xworm | 327e9385019706a31563b32a12a5cff31ca042078a0ccb8c9e668d1bd12a6497

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2025, 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VelocitySupportTool.exe
Size

10.1MB
MD5

67462ee5d9b46994eeb4a4c17410a206
SHA1

208514cd39b81476b31edbf2d56f6ef8e9e6870f
SHA256

327e9385019706a31563b32a12a5cff31ca042078a0ccb8c9e668d1bd12a6497
SHA512

ef551052fa54fdc2b7818f3dc6e6163a1301b413762ba69916347e3a4acfd2d9c3e878e732b66c05283f6c922f49a96a00bcd1655d7c2ba2ac363802efa78f94
SSDEEP

196608:SgNsPPpW0RYeIeKkrAW4LQkhf+LYYlrlJQxSQcGKQ999uvqivV9CSxTcf7nL:RKhW0afk0ZLQkhfNYGdH999VivOYeLL

Score

10^/10

xworm execution persistence pyinstaller rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

Mutex

0PPzuWGEdxzyPz40

Attributes

Install_directory
%AppData%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/0AT3JnEx

aes.plain

Extracted

Family

xworm

Attributes

Install_directory
%port%
install_file
USB.exe
pastebin_url
https://pastebin.com/raw/k7RJ4RZQ

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023cd7-24.dat	family_xworm
behavioral2/files/0x0008000000023cea-37.dat	family_xworm
behavioral2/memory/4296-49-0x0000000000BE0000-0x0000000000BF0000-memory.dmp	family_xworm
behavioral2/memory/3660-45-0x00000000002C0000-0x00000000002E0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1560	powershell.exe
4812	powershell.exe
632	powershell.exe
4144	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	VelocitySupportTool.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	VelocitySupportTool.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	VelocityFix.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	VelocityFix.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	VelocityFix.exe

Executes dropped EXE 7 IoCs

pid	Process
3300	VelocitySupportTool.exe
3660	VelocitySupportTools.exe
4296	VelocityFix.exe
2160	VelocitySupport.exe
4640	VelocitySupport.exe
4308	svchost.exe
4252	svchost.exe

Loads dropped DLL 8 IoCs

pid	Process
4640	VelocitySupport.exe
4640	VelocitySupport.exe
4640	VelocitySupport.exe
4640	VelocitySupport.exe
4640	VelocitySupport.exe
4640	VelocitySupport.exe
4640	VelocitySupport.exe
4640	VelocitySupport.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	VelocityFix.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
32	pastebin.com
34	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0008000000023cd8-22.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1560	powershell.exe
1560	powershell.exe
4812	powershell.exe
4812	powershell.exe
4812	powershell.exe
632	powershell.exe
632	powershell.exe
632	powershell.exe
4144	powershell.exe
4144	powershell.exe
4144	powershell.exe
4296	VelocityFix.exe
4296	VelocityFix.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3660	VelocitySupportTools.exe
Token: SeDebugPrivilege	4296	VelocityFix.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeDebugPrivilege	632	powershell.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	4296	VelocityFix.exe
Token: SeDebugPrivilege	4308	svchost.exe
Token: SeDebugPrivilege	4252	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4296	VelocityFix.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3300	1656	VelocitySupportTool.exe	85
PID 1656 wrote to memory of 3300	1656	VelocitySupportTool.exe	85
PID 3300 wrote to memory of 3660	3300	VelocitySupportTool.exe	86
PID 3300 wrote to memory of 3660	3300	VelocitySupportTool.exe	86
PID 3300 wrote to memory of 4296	3300	VelocitySupportTool.exe	88
PID 3300 wrote to memory of 4296	3300	VelocitySupportTool.exe	88
PID 1656 wrote to memory of 2160	1656	VelocitySupportTool.exe	87
PID 1656 wrote to memory of 2160	1656	VelocitySupportTool.exe	87
PID 2160 wrote to memory of 4640	2160	VelocitySupport.exe	93
PID 2160 wrote to memory of 4640	2160	VelocitySupport.exe	93
PID 4296 wrote to memory of 1560	4296	VelocityFix.exe	94
PID 4296 wrote to memory of 1560	4296	VelocityFix.exe	94
PID 4296 wrote to memory of 4812	4296	VelocityFix.exe	97
PID 4296 wrote to memory of 4812	4296	VelocityFix.exe	97
PID 4296 wrote to memory of 632	4296	VelocityFix.exe	104
PID 4296 wrote to memory of 632	4296	VelocityFix.exe	104
PID 4296 wrote to memory of 4144	4296	VelocityFix.exe	106
PID 4296 wrote to memory of 4144	4296	VelocityFix.exe	106
PID 4296 wrote to memory of 2620	4296	VelocityFix.exe	111
PID 4296 wrote to memory of 2620	4296	VelocityFix.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VelocitySupportTool.exe
"C:\Users\Admin\AppData\Local\Temp\VelocitySupportTool.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Roaming\VelocitySupportTool.exe
  "C:\Users\Admin\AppData\Roaming\VelocitySupportTool.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Users\Admin\AppData\Roaming\VelocitySupportTools.exe
    "C:\Users\Admin\AppData\Roaming\VelocitySupportTools.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3660
- - C:\Users\Admin\AppData\Roaming\VelocityFix.exe
    "C:\Users\Admin\AppData\Roaming\VelocityFix.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\VelocityFix.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'VelocityFix.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4144
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2620
- C:\Users\Admin\AppData\Roaming\VelocitySupport.exe
  "C:\Users\Admin\AppData\Roaming\VelocitySupport.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Users\Admin\AppData\Roaming\VelocitySupport.exe
    "C:\Users\Admin\AppData\Roaming\VelocitySupport.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4640

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\VelocitySupportTool.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ba169f4dcbbf147fe78ef0061a95e83b

SHA1
92a571a6eef49fff666e0f62a3545bcd1cdcda67

SHA256
5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

SHA512
8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d7ffb133db0265ed6ea822452200baad

SHA1
7645c6456be00e61ac8f64b2d2d70e7d1bb787ac

SHA256
89b73bb1dbe8fe5e028ed96158f5ae418b1e89856e70df2ddf10b1064cd0e029

SHA512
d8892187b0141ec137aec1419a20ddfef0732cabf9b38c5c30e9291d92d3f6321b728d420524e2cb1dde4551312c668288926b514ed0b0faeb04842ff6433685

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21602\VCRUNTIME140.dll

Filesize
117KB

MD5
862f820c3251e4ca6fc0ac00e4092239

SHA1
ef96d84b253041b090c243594f90938e9a487a9a

SHA256
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

SHA512
2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21602\_bz2.pyd

Filesize
84KB

MD5
057325e89b4db46e6b18a52d1a691caa

SHA1
8eab0897d679e223aa0d753f6d3d2119f4d72230

SHA256
5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869

SHA512
6bc7606869ca871b7ee5f2d43ec52ed295fa5c3a7df31dbd7e955ddb98c0748aff58d67f09d82edcde9d727e662d1550c6a9cf82f9cb7be021159d4b410e7cbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21602\_lzma.pyd

Filesize
155KB

MD5
3e73bc69efb418e76d38be5857a77027

SHA1
7bee01096669caa7bec81cdc77d6bb2f2346608c

SHA256
6f48e7eba363cb67f3465a6c91b5872454b44fc30b82710dfa4a4489270ce95c

SHA512
b6850e764c8849058488f7051dcabff096709b002d2f427a49e83455838d62a9d3fc7b65285702de2b995858ed433e35a0c4da93c2d5ae34684bf624eb59fa6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21602\_tkinter.pyd

Filesize
66KB

MD5
653b8194cafca1902f451fdd2563b770

SHA1
701497c55588a9c2d63a3eb16651dd22d47140c2

SHA256
6edeccc758733e44edaeff20e403ede9a782335f7bd80975697547087c32c5cc

SHA512
671286359096a454338d1c371e576f24c6ae1eb6cbfbf7ddc0044dd2dc5d14f6aa0044c8112512839f6857eb70bcb98544b149b16392ca9ce09d207134644ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21602\python313.dll

Filesize
5.8MB

MD5
501080884bed38cb8801a307c9d7b7b4

SHA1
881b250cc8f4fa4f75111ac557a4fde8e1e217af

SHA256
bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749

SHA512
63d74a4871d1c72c2a79ae8a5d380070f9d2128c16949c3ad36c9862fcc4dab738137ed3d51caf0bc46b36655f8bd8a2d425d68200123415ee8d4de0e1cbebc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21602\tcl86t.dll

Filesize
1.8MB

MD5
3688caba94d9a1dc124df80aef41ac47

SHA1
66b314fc54b1d2475bfb655facacf8a8d6eacfed

SHA256
31560ca3b0eec014013405e9652b9261824232883749f0461d7d4e5f7faea3ab

SHA512
f3cd68e26f008b27370bd5222b6dafd8bb5f312a885db4e2f8f6502a719403263412f2aa7c8451b4ab7c59e674e3746710ce5a3c3c09f0cdb0266f82f226e9f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21602\tk86t.dll

Filesize
1.5MB

MD5
d379810228b51c2571d9071eed3286b8

SHA1
a643cda1683168e27a209b397d0eea7bc14c5103

SHA256
34d402f3d6a237aac1165a010016ac032e0ae1a86dcfa03dda49ebfc0af40cad

SHA512
f195c4d38f3e1d6853efae68ef50a2d3e70fc0f3840aa9aa2c1cddaec6a311e60cd86fc84dcdf0d4febf4d0e94bb89238c1408c5781302bbfaeafc613e10084a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21602\zlib1.dll

Filesize
144KB

MD5
de2e3379deeacbe476b9ee8ddeac7ffe

SHA1
b112c267f5a6e3d06809896708d9ef9f7c118462

SHA256
94675de9234f00e75c73e4973f8fb49a272a1df8003337205cd1b15fb642a168

SHA512
0dbe2d131f41258c81e931bbc459051b26de488030a0ad20cb1d2d8ce8cce0a1ddd17a7049a2878368d7e535428bdc6c7886265f43be27fbc6aeed784080c93b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4m5eiizf.xps.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\VelocityFix.exe

Filesize
39KB

MD5
53bfc0f8986b70724e4823f47241f6aa

SHA1
62e79122cea2f27e6f093fa484e5aa7795088ccc

SHA256
9286f18acfd1a8277f23da9a1079b571587c9bd5f28dbcff51845b933595426c

SHA512
5abbfbcc2e5cff491f4d213f4b83047f50e1de77d67631d510c7b540965c5f03a7611a0f1e79479d3a05a1e2f05fee6180b47ececc96c78f2e38ee5fa06430f2

Download Submit
C:\Users\Admin\AppData\Roaming\VelocitySupport.exe

Filesize
9.8MB

MD5
38c4223ac857cb56e3014d33c2062d05

SHA1
d32150012ab49dad1f1c7ad3b68b2e3c483f81f5

SHA256
cbcb51837d0ebd8fcae0dfa61ba516c103c34ca56a0aef400a2d14e9610cb43e

SHA512
f000154ce3e2fb06fc98d1cf8d867996c0fc2747aefc24a7d091a13443316396e24080aafffdb048de1b37ab360265afe7cee31ab07c7eb246e293b50c0edfa7

Download Submit
C:\Users\Admin\AppData\Roaming\VelocitySupportTool.exe

Filesize
250KB

MD5
1904b43012a89c4ec5b3c82c7f7e313e

SHA1
3b0eedb1ba0bff205b9d099dd355091229007d04

SHA256
1446224da9810c06e7336730dab3811c39c8d1d4b200c4e7d568b1440b432f61

SHA512
c37e6bba9776516201c28367dcb541ac108a1def13d72eaf311800710c854a794835b7b92075e3b5d61ff3c500e1446004479065e418e3cb0dfb41963123a06e

Download Submit
C:\Users\Admin\AppData\Roaming\VelocitySupportTools.exe

Filesize
103KB

MD5
3d47fe184f91ceb1bd0d4c213da5ebfa

SHA1
05ca3411a2b89f0c7884024f48b51e7574862992

SHA256
f0879c8017351b9cebbb546ea14f323ddb777cd97e435bb2de904ac28aa8525f

SHA512
1975ed404e30d674806a8209982cf5c81ec7b057178e5597195ca89d79406ddc1edcd25a3e6098e74ac5ce220e9a9975cb2bcbff4d2de8abfa7952c1902ff256

Download Submit
memory/1560-1011-0x000001FC66A20000-0x000001FC66A42000-memory.dmp

Filesize
136KB

Download
memory/1656-0-0x00007FFD9B283000-0x00007FFD9B285000-memory.dmp

Filesize
8KB

Download
memory/1656-1-0x0000000000BA0000-0x00000000015B4000-memory.dmp

Filesize
10.1MB

Download
memory/3300-50-0x00007FFD9B280000-0x00007FFD9BD41000-memory.dmp

Filesize
10.8MB

Download
memory/3300-15-0x00007FFD9B280000-0x00007FFD9BD41000-memory.dmp

Filesize
10.8MB

Download
memory/3300-13-0x0000000000640000-0x0000000000684000-memory.dmp

Filesize
272KB

Download
memory/3660-45-0x00000000002C0000-0x00000000002E0000-memory.dmp

Filesize
128KB

Download
memory/4296-49-0x0000000000BE0000-0x0000000000BF0000-memory.dmp

Filesize
64KB

Download
memory/4296-1056-0x000000001CE50000-0x000000001CE5C000-memory.dmp

Filesize
48KB

Download
memory/4640-1052-0x00007FFDA9A60000-0x00007FFDA9A89000-memory.dmp

Filesize
164KB

Download