xworm | a403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe
Size 10.8MB
Sample260522-ddv8psfy8x
SHA256 a403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1
MD5 4c4d232c28d1081d032892b418be1583
SHA1 51271091408567f4fab11254bcc77da983ec25a8
SHA512 fb6dcc593a612d9b2f4eac2aee508ffff70a69dc2cf0f8eb175a464c99145593bc8cc269f04876e61274f0807c5f6696ebca5298b360ca32f782e5fa9373f7f4
SSDEEP 12288:SstE/7ioLLu8nuMoBpxB0IgP5sOttsiBPJnu:SwG7ionu8n5U/0bhtsiBxu
TLSH
T11BB6A419E253CF6E187713E055655FFCAEEEB14E696A1687D0F9E24332E606C80BF840
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

6.tcp.eu.ngrok.io:29843

Mutex

n2a9kAFC9fPtli8N

Attributes

Install_directory
%AppData%
install_file
svhost.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5308-47-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4648	powershell.exe
4748	powershell.exe
5184	powershell.exe
2032	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsService.exe	xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe

Executes dropped EXE 2 IoCs

pid	Process
1612	winupdate.exe
1384	svhost.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdateManager = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Updates\\winupdate.exe"	xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdateManager = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Updates\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe"	cvtres.exe

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	6.tcp.eu.ngrok.io

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3732 set thread context of 5308	3732	xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe	80
PID 1612 set thread context of 3636	1612	winupdate.exe	83

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2032	powershell.exe
2032	powershell.exe
4648	powershell.exe
4648	powershell.exe
4748	powershell.exe
4748	powershell.exe
5184	powershell.exe
5184	powershell.exe
5308	cvtres.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5308	cvtres.exe
Token: SeDebugPrivilege	3636	cvtres.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	5184	powershell.exe
Token: SeDebugPrivilege	5308	cvtres.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5308	cvtres.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 5308	3732	xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe	80
PID 3732 wrote to memory of 5308	3732	xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe	80
PID 3732 wrote to memory of 5308	3732	xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe	80
PID 3732 wrote to memory of 5308	3732	xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe	80
PID 3732 wrote to memory of 5308	3732	xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe	80
PID 1612 wrote to memory of 3636	1612	winupdate.exe	83
PID 1612 wrote to memory of 3636	1612	winupdate.exe	83
PID 1612 wrote to memory of 3636	1612	winupdate.exe	83
PID 1612 wrote to memory of 3636	1612	winupdate.exe	83
PID 1612 wrote to memory of 3636	1612	winupdate.exe	83
PID 5308 wrote to memory of 2032	5308	cvtres.exe	84
PID 5308 wrote to memory of 4648	5308	cvtres.exe	86
PID 5308 wrote to memory of 4748	5308	cvtres.exe	88
PID 5308 wrote to memory of 5184	5308	cvtres.exe	90

C:\Users\Admin\AppData\Local\Temp\xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe
"C:\Users\Admin\AppData\Local\Temp\xa403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5308
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'cvtres.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5184

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Updates\winupdate.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Updates\winupdate.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3636

C:\Users\Admin\AppData\Roaming\svhost.exe
C:\Users\Admin\AppData\Roaming\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
TLSH
T113415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 4dd46624644a48a4eec2e089e2a17c799ed30b399144f94150cfe192acf6b002
MD5 23c4d92b9595d689a188efda681ddc5f
SHA1 0f9c7142b25ba8e845597b35178d73f0c32f2a87
SHA512 7d8a6b06a7f39dc7a053d2aeccc06de292659ef962dff361533c61a984ce4caad4683da8f3da027d60a3fbe235a69da1aee320bf69d92fd580d13a119e03b1da
SSDEEP 384:fL3HhkSS1HHy+RKqFRHEMEzgnnN/js2gtgKNrqU59h9J0u0iFZX:DOSSNyIKqRPEUN/j7gtgarqWh9J0u0k
TLSH
T13592B5AE611F22C3C89563B8D107050FE8F2DE8D431913D8BB2E9F7B89AC95E917D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 d697256eca3cbf4695b7470c84d27d5fa93df71af89e611366369f0b5d86db94
MD5 2f4a424da5678b6c1c62bce7b96e71fd
SHA1 3e537f47c95b5d6dd7101553a75f43d875ab4004
SHA512 b6bb6fa1241f099ce057cb0b1d16057b3cf1d862577c23a0316b7fde5059e824d2858a7e936b1331b1c7382b7621ab342b49b595cc57425ceedb8e38d1b14d2b
SSDEEP 384:kTHht1SSpcYH8QHRnAOh3MR61nRjsaRzbv5O9+RO5nYE9pDU1C:cSS8QHRnBMUrjxv5wGOmCUM
TLSH
T10F922A6E321F2697C0A623B4D017079FEEF0DECE430413DD67585E3B06DA6A684A95EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 87eb66fc2eb7186ab20d63534abde360b228081bdcb84bde3c6725e0cbf7b8b0
MD5 06c05638e16a753cfba6a6090f42c164
SHA1 75f9d79130b6eff00595df0e99805ffcbef97870
SHA512 1999f9c87c1e118361bbc55a4dedf601f592059dac8f681893633f438d3659cbf5a2dde640562fc4d7d5aa6ce43ebd0f2f4d02bbf6042836e4ba3f4326b7072e
SSDEEP 384:xL3Hht1iSptTl7eHtAFTnnpYaRzbFsOZSTRCAnYEYapDU1C:5piSp7eHY1tnZGC3iUM
TLSH
T1C292076E322F269BC4A663F9C423079BEDA09ECF430493DD6718193B05CB27184A95EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mtxuu00a.uaj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mtxuu00a.uaj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cryptor_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cryptor_debug.log
Size 2KB
SHA256 0671027e0ce254c8086c6194068d3d91b068d493621ae071da12471a36822c4f
MD5 46bc01573c78692f6c466ad41cd4d9a2
SHA1 f67e9d895ca5682748998d1f893c7ba6e0bd4e31
SHA512 38cdfec6e40b5006cdf8b9170557027efc368c192d21d82e3ae445340cb14b759cd0028736acefb8561ab11ddbee601cfb7b47a3524be69b8ebc4922c28eaae5
TLSH
T1FB51D92D48FCC8778358828BEB01BED21E21B2416A6C4D0AA7C0D3CC6441EB93DE67D5
MD5 SHA1 SHA512 TLSH

Submit Download

cryptor_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cryptor_debug.log
Size 430B
SHA256 51bc365572ef10ebf133fd3f8d48316d25bcad893631a4717aa543ecb3d07780
MD5 a5e7997a61b72ed25eacb119c841326f
SHA1 8d8d800f12b40c431bcc5dadec4cd144c95b79b0
SHA512 12e542642f58e4f28dfd9f7c82d06943e4bb583b78147f259d4ae2ef72c7e85ab773340d9c89ce6fbc2282f48fd114edbf9da68e840387d912fc79b042d109f2
TLSH
T177E0C27D48FC9E7343159B9F9B8279C22E59B605266C8D11A3D0C7C820419382DF63D5
MD5 SHA1 SHA512 TLSH

Submit Download

cryptor_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cryptor_debug.log
Size 3KB
SHA256 a6fa333ec382a70064e6eabe64dae3384df9ad4fa9958ba64606b5f318b981bd
MD5 130310134c7cea5f7a60d83f65fd9af2
SHA1 f647ebea8ecf7c211481630f2347e81983159463
SHA512 85d3bd5541a4d2ff24adda86a23f1bde26fb63da0da901ef0871f6827f5583da079e0cf01c23f711c3e3e50a970fcd335ca9219d21286157c580eec319f0a2b5
TLSH
T1C351B82D48FCC9778359938BEB01BED22E25B2116A684D1AB7C0D2CC6441E783DE67D6
MD5 SHA1 SHA512 TLSH

Submit Download

cryptor_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cryptor_debug.log
Size 3KB
SHA256 a542a0193d0f030a85232397e205945d23f7fa0738f1217865f2947c16727072
MD5 e49a0d1f6e022e8e95e897625e3f7226
SHA1 c96dbc5e31622ca94a0aafe3473ebf6b802f443c
SHA512 4f82f8ecda58e9aebc64afb62a84d5b0b56f8874056e4fb84e06039db8948777ca1326b0c9a84f9e3233928753e4a4a58b79cd2774a00d50be807153a9208d94
TLSH
T1FC81E82D48FCC9778358D28BEB41BDD22E25B2116A784E1AB7C0D2CC6841E783DE67D5
MD5 SHA1 SHA512 TLSH

Submit Download

cryptor_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cryptor_debug.log
Size 5KB
SHA256 f05d79051a0274545e6f872027a5ce710052c82b3f253ddd26cad490c6547678
MD5 12476a5be380d88b0d3cb0dea2ad83a4
SHA1 60fa32faca4239cec496676d2e1558b124f86ef6
SHA512 b4665f00a524026e020dd13331849429442f095b0d837e9c27d864d9b5fd7b51e1e017718361f09f7908346100878728d85ef68c9fd11d791c69ec703a218ea7
SSDEEP 96:ogUQGvLFhj22s4FxIJtXarUr4Obu2tTql1:DUQG/jD5oJtvrvr5q1
TLSH
T152B11F2D48FCC9774359C28BEB80BDD21E21B2156A785E1AB7C0D2CC6441EB83DE67D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winupdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Updates\winupdate.exe
Size 10.8MB
SHA256 a403cd8cc03aee693d587a568be64d717edf6c8c6d3e40f07199067c734153c1
MD5 4c4d232c28d1081d032892b418be1583
SHA1 51271091408567f4fab11254bcc77da983ec25a8
SHA512 fb6dcc593a612d9b2f4eac2aee508ffff70a69dc2cf0f8eb175a464c99145593bc8cc269f04876e61274f0807c5f6696ebca5298b360ca32f782e5fa9373f7f4
SSDEEP 12288:SstE/7ioLLu8nuMoBpxB0IgP5sOttsiBPJnu:SwG7ionu8n5U/0bhtsiBxu
TLSH
T11BB6A419E253CF6E187713E055655FFCAEEEB14E696A1687D0F9E24332E606C80BF840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svhost.exe

Path C:\Users\Admin\AppData\Roaming\svhost.exe
Size 45KB
SHA256 e4dbdbf7888ea96f3f8aa5c4c7f2bcf6e57d724dd8194fe5f35b673c6ef724ea
MD5 70d838a7dc5b359c3f938a71fad77db0
SHA1 66b83eb16481c334719eed406bc58a3c2b910923
SHA512 9c9a945db5b5e7ff8105bfe74578e6f00b5f707f7c3d8f1f1fb41553a6d0eab29cef026e77877a1ad6435fa7bc369141921442e1485f2b0894c6bbcbd7791034
SSDEEP 768:bINyGPbIriyUAfETlzjpyXcZ0R55GhrdRMJmcBkmcrH+ihBy3kM:3GjyUAfWNkFR5GTMJhkmM+wBxM
TLSH
T1E0237D929AFC8062F593AAB057B1E587ED3EB6E31970811F0359DC661D937C0EA0072F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2032-130-0x0000000006D20000-0x0000000006D3A000-memory.dmp

Download

memory/2032-135-0x0000000006F70000-0x0000000006F85000-memory.dmp

Download

memory/2032-115-0x00000000054E0000-0x0000000005837000-memory.dmp

Download

memory/2032-116-0x00000000059D0000-0x00000000059EE000-memory.dmp

Download

memory/2032-117-0x0000000005A20000-0x0000000005A6C000-memory.dmp

Download

memory/2032-119-0x0000000006000000-0x0000000006034000-memory.dmp

Download

memory/2032-120-0x0000000070460000-0x00000000704AC000-memory.dmp

Download

memory/2032-127-0x0000000005FC0000-0x0000000005FDE000-memory.dmp

Download

memory/2032-128-0x0000000006BF0000-0x0000000006C94000-memory.dmp

Download

memory/2032-129-0x0000000007370000-0x00000000079EA000-memory.dmp

Download

memory/2032-107-0x0000000004DD0000-0x0000000004E36000-memory.dmp

Download

memory/2032-131-0x0000000006D90000-0x0000000006D9A000-memory.dmp

Download

memory/2032-132-0x0000000006FC0000-0x0000000007056000-memory.dmp

Download

memory/2032-133-0x0000000006F30000-0x0000000006F41000-memory.dmp

Download

memory/2032-134-0x0000000006F60000-0x0000000006F6E000-memory.dmp

Download

memory/2032-108-0x0000000004E40000-0x0000000004EA6000-memory.dmp

Download

memory/2032-136-0x0000000007080000-0x000000000709A000-memory.dmp

Download

memory/2032-137-0x0000000007060000-0x0000000007068000-memory.dmp

Download

memory/2032-106-0x0000000004B30000-0x0000000004B52000-memory.dmp

Download

memory/2032-104-0x0000000000D40000-0x0000000000D76000-memory.dmp

Download

memory/2032-105-0x0000000004EB0000-0x00000000054DA000-memory.dmp

Download

memory/4648-149-0x0000000070460000-0x00000000704AC000-memory.dmp

Download

memory/4648-147-0x0000000005C80000-0x0000000005FD7000-memory.dmp

Download

memory/4748-164-0x0000000070460000-0x00000000704AC000-memory.dmp

Download

memory/5184-179-0x0000000070460000-0x00000000704AC000-memory.dmp

Download

memory/5308-52-0x0000000005510000-0x00000000055AC000-memory.dmp

Download

memory/5308-188-0x0000000003050000-0x0000000003060000-memory.dmp

Download

memory/5308-189-0x00000000062B0000-0x0000000006856000-memory.dmp

Download

memory/5308-190-0x0000000006190000-0x0000000006222000-memory.dmp

Download

memory/5308-191-0x0000000006160000-0x000000000616A000-memory.dmp

Download

memory/5308-47-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5308-194-0x0000000003050000-0x0000000003060000-memory.dmp

Download