xworm | c0361ce0281736d7c36d465ba67683cc16d70335186bd179cedc8f0383760ae4

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/03/2025, 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BootstrapperNeww.exe
Size

2.9MB
MD5

1b1b8584e5ef883aaa5be59076087d6b
SHA1

e2067cedc5a022487fdcd4f7407b75202d6b0eb1
SHA256

c0361ce0281736d7c36d465ba67683cc16d70335186bd179cedc8f0383760ae4
SHA512

73a951370df807595ddb61ab81aa7e5d7407fca5dba08f40e209d48e1bc2e4e4960439fa61bdf8a2967cde1865460c1df025fff6124607f6eb0752f35e382d45
SSDEEP

49152:IlcyXfHnaBTof9ePCjkIAm1skqXfd+/9A9ByClY1v/a/ehH7pNLLn2tM:CZXfHaFoCIvqkqXf0FglY1XOe97vLnh

Score

10^/10

xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

casino-offline.gl.at.ply.gg:34999

Attributes

Install_directory
%AppData%
install_file
NVIDIA app.exe

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0008000000017481-8.dat	family_xworm
behavioral1/memory/2972-11-0x0000000000400000-0x00000000006F8000-memory.dmp	family_xworm
behavioral1/memory/2508-13-0x0000000000930000-0x0000000000948000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2736	powershell.exe
2272	powershell.exe
2656	powershell.exe
672	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVIDIA app.lnk	loader.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVIDIA app.lnk	loader.exe

Executes dropped EXE 3 IoCs

pid	Process
2360	BootstrapperNew.exe
2508	loader.exe
1196	Process not Found

Loads dropped DLL 3 IoCs

pid	Process
2972	BootstrapperNeww.exe
2972	BootstrapperNeww.exe
1196	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\NVIDIA app = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA app.exe"	loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BootstrapperNeww.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	csrss.exe

Enumerates system info in registry 2 TTPs 32 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor"	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000	winlogon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2736	powershell.exe
2272	powershell.exe
2656	powershell.exe
672	powershell.exe
2508	loader.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	loader.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeDebugPrivilege	2508	loader.exe
Token: 33	2308	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2308	AUDIODG.EXE
Token: 33	2308	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2308	AUDIODG.EXE
Token: SeShutdownPrivilege	2856	LogonUI.exe
Token: SeShutdownPrivilege	2856	LogonUI.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2508	loader.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2360	2972	BootstrapperNeww.exe	30
PID 2972 wrote to memory of 2360	2972	BootstrapperNeww.exe	30
PID 2972 wrote to memory of 2360	2972	BootstrapperNeww.exe	30
PID 2972 wrote to memory of 2360	2972	BootstrapperNeww.exe	30
PID 2972 wrote to memory of 2508	2972	BootstrapperNeww.exe	31
PID 2972 wrote to memory of 2508	2972	BootstrapperNeww.exe	31
PID 2972 wrote to memory of 2508	2972	BootstrapperNeww.exe	31
PID 2972 wrote to memory of 2508	2972	BootstrapperNeww.exe	31
PID 2508 wrote to memory of 2736	2508	loader.exe	32
PID 2508 wrote to memory of 2736	2508	loader.exe	32
PID 2508 wrote to memory of 2736	2508	loader.exe	32
PID 2508 wrote to memory of 2272	2508	loader.exe	34
PID 2508 wrote to memory of 2272	2508	loader.exe	34
PID 2508 wrote to memory of 2272	2508	loader.exe	34
PID 2508 wrote to memory of 2656	2508	loader.exe	36
PID 2508 wrote to memory of 2656	2508	loader.exe	36
PID 2508 wrote to memory of 2656	2508	loader.exe	36
PID 2508 wrote to memory of 672	2508	loader.exe	38
PID 2508 wrote to memory of 672	2508	loader.exe	38
PID 2508 wrote to memory of 672	2508	loader.exe	38
PID 2508 wrote to memory of 1304	2508	loader.exe	40
PID 2508 wrote to memory of 1304	2508	loader.exe	40
PID 2508 wrote to memory of 1304	2508	loader.exe	40
PID 2508 wrote to memory of 2152	2508	loader.exe	45
PID 2508 wrote to memory of 2152	2508	loader.exe	45
PID 2508 wrote to memory of 2152	2508	loader.exe	45
PID 2088 wrote to memory of 2856	2088	csrss.exe	52
PID 2088 wrote to memory of 2856	2088	csrss.exe	52
PID 2852 wrote to memory of 2856	2852	winlogon.exe	52
PID 2852 wrote to memory of 2856	2852	winlogon.exe	52
PID 2852 wrote to memory of 2856	2852	winlogon.exe	52
PID 2088 wrote to memory of 2856	2088	csrss.exe	52
PID 2088 wrote to memory of 2856	2088	csrss.exe	52
PID 2088 wrote to memory of 2856	2088	csrss.exe	52
PID 2088 wrote to memory of 2856	2088	csrss.exe	52
PID 2088 wrote to memory of 2856	2088	csrss.exe	52
PID 2088 wrote to memory of 2856	2088	csrss.exe	52
PID 2088 wrote to memory of 2856	2088	csrss.exe	52
PID 2088 wrote to memory of 2856	2088	csrss.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BootstrapperNeww.exe
"C:\Users\Admin\AppData\Local\Temp\BootstrapperNeww.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\loader.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'loader.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\NVIDIA app.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NVIDIA app.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:672
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "NVIDIA app" /tr "C:\Users\Admin\AppData\Roaming\NVIDIA app.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1304
- - C:\Windows\system32\shutdown.exe
    shutdown.exe -L
    3⤵
    PID:2152

C:\Windows\system32\taskeng.exe
taskeng.exe {3D363E00-E38A-4375-90CA-B24518E21023} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]
1⤵
PID:2300

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2124

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x468
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
5c4363ccddba1c4a2dd06fa99debe8ec

SHA1
2cd0f7639e4bd38af6cf22f7648a037accc7d100

SHA256
d8dde507d8b77232a70f8461f683a0665673b6a838a82f3db2d557b8621f0ccf

SHA512
4ec1511e1b993005bd2c3c01f666d378f4c51e379358bbb697f11ea9c779d0253ef3393845a10f5876a50aacbac11e9f741b6213d5b37cf5a8d2dc348ea3a12d

Download Submit
\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe

Filesize
2.9MB

MD5
f227cdfd423b3cc03bb69c49babf4da3

SHA1
3db5a97d9b0f2545e7ba97026af6c28512200441

SHA256
cb5d6c1ca0aa6232a2d55e14b20ac4a9945a0bd063c57d60a5ed3ae94160e3e8

SHA512
b10afd03b02a928545c16fad39a6ae46b68b1e1a2477a6990803ce80008e7161fb2ebc9380ba15a1b074bb436aa34bcd6c94a922933d438b1c22489717e1e10e

Download Submit
\Users\Admin\AppData\Local\Temp\loader.exe

Filesize
67KB

MD5
de7e058ade5e6ebe2cce6b2fd10d4bae

SHA1
0196abbe9f3fc7db4ad524d29119f7ee9beb37db

SHA256
271c6a42cc3f42923496857ea6adf8407f73fda81faa2586fb0fe5f6901e6d5a

SHA512
3fb799fca20dfb6a2871b507bec70587c555882ab7b3af6bbca855f90b66f5172a22d5dda0f2baa9e67781b9277d30e04d9dccfddc8dea095ab75b4898d921cd

Download Submit
memory/2272-41-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2272-40-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/2360-15-0x0000000000B50000-0x0000000000B5A000-memory.dmp

Filesize
40KB

Download
memory/2360-27-0x0000000002770000-0x0000000002778000-memory.dmp

Filesize
32KB

Download
memory/2360-20-0x000000001E1E0000-0x000000001E2E0000-memory.dmp

Filesize
1024KB

Download
memory/2360-21-0x0000000002670000-0x000000000267A000-memory.dmp

Filesize
40KB

Download
memory/2360-23-0x0000000002740000-0x0000000002748000-memory.dmp

Filesize
32KB

Download
memory/2360-25-0x0000000002680000-0x000000000268A000-memory.dmp

Filesize
40KB

Download
memory/2360-24-0x0000000002750000-0x0000000002766000-memory.dmp

Filesize
88KB

Download
memory/2360-22-0x0000000002710000-0x0000000002736000-memory.dmp

Filesize
152KB

Download
memory/2360-26-0x0000000002660000-0x000000000266A000-memory.dmp

Filesize
40KB

Download
memory/2360-17-0x0000000000B50000-0x0000000000B60000-memory.dmp

Filesize
64KB

Download
memory/2360-57-0x0000000000B50000-0x0000000000B5A000-memory.dmp

Filesize
40KB

Download
memory/2360-14-0x0000000000040000-0x0000000000322000-memory.dmp

Filesize
2.9MB

Download
memory/2360-16-0x0000000000B50000-0x0000000000B5A000-memory.dmp

Filesize
40KB

Download
memory/2508-13-0x0000000000930000-0x0000000000948000-memory.dmp

Filesize
96KB

Download
memory/2508-58-0x0000000000920000-0x000000000092C000-memory.dmp

Filesize
48KB

Download
memory/2736-34-0x0000000002760000-0x0000000002768000-memory.dmp

Filesize
32KB

Download
memory/2736-33-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2972-11-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download