xworm | ef5945a33a45fb59f4a1bfaecda7cbef60b5db36f86809f6a4330cebbaac6107

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-02-2024 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CatrinePerm/CatrinePerm.exe
Size

401KB
MD5

9507155d937399149aa9078a3e87a155
SHA1

fc849d158401ef8c2c70589d7d96d82c061e171e
SHA256

b8966ebd8b18c419d14cc7586009c2ab1bf1a08a438d49058bea5bd076fb8a34
SHA512

f11ac8157a7a3e52f957f6fd444c0fdaad89295890d8474576e1af93ece65e804a019cde8ce4c2c7bb610debc6c252ae604f87419dc32f994574d1171fdca42b
SSDEEP

6144:ADxYwup0zGAc6Y4PWGFrzaN1tM06g51Ejxm7brM0Nfm2Wm5geB5MNXHHHHHHHRHr:AdYr4Gj6OGkpsoM4fm2WmOI5fa/

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

78.69.106.17:8000

Attributes

Install_directory
%ProgramData%
install_file
Winrar.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\winrar.exe	family_xworm
behavioral4/memory/208-25-0x00000000002D0000-0x0000000000314000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Winrar.exeCatrinePerm.exewinrar.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	Winrar.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	CatrinePerm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	winrar.exe

Drops startup file 3 IoCs

Processes:

winrar.exeWinrar.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Winrar.lnk	winrar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Winrar.lnk	winrar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Winrar.lnk	Winrar.exe

Executes dropped EXE 4 IoCs

Processes:

CatrinePerm.exewinrar.exeWinrar.exeWinrar.exe

pid process

320 CatrinePerm.exe
208 winrar.exe
764 Winrar.exe
528 Winrar.exe

pid	process
320	CatrinePerm.exe
208	winrar.exe
764	Winrar.exe
528	Winrar.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Winrar.exewinrar.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winrar = "C:\\ProgramData\\Winrar.exe"	Winrar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winrar = "C:\\ProgramData\\Winrar.exe"	winrar.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com
63 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3720 schtasks.exe
3232 schtasks.exe

flow	ioc
15	ip-api.com
63	ip-api.com

pid	process
3720	schtasks.exe
3232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exewinrar.exepowershell.exepowershell.exepowershell.exepowershell.exeWinrar.exe

pid	process
4616	powershell.exe
4616	powershell.exe
2648	powershell.exe
2648	powershell.exe
5076	powershell.exe
5076	powershell.exe
1596	powershell.exe
1596	powershell.exe
208	winrar.exe
3660	powershell.exe
3660	powershell.exe
4900	powershell.exe
4900	powershell.exe
4932	powershell.exe
4932	powershell.exe
2436	powershell.exe
2436	powershell.exe
528	Winrar.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

winrar.exepowershell.exepowershell.exepowershell.exepowershell.exeWinrar.exeWinrar.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	208	winrar.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	208	winrar.exe
Token: SeDebugPrivilege	764	Winrar.exe
Token: SeDebugPrivilege	528	Winrar.exe
Token: SeDebugPrivilege	3660	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	528	Winrar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

winrar.exeWinrar.exe

pid process

208 winrar.exe
528 Winrar.exe

pid	process
208	winrar.exe
528	Winrar.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

CatrinePerm.exewinrar.exeWinrar.exe

description	pid	process	target process
PID 2436 wrote to memory of 320	2436	CatrinePerm.exe	CatrinePerm.exe
PID 2436 wrote to memory of 320	2436	CatrinePerm.exe	CatrinePerm.exe
PID 2436 wrote to memory of 208	2436	CatrinePerm.exe	winrar.exe
PID 2436 wrote to memory of 208	2436	CatrinePerm.exe	winrar.exe
PID 208 wrote to memory of 4616	208	winrar.exe	powershell.exe
PID 208 wrote to memory of 4616	208	winrar.exe	powershell.exe
PID 208 wrote to memory of 2648	208	winrar.exe	powershell.exe
PID 208 wrote to memory of 2648	208	winrar.exe	powershell.exe
PID 208 wrote to memory of 5076	208	winrar.exe	powershell.exe
PID 208 wrote to memory of 5076	208	winrar.exe	powershell.exe
PID 208 wrote to memory of 1596	208	winrar.exe	powershell.exe
PID 208 wrote to memory of 1596	208	winrar.exe	powershell.exe
PID 208 wrote to memory of 3720	208	winrar.exe	schtasks.exe
PID 208 wrote to memory of 3720	208	winrar.exe	schtasks.exe
PID 528 wrote to memory of 3660	528	Winrar.exe	powershell.exe
PID 528 wrote to memory of 3660	528	Winrar.exe	powershell.exe
PID 528 wrote to memory of 4900	528	Winrar.exe	powershell.exe
PID 528 wrote to memory of 4900	528	Winrar.exe	powershell.exe
PID 528 wrote to memory of 4932	528	Winrar.exe	powershell.exe
PID 528 wrote to memory of 4932	528	Winrar.exe	powershell.exe
PID 528 wrote to memory of 2436	528	Winrar.exe	powershell.exe
PID 528 wrote to memory of 2436	528	Winrar.exe	powershell.exe
PID 528 wrote to memory of 3232	528	Winrar.exe	schtasks.exe
PID 528 wrote to memory of 3232	528	Winrar.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\CatrinePerm\CatrinePerm.exe
"C:\Users\Admin\AppData\Local\Temp\CatrinePerm\CatrinePerm.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2436

C:\Users\Admin\AppData\Roaming\CatrinePerm.exe
"C:\Users\Admin\AppData\Roaming\CatrinePerm.exe"
2⤵
- Executes dropped EXE
PID:320

C:\Users\Admin\AppData\Roaming\winrar.exe
"C:\Users\Admin\AppData\Roaming\winrar.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:208

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\winrar.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winrar.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Winrar.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Winrar.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Winrar" /tr "C:\ProgramData\Winrar.exe"
3⤵
- Creates scheduled task(s)
PID:3720

C:\ProgramData\Winrar.exe
C:\ProgramData\Winrar.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\ProgramData\Winrar.exe
C:\ProgramData\Winrar.exe
1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Winrar.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Winrar.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Winrar.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Winrar.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Winrar" /tr "C:\ProgramData\Winrar.exe"
2⤵
- Creates scheduled task(s)
PID:3232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
440cb38dbee06645cc8b74d51f6e5f71

SHA1
d7e61da91dc4502e9ae83281b88c1e48584edb7c

SHA256
8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

SHA512
3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winrar.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3072fa0040b347c3941144486bf30c6f

SHA1
e6dc84a5bd882198583653592f17af1bf8cbfc68

SHA256
da8b533f81b342503c109e46b081b5c5296fdad5481f93fe5cc648e49ca6238e

SHA512
62df0eed621fe8ec340887a03d26b125429025c14ddcdfef82cb78ce1c9c6110c1d51ff0e423754d7966b6251363bf92833970eaf67707f8dd62e1549a79536c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22310ad6749d8cc38284aa616efcd100

SHA1
440ef4a0a53bfa7c83fe84326a1dff4326dcb515

SHA256
55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

SHA512
2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
10890cda4b6eab618e926c4118ab0647

SHA1
1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

SHA256
00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

SHA512
a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e6b9e03dcde217fc7d1692b3d65233d7

SHA1
67367ef59dbc1661ff29d6fe5ce3ed3d39678044

SHA256
790c142b39325b5bcf07c2d7b8afb8fb3b6f8c1e99a39ce5870b2ef043d8cfdd

SHA512
8f34d037a97f1131ff9863c10ff7cf7f029c2973c5f32fcee1751cd47a5b7cfc3bf5b6c30ada08f3793918e600d4a45f8cb8d22502b693c6a9aeba9d0d504410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3f3e838696dd86d3d78a46594a0074c4

SHA1
8cfc908ecf0162910fa4eb759a367ee9d9ff33df

SHA256
9b49d3d3083df8da0c7d9f8e2a433efd4bb45e49ef94bf6163267b5921c8504e

SHA512
86a8d4d6505203e2a3311f9fc17ec1482c2803a88d69dc869c0942a66a0b67f26890fe2388bf965c377e2422cf1b3d89ba3c0d2a828fdce6c6217404f3813585

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d8cb3e9459807e35f02130fad3f9860d

SHA1
5af7f32cb8a30e850892b15e9164030a041f4bd6

SHA256
2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68

SHA512
045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ttuphgip.nvy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\CatrinePerm.exe

Filesize
139KB

MD5
10605ec186aacb6a4b3dde419cb0b5e5

SHA1
9c41040a4c238dec28c4f47bfb0a28a3cd4bf19d

SHA256
ca5b3ebffc2080fec7d44655069190b892e51e4bc4401c31f64a5a70d46f1ead

SHA512
1d48bbc5c965f098300ce5404269ea5b1694887531b9aa1e953755f631325946e4914405ae3cabfe13d222ddfde4b0368d446b9aad3956f345d6b142d6579a9d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Winrar.lnk

Filesize
665B

MD5
29502798d0cf25d72f01b35b5947ace3

SHA1
6aa4d401dd4da455addbe0e95e8244a4972db5d6

SHA256
75243350ffeec2f39d9c9657ec5cd688d447f5b5d41b8587e89dee9e5232e7d3

SHA512
1acb9c231acf2195d9fb765257f2b005de1a837b4fb15f2c7ad2d5d6801a1bff06a8bcdb69f671a2f805aa7c1f24885995211572072134a3012abef5bd9b5e23

Download Submit
C:\Users\Admin\AppData\Roaming\winrar.exe

Filesize
251KB

MD5
e10be4048c01cbdb578d684b1137cbd9

SHA1
e1848070b2840559524572f735f4df8e8fd2205d

SHA256
ae3e0d672c98c2c7afa877acd2e35b5867ae289eae42c28a909b3f5702108ea8

SHA512
22ef316c6989248c70e45611ccc9532e0ac687b6889657f9ad48627594fa4b10de6ad38132a9901ab96e1b832273f74a82181c949fd12fd0c8ac1b7de02488d5

Download Submit
memory/208-102-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/208-94-0x00000000022C0000-0x00000000022D0000-memory.dmp

Filesize
64KB

Download
memory/208-93-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/208-28-0x00000000022C0000-0x00000000022D0000-memory.dmp

Filesize
64KB

Download
memory/208-25-0x00000000002D0000-0x0000000000314000-memory.dmp

Filesize
272KB

Download
memory/208-26-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/528-161-0x000000001AE90000-0x000000001AEA0000-memory.dmp

Filesize
64KB

Download
memory/528-172-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/528-149-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/528-104-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/528-105-0x000000001AE90000-0x000000001AEA0000-memory.dmp

Filesize
64KB

Download
memory/764-97-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/764-99-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/1596-76-0x000001D83AAE0000-0x000001D83AAF0000-memory.dmp

Filesize
64KB

Download
memory/1596-75-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/1596-88-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2436-160-0x000001FC35BE0000-0x000001FC35BF0000-memory.dmp

Filesize
64KB

Download
memory/2436-0-0x0000000000270000-0x00000000002DA000-memory.dmp

Filesize
424KB

Download
memory/2436-159-0x000001FC35BE0000-0x000001FC35BF0000-memory.dmp

Filesize
64KB

Download
memory/2436-158-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2436-168-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2436-27-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2436-2-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2648-51-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2648-60-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2648-56-0x000001462FCF0000-0x000001462FD00000-memory.dmp

Filesize
64KB

Download
memory/2648-57-0x000001462FCF0000-0x000001462FD00000-memory.dmp

Filesize
64KB

Download
memory/3660-112-0x0000017AE4780000-0x0000017AE4790000-memory.dmp

Filesize
64KB

Download
memory/3660-118-0x0000017AE4780000-0x0000017AE4790000-memory.dmp

Filesize
64KB

Download
memory/3660-120-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/3660-111-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-29-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/4616-31-0x000002186FC20000-0x000002186FC30000-memory.dmp

Filesize
64KB

Download
memory/4616-37-0x00000218722E0000-0x0000021872302000-memory.dmp

Filesize
136KB

Download
memory/4616-30-0x000002186FC20000-0x000002186FC30000-memory.dmp

Filesize
64KB

Download
memory/4616-44-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/4900-137-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/4900-135-0x0000024E9B600000-0x0000024E9B610000-memory.dmp

Filesize
64KB

Download
memory/4900-129-0x0000024E9B600000-0x0000024E9B610000-memory.dmp

Filesize
64KB

Download
memory/4900-125-0x0000024E9B600000-0x0000024E9B610000-memory.dmp

Filesize
64KB

Download
memory/4900-122-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/4932-150-0x00000173B4A80000-0x00000173B4A90000-memory.dmp

Filesize
64KB

Download
memory/4932-152-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/4932-143-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/5076-62-0x0000024ACBE70000-0x0000024ACBE80000-memory.dmp

Filesize
64KB

Download
memory/5076-61-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download
memory/5076-74-0x00007FFE65500000-0x00007FFE65FC1000-memory.dmp

Filesize
10.8MB

Download