Overview

overview

10

Static

static

10

XWorm-RAT-...in.zip

windows11-21h2-x64

10

Analysis

  • max time kernel
    300s
  • max time network
    301s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02-05-2024 16:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XWorm-RAT-V2.1-main.zip

  • Size

    34.0MB

  • MD5

    88dfc456336a95ffeac16d9276083b7b

  • SHA1

    8949c8c8778bd6412a456212d4ba2707f12e9d7a

  • SHA256

    edbdc2e1bed353b533761a069b2d9a563683318fd1657ce09f9be2fa8ccd497a

  • SHA512

    988ec72613d155bc362b1c0e0f1ee731f9653947328084e96eb436e7576b8e9c5114e59488216ea4f05d48126c5dbd7e983a02a412755b59b961f15c3ceea5f5

  • SSDEEP

    786432:jiIKRjrYlNTspDclWQUF4DQXzTnHB35mjVjYX/BbmLqIZW:efApsGAX0Wh35mj+bY8

Score
10/10
xwormpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:7000

Mutex

duOqxoZJn4KwRoB3

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 6 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Drops startup file 4 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Modifies registry class 55 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\XWorm-RAT-V2.1-main.zip
    1⤵
      PID:2940
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4976
      • C:\Users\Admin\Documents\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XWorm RAT V2.1.exe
        "C:\Users\Admin\Documents\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\XWorm RAT V2.1.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1148
        • C:\Users\Admin\Documents\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe
          "C:\Users\Admin\Documents\XWorm-RAT-V2.1-main\XWorm-RAT-V2.1-main\XWorm RAT V2.1\Command Reciever.exe"
          2⤵
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4056
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qpclfxnk\qpclfxnk.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:388
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCEE4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4320FF6369B84779B041E19BCE842EF.TMP"
              4⤵
                PID:3712
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pko2udc3\pko2udc3.cmdline"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2792
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7DBD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3DA42408C96647C79C3E94D2C45EF8F.TMP"
                4⤵
                  PID:4296
            • C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe
              "C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4388
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp7E14.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp7E14.tmp.bat
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4524
                • C:\Windows\system32\tasklist.exe
                  Tasklist /fi "PID eq 4388"
                  4⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:832
                • C:\Windows\system32\find.exe
                  find ":"
                  4⤵
                    PID:3420
                  • C:\Windows\system32\timeout.exe
                    Timeout /T 1 /Nobreak
                    4⤵
                    • Delays execution with timeout.exe
                    PID:2196
                  • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe
                    "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1992
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdater /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe /f
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:436
                      • C:\Windows\system32\reg.exe
                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdater /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLogger\Update.exe /f
                        6⤵
                        • Adds Run key to start application
                        • Modifies registry key
                        PID:4520
            • C:\Windows\system32\wbem\WmiApSrv.exe
              C:\Windows\system32\wbem\WmiApSrv.exe
              1⤵
                PID:3096
              • C:\Users\Admin\Downloads\XWorm.exe
                "C:\Users\Admin\Downloads\XWorm.exe"
                1⤵
                • Drops startup file
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:3140
                • C:\Windows\System32\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn "XWorm" /tr "C:\Users\Admin\AppData\Roaming\XWorm.exe"
                  2⤵
                  • Creates scheduled task(s)
                  PID:3324
                • C:\Windows\System32\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /delete /f /tn "XWorm"
                  2⤵
                    PID:2096
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp44EA.tmp.bat""
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1084
                    • C:\Windows\system32\timeout.exe
                      timeout 3
                      3⤵
                      • Delays execution with timeout.exe
                      PID:4984
                • C:\Users\Admin\AppData\Roaming\XWorm.exe
                  C:\Users\Admin\AppData\Roaming\XWorm.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4756
                • C:\Users\Admin\Downloads\YoutubeSimulator.exe
                  "C:\Users\Admin\Downloads\YoutubeSimulator.exe"
                  1⤵
                  • Drops startup file
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:760
                  • C:\Windows\System32\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn "YoutubeSimulator" /tr "C:\Users\Admin\AppData\Roaming\YoutubeSimulator.exe"
                    2⤵
                    • Creates scheduled task(s)
                    PID:1528
                • C:\Users\Admin\Downloads\YoutubeSimulator.exe
                  "C:\Users\Admin\Downloads\YoutubeSimulator.exe"
                  1⤵
                  • Executes dropped EXE
                  PID:4728
                • C:\Users\Admin\AppData\Roaming\YoutubeSimulator.exe
                  C:\Users\Admin\AppData\Roaming\YoutubeSimulator.exe
                  1⤵
                  • Executes dropped EXE
                  PID:5112

                Network

                MITRE ATT&CK Matrix ATT&CK v13

                Initial Access

                Execution

                Scripting

                1
                T1064

                Scheduled Task/Job

                1
                T1053

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Scheduled Task/Job

                1
                T1053

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Scheduled Task/Job

                1
                T1053

                Defense Evasion

                Scripting

                1
                T1064

                Modify Registry

                2
                T1112

                Credential Access

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                System Information Discovery

                2
                T1082

                Query Registry

                2
                T1012

                Process Discovery

                1
                T1057

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Exfiltration

                Command and Control

                Web Service

                1
                T1102

                Impact

                Resource Development

                Reconnaissance

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XWorm.exe.log
                  Filesize

                  1KB

                  MD5

                  e7edf56d23e3eddab9453776bd1cc9ed

                  SHA1

                  36c5a79710d6810871de84443bc4f42c404504bc

                  SHA256

                  b115c8bd4e8c80eedb64322046695b1bb6783ddfebf7bf93a0562a12bb4de95a

                  SHA512

                  ab2c905ff55d9a202469218f65d6df63eac131c06886316ae4e8cd05dffaa42541d11df774d89629d0cc6df067ed9d0c2b44811952e4f3668c3e9d4fb84f57a1

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe
                  Filesize

                  5.6MB

                  MD5

                  b8703418e6c3d1ccd83b8d178ab9f4c9

                  SHA1

                  6fb0e1e0ee5bc745f52a1c29e3cf4b88a2298dd6

                  SHA256

                  d6e9972976881d3dad7ac2a0c66cd7dd81420908aae8b00195a02fdf756cfc5e

                  SHA512

                  75ff6e911691e3d0d32c25d4b6d275a2b6157dae418ce5507f3e3f1b321c3f0dee516b7db0fd6588860019a19862f43c5335c465829de7a418a71999b71cfc3f

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll
                  Filesize

                  1.7MB

                  MD5

                  65ccd6ecb99899083d43f7c24eb8f869

                  SHA1

                  27037a9470cc5ed177c0b6688495f3a51996a023

                  SHA256

                  aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

                  SHA512

                  533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\RES7DBD.tmp
                  Filesize

                  1KB

                  MD5

                  fc4d4d39cc055bd34a997dbee23461fa

                  SHA1

                  c1c61c6df42be4edf2f659cf6556db43bebef3eb

                  SHA256

                  7ed2a08fe16f77d0dae93e4757a2cbca6f0370d9b1ea4a8bacaa84ab36549fe2

                  SHA512

                  16ecd1e09e76d6de6d560a9c4cd6b9b3bf645cd6735b78965cd798cfc8075eeb3d9ebb3e697489f0dc98f8dc10417c74cec8148b2e5dae5bd0ea6b62d21ed46d

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\RESCEE4.tmp
                  Filesize

                  1KB

                  MD5

                  5ea10fdebc102b33439620ee7e844d57

                  SHA1

                  9f6a5bbe2a3dcc92bb8a73b10883f8d2ee143ef9

                  SHA256

                  3ab629b882a716e62a25233ed5605bf3ab07f28b204e7f54841a725c45299bf9

                  SHA512

                  b48d35273d9aab65ecfa4c0a5ee2c9d73638d5e8b2cb97710e9af91792a89510cf3a14bc1e0d7f1ac73a3eb45fa39222be7deaab5b7b55d5cc101d5d36ddac2a

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\pko2udc3\pko2udc3.0.vb
                  Filesize

                  60KB

                  MD5

                  45e830467adabde5df3c45c7e4631f96

                  SHA1

                  3f58ff7f59eab9cb0d881e9b32d8ebe333373d77

                  SHA256

                  45cb9e98bbd904b26780478c59d00d8fdba0e1a1f8185629dc87eb3ef435416a

                  SHA512

                  42cdccb8ee9587e8603535e973d9a050b2b989d0414c071ca2a401fa1bfc3c349dc75eb84278175fde0a1dee3032b632816a938c02eada63ba4d6f4b92b4be63

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\pko2udc3\pko2udc3.cmdline
                  Filesize

                  269B

                  MD5

                  d3a391855037c77e7e0e1df5a6091151

                  SHA1

                  d3f0dfcb5be2fa2b1b9a776cabc0ced499311f44

                  SHA256

                  2eb5461149fddc072d8313d0d01a3234d9948ae19da2bff5cffb33cdaeb3ae0a

                  SHA512

                  7cab7afef6234d77d1cf375a79dc8fd146d3abd14dd7648b43aecb71d425de3aaaaa87b371d2c88d1c6c90b046cefaaec3fe8dbb5971b5698441d264b14f4c0c

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\qpclfxnk\qpclfxnk.0.vb
                  Filesize

                  60KB

                  MD5

                  e97caf82ffa66d812910c80b4b2820ce

                  SHA1

                  f158894a089aa09f97fe486888bde206a5ec0fc0

                  SHA256

                  8dccf5a7131ea40afdfacefd94cdacb90a123c7390ee279a7c74ba903058a9ee

                  SHA512

                  9624b48093b7537d26d771e34f6e689c252cad9a1b9d67d42a24a5136062e5ac4ae95b0a7da40a67196a8e8b18f05ccbb68ef54f16d1d26347c9b5a63b387006

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\qpclfxnk\qpclfxnk.cmdline
                  Filesize

                  269B

                  MD5

                  9ba143b45590ce6eca1dd9c99d540752

                  SHA1

                  3eb4a214e1479b29d645938bfbfc7d6cfad23433

                  SHA256

                  46e13ed991c1ebcc91bf1c119a9ef3984a2e0de8b3e7e30775c28afc24d7ada5

                  SHA512

                  b85c3f3fa6de4dcefafd6e2a2456418fa6a0437e6e0a19bb697bad8796a44a040ac36edf9ad3d32ffc767a38b2a0e38678ceb945dc85c696fb7bd57aa2204bf8

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\tmp44EA.tmp.bat
                  Filesize

                  148B

                  MD5

                  bb2ed461b8e7dbefe63163315ac92ee7

                  SHA1

                  bc51f3b0127f2ef85a20778de3177a3136465b73

                  SHA256

                  b1f9c0e9ac2e0ca098c750382350682c2b58f7ade9b3d208d983e61627f8a91d

                  SHA512

                  58b31ad3e0b715d296baf01e0f78814328e7de3566041dc79b4b67bf2b2df66387c6cb154e7ee58332ee664fa30ba596d58e11ce0ccef41cacefb63b4738e157

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\tmp7E14.tmp.bat
                  Filesize

                  290B

                  MD5

                  8e44845eec66f1d61daee75c19f9a497

                  SHA1

                  91a3ce4de1e199d7ac8e0ce65636a59e4158f510

                  SHA256

                  95c3d8245d72df84a1b4fb9879b241885a122f3ceb060110b478ed331d289050

                  SHA512

                  0449914d6e9177d11a5b16e603f29a8ab962935f34a0828369c651c7929d9c38590ead03fbad252d724e9c1353ab3789e0b0a4276db1a2bec3467306de121948

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\vbc4320FF6369B84779B041E19BCE842EF.TMP
                  Filesize

                  1KB

                  MD5

                  b70192bdfa82953d23893557b94122f2

                  SHA1

                  4fd73efd6a6b28f57df1dde6a4241526c5b0fb60

                  SHA256

                  6443d3bc34cc48e858c4fdb3ab0ad9a433705f266cb70f92886e90cbf589eab4

                  SHA512

                  6dcb0273ffe6675af850d0a5e1976d9e8f8e9d6306a21856b1df4d8c0fef38fb8ff28f113e8c8b923c6451e32e734c514a15f79efe6316f180874f78608928da

                  Download Submit
                • C:\Users\Admin\Downloads\XWorm.exe
                  Filesize

                  42KB

                  MD5

                  6e602ed5492e0258294ea5cc8e3ea74a

                  SHA1

                  37d44ed96a6ad0aa2e2d75e376295267fdc75622

                  SHA256

                  ea4c32d7aa3ad51c6890d3c18a1a8db963ac4bd6425608ec9e1fc48fc9ef8361

                  SHA512

                  4bbeaf620465b7353027dba9ae362dfa1b3ba0dcc5978264637a800f6e2f378c7c0ed45f174bd9cc21d40b3ef041c1e58eb05a6a1b063fb9da7d4e8ef8348d61

                  Download Submit
                • C:\Users\Admin\Downloads\YoutubeSimulator.exe
                  Filesize

                  42KB

                  MD5

                  79651f83b93c25ae9f99cf23fc3435bb

                  SHA1

                  537ebb24e9b1c6b42fcb0d35690a61f74e53dfd4

                  SHA256

                  5e2002f4618817d4f59cd948a66749e6778e116b39cdfc2991bf69d174a2ffce

                  SHA512

                  8193aede9f3c0c3c93ccc8e4f8b0c6ad874483bcbfd5dcc29c39bb9ccc6662fd30ec492d571ac52e3c42b78e88acfb35d4d6cb5917bccc278c7fa7fb9a7eff10

                  Download Submit
                • memory/760-143-0x0000000000750000-0x0000000000760000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/1148-0-0x0000000074ADE000-0x0000000074ADF000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/1148-2-0x0000000005730000-0x0000000005CD6000-memory.dmp
                  Filesize

                  5.6MB

                  Download
                • memory/1148-1-0x0000000000540000-0x0000000000782000-memory.dmp
                  Filesize

                  2.3MB

                  Download
                • memory/1992-39-0x000002C574DA0000-0x000002C574E0A000-memory.dmp
                  Filesize

                  424KB

                  Download
                • memory/1992-41-0x000002C574EF0000-0x000002C574FA2000-memory.dmp
                  Filesize

                  712KB

                  Download
                • memory/1992-42-0x000002C574FF0000-0x000002C575040000-memory.dmp
                  Filesize

                  320KB

                  Download
                • memory/1992-43-0x000002C575240000-0x000002C575262000-memory.dmp
                  Filesize

                  136KB

                  Download
                • memory/1992-45-0x000002C5752B0000-0x000002C5752EA000-memory.dmp
                  Filesize

                  232KB

                  Download
                • memory/1992-46-0x000002C574B30000-0x000002C574B56000-memory.dmp
                  Filesize

                  152KB

                  Download
                • memory/1992-64-0x000002C5752F0000-0x000002C575302000-memory.dmp
                  Filesize

                  72KB

                  Download
                • memory/1992-38-0x000002C574D20000-0x000002C574D2A000-memory.dmp
                  Filesize

                  40KB

                  Download
                • memory/3140-94-0x0000000000970000-0x000000000097A000-memory.dmp
                  Filesize

                  40KB

                  Download
                • memory/3140-95-0x0000000000A30000-0x0000000000A3A000-memory.dmp
                  Filesize

                  40KB

                  Download
                • memory/3140-84-0x00000000001B0000-0x00000000001C0000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/3140-97-0x0000000000A50000-0x0000000000A5A000-memory.dmp
                  Filesize

                  40KB

                  Download
                • memory/3140-96-0x000000001D740000-0x000000001DC68000-memory.dmp
                  Filesize

                  5.2MB

                  Download
                • memory/4056-25-0x0000000005580000-0x000000000558A000-memory.dmp
                  Filesize

                  40KB

                  Download
                • memory/4056-88-0x0000000010170000-0x00000000101F2000-memory.dmp
                  Filesize

                  520KB

                  Download
                • memory/4056-26-0x00000000056B0000-0x0000000005706000-memory.dmp
                  Filesize

                  344KB

                  Download
                • memory/4056-28-0x00000000089B0000-0x0000000008A16000-memory.dmp
                  Filesize

                  408KB

                  Download
                • memory/4056-17-0x0000000005610000-0x00000000056A2000-memory.dmp
                  Filesize

                  584KB

                  Download
                • memory/4056-15-0x00000000054D0000-0x000000000556C000-memory.dmp
                  Filesize

                  624KB

                  Download
                • memory/4056-11-0x00000000004E0000-0x0000000000B72000-memory.dmp
                  Filesize

                  6.6MB

                  Download
                • memory/4388-27-0x0000021159220000-0x000002115923E000-memory.dmp
                  Filesize

                  120KB

                  Download
                • memory/4388-18-0x0000021156F10000-0x00000211574B0000-memory.dmp
                  Filesize

                  5.6MB

                  Download
                • memory/4388-24-0x0000021159270000-0x00000211592E6000-memory.dmp
                  Filesize

                  472KB

                  Download