xworm | b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xSpoofer-new.exe
Size 7.0MB
Sample240402-kkwalsce65
SHA256 b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07
MD5 6b47add2cf208a988c57c8f00461de0b
SHA1 cf9518f4bd3cf94ab7225423e4365f4a262a9c61
SHA512 e2f5eb2e82ab1951e0bfe0994219ed676a71ccb9804be7ebbea42d9ad9596922c16600a101caccbbfd161b98fcc2d7b3e9591afb66e1878627f6cee0918b6a35
SSDEEP 196608:oA+bmZgkjTKD4C4+e4YcJE4AcnPmP99j+zE/k:oAEGZjTvC4EtAcPmPJ/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm evasion rat themida trojan

Malware Config

Extracted

Family

xworm

210.246.215.82:7000

Attributes

Install_directory
%ProgramData%
install_file
WindowsNT.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023204-6.dat	family_xworm
behavioral2/memory/3500-13-0x0000000000560000-0x000000000057C000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	xSpoofer-new.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	xSpoofer-new.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xSpoofer-new.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xSpoofer-new.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xSpoofer-new.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xSpoofer-new.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	xSpoofer-new.exe

Executes dropped EXE 19 IoCs

pid	Process
3500	XClient.exe
4228	xSpoofer-new.exe
1520	xSpoofer-new.exe
1720	xSpoofer-new.exe
4272	xSpoofer-new.exe
1328	xSpoofer-new.exe
2616	xSpoofer-new.exe
2228	xSpoofer-new.exe
412	xSpoofer-new.exe
4692	xSpoofer-new.exe
4976	xSpoofer-new.exe
4316	xSpoofer-new.exe
4920	xSpoofer-new.exe
1004	xSpoofer-new.exe
4176	xSpoofer-new.exe
2628	xSpoofer-new.exe
1728	xSpoofer-new.exe
440	xSpoofer-new.exe
3968	xSpoofer-new.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/3968-178-0x0000000140000000-0x0000000140AE7000-memory.dmp	themida
behavioral2/memory/3968-195-0x0000000140000000-0x0000000140AE7000-memory.dmp	themida
behavioral2/memory/3968-199-0x0000000140000000-0x0000000140AE7000-memory.dmp	themida
behavioral2/memory/3968-200-0x0000000140000000-0x0000000140AE7000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xSpoofer-new.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3968	xSpoofer-new.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3968	xSpoofer-new.exe

Suspicious use of SetThreadContext 17 IoCs

description	pid	Process	procid_target
PID 4228 set thread context of 1520	4228	xSpoofer-new.exe	90
PID 4228 set thread context of 1720	4228	xSpoofer-new.exe	93
PID 4228 set thread context of 4272	4228	xSpoofer-new.exe	95
PID 4228 set thread context of 1328	4228	xSpoofer-new.exe	100
PID 4228 set thread context of 2616	4228	xSpoofer-new.exe	103
PID 4228 set thread context of 2228	4228	xSpoofer-new.exe	108
PID 4228 set thread context of 412	4228	xSpoofer-new.exe	110
PID 4228 set thread context of 4692	4228	xSpoofer-new.exe	112
PID 4228 set thread context of 4976	4228	xSpoofer-new.exe	114
PID 4228 set thread context of 4316	4228	xSpoofer-new.exe	116
PID 4228 set thread context of 4920	4228	xSpoofer-new.exe	118
PID 4228 set thread context of 1004	4228	xSpoofer-new.exe	121
PID 4228 set thread context of 4176	4228	xSpoofer-new.exe	123
PID 4228 set thread context of 2628	4228	xSpoofer-new.exe	125
PID 4228 set thread context of 1728	4228	xSpoofer-new.exe	127
PID 4228 set thread context of 440	4228	xSpoofer-new.exe	129
PID 4228 set thread context of 3968	4228	xSpoofer-new.exe	133

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
440	xSpoofer-new.exe
440	xSpoofer-new.exe
440	xSpoofer-new.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	XClient.exe
Token: SeDebugPrivilege	4228	xSpoofer-new.exe
Token: SeDebugPrivilege	440	xSpoofer-new.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 3500	4892	xSpoofer-new.exe	86
PID 4892 wrote to memory of 3500	4892	xSpoofer-new.exe	86
PID 4892 wrote to memory of 4228	4892	xSpoofer-new.exe	87
PID 4892 wrote to memory of 4228	4892	xSpoofer-new.exe	87
PID 4228 wrote to memory of 1520	4228	xSpoofer-new.exe	90
PID 4228 wrote to memory of 1520	4228	xSpoofer-new.exe	90
PID 4228 wrote to memory of 1520	4228	xSpoofer-new.exe	90
PID 4228 wrote to memory of 1520	4228	xSpoofer-new.exe	90
PID 4228 wrote to memory of 1520	4228	xSpoofer-new.exe	90
PID 4228 wrote to memory of 1520	4228	xSpoofer-new.exe	90
PID 4228 wrote to memory of 1520	4228	xSpoofer-new.exe	90
PID 4228 wrote to memory of 1520	4228	xSpoofer-new.exe	90
PID 4228 wrote to memory of 1520	4228	xSpoofer-new.exe	90
PID 4228 wrote to memory of 1520	4228	xSpoofer-new.exe	90
PID 4228 wrote to memory of 1520	4228	xSpoofer-new.exe	90
PID 4228 wrote to memory of 1720	4228	xSpoofer-new.exe	93
PID 4228 wrote to memory of 1720	4228	xSpoofer-new.exe	93
PID 4228 wrote to memory of 1720	4228	xSpoofer-new.exe	93
PID 4228 wrote to memory of 1720	4228	xSpoofer-new.exe	93
PID 4228 wrote to memory of 1720	4228	xSpoofer-new.exe	93
PID 4228 wrote to memory of 1720	4228	xSpoofer-new.exe	93
PID 4228 wrote to memory of 1720	4228	xSpoofer-new.exe	93
PID 4228 wrote to memory of 1720	4228	xSpoofer-new.exe	93
PID 4228 wrote to memory of 1720	4228	xSpoofer-new.exe	93
PID 4228 wrote to memory of 1720	4228	xSpoofer-new.exe	93
PID 4228 wrote to memory of 1720	4228	xSpoofer-new.exe	93
PID 4228 wrote to memory of 4272	4228	xSpoofer-new.exe	95
PID 4228 wrote to memory of 4272	4228	xSpoofer-new.exe	95
PID 4228 wrote to memory of 4272	4228	xSpoofer-new.exe	95
PID 4228 wrote to memory of 4272	4228	xSpoofer-new.exe	95
PID 4228 wrote to memory of 4272	4228	xSpoofer-new.exe	95
PID 4228 wrote to memory of 4272	4228	xSpoofer-new.exe	95
PID 4228 wrote to memory of 4272	4228	xSpoofer-new.exe	95
PID 4228 wrote to memory of 4272	4228	xSpoofer-new.exe	95
PID 4228 wrote to memory of 4272	4228	xSpoofer-new.exe	95
PID 4228 wrote to memory of 4272	4228	xSpoofer-new.exe	95
PID 4228 wrote to memory of 4272	4228	xSpoofer-new.exe	95
PID 4228 wrote to memory of 1328	4228	xSpoofer-new.exe	100
PID 4228 wrote to memory of 1328	4228	xSpoofer-new.exe	100
PID 4228 wrote to memory of 1328	4228	xSpoofer-new.exe	100
PID 4228 wrote to memory of 1328	4228	xSpoofer-new.exe	100
PID 4228 wrote to memory of 1328	4228	xSpoofer-new.exe	100
PID 4228 wrote to memory of 1328	4228	xSpoofer-new.exe	100
PID 4228 wrote to memory of 1328	4228	xSpoofer-new.exe	100
PID 4228 wrote to memory of 1328	4228	xSpoofer-new.exe	100
PID 4228 wrote to memory of 1328	4228	xSpoofer-new.exe	100
PID 4228 wrote to memory of 1328	4228	xSpoofer-new.exe	100
PID 4228 wrote to memory of 1328	4228	xSpoofer-new.exe	100
PID 4228 wrote to memory of 2616	4228	xSpoofer-new.exe	103
PID 4228 wrote to memory of 2616	4228	xSpoofer-new.exe	103
PID 4228 wrote to memory of 2616	4228	xSpoofer-new.exe	103
PID 4228 wrote to memory of 2616	4228	xSpoofer-new.exe	103
PID 4228 wrote to memory of 2616	4228	xSpoofer-new.exe	103
PID 4228 wrote to memory of 2616	4228	xSpoofer-new.exe	103
PID 4228 wrote to memory of 2616	4228	xSpoofer-new.exe	103
PID 4228 wrote to memory of 2616	4228	xSpoofer-new.exe	103
PID 4228 wrote to memory of 2616	4228	xSpoofer-new.exe	103
PID 4228 wrote to memory of 2616	4228	xSpoofer-new.exe	103
PID 4228 wrote to memory of 2616	4228	xSpoofer-new.exe	103
PID 4228 wrote to memory of 2228	4228	xSpoofer-new.exe	108
PID 4228 wrote to memory of 2228	4228	xSpoofer-new.exe	108
PID 4228 wrote to memory of 2228	4228	xSpoofer-new.exe	108
PID 4228 wrote to memory of 2228	4228	xSpoofer-new.exe	108
PID 4228 wrote to memory of 2228	4228	xSpoofer-new.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xSpoofer-new.exe
"C:\Users\Admin\AppData\Local\Temp\xSpoofer-new.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Roaming\XClient.exe
  "C:\Users\Admin\AppData\Roaming\XClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
  "C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe"
  2⤵
  - Drops file in Drivers directory
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XblAuthManager
    3⤵
    - Executes dropped EXE
    PID:1520
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XblGameSave
    3⤵
    - Executes dropped EXE
    PID:1720
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XboxGipSvc
    3⤵
    - Executes dropped EXE
    PID:4272
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop XboxNetApiSvc
    3⤵
    - Executes dropped EXE
    PID:1328
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop xboxgip
    3⤵
    - Executes dropped EXE
    PID:2616
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XblAuthManager
    3⤵
    - Executes dropped EXE
    PID:2228
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XblGameSave
    3⤵
    - Executes dropped EXE
    PID:412
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XboxNetApiSvc
    3⤵
    - Executes dropped EXE
    PID:4692
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete XboxGipSvc
    3⤵
    - Executes dropped EXE
    PID:4976
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete xboxgip
    3⤵
    - Executes dropped EXE
    PID:4316
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe stop vgk
    3⤵
    - Executes dropped EXE
    PID:4920
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\xbgm" /f
    3⤵
    - Executes dropped EXE
    PID:1004
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\GameDVR" /v AllowGameDVR /t REG_DWORD /d 0 /f
    3⤵
    - Executes dropped EXE
    PID:4176
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe /Change /TN "Microsoft\XblGameSave\XblGameSaveTask" /disable
    3⤵
    - Executes dropped EXE
    PID:2628
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe /Change /TN "Microsoft\XblGameSave\XblGameSaveTaskLogon" /disableL
    3⤵
    - Executes dropped EXE
    PID:1728
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe -Command "& {Get-AppxPackage -allusers *xbox* | Remove-AppxPackage}"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:440
- - C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xSpoofer-new.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xSpoofer-new.exe.log
Size 654B
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_joaw4td4.m52.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_joaw4td4.m52.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

XClient.exe

Path C:\Users\Admin\AppData\Roaming\XClient.exe
Size 87KB
SHA256 3c468ad439464cebe619052e06cf797b296ab0d9bcf88d475fb5c9b42b489573
MD5 626eb43e3611e3217f8602f7b8206889
SHA1 358935565a0a495a62559b204b7b41cbc365d8d9
SHA512 f4bf30eeadb557501362de71d4b6d58ab498d98e52b453f6e20309da36fe288d098dab9bb08cfcecf12787536ff20f0e649401ab6b0ff75e6671a4f3ebc4cd29
SSDEEP 1536:hXuooB0BQzpQpF/P46eQTjxME8xbEl7KyNvU6hbq1OSiGoRN8dsGydS1EAd8IIR:mMVP46e6jr8xb271vHq1OSiGONzG+gE7
MD5 SHA1 SHA512 SSDEEP

Submit Download

xSpoofer-new.exe

Path C:\Users\Admin\AppData\Roaming\xSpoofer-new.exe
Size 6.8MB
SHA256 edb57df920f62e6f1241695f8a46e420f104455a54fe91431db545834fd8d5ba
MD5 233320478ce264f9e08d249244dc4fdb
SHA1 af46758a7c39b4edf4b5b0819f732abb5ad19e17
SHA512 b1c06e96cbabd58f8489a18c8c270718cea634a9bbd4fd67786cd5d31cfa475d4f97e2389f1ce2b5ddf10db9687b5cb5361e878d29427f9670f59343468d5967
SSDEEP 196608:5Q2UWm2aP6px6/H1HuHqCdKwG0/QZ2Y4KRNCpcvlPc:5V5m340/NYFz/QoY4KmpIlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-89-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/412-85-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/412-88-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/412-90-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/440-162-0x000001C96DC40000-0x000001C96DC4A000-memory.dmp

Download

memory/440-159-0x00007FFFCCD00000-0x00007FFFCD7C1000-memory.dmp

Download

memory/440-148-0x000001C955280000-0x000001C955290000-memory.dmp

Download

memory/440-163-0x000001C96DEC0000-0x000001C96DEE6000-memory.dmp

Download

memory/440-147-0x0000000140000000-0x0000000140071000-memory.dmp

Download

memory/440-170-0x0000000140000000-0x0000000140071000-memory.dmp

Download

memory/440-167-0x000001C955280000-0x000001C955290000-memory.dmp

Download

memory/440-158-0x000001C96DA90000-0x000001C96DAB2000-memory.dmp

Download

memory/440-166-0x000001C955280000-0x000001C955290000-memory.dmp

Download

memory/440-169-0x00007FFFCCD00000-0x00007FFFCD7C1000-memory.dmp

Download

memory/440-160-0x000001C955280000-0x000001C955290000-memory.dmp

Download

memory/440-161-0x000001C96DC20000-0x000001C96DC36000-memory.dmp

Download

memory/1004-118-0x0000000140000000-0x0000000140057000-memory.dmp

Download

memory/1004-120-0x0000000140000000-0x0000000140057000-memory.dmp

Download

memory/1004-165-0x0000000140000000-0x0000000140057000-memory.dmp

Download

memory/1004-116-0x0000000140000000-0x0000000140057000-memory.dmp

Download

memory/1004-119-0x0000000140000000-0x0000000140057000-memory.dmp

Download

memory/1328-64-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1328-63-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1328-65-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1328-67-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1328-60-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1520-36-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1520-30-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1520-32-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1520-34-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1520-37-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1520-38-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1720-43-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1720-46-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1720-45-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1720-44-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1720-47-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1720-41-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/1728-138-0x0000000140000000-0x000000014003E000-memory.dmp

Download

memory/2228-82-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/2228-81-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/2228-79-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/2616-76-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/2616-75-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/2616-74-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/2616-73-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/2616-70-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/2628-131-0x0000000140000000-0x000000014003E000-memory.dmp

Download

memory/2628-132-0x0000000140000000-0x000000014003E000-memory.dmp

Download

memory/3500-13-0x0000000000560000-0x000000000057C000-memory.dmp

Download

memory/3500-61-0x00007FFFCCD00000-0x00007FFFCD7C1000-memory.dmp

Download

memory/3500-87-0x00007FFFCCD00000-0x00007FFFCD7C1000-memory.dmp

Download

memory/3500-56-0x000000001B230000-0x000000001B240000-memory.dmp

Download

memory/3500-14-0x00007FFFCCD00000-0x00007FFFCD7C1000-memory.dmp

Download

memory/3968-196-0x00000211C0F10000-0x00000211C0F11000-memory.dmp

Download

memory/3968-178-0x0000000140000000-0x0000000140AE7000-memory.dmp

Download

memory/3968-195-0x0000000140000000-0x0000000140AE7000-memory.dmp

Download

memory/3968-199-0x0000000140000000-0x0000000140AE7000-memory.dmp

Download

memory/3968-200-0x0000000140000000-0x0000000140AE7000-memory.dmp

Download

memory/4176-175-0x0000000140000000-0x0000000140057000-memory.dmp

Download

memory/4176-125-0x0000000140000000-0x0000000140057000-memory.dmp

Download

memory/4228-29-0x00007FFFEAFB0000-0x00007FFFEB1A5000-memory.dmp

Download

memory/4228-71-0x00007FFFEAFB0000-0x00007FFFEB1A5000-memory.dmp

Download

memory/4228-27-0x00007FF757750000-0x00007FF758240000-memory.dmp

Download

memory/4228-66-0x00007FF757750000-0x00007FF758240000-memory.dmp

Download

memory/4272-54-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4272-57-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4272-55-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4272-53-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4272-52-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4272-50-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4316-107-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4316-105-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4316-108-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4692-95-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4692-96-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4692-93-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4892-2-0x00007FFFCCD00000-0x00007FFFCD7C1000-memory.dmp

Download

memory/4892-26-0x00007FFFCCD00000-0x00007FFFCD7C1000-memory.dmp

Download

memory/4892-0-0x0000000000C20000-0x000000000132E000-memory.dmp

Download

memory/4920-115-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4920-114-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4920-111-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4920-113-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4976-99-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4976-102-0x0000000140000000-0x0000000140017000-memory.dmp

Download

memory/4976-101-0x0000000140000000-0x0000000140017000-memory.dmp

Download