x000001733093B000-memory.dmp

Download

memory/1528-266-0x0000025BCE1E0000-0x0000025BCE20B000-memory.dmp

Download

memory/1528-39-0x0000025BCE1E0000-0x0000025BCE20B000-memory.dmp

Download

memory/1528-40-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1548-122-0x0000000001050000-0x000000000107B000-memory.dmp

Download

memory/1548-123-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1572-133-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1572-298-0x000001B8B5800000-0x000001B8B582B000-memory.dmp

Download

memory/1572-68-0x000001B8B5800000-0x000001B8B582B000-memory.dmp

Download

memory/1640-300-0x000001A01DDE0000-0x000001A01DE0B000-memory.dmp

Download

memory/1640-130-0x000001A01DDE0000-0x000001A01DE0B000-memory.dmp

Download

memory/1640-131-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1656-301-0x000001EBEDFB0000-0x000001EBEDFDB000-memory.dmp

Download

memory/1716-147-0x000001EA2ED60000-0x000001EA2ED8B000-memory.dmp

Download

memory/1716-148-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1724-136-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1724-135-0x00000211EE030000-0x00000211EE05B000-memory.dmp

Download

memory/1876-139-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1876-138-0x0000020A52D90000-0x0000020A52DBB000-memory.dmp

Download

memory/1976-142-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/1976-141-0x000001C7520D0000-0x000001C7520FB000-memory.dmp

Download

memory/2052-2-0x000002722B200000-0x000002722B22C000-memory.dmp

Download

memory/2052-18-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2052-327-0x0000027243DB0000-0x0000027243DBE000-memory.dmp

Download

memory/2052-1-0x00007FFFED53F000-0x00007FFFED540000-memory.dmp

Download

memory/2052-348-0x0000027243DD0000-0x0000027243DE0000-memory.dmp

Download

memory/2052-347-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2052-4-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2052-335-0x0000027243DD0000-0x0000027243DE0000-memory.dmp

Download

memory/2052-346-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp

Download

memory/2052-0-0x00000272295B0000-0x00000272295F0000-memory.dmp

Download

memory/2056-150-0x000001A2C08C0000-0x000001A2C08EB000-memory.dmp

Download

memory/2056-151-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/2088-153-0x00000237A1E80000-0x00000237A1EAB000-memory.dmp

Download

memory/2088-154-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/2208-156-0x000001DD2C5D0000-0x000001DD2C5FB000-memory.dmp

Download

memory/2336-157-0x0000012AE42C0000-0x0000012AE42EB000-memory.dmp

Download

memory/2444-158-0x00000281A1BC0000-0x00000281A1BEB000-memory.dmp

Download

memory/2444-159-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/2556-161-0x0000028B2ED40000-0x0000028B2ED6B000-memory.dmp

Download

memory/2556-162-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/2696-165-0x0000023335CB0000-0x0000023335CDB000-memory.dmp

Download

memory/2712-166-0x00000151E7810000-0x00000151E783B000-memory.dmp

Download

memory/2712-167-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/2772-169-0x0000022005E80000-0x0000022005EAB000-memory.dmp

Download

memory/2812-170-0x0000028FFA950000-0x0000028FFA97B000-memory.dmp

Download

memory/2812-171-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/2940-173-0x00000202C7B50000-0x00000202C7B7B000-memory.dmp

Download

memory/2940-174-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download

memory/3124-176-0x0000017312F80000-0x0000017312FAB000-memory.dmp

Download

memory/4676-13-0x00007FF80FFF0000-0x00007FF8100B7000-memory.dmp

Download

memory/4676-12-0x00007FF810560000-0x00007FF8107C3000-memory.dmp

Download

memory/4940-299-0x00000261C1ED0000-0x00000261C1EFB000-memory.dmp

Download

memory/4940-108-0x00000261C1ED0000-0x00000261C1EFB000-memory.dmp

Download

memory/4940-109-0x00007FF7D06A0000-0x00007FF7D06B0000-memory.dmp

Download