xworm | 6857d59d1179d9e3745115f7e08cde964c3cee54bb91fd891bba282fe226eb2b

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2025, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FFDOC-2025210pdf.exe
Size

319KB
MD5

d8ea07f0f0072e6ae8ac3b7996941eb7
SHA1

24a6d36259ca0d0c89f46411da822a7f2683beaf
SHA256

6857d59d1179d9e3745115f7e08cde964c3cee54bb91fd891bba282fe226eb2b
SHA512

7c44f2746117f35e8bd8cf40327390edfd7a33650a42f3a8e110de3f1eac02649ec50988c9be956968627af0682e22edbfa442fbf6f206a770c086289d88bbd3
SSDEEP

6144:Lyh4ZwGcFZxO4MvaL7eS7sZXl1YoEhVJGfT/zoMWk:LaZc4MBS7s6sfXotk

Score

10^/10

xworm discovery rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

56TvElZMbqDoRvU7

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3188-1347-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 1832 created 3464	1832	FFDOC-2025210pdf.exe	56
PID 4320 created 3464	4320	imzluw.exe	56
PID 2696 created 3464	2696	irurcy.exe	56

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation	FFDOC-2025210pdf.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Current.vbs	imzluw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Current.vbs	irurcy.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Current.vbs	FFDOC-2025210pdf.exe

Executes dropped EXE 4 IoCs

pid	Process
4320	imzluw.exe
2696	irurcy.exe
4804	imzluw.exe
5176	irurcy.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1832 set thread context of 3188	1832	FFDOC-2025210pdf.exe	99
PID 4320 set thread context of 4804	4320	imzluw.exe	111
PID 2696 set thread context of 5176	2696	irurcy.exe	112
PID 5176 set thread context of 4804	5176	irurcy.exe	111
PID 5176 set thread context of 5972	5176	irurcy.exe	113
PID 5972 set thread context of 4804	5972	netsh.exe	111

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FFDOC-2025210pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FFDOC-2025210pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irurcy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imzluw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imzluw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1479699283-3000499823-2337359760-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	netsh.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1832	FFDOC-2025210pdf.exe
1832	FFDOC-2025210pdf.exe
1832	FFDOC-2025210pdf.exe
4320	imzluw.exe
4320	imzluw.exe
4320	imzluw.exe
2696	irurcy.exe
2696	irurcy.exe
2696	irurcy.exe
5176	irurcy.exe
5176	irurcy.exe
5176	irurcy.exe
5176	irurcy.exe
5176	irurcy.exe
5176	irurcy.exe
5176	irurcy.exe
5176	irurcy.exe
5972	netsh.exe
5972	netsh.exe
5972	netsh.exe
5972	netsh.exe
5972	netsh.exe
5972	netsh.exe
5972	netsh.exe
5972	netsh.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
5176	irurcy.exe
4804	imzluw.exe
4804	imzluw.exe
5972	netsh.exe
5972	netsh.exe
5972	netsh.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	FFDOC-2025210pdf.exe
Token: SeDebugPrivilege	1832	FFDOC-2025210pdf.exe
Token: SeDebugPrivilege	3188	FFDOC-2025210pdf.exe
Token: SeDebugPrivilege	2696	irurcy.exe
Token: SeDebugPrivilege	4320	imzluw.exe
Token: SeDebugPrivilege	4320	imzluw.exe
Token: SeDebugPrivilege	2696	irurcy.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4804	imzluw.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 3188	1832	FFDOC-2025210pdf.exe	99
PID 1832 wrote to memory of 3188	1832	FFDOC-2025210pdf.exe	99
PID 1832 wrote to memory of 3188	1832	FFDOC-2025210pdf.exe	99
PID 1832 wrote to memory of 3188	1832	FFDOC-2025210pdf.exe	99
PID 1832 wrote to memory of 3188	1832	FFDOC-2025210pdf.exe	99
PID 1832 wrote to memory of 3188	1832	FFDOC-2025210pdf.exe	99
PID 1832 wrote to memory of 3188	1832	FFDOC-2025210pdf.exe	99
PID 1832 wrote to memory of 3188	1832	FFDOC-2025210pdf.exe	99
PID 3188 wrote to memory of 4320	3188	FFDOC-2025210pdf.exe	109
PID 3188 wrote to memory of 4320	3188	FFDOC-2025210pdf.exe	109
PID 3188 wrote to memory of 4320	3188	FFDOC-2025210pdf.exe	109
PID 3188 wrote to memory of 2696	3188	FFDOC-2025210pdf.exe	110
PID 3188 wrote to memory of 2696	3188	FFDOC-2025210pdf.exe	110
PID 3188 wrote to memory of 2696	3188	FFDOC-2025210pdf.exe	110
PID 4320 wrote to memory of 4804	4320	imzluw.exe	111
PID 4320 wrote to memory of 4804	4320	imzluw.exe	111
PID 4320 wrote to memory of 4804	4320	imzluw.exe	111
PID 4320 wrote to memory of 4804	4320	imzluw.exe	111
PID 4320 wrote to memory of 4804	4320	imzluw.exe	111
PID 4320 wrote to memory of 4804	4320	imzluw.exe	111
PID 4320 wrote to memory of 4804	4320	imzluw.exe	111
PID 4320 wrote to memory of 4804	4320	imzluw.exe	111
PID 2696 wrote to memory of 5176	2696	irurcy.exe	112
PID 2696 wrote to memory of 5176	2696	irurcy.exe	112
PID 2696 wrote to memory of 5176	2696	irurcy.exe	112
PID 2696 wrote to memory of 5176	2696	irurcy.exe	112
PID 2696 wrote to memory of 5176	2696	irurcy.exe	112
PID 2696 wrote to memory of 5176	2696	irurcy.exe	112
PID 4804 wrote to memory of 5972	4804	imzluw.exe	113
PID 4804 wrote to memory of 5972	4804	imzluw.exe	113
PID 4804 wrote to memory of 5972	4804	imzluw.exe	113
PID 5972 wrote to memory of 920	5972	netsh.exe	114
PID 5972 wrote to memory of 920	5972	netsh.exe	114

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3464
- C:\Users\Admin\AppData\Local\Temp\FFDOC-2025210pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\FFDOC-2025210pdf.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops startup file
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1832
- C:\Users\Admin\AppData\Local\Temp\FFDOC-2025210pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\FFDOC-2025210pdf.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Users\Admin\AppData\Local\Temp\imzluw.exe
    "C:\Users\Admin\AppData\Local\Temp\imzluw.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4320
- - C:\Users\Admin\AppData\Local\Temp\irurcy.exe
    "C:\Users\Admin\AppData\Local\Temp\irurcy.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2696
- C:\Users\Admin\AppData\Local\Temp\imzluw.exe
  "C:\Users\Admin\AppData\Local\Temp\imzluw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\SysWOW64\netsh.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\Program Files\Mozilla Firefox\Firefox.exe
      "C:\Program Files\Mozilla Firefox\Firefox.exe"
      4⤵
      PID:920
- C:\Users\Admin\AppData\Local\Temp\irurcy.exe
  "C:\Users\Admin\AppData\Local\Temp\irurcy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:5176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\80fQ01Ig9

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\80fQ01Ig9

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\imzluw.exe

Filesize
321KB

MD5
5138a5678f8982621ea73a6335b7b38b

SHA1
8c2d602d5666b03fbc3ec1decce2b28d6bd7ca5f

SHA256
ebb556e873ef35d93c5c62404263659ac3f2604cea643015f29fee85c3a3a167

SHA512
289732f4ab4a7bae27b24e6d272832f0d43824f3dc03c1554b5c8cf1a24f0f25d18ae794c3ece142716b3e82319a3317a17f909af780ae258fc2a9d831f7ef50

Download Submit
C:\Users\Admin\AppData\Local\Temp\irurcy.exe

Filesize
321KB

MD5
62e28c115b73a2b918fe4a33148f36e4

SHA1
0601aba05513fdf160a9f10a92dca288bb0cd981

SHA256
d0e058ee5585d906c9dab04a5399cedbec52a97416e201f59714d8da7d99b3b3

SHA512
17af001fe8c5411b44fe0384471ab86de58fcc4620b0205fa47d9968b861bbcd7644f0876dfe6d3559cef88b0a294d71ebf695aaeccf1d5f71b098595497fe9d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Current.vbs

Filesize
82B

MD5
89d8c2a9f15a247516fed10895467a3b

SHA1
b411d417c30da83dfbd39ecc44f0dde0529fdeaf

SHA256
7b5f7caf04bbc0eeef94c49e6bbef4b40253724c893c3055215974c730413aa5

SHA512
f6a0652703cc6f0d1329b8cdd8414246df9801390a779cf38c49e3be080e709bd6b96f7de80a8f36e918ba35a50ec0a8cf916d523961338312d8ac7937ca676d

Download Submit
\??\c:\users\admin\appdata\roaming\current.exe

Filesize
321KB

MD5
452984f98fdad49b2077f586842d3fe8

SHA1
a285ca52d31785be9c1e0b4794432f090a17d614

SHA256
8ce5dea53cccf5c37f4b0452952b15e90965bb8120a32fd312ed6e4df67f8b76

SHA512
6ff4905e421637e8672c8a498ea6e40375a0e6224bed8a62e2ab968106f2daa977acd9b1524e2bd363b1c71e107ec5292a7dc0b00910c86a905f70bd94ab6458

Download Submit
memory/1832-9-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-1328-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/1832-15-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-23-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-67-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-69-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-65-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-63-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-61-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-59-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-57-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-55-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-53-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-51-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-49-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-45-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-43-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-41-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-39-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-37-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-35-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-33-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-29-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-27-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-25-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-21-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-19-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-17-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-13-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-11-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-4-0x00000000060B0000-0x0000000006654000-memory.dmp

Filesize
5.6MB

Download
memory/1832-8-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-47-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-1329-0x0000000005DE0000-0x0000000005E3C000-memory.dmp

Filesize
368KB

Download
memory/1832-5-0x0000000005BE0000-0x0000000005C72000-memory.dmp

Filesize
584KB

Download
memory/1832-6-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-31-0x0000000005A00000-0x0000000005AFB000-memory.dmp

Filesize
1004KB

Download
memory/1832-1330-0x0000000005EA0000-0x0000000005EF8000-memory.dmp

Filesize
352KB

Download
memory/1832-1331-0x0000000006660000-0x00000000066AC000-memory.dmp

Filesize
304KB

Download
memory/1832-1332-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

Filesize
4KB

Download
memory/1832-1333-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/1832-1334-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/1832-1335-0x0000000006710000-0x0000000006764000-memory.dmp

Filesize
336KB

Download
memory/1832-1341-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/1832-1343-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/1832-1345-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/1832-1346-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/1832-0-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

Filesize
4KB

Download
memory/1832-1-0x00000000008F0000-0x0000000000946000-memory.dmp

Filesize
344KB

Download
memory/1832-2-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/1832-3-0x0000000005A00000-0x0000000005B00000-memory.dmp

Filesize
1024KB

Download
memory/2696-4027-0x0000000005F80000-0x000000000601C000-memory.dmp

Filesize
624KB

Download
memory/2696-1378-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/2696-1376-0x0000000000A10000-0x0000000000A66000-memory.dmp

Filesize
344KB

Download
memory/2696-4063-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/2696-1539-0x0000000005B10000-0x0000000005C52000-memory.dmp

Filesize
1.3MB

Download
memory/2696-4029-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/2696-4028-0x0000000006150000-0x00000000061E8000-memory.dmp

Filesize
608KB

Download
memory/3188-1353-0x0000000005EC0000-0x0000000005F26000-memory.dmp

Filesize
408KB

Download
memory/3188-1351-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/3188-1348-0x00000000056F0000-0x000000000578C000-memory.dmp

Filesize
624KB

Download
memory/3188-1349-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/3188-1347-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3188-1352-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/3188-1350-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/4320-3780-0x0000000005C40000-0x0000000005CD2000-memory.dmp

Filesize
584KB

Download
memory/4320-1379-0x0000000005860000-0x000000000599A000-memory.dmp

Filesize
1.2MB

Download
memory/4320-1377-0x0000000000710000-0x0000000000766000-memory.dmp

Filesize
344KB

Download
memory/4320-3529-0x0000000005B60000-0x0000000005BF4000-memory.dmp

Filesize
592KB

Download