50505aa9a36faa076b8a6894297bc8fed02269938e6592b7b7be7c9c809897dd

Analysis

max time kernel
1799s
max time network
1691s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
20-06-2024 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWorm-v5-Remote-Access-Tool-main/D3DX9_43.dll
Size

2.3MB
MD5

7160fc226391c0b50c85571fa1a546e5
SHA1

2bf450850a522a09e8d1ce0f1e443d86d934f4ad
SHA256

84b900dbd7fa978d6e0caee26fc54f2f61d92c9c75d10b35f00e3e82cd1d67b4
SHA512

dfab0eaab8c40fb80369e150cd36ff2224f3a6baf713044f47182961cd501fe4222007f9a93753ac757f64513c707c68a5cf4ae914e23fecaa4656a68df8349b
SSDEEP

49152:dbCJsk4VlPXA+15Om5wxw9Qsi55K+31BhZ64nW:YIIBnW

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

XWorm V5.6.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\COM Surrogate.lnk	XWorm V5.6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\COM Surrogate.lnk	XWorm V5.6.exe

Executes dropped EXE 28 IoCs

Processes:

COM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM SurrogateCOM Surrogate

pid	process
2600	COM Surrogate
4584	COM Surrogate
900	COM Surrogate
2352	COM Surrogate
3868	COM Surrogate
3604	COM Surrogate
2376	COM Surrogate
1940	COM Surrogate
5044	COM Surrogate
380	COM Surrogate
3748	COM Surrogate
4932	COM Surrogate
2472	COM Surrogate
1648	COM Surrogate
2724	COM Surrogate
1868	COM Surrogate
2764	COM Surrogate
2044	COM Surrogate
4492	COM Surrogate
3368	COM Surrogate
3520	COM Surrogate
3160	COM Surrogate
4812	COM Surrogate
2600	COM Surrogate
5000	COM Surrogate
4724	COM Surrogate
3896	COM Surrogate
912	COM Surrogate

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

XWorm V5.6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Microsoft\Windows\CurrentVersion\Run\COM Surrogate = "C:\\Users\\Public\\COM Surrogate"	XWorm V5.6.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 ip-api.com

flow	ioc
13	ip-api.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133633539510813484"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings chrome.exe
NTFS ADS 1 IoCs

Processes:

chrome.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\XWORM-V5.6-RAT-CRACKED-main.zip:Zone.Identifier chrome.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2084 schtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000_Classes\Local Settings	chrome.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\XWORM-V5.6-RAT-CRACKED-main.zip:Zone.Identifier	chrome.exe

pid	process
2084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

chrome.exeXWorm V5.6.exechrome.exe

pid	process
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
2752	chrome.exe
2752	chrome.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe
3104	XWorm V5.6.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

3688 chrome.exe
3688 chrome.exe
3688 chrome.exe
3688 chrome.exe
3688 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe
Token: SeShutdownPrivilege	3688	chrome.exe
Token: SeCreatePagefilePrivilege	3688	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

Processes:

chrome.exe

pid	process
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe
3688	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid process

3688 chrome.exe
3688 chrome.exe
3688 chrome.exe
3688 chrome.exe
3688 chrome.exe
3688 chrome.exe
3688 chrome.exe
3688 chrome.exe
3688 chrome.exe
3688 chrome.exe
3688 chrome.exe
3688 chrome.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

XWorm V5.6.exe

pid process

3104 XWorm V5.6.exe

pid	process
3104	XWorm V5.6.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3688 wrote to memory of 1580	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 1580	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 3180	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 1532	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 1532	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe
PID 3688 wrote to memory of 2088	3688	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XWorm-v5-Remote-Access-Tool-main\D3DX9_43.dll,#1
1⤵
PID:2616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc586dab58,0x7ffc586dab68,0x7ffc586dab78
2⤵
PID:1580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:2
2⤵
PID:3180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:8
2⤵
PID:1532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:8
2⤵
PID:2088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:1
2⤵
PID:1716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:1
2⤵
PID:244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4180 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:1
2⤵
PID:2892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4204 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:8
2⤵
PID:1388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4416 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:8
2⤵
PID:2264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:8
2⤵
PID:756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4784 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:8
2⤵
PID:3372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:8
2⤵
PID:812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4512 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:1
2⤵
PID:2204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4960 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:1
2⤵
PID:2448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4124 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:8
2⤵
PID:1164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2708 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:8
2⤵
- NTFS ADS
PID:4544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1496 --field-trial-handle=1740,i,3626641728613103415,14824196686308289636,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2752

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1948

C:\Users\Admin\Videos\lol\XWORM-V5.6-RAT-CRACKED-main\XWorm V5.6.exe
"C:\Users\Admin\Videos\lol\XWORM-V5.6-RAT-CRACKED-main\XWorm V5.6.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3104

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "COM Surrogate" /tr "C:\Users\Public\COM Surrogate"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Users\Admin\Videos\lol\XWORM-V5.6-RAT-CRACKED-main\XWorm V5.6.exe
"C:\Users\Admin\Videos\lol\XWORM-V5.6-RAT-CRACKED-main\XWorm V5.6.exe"
1⤵
PID:1904

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:2600

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:4584

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:900

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:2352

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:3868

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:3604

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:2376

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:1940

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:5044

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:380

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:3748

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:4932

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:2472

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:1648

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:2724

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:1868

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:2764

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:2044

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:4492

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:3368

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:3520

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:3160

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:4812

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:2600

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:5000

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:4724

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:3896

C:\Users\Public\COM Surrogate
"C:\Users\Public\COM Surrogate"
1⤵
- Executes dropped EXE
PID:912

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
38afa85aa1870b4a4dca37bdab93004c

SHA1
94a3ddc37883d102bf88118d80826d972ca3d809

SHA256
c6084aa495a329133e1d96e67c587246e24a7e7443e0c7f779fc2f85038063ae

SHA512
18045feed91cdb2cd21a91d11705e11fbdc1f0980cb2ffa03bd375649e3bfa709d35f9e21d2c0497bf49ab0aa48a502ddec331e010f11a9d6dc79195cfddbe64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
d4701ffb9ffbc232e04e36e3d22eb9f9

SHA1
da325fb3e136c8b14e7d6a5e4781ee79ca0c56b0

SHA256
8fee42f0710f3770be4756e29db81f586e0f07480bd1013c87865a10abda3ebf

SHA512
973b623f15b16ab90fde77ccf05808bedbb34339d62c166c9617c8a75aa69dd115104053b39cdf034944adfee70c96495c94de9dd649abe150d05ce0c199dbee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
92af8471b010b178ebc3191eb25d90ad

SHA1
d71f2641bf6184e5d313973ccb4e550e5d92eceb

SHA256
81b388bbf44a5b7dad1fa4470b0f929e84a2a8ca479832251b8aae25eeec2b1c

SHA512
9ce0a220c6b8f9fc50db1c384d7f72bfaa1875690b08438d9865fd5b90fa94dad45eeb1cd2bad5494a0dbf032b876adf8fc3c38883e4d4684b132e8d165ff3dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
02c80c995a40e7f8e7c9c68790d87a55

SHA1
62a845a132afa4d877f7ac51aaf209e4dbff4ca9

SHA256
bf9b61211b97a72714bb843d1919aedf95c57154bc9865763a06b0fe748399a2

SHA512
dd095866d4c8513985d16636de9eba4fbfb7e6e5293a933dbe386023273fec52cd88818d94840da17697fc8bb09b0168cef470b780e05111e94e1edc972d5105

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
2b3aefa88e3d4de84e6f2d734bf0b7a8

SHA1
6f87bdf42d74830096cd11a79109c2457df06392

SHA256
48491f4ebe0dd07263a119d370b384022baabaefde37c33b7ea96e89339f32b3

SHA512
bb99c0aa4819794b844463bcb3af8af28a4b47b9f1f46b2fa38fcfc9e8d9a2b0d978e4b84c5267a68cc2992d520f42dcb24219ff8a29cb3b11724149ab381284

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
e1ac99cbfd5bd380131f6885ad3547e3

SHA1
7fb94677f92e5133ea837548a4beb1313924aae6

SHA256
49c1f28af48751dd95b6b03303b560fa78ed1aa0bcba9a11a44c0b54407d7c0b

SHA512
4b983c54737bc416d4be61bd5b56c25d8bc9e06d403ba8be1b78cd036a43325e993e599b329b6cd5d8204f82eb5b9cb02434843bf83ae1f7b352e12bd683e957

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
4bb6b25ff4b9a6720129ba0a6ff4d662

SHA1
c93b28d2a5f04bf5cb0bd3a4001d3cc99dae3805

SHA256
78965a091efb3c4ae08479d2f1e26025d13939bea0fc5e6c32103af6fe924452

SHA512
21fef9d12142d19d1ec82df398adae33b64562cc39707125dd49be7076acbe97f177a63115206dd7f453b8bc393ed932cddbed9dcd743bb12d21791febd9b92c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
ab37374bbc004a057129f8d2b7458fff

SHA1
5f9f649adce63afd9c5f1cd77b8b9f0649af003d

SHA256
9998bbb5054876e8a5f321c8b520f9c132387a7ca9a522ba2644edccc94658b5

SHA512
9abda2e88e12c33f11a5128bcc8e783154433240966cddf2447cc2dd5978de3784fc8b7eec86f696d256dea29bbee457d61ed0bfb76060f5f53e5679b4fd1f3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
4c0dcb3e9a5b8970cdd3962aee1e7e5a

SHA1
8aadd97e786aec1c3ab63cfd0c9c068142f9b2e3

SHA256
e6ce9c0d1a31546fd4456ffe0b9d7bcd736881581f2f41d0c0bc1d8f1a4d3eff

SHA512
0819e817a8ccc6b716cef73ec113cd5ddcdc3415ab6473de8ad0c14448025f4f229e32d92d318ddfccc4e13ea254875e2f6e27882d3cc9354018e2253cefdf63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
f0fa6308021df48c47cfa6fc9da951f7

SHA1
abb6dbf4d7399b717cb37d2f8b4bda5bace9313e

SHA256
add3fa3d29d203fe18a30a1ee9e3737d876b6d4861eade57aaa947fe41094842

SHA512
811c07389921cf4dc65af164e7c16d17272a5e90234d31e0a26eb1688d8f244ae63972cabe47bd48324a631983a53cd624adf24509cb5afa54b9926c6ae4bcee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
523B

MD5
4e10d474763d5484c44562d5be6bb9c4

SHA1
1fbc7c13dbdda1e9652e013cb25e48be0c953045

SHA256
3de99571bd8577747ba9e4d0235bca4eb65be1c70e08bee01ce9d2d142052165

SHA512
5209bd33fcee2fed0d54088f072489b7981294eb0b08ec112afdbb392c74f699dd6e5aeb9200a1dc546543e7adbdc0b64f249dffd9a17f10a40ee28464e813c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
89d05988a9f10e26e50fefd795d49d3b

SHA1
a445de6406bda8b5a6cb0dd672632070bc1a6c2a

SHA256
4e6ab2b73ac14e50ab2be60c8390a31278d7f05d974d5a4279bac939e56585ed

SHA512
e4e6d406943c7259589233862d1172e1e833e593619b0b97d6c34d797a0fc8faf3b338dcd34b8e0ffc8f763ee8ae57b2ccc7541c1a9556cda5218df6fcea6250

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
c0a9f432824db13927b7796801bdb7fe

SHA1
41ce2ac71a1b810528b683e8f2cc408a3c94c6a3

SHA256
52a6f133c634432b8cfc6dc19b735a9dbbf94b34203d03a651fe5b086fe96b26

SHA512
d8285229148fec5afcc75875d3237ed7024cd500f63b237ac214c99f011c2c4580ed0e49fd4e0af59e909c526b46401d55dba43a43d6d87d04e5369c46399dd8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
8b8168779a54b1ee7aaf95566c266cdb

SHA1
e767a9d5d168ca3bcf8d371b9d53e8e144fc6a09

SHA256
096b7c09adad5f737f520bb6118b9f5031902608ca51a8b49417d5985ea1ade8

SHA512
a4053889a118ac308942250ec09b89c2d7d7ceee1a6751fdc15d694ced154437a6f2367bce1b4c011950009e11a668f600ac74d7faf3e3c0f4f851eb106ea846

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
348806fb93be68adf9dccfcdbc3b0e52

SHA1
d31a4cfa6dc9233aa654aaa3c5253ea9bd912089

SHA256
75a25878fa6fec53464d12a9555e59efa7bcb9449adfdb9f281a024c1c19eb8b

SHA512
f010db6a745d5386ee398c0833794f724a18e789fdcd047494838af46ab67f055bb6a0a4ebffdf6f6013c4f2c75c5e6ada2cb7bae08769eea827b80cf668a9d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
8a7ea9782ad1b3f5e24edb8e74204618

SHA1
a99a0d7d3a6ae19b1dd8e9e4daf0ff9172e7c5d6

SHA256
94d68c1537a7eda35ac29467af488be8aab1240a7bf936ee7d1c41e299cdc4b8

SHA512
28723a370673e64656b0b8ae4129ad9eccfdfb6a3451e6e95522ac9916744e4037aeaed71b3abc2e9cda7a9bdc387a76780f42d632e57086cb46acb81fc87e11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
ea8b6b7df2fa3d694b5929aec07fdb63

SHA1
a66ced1c7683eda987930ff026a5210fb708922b

SHA256
d96d3ea947b003cc5fa99ab5043e63f186552d3039ad970eef3639bc25a1ec8c

SHA512
b8924d80c3b82886debaf594a58215cabedc1a715da23183f82b0da67db77e1a13470a09089beb6024cf374dbf31b6e5cd86cc798613e048ac1cf40a7bb3d817

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
278KB

MD5
cdfdffbad416f6331267c913971a42b7

SHA1
56bcfa69de5c0ba238a40ac7edfb9b7439223c9c

SHA256
1c23500c0df43511590ca2f2af6a2d9cff54b11a698e852d746e55dc859c80aa

SHA512
ce9d57485b2832d630c2079506ae8fda3c4f518bc20f514ddd550bba77e6d83d0210373d8c41688806f882a36cf7da1d520eacd512704501ac424437416ba0c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
92KB

MD5
90fc631f33e1c1041a668278588d40a7

SHA1
c780ba4f04d799dc51749191bedaddcf9c9e0916

SHA256
d83e2b840f4c20eae61d9e989ad5998e3be81259390576070dece891435e1172

SHA512
3bb4116ef66d74c1c350aa7fd5f22e3e9a87b7db545cfc9770a5065d01df6498050d6a750a248a3ad5c63f14d5806fc73de8ddda7ea457465bbc1b10737d18da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58b10b.TMP
Filesize
83KB

MD5
a43ab5c0affcc59f68bb6e21f5d16f91

SHA1
bdbf29a5c0b4d87e22eb59d7180d405024700f22

SHA256
64cae505c26f0847b61a762297a27d3d11b1b6adc1b0751c253deae56621f023

SHA512
7e16a9df670d0ce53d7d40285702b6e52187f9bc14a043ab36717f98cde338808c7ab72f9c3520d6fba1c9306683d8240a8523aa3889207e3aef424c8f29a0a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\COM Surrogate.log
Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\Downloads\XWORM-V5.6-RAT-CRACKED-main.zip.crdownload
Filesize
16.3MB

MD5
8e449118e72361933c00bd134ba5bbd9

SHA1
e1ff9d49d04804779b08f07a6b77a84806f3fbf1

SHA256
03091681dd4b73c8835530a54a592d55bc11fda05653fc00d9697a9a52b9aef9

SHA512
edffa9347cb8ff8f1d18388826037d67ccbd1765d46efd7699bb0b4acd7203cbd07f2bac1b669879059d777d0c35bd66eb4a04f84d55130829d052a49dd28b4a

Download Submit
C:\Users\Admin\Downloads\XWORM-V5.6-RAT-CRACKED-main.zip:Zone.Identifier
Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Public\COM Surrogate
Filesize
476KB

MD5
bf1ccd2d127e4ac0dc4ad6307cd1b62f

SHA1
fc95eb4ec00d3b745fb97f7f8f140cfbe51c23ac

SHA256
b32c1554a1a62e6d4c30bad330e5146016fe11521671536c669b429b895e5a11

SHA512
0b6fcb5596904849c5d1ef7439af2849394a56a5f64d337b85cfe2158c8aff2c2a6db5a03c5464520537ec5a203f4c784db4e47d48dc16efdfe064a0e831a3ce

Download Submit
\??\pipe\crashpad_3688_SCILWWZQCZYGWSMB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3104-334-0x00007FFC53CE0000-0x00007FFC547A2000-memory.dmp

Filesize
10.8MB

Download
memory/3104-378-0x00007FFC53CE0000-0x00007FFC547A2000-memory.dmp

Filesize
10.8MB

Download
memory/3104-333-0x00007FFC53CE3000-0x00007FFC53CE5000-memory.dmp

Filesize
8KB

Download
memory/3104-332-0x0000000000B80000-0x0000000000C00000-memory.dmp

Filesize
512KB

Download