xworm | 8e5387b8e5b1d7437979f00b42b6b481281f9ced1c3a7101f6a5832402563e5b

Analysis

max time kernel
13s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29-07-2024 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CatrinePerm/CatrinePerm.exe
Size

811KB
MD5

5aabc1aaec4fe6297da47c8d327ddd29
SHA1

ddfb19d827747f4ed4e59d4f2975f7017568e974
SHA256

45df56d3bd73f3dd6ee05a8d77afd52d61012d1742cae6e42196f9f6f236f6d8
SHA512

290b5f9e373b39f41b235ea09d90d026db38e0e63b7f660ff020d9c99819d7baa051fe5fae8221fc8eb5ac635a65de47ba127da2453e7d3a25f1ca337afb9fd6
SSDEEP

12288:bwr+M1vyQiO+e7tmMjg4yDY7YjqhRNecqnfpQzt562ByZG3Xw5FP/umZtD1ryHsw:MzDE4Hzn2pstQEyZGw5F+SD1OHo6T

Score

10^/10

xworm discovery execution persistence pyinstaller rat trojan

Malware Config

Extracted

Family

xworm

78.69.106.17:8000

Attributes

Install_directory
%AppData%
install_file
Update.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\WinRAR.exe	family_xworm
behavioral1/memory/2312-18-0x0000000000970000-0x00000000009A2000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

2148 powershell.exe
304 powershell.exe
1036 powershell.exe
1624 powershell.exe

pid	process
2148	powershell.exe
304	powershell.exe
1036	powershell.exe
1624	powershell.exe

Drops startup file 2 IoCs

Processes:

WinRAR.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk	WinRAR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk	WinRAR.exe

Executes dropped EXE 7 IoCs

Processes:

Win (3).exeCatrinePerm.exeWinRAR.exeRtkBtAudioServ.exepythonw.exepythonw.exe

pid process

852 Win (3).exe
2932 CatrinePerm.exe
2312 WinRAR.exe
2444 RtkBtAudioServ.exe
1448 pythonw.exe
1944 pythonw.exe
1208

pid	process
852	Win (3).exe
2932	CatrinePerm.exe
2312	WinRAR.exe
2444	RtkBtAudioServ.exe
1448	pythonw.exe
1944	pythonw.exe
1208

Loads dropped DLL 16 IoCs

Processes:

CatrinePerm.exeWin (3).exepythonw.exepythonw.exeWerFault.exe

pid	process
2408	CatrinePerm.exe
852	Win (3).exe
1448	pythonw.exe
1944	pythonw.exe
1944	pythonw.exe
1944	pythonw.exe
1944	pythonw.exe
1944	pythonw.exe
1944	pythonw.exe
1944	pythonw.exe
1208
2960	WerFault.exe
2960	WerFault.exe
2960	WerFault.exe
2960	WerFault.exe
2960	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WinRAR.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\Update.exe"	WinRAR.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com

flow	ioc
4	ip-api.com

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\pythonw.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2960 2444 WerFault.exe RtkBtAudioServ.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

RtkBtAudioServ.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtkBtAudioServ.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1292 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeWinRAR.exe

pid process

2148 powershell.exe
304 powershell.exe
1036 powershell.exe
1624 powershell.exe
2312 WinRAR.exe

pid	pid_target	process	target process
2960	2444	WerFault.exe	RtkBtAudioServ.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtkBtAudioServ.exe

pid	process
1292	schtasks.exe

pid	process
2148	powershell.exe
304	powershell.exe
1036	powershell.exe
1624	powershell.exe
2312	WinRAR.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

WinRAR.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2312	WinRAR.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	304	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	2312	WinRAR.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WinRAR.exe

pid process

2312 WinRAR.exe

pid	process
2312	WinRAR.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

CatrinePerm.exeWin (3).exepythonw.exeRtkBtAudioServ.exeWinRAR.exe

description	pid	process	target process
PID 2408 wrote to memory of 852	2408	CatrinePerm.exe	Win (3).exe
PID 2408 wrote to memory of 852	2408	CatrinePerm.exe	Win (3).exe
PID 2408 wrote to memory of 852	2408	CatrinePerm.exe	Win (3).exe
PID 2408 wrote to memory of 2932	2408	CatrinePerm.exe	CatrinePerm.exe
PID 2408 wrote to memory of 2932	2408	CatrinePerm.exe	CatrinePerm.exe
PID 2408 wrote to memory of 2932	2408	CatrinePerm.exe	CatrinePerm.exe
PID 852 wrote to memory of 2312	852	Win (3).exe	WinRAR.exe
PID 852 wrote to memory of 2312	852	Win (3).exe	WinRAR.exe
PID 852 wrote to memory of 2312	852	Win (3).exe	WinRAR.exe
PID 852 wrote to memory of 1448	852	Win (3).exe	pythonw.exe
PID 852 wrote to memory of 1448	852	Win (3).exe	pythonw.exe
PID 852 wrote to memory of 1448	852	Win (3).exe	pythonw.exe
PID 852 wrote to memory of 2444	852	Win (3).exe	RtkBtAudioServ.exe
PID 852 wrote to memory of 2444	852	Win (3).exe	RtkBtAudioServ.exe
PID 852 wrote to memory of 2444	852	Win (3).exe	RtkBtAudioServ.exe
PID 852 wrote to memory of 2444	852	Win (3).exe	RtkBtAudioServ.exe
PID 1448 wrote to memory of 1944	1448	pythonw.exe	pythonw.exe
PID 1448 wrote to memory of 1944	1448	pythonw.exe	pythonw.exe
PID 1448 wrote to memory of 1944	1448	pythonw.exe	pythonw.exe
PID 2444 wrote to memory of 2960	2444	RtkBtAudioServ.exe	WerFault.exe
PID 2444 wrote to memory of 2960	2444	RtkBtAudioServ.exe	WerFault.exe
PID 2444 wrote to memory of 2960	2444	RtkBtAudioServ.exe	WerFault.exe
PID 2444 wrote to memory of 2960	2444	RtkBtAudioServ.exe	WerFault.exe
PID 2312 wrote to memory of 2148	2312	WinRAR.exe	powershell.exe
PID 2312 wrote to memory of 2148	2312	WinRAR.exe	powershell.exe
PID 2312 wrote to memory of 2148	2312	WinRAR.exe	powershell.exe
PID 2312 wrote to memory of 304	2312	WinRAR.exe	powershell.exe
PID 2312 wrote to memory of 304	2312	WinRAR.exe	powershell.exe
PID 2312 wrote to memory of 304	2312	WinRAR.exe	powershell.exe
PID 2312 wrote to memory of 1036	2312	WinRAR.exe	powershell.exe
PID 2312 wrote to memory of 1036	2312	WinRAR.exe	powershell.exe
PID 2312 wrote to memory of 1036	2312	WinRAR.exe	powershell.exe
PID 2312 wrote to memory of 1624	2312	WinRAR.exe	powershell.exe
PID 2312 wrote to memory of 1624	2312	WinRAR.exe	powershell.exe
PID 2312 wrote to memory of 1624	2312	WinRAR.exe	powershell.exe
PID 2312 wrote to memory of 1292	2312	WinRAR.exe	schtasks.exe
PID 2312 wrote to memory of 1292	2312	WinRAR.exe	schtasks.exe
PID 2312 wrote to memory of 1292	2312	WinRAR.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\CatrinePerm\CatrinePerm.exe
"C:\Users\Admin\AppData\Local\Temp\CatrinePerm\CatrinePerm.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408

C:\Users\Admin\AppData\Roaming\Win (3).exe
"C:\Users\Admin\AppData\Roaming\Win (3).exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Local\Temp\WinRAR.exe
"C:\Users\Admin\AppData\Local\Temp\WinRAR.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinRAR.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WinRAR.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:304

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Update.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Update.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Update" /tr "C:\Users\Admin\AppData\Roaming\Update.exe"
4⤵
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Users\Admin\AppData\Local\Temp\pythonw.exe
"C:\Users\Admin\AppData\Local\Temp\pythonw.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1448

C:\Users\Admin\AppData\Local\Temp\pythonw.exe
"C:\Users\Admin\AppData\Local\Temp\pythonw.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944

C:\Users\Admin\AppData\Local\Temp\RtkBtAudioServ.exe
"C:\Users\Admin\AppData\Local\Temp\RtkBtAudioServ.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 592
4⤵
- Loads dropped DLL
- Program crash
PID:2960

C:\Users\Admin\AppData\Roaming\CatrinePerm.exe
"C:\Users\Admin\AppData\Roaming\CatrinePerm.exe"
2⤵
- Executes dropped EXE
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RtkBtAudioServ.exe

Filesize
11KB

MD5
9dfb70a009d9a1696a1a55d17b0321a5

SHA1
0129fcc88ba5c5bb58e8cf0e8860b3b53dbec7a9

SHA256
4eba44c61669a2d7c77b7997846b0d779989d4fff31120caeca595887576c19b

SHA512
0f18f936de567c884d284cd00d9c5953c89865776ef3adc8e7c4de801dda4548c9d1998f222011ca66d567d64c2ad6bfd10050987ec216f9c14844edfb5c6d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinRAR.exe

Filesize
179KB

MD5
3eda75ddf0da931a8b305573d7508e8c

SHA1
d19618faac5e98152797aa94860725827dae4359

SHA256
c66e4c3be01e7830f7e564ce3139c774eed746c7db619b767e4f1f6e83c52cb9

SHA512
32d05e9c0fe66fee74d67ec20ea33b9332e5a077ef6e8ae26956e00fc839cdd9a840fcd944e33dd8655395588ab74e9768e1ea6210c234a0d60d14e560d544d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14482\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
4380d56a3b83ca19ea269747c9b8302b

SHA1
0c4427f6f0f367d180d37fc10ecbe6534ef6469c

SHA256
a79c7f86462d8ab8a7b73a3f9e469514f57f9fe456326be3727352b092b6b14a

SHA512
1c29c335c55f5f896526c8ee0f7160211fd457c1f1b98915bcc141112f8a730e1a92391ab96688cbb7287e81e6814cc86e3b057e0a6129cbb02892108bfafaf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14482\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
2554060f26e548a089cab427990aacdf

SHA1
8cc7a44a16d6b0a6b7ed444e68990ff296d712fe

SHA256
5ab003e899270b04abc7f67be953eaccf980d5bbe80904c47f9aaf5d401bb044

SHA512
fd4d5a7fe4da77b0222b040dc38e53f48f7a3379f69e2199639b9f330b2e55939d89ce8361d2135182b607ad75e58ee8e34b90225143927b15dcc116b994c506

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14482\python311.dll

Filesize
5.5MB

MD5
86e0ad6ba8a9052d1729db2c015daf1c

SHA1
48112072903fff2ec5726cca19cc09e42d6384c7

SHA256
5ecda62f6fd2822355c560412f6d90be46a7f763f0ffeec9854177904632ac2d

SHA512
5d6e32f9ff90a9a584183dad1583aea2327b4aea32184b0ebbec3df41b0b833e6bb3cd40822dd64d1033125f52255812b17e4fa0add38fcda6bab1724dfaa2eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14482\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\pythonw.exe

Filesize
10.8MB

MD5
4f5026ca550536ba2782fe3221ae6787

SHA1
d91e8dd609e2bde9857a0ce4aa2e049636cb34a3

SHA256
5a03d4bba3d6916cfc76bad8afb9dc22094b60a8d0aab8a2330d1b1d692fe6ee

SHA512
4d63c136ed41b68b56f80920005ad03a99708c44b2b4a776f20366011059126a54a5ff446f6967f49f7e20a918d4c50e062c3cae2f5f8f34f30cdb8ec508914a

Download Submit
C:\Users\Admin\AppData\Roaming\CatrinePerm.exe

Filesize
139KB

MD5
10605ec186aacb6a4b3dde419cb0b5e5

SHA1
9c41040a4c238dec28c4f47bfb0a28a3cd4bf19d

SHA256
ca5b3ebffc2080fec7d44655069190b892e51e4bc4401c31f64a5a70d46f1ead

SHA512
1d48bbc5c965f098300ce5404269ea5b1694887531b9aa1e953755f631325946e4914405ae3cabfe13d222ddfde4b0368d446b9aad3956f345d6b142d6579a9d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3136de678293e70ea143559b055b0f0a

SHA1
20cfc770468102b4a00cb833324764b58fd4ee99

SHA256
cfd82572ea10eca11c465633d8168de81049f10ee272bbd987fb60125a56d9e8

SHA512
da56729a4996bd9b05d592658a2ec999e48a5455b653b3ff64ca2c8a9c8d29262f4e93041c10952be3d567f768a7d0c846fc16e111892bd11edceaeabcee3498

Download Submit
C:\Users\Admin\AppData\Roaming\Win (3).exe

Filesize
11.1MB

MD5
5b38b99b1d06989fcb361234e48f5087

SHA1
13ebfd2fba93556f68ab5400a9305ca46d3cef97

SHA256
15e3f8123a8183dcf94c8e5be709d81ff5f1ae4e27ed4c7e5346c0074667a935

SHA512
9daddeb5cd96d3c56c4b1b67985e274a8addef80d15b5ebab040a700cc3f47e541f86839ec0497186a294bc198ede3323cd93f028628e4cb68b5a3b2ef688086

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI14482\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
bcb8b9f6606d4094270b6d9b2ed92139

SHA1
bd55e985db649eadcb444857beed397362a2ba7b

SHA256
fa18d63a117153e2ace5400ed89b0806e96f0627d9db935906be9294a3038118

SHA512
869b2b38fd528b033b3ec17a4144d818e42242b83d7be48e2e6da6992111758b302f48f52e0dd76becb526a90a2b040ce143c6d4f0e009a513017f06b9a8f2b9

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI14482\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI14482\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
20ddf543a1abe7aee845de1ec1d3aa8e

SHA1
0eaf5de57369e1db7f275a2fffd2d2c9e5af65bf

SHA256
d045a72c3e4d21165e9372f76b44ff116446c1e0c221d9cea3ab0a1134a310e8

SHA512
96dd48df315a7eea280ca3da0965a937a649ee77a82a1049e3d09b234439f7d927d7fb749073d7af1b23dadb643978b70dcdadc6c503fe850b512b0c9c1c78dd

Download Submit
memory/304-171-0x0000000002050000-0x0000000002058000-memory.dmp

Filesize
32KB

Download
memory/304-170-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/852-98-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

Filesize
9.9MB

Download
memory/852-12-0x00000000009E0000-0x00000000014F8000-memory.dmp

Filesize
11.1MB

Download
memory/1036-177-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2148-164-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2148-163-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2312-18-0x0000000000970000-0x00000000009A2000-memory.dmp

Filesize
200KB

Download
memory/2408-1-0x0000000001100000-0x0000000001C3E000-memory.dmp

Filesize
11.2MB

Download
memory/2408-0-0x000007FEF56E3000-0x000007FEF56E4000-memory.dmp

Filesize
4KB

Download
memory/2444-119-0x0000000000B20000-0x0000000000B2A000-memory.dmp

Filesize
40KB

Download
memory/2444-151-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/2444-147-0x0000000000320000-0x000000000033A000-memory.dmp

Filesize
104KB

Download