Analysis
- user interaction
yes - max time kernel
43s - max time network
68s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
13/02/2026, 15:24
General
- Target Crack_voicemod_proV3.exe
- Size 6.1MB
- Sample260213-ss7ydafy6c
- SHA256 78a384edfcff245183b8dfea7d7c889bf8ad99b45bd1d8232dae608a88ed34b2
Malware Config
Extracted
-
xworm
-
144.31.164.226:56778
-
Install_directory
%AppData%
-
install_file
svchost.exe
-
telegram
https://api.telegram.org/bot8124774457:AAEauJyi2Yn36b2arg_KkQ-4kupsJaEpOY4/sendMessage?chat_id=7641564982
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Command and Scripting Interpreter: PowerShell 1 TTPs 23 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 15 IoCs
- Adds Run key to start application 2 TTPs 14 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"3⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"4⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"5⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"6⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"7⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"8⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"9⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"9⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"10⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"11⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"11⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"12⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"12⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"13⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"14⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"14⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'15⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"15⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"15⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'16⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"16⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'17⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"17⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'18⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"18⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'19⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"19⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'20⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"20⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'21⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"21⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'22⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"22⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'23⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"23⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Discord.exe'24⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exe"C:\Users\Admin\AppData\Local\Temp\Discord.exe"24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"C:\Users\Admin\AppData\Local\Temp\Crack_voicemod_proV3.exe"24⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Discord.exeC:\Users\Admin\AppData\Local\Temp\Discord.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Crack_voicemod_proV3.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
Discord.exe
__PSScriptPolicyTest_q1wmt4wk.yqf.ps1
memory/632-298-0x000000001BCC0000-0x000000001BCCC000-memory.dmp
memory/660-221-0x0000000000DB0000-0x0000000000DBC000-memory.dmp
memory/976-101-0x0000029B57470000-0x0000029B5747C000-memory.dmp
memory/1004-195-0x0000000000C60000-0x0000000000C6C000-memory.dmp
memory/1016-75-0x000001C1917B0000-0x000001C1917BC000-memory.dmp
memory/1032-153-0x00000224E4610000-0x00000224E461C000-memory.dmp
memory/1080-361-0x00000265EC520000-0x00000265EC52C000-memory.dmp
memory/1104-220-0x000000001C5B0000-0x000000001C5BC000-memory.dmp
memory/1148-142-0x000000001C5F0000-0x000000001C5FC000-memory.dmp
memory/1384-430-0x0000000002640000-0x000000000264C000-memory.dmp
memory/1612-455-0x000000001C1B0000-0x000000001C1BC000-memory.dmp
memory/1624-481-0x000000001BC00000-0x000000001BC0C000-memory.dmp
memory/1652-518-0x000002B33A140000-0x000002B33A14C000-memory.dmp
memory/1660-91-0x00000000012D0000-0x00000000012DC000-memory.dmp
memory/1736-533-0x000000001BE60000-0x000000001BE6C000-memory.dmp
memory/1760-273-0x00000000008E0000-0x00000000008EC000-memory.dmp
memory/1776-335-0x000001760D5D0000-0x000001760D5DC000-memory.dmp
memory/1836-324-0x000000001B9B0000-0x000000001B9BC000-memory.dmp
memory/1844-231-0x000001F74C290000-0x000001F74C29C000-memory.dmp
memory/2260-247-0x0000000000FB0000-0x0000000000FBC000-memory.dmp
memory/2412-2-0x00000186C6160000-0x00000186C6170000-memory.dmp
memory/2412-1-0x00000186C6160000-0x00000186C6170000-memory.dmp
memory/2412-9-0x00000186C60B0000-0x00000186C60D2000-memory.dmp
memory/2412-11-0x00000186C6160000-0x00000186C6170000-memory.dmp
memory/2412-14-0x00000186ADA00000-0x00000186ADA0C000-memory.dmp
memory/2432-117-0x0000000001520000-0x000000000152C000-memory.dmp
memory/2440-36-0x0000000000AA0000-0x0000000000AAC000-memory.dmp
memory/2464-350-0x0000000002FF0000-0x0000000002FFC000-memory.dmp
memory/2500-534-0x00000000011E0000-0x00000000011EC000-memory.dmp
memory/2504-48-0x0000020E096F0000-0x0000020E096FC000-memory.dmp
memory/2780-403-0x0000000003540000-0x000000000354C000-memory.dmp
memory/2804-482-0x0000000002400000-0x000000000240C000-memory.dmp
memory/3012-127-0x0000021E1D660000-0x0000021E1D66C000-memory.dmp
memory/3076-508-0x0000000000B90000-0x0000000000B9C000-memory.dmp
memory/3196-37-0x0000000002870000-0x000000000287C000-memory.dmp
memory/3196-30-0x0000000000810000-0x000000000082E000-memory.dmp
memory/3244-64-0x000000001C6D0000-0x000000001C6DC000-memory.dmp
memory/3416-299-0x0000000000BD0000-0x0000000000BDC000-memory.dmp
memory/3496-376-0x000000001C230000-0x000000001C23C000-memory.dmp
memory/3516-466-0x0000029F15EB0000-0x0000029F15EBC000-memory.dmp
memory/3796-309-0x000001D9D79B0000-0x000001D9D79BC000-memory.dmp
memory/3888-387-0x0000014C22290000-0x0000014C223B3000-memory.dmp
memory/3888-388-0x0000014C224D0000-0x0000014C224DC000-memory.dmp
memory/4216-492-0x000002C060F40000-0x000002C060F4C000-memory.dmp
memory/4276-456-0x0000000001690000-0x000000000169C000-memory.dmp
memory/4364-194-0x000000001B600000-0x000000001B60C000-memory.dmp
memory/4380-377-0x0000000000B50000-0x0000000000B5C000-memory.dmp
memory/4520-169-0x0000000000A40000-0x0000000000A4C000-memory.dmp
memory/4564-179-0x000001D59E020000-0x000001D59E02C000-memory.dmp
memory/4712-246-0x0000000001CB0000-0x0000000001CBC000-memory.dmp
memory/4980-116-0x0000000002D90000-0x0000000002D9C000-memory.dmp
memory/5112-143-0x0000000001430000-0x000000000143C000-memory.dmp
memory/5332-33-0x00000000031B0000-0x00000000031BC000-memory.dmp
memory/5332-0-0x00000000009A0000-0x0000000000FB8000-memory.dmp
memory/5332-15-0x000000001C4C0000-0x000000001C4D0000-memory.dmp
memory/5452-414-0x0000027FB1A20000-0x0000027FB1A2C000-memory.dmp
memory/5572-65-0x0000000000F90000-0x0000000000F9C000-memory.dmp
memory/5640-272-0x0000000002A70000-0x0000000002A7C000-memory.dmp
memory/5696-351-0x0000000002CC0000-0x0000000002CCC000-memory.dmp
memory/5708-544-0x000001D04D3B0000-0x000001D04D4D3000-memory.dmp
memory/5708-545-0x000001D04EDF0000-0x000001D04EDFC000-memory.dmp
memory/5880-283-0x000001F7372A0000-0x000001F7372AC000-memory.dmp
memory/5888-168-0x0000000002F70000-0x0000000002F7C000-memory.dmp
memory/5968-429-0x000000001B850000-0x000000001B85C000-memory.dmp
memory/5996-507-0x000000001BBD0000-0x000000001BBDC000-memory.dmp
memory/5996-205-0x00000152228A0000-0x00000152228AC000-memory.dmp
memory/6000-325-0x0000000002830000-0x000000000283C000-memory.dmp
memory/6048-90-0x0000000002830000-0x000000000283C000-memory.dmp
memory/6072-257-0x0000028896470000-0x000002889647C000-memory.dmp
memory/6072-404-0x0000000000C50000-0x0000000000C5C000-memory.dmp
memory/6136-440-0x0000028FF3E30000-0x0000028FF3E3C000-memory.dmp