xworm | f3f68266726abc9e9fe6c2e9f2170721343c8359d44b169ebd8818cd60eaad14

Resubmissions

05/03/2024, 13:26

240305-qpl6dsfg8y

04/03/2024, 20:28

240304-y89d2acd8w10

Analysis

max time kernel
299s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XClient.exe
Size 38KB
Sample240304-y89d2acd8w
SHA256 f3f68266726abc9e9fe6c2e9f2170721343c8359d44b169ebd8818cd60eaad14
MD5 9ad04c0709f27858966c2e0052e0f56c
SHA1 20ae7ec2955d70afb4795ee27fa859bd023212df
SHA512 b566eda3d3b43a37a46682a05ae1a8d8341bdceee9df04582c30daa8665f33388e03643b5198ac15461a2907c1e9c3f8b86c478b124249903d83d4d05bb9e03f
SSDEEP 768:93WXQw2ZV1jLfDaBrEvG3GXFyc9Bj06OO/hSDEnlw:93WXCNnaBr7IF39x06OO//lw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

16.ip.gl.ply.gg:52773

Mutex

MYba773WdMHAeUFl

Attributes

Install_directory
%AppData%
install_file
taskhost.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3248-0-0x0000000000A10000-0x0000000000A20000-memory.dmp	family_xworm
behavioral2/files/0x000d000000023242-73.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	XClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	vwkpdd.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskhost.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskhost.lnk	XClient.exe

Executes dropped EXE 9 IoCs

pid	Process
4768	taskhost.exe
3496	vwkpdd.exe
3012	crazyinvers.exe
3788	TEXT.exe
4356	OOPS.exe
4700	taskhost.exe
3172	taskhost.exe
3560	taskhost.exe
2536	taskhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "C:\\Users\\Admin\\AppData\\Roaming\\taskhost.exe"	XClient.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
35	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4568	schtasks.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2996	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1464	powershell.exe
1464	powershell.exe
3460	powershell.exe
3460	powershell.exe
1116	powershell.exe
1116	powershell.exe
3376	powershell.exe
3376	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3248	XClient.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	3248	XClient.exe
Token: SeDebugPrivilege	4768	taskhost.exe
Token: SeDebugPrivilege	3496	vwkpdd.exe
Token: SeDebugPrivilege	4700	taskhost.exe
Token: SeDebugPrivilege	3172	taskhost.exe
Token: SeDebugPrivilege	3560	taskhost.exe
Token: SeDebugPrivilege	2536	taskhost.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 1464	3248	XClient.exe	91
PID 3248 wrote to memory of 1464	3248	XClient.exe	91
PID 3248 wrote to memory of 3460	3248	XClient.exe	94
PID 3248 wrote to memory of 3460	3248	XClient.exe	94
PID 3248 wrote to memory of 1116	3248	XClient.exe	96
PID 3248 wrote to memory of 1116	3248	XClient.exe	96
PID 3248 wrote to memory of 3376	3248	XClient.exe	98
PID 3248 wrote to memory of 3376	3248	XClient.exe	98
PID 3248 wrote to memory of 4568	3248	XClient.exe	100
PID 3248 wrote to memory of 4568	3248	XClient.exe	100
PID 3248 wrote to memory of 3496	3248	XClient.exe	105
PID 3248 wrote to memory of 3496	3248	XClient.exe	105
PID 3496 wrote to memory of 3012	3496	vwkpdd.exe	108
PID 3496 wrote to memory of 3012	3496	vwkpdd.exe	108
PID 3496 wrote to memory of 3012	3496	vwkpdd.exe	108
PID 3496 wrote to memory of 3788	3496	vwkpdd.exe	109
PID 3496 wrote to memory of 3788	3496	vwkpdd.exe	109
PID 3496 wrote to memory of 3788	3496	vwkpdd.exe	109
PID 3496 wrote to memory of 4356	3496	vwkpdd.exe	110
PID 3496 wrote to memory of 4356	3496	vwkpdd.exe	110
PID 3496 wrote to memory of 4356	3496	vwkpdd.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\taskhost.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskhost.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskhost" /tr "C:\Users\Admin\AppData\Roaming\taskhost.exe"
  2⤵
  - Creates scheduled task(s)
  PID:4568
- C:\Users\Admin\AppData\Local\Temp\vwkpdd.exe
  "C:\Users\Admin\AppData\Local\Temp\vwkpdd.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Users\Admin\AppData\Local\Temp\crazyinvers.exe
    "C:\Users\Admin\AppData\Local\Temp\crazyinvers.exe"
    3⤵
    - Executes dropped EXE
    PID:3012
- - C:\Users\Admin\AppData\Local\Temp\TEXT.exe
    "C:\Users\Admin\AppData\Local\Temp\TEXT.exe"
    3⤵
    - Executes dropped EXE
    PID:3788
- - C:\Users\Admin\AppData\Local\Temp\OOPS.exe
    "C:\Users\Admin\AppData\Local\Temp\OOPS.exe"
    3⤵
    - Executes dropped EXE
    PID:4356

C:\Users\Admin\AppData\Roaming\taskhost.exe
C:\Users\Admin\AppData\Roaming\taskhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DIE_4.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2996

C:\Users\Admin\AppData\Roaming\taskhost.exe
C:\Users\Admin\AppData\Roaming\taskhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Users\Admin\AppData\Roaming\taskhost.exe
C:\Users\Admin\AppData\Roaming\taskhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Users\Admin\AppData\Roaming\taskhost.exe
C:\Users\Admin\AppData\Roaming\taskhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Users\Admin\AppData\Roaming\taskhost.exe
C:\Users\Admin\AppData\Roaming\taskhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DIE_5.exe

Path C:\DIE_5.exe
Size 640KB
SHA256 ff6335069b6e140eb47149d847aea80bf7e2b06bd80ae9708aa382efb3ae21ee
MD5 157e39521e47ad1c923a94edd69ad59c
SHA1 0f60bfe50f3744b4a6653e5a85af4d3ec0991927
SHA512 8a8f52b7cb06a2c78e980c75c794a64bd67e085ed52478e9f1aa734493f3e074b1f810eaff4760120b6c1a8d69a866e00fd43d414b8c85d1cc5117b6052db6c3
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

taskhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhost.exe.log
Size 654B
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2987e99ec7fa17bd4ab7de3cb4dc62645e1052012a5a357904d6fc6db9054147
MD5 50d3033f2bc3a3774c469d03e71a79a9
SHA1 22027b1d52085de99b3bffa276530fea5d961471
SHA512 ecf7ab1a9e4192454a3e24c60453fd702a8c648e00078fc933b9182f4a3d3c10c6f5da622a5729b35727e6ddc8837029caddcaf76f56e805b9744253b56da5d8
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 d02e76fb112f578e455d6eb4fef7904cc1b318f4c554441eac5b68a62ae58bc4
MD5 f32267ac1ddb28dbda52672355628ad4
SHA1 17a84af001f273234d147572f9301c69e3078465
SHA512 a4a05c51b08f252c809daf6dab355fa5e1cecb4236e36eea2837dad78c6705c6b55ba11d433fc197dcb3f3813bcde6b1a4c5d17be414b6462a70564d448a0f81
MD5 SHA1 SHA512

Submit Download

OOPS.exe

Path C:\Users\Admin\AppData\Local\Temp\OOPS.exe
Size 5KB
SHA256 40293703c2c00b2c9ccb6d28933756c995186ceefb786ea7aa504b5f89ac920d
MD5 49e0053a11bde52c2d56d4d3cf7dff55
SHA1 60951255f5cfde5eb5241fb4678226eb9361ac55
SHA512 1f00a00639f7a4714497372f1d685a2fd747b9577220c39f98a35b9a5f63fcb825f7ca1e9bbff745e79c090fa3e3216edf62cd5c3cf5ac89b50e214fe1830be7
SSDEEP 48:6kaoFKaOIxOxkDHZpf2Kf6NM4QEQNbHsTwTEV1cb48lCt+7l0HmfFypfbNtm:elexOWlpuJQEQDQV1c8QCFzNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

TEXT.exe

Path C:\Users\Admin\AppData\Local\Temp\TEXT.exe
Size 5KB
SHA256 cda81c2a0f08bfd2bcf6c11a126bcc28c1286a6fdc1368a6f1df9f09b44812d2
MD5 eac0f63b273b4710b994e552f29de354
SHA1 8705f0a75405eca6fbab21b19e5b19ac0c12aaff
SHA512 f16b0f64e79f33e86fa6eda92d0596a15df9679c6592bf9a8a320a5bb6c13ceb8db4a3237e96947dce8c783e92c9ed04b48dc262de0f9b616d2b55aee52216e6
SSDEEP 48:6jaPn61h4Z62PvagIQkosmya7i6xf6NMeKEnhFKFvBb/VhtbRCt+Nln+FTmpFypu:lWW6eagOmyaW6rE76/Vht3wVzNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_s5pnpxyk.chy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s5pnpxyk.chy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

crazyinvers.exe

Path C:\Users\Admin\AppData\Local\Temp\crazyinvers.exe
Size 2.3MB
SHA256 47f0e9a90d45b193e81d3e60b7a43e5a4550a07a3dd1f7c98110fde12265d999
MD5 a44458813e819777013eb3e644d74362
SHA1 2dd0616ca78e22464cf0cf68ef7915358a16f9ee
SHA512 1a4723a36f55cf696f33a7927571bda403e81ced32fda85c7cf25c8458897fb187e46bf5f80c26542725a9a7e5aa0e961fd3f3b110ae8f54b3b96b3e5dfc8215
SSDEEP 49152:t3Qe5ZlQ0WORqQ6BbXNYD8fOVk9hVzestkkWi5sWTnE:tJ320WORRqNYD8fOVk9hVzestkk15sWw
MD5 SHA1 SHA512 SSDEEP

Submit Download

vwkpdd.exe

Path C:\Users\Admin\AppData\Local\Temp\vwkpdd.exe
Size 706KB
SHA256 c4be02ebea91f47eb66c4c247347b1fdea520b3210b56c619b9128b5a996fcdd
MD5 9ad55f39cc007cf0313456472f39b71d
SHA1 c947f2d0c437c8fe6a17e32a11c32cd423b73a72
SHA512 2955475a9a026db944395ecc548cfd61f6280f435742bd45f1a636b3351898886c01d4814c4389dc4a38d7966e39ac3e282e8cfc7471d3e6e39443df85004845
SSDEEP 12288:GmtamMJ/UBiXkT+szLAwtC9dMdS+nfekMZ4EvO2OFreSlQHIY:GmEmA/2iUisnBZgKfK4NTFLa
MD5 SHA1 SHA512 SSDEEP

Submit Download

taskhost.exe

Path C:\Users\Admin\AppData\Roaming\taskhost.exe
Size 38KB
SHA256 f3f68266726abc9e9fe6c2e9f2170721343c8359d44b169ebd8818cd60eaad14
MD5 9ad04c0709f27858966c2e0052e0f56c
SHA1 20ae7ec2955d70afb4795ee27fa859bd023212df
SHA512 b566eda3d3b43a37a46682a05ae1a8d8341bdceee9df04582c30daa8665f33388e03643b5198ac15461a2907c1e9c3f8b86c478b124249903d83d4d05bb9e03f
SSDEEP 768:93WXQw2ZV1jLfDaBrEvG3GXFyc9Bj06OO/hSDEnlw:93WXCNnaBr7IF39x06OO//lw
MD5 SHA1 SHA512 SSDEEP

Submit Download

DIE_5.txt

Path C:\Users\Admin\Desktop\DIE_5.txt
Size 26B
SHA256 1c746f23a9ae7e24d8bad9b1814aea9a2379985dd954e42b91b10de1c1115e04
MD5 a9d5c20dc5c1801c68fb0fdfacaef241
SHA1 4600f7c027813889d4af992f486d8f9cf54c6a53
SHA512 61834ef9341c3b538dc70db5f1f39cc59fd854142f851d2b12ccf979ae3fe73547d96d85c678abd6fc61b1b4f48046f71dcfb790ae683290813fa5183be9a8b5
MD5 SHA1 SHA512

Submit Download

memory/1116-44-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/1116-48-0x00000201F3B10000-0x00000201F3B20000-memory.dmp

Download

memory/1116-49-0x00000201F3B10000-0x00000201F3B20000-memory.dmp

Download

memory/1116-51-0x00000201F3B10000-0x00000201F3B20000-memory.dmp

Download

memory/1116-53-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/1464-14-0x000001C0DB8E0000-0x000001C0DB8F0000-memory.dmp

Download

memory/1464-12-0x000001C0C3350000-0x000001C0C3372000-memory.dmp

Download

memory/1464-13-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/1464-19-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/1464-16-0x000001C0DB8E0000-0x000001C0DB8F0000-memory.dmp

Download

memory/1464-15-0x000001C0DB8E0000-0x000001C0DB8F0000-memory.dmp

Download

memory/2536-6662-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/2536-6642-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/3012-536-0x0000000000400000-0x0000000000582000-memory.dmp

Download

memory/3172-3364-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/3172-3529-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/3248-0-0x0000000000A10000-0x0000000000A20000-memory.dmp

Download

memory/3248-37-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/3248-2-0x000000001B7A0000-0x000000001B7B0000-memory.dmp

Download

memory/3248-1-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/3376-68-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/3376-65-0x00000297A92C0000-0x00000297A92D0000-memory.dmp

Download

memory/3376-64-0x00000297A92C0000-0x00000297A92D0000-memory.dmp

Download

memory/3376-63-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/3460-34-0x00000245DA340000-0x00000245DA350000-memory.dmp

Download

memory/3460-21-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/3460-22-0x00000245DA340000-0x00000245DA350000-memory.dmp

Download

memory/3460-23-0x00000245DA340000-0x00000245DA350000-memory.dmp

Download

memory/3460-36-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/3496-89-0x0000000000D20000-0x0000000000DD6000-memory.dmp

Download

memory/3496-124-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/3496-91-0x000000001BDF0000-0x000000001BE00000-memory.dmp

Download

memory/3496-90-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/3560-4974-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/3560-5400-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/3788-353-0x0000000074530000-0x0000000074CE0000-memory.dmp

Download

memory/3788-128-0x0000000074530000-0x0000000074CE0000-memory.dmp

Download

memory/3788-126-0x0000000000640000-0x0000000000648000-memory.dmp

Download

memory/4356-1259-0x0000000074530000-0x0000000074CE0000-memory.dmp

Download

memory/4356-134-0x0000000074530000-0x0000000074CE0000-memory.dmp

Download

memory/4356-127-0x00000000004F0000-0x00000000004F8000-memory.dmp

Download

memory/4356-6660-0x0000000074530000-0x0000000074CE0000-memory.dmp

Download

memory/4700-1392-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/4700-1545-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/4768-77-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download

memory/4768-75-0x00007FFD55430000-0x00007FFD55EF1000-memory.dmp

Download