xworm | 70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe
Size 735KB
Sample260702-g5vm2abt4j
SHA256 70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7
MD5 f3f5b3f73221c983693a4658a8875fc1
SHA1 53b4f3493184045d5bbff9de6b8a94b150c6e0e9
SHA512 f15a76928e03bf36fe368119d0811657f6361aeb5a60717786ab8cb8ac106a43c83e1c0a3577882bce05fcdfcae17704d06b8a79a02eeb71838228d72d32125d
SSDEEP 12288:D2LxnupjXgxUf1sOhbrotlBIeSYsJd3Q8mClXi2zGF9fiRWl:D8IjY0otpSY+d3Mr2zGDqR
TLSH
T10DF40228042BC40AE9F56EB11C71F1F5A7B73D9AB238D0296FC64D6F72636087D89325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

109.248.150.234:443

Mutex

70vLmgcqMEnUJOeL

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3012-11-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3004	powershell.exe
1864	powershell.exe
5620	powershell.exe
4800	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe

Executes dropped EXE 5 IoCs

pid	Process
4152	bin.exe
5052	bin.exe
3536	bin.exe
5660	bin.exe
464	bin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Roaming\\bin.exe"	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3940 set thread context of 3012	3940	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	88
PID 4152 set thread context of 5052	4152	bin.exe	104
PID 3536 set thread context of 5660	3536	bin.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1864	powershell.exe
1864	powershell.exe
5620	powershell.exe
5620	powershell.exe
4800	powershell.exe
4800	powershell.exe
3004	powershell.exe
3004	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeIncreaseQuotaPrivilege	1864	powershell.exe
Token: SeSecurityPrivilege	1864	powershell.exe
Token: SeTakeOwnershipPrivilege	1864	powershell.exe
Token: SeLoadDriverPrivilege	1864	powershell.exe
Token: SeSystemProfilePrivilege	1864	powershell.exe
Token: SeSystemtimePrivilege	1864	powershell.exe
Token: SeProfSingleProcessPrivilege	1864	powershell.exe
Token: SeIncBasePriorityPrivilege	1864	powershell.exe
Token: SeCreatePagefilePrivilege	1864	powershell.exe
Token: SeBackupPrivilege	1864	powershell.exe
Token: SeRestorePrivilege	1864	powershell.exe
Token: SeShutdownPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeSystemEnvironmentPrivilege	1864	powershell.exe
Token: SeRemoteShutdownPrivilege	1864	powershell.exe
Token: SeUndockPrivilege	1864	powershell.exe
Token: SeManageVolumePrivilege	1864	powershell.exe
Token: 33	1864	powershell.exe
Token: 34	1864	powershell.exe
Token: 35	1864	powershell.exe
Token: 36	1864	powershell.exe
Token: SeDebugPrivilege	5620	powershell.exe
Token: SeIncreaseQuotaPrivilege	5620	powershell.exe
Token: SeSecurityPrivilege	5620	powershell.exe
Token: SeTakeOwnershipPrivilege	5620	powershell.exe
Token: SeLoadDriverPrivilege	5620	powershell.exe
Token: SeSystemProfilePrivilege	5620	powershell.exe
Token: SeSystemtimePrivilege	5620	powershell.exe
Token: SeProfSingleProcessPrivilege	5620	powershell.exe
Token: SeIncBasePriorityPrivilege	5620	powershell.exe
Token: SeCreatePagefilePrivilege	5620	powershell.exe
Token: SeBackupPrivilege	5620	powershell.exe
Token: SeRestorePrivilege	5620	powershell.exe
Token: SeShutdownPrivilege	5620	powershell.exe
Token: SeDebugPrivilege	5620	powershell.exe
Token: SeSystemEnvironmentPrivilege	5620	powershell.exe
Token: SeRemoteShutdownPrivilege	5620	powershell.exe
Token: SeUndockPrivilege	5620	powershell.exe
Token: SeManageVolumePrivilege	5620	powershell.exe
Token: 33	5620	powershell.exe
Token: 34	5620	powershell.exe
Token: 35	5620	powershell.exe
Token: 36	5620	powershell.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeIncreaseQuotaPrivilege	4800	powershell.exe
Token: SeSecurityPrivilege	4800	powershell.exe
Token: SeTakeOwnershipPrivilege	4800	powershell.exe
Token: SeLoadDriverPrivilege	4800	powershell.exe
Token: SeSystemProfilePrivilege	4800	powershell.exe
Token: SeSystemtimePrivilege	4800	powershell.exe
Token: SeProfSingleProcessPrivilege	4800	powershell.exe
Token: SeIncBasePriorityPrivilege	4800	powershell.exe
Token: SeCreatePagefilePrivilege	4800	powershell.exe
Token: SeBackupPrivilege	4800	powershell.exe
Token: SeRestorePrivilege	4800	powershell.exe
Token: SeShutdownPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeSystemEnvironmentPrivilege	4800	powershell.exe
Token: SeRemoteShutdownPrivilege	4800	powershell.exe
Token: SeUndockPrivilege	4800	powershell.exe
Token: SeManageVolumePrivilege	4800	powershell.exe
Token: 33	4800	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 3012	3940	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	88
PID 3940 wrote to memory of 3012	3940	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	88
PID 3940 wrote to memory of 3012	3940	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	88
PID 3940 wrote to memory of 3012	3940	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	88
PID 3940 wrote to memory of 3012	3940	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	88
PID 3012 wrote to memory of 1864	3012	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	89
PID 3012 wrote to memory of 5620	3012	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	92
PID 3012 wrote to memory of 4800	3012	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	94
PID 3012 wrote to memory of 3004	3012	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	97
PID 3012 wrote to memory of 2200	3012	70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe	99
PID 4152 wrote to memory of 5052	4152	bin.exe	104
PID 4152 wrote to memory of 5052	4152	bin.exe	104
PID 4152 wrote to memory of 5052	4152	bin.exe	104
PID 4152 wrote to memory of 5052	4152	bin.exe	104
PID 4152 wrote to memory of 5052	4152	bin.exe	104
PID 3536 wrote to memory of 5660	3536	bin.exe	106
PID 3536 wrote to memory of 5660	3536	bin.exe	106
PID 3536 wrote to memory of 5660	3536	bin.exe	106
PID 3536 wrote to memory of 5660	3536	bin.exe	106
PID 3536 wrote to memory of 5660	3536	bin.exe	106

C:\Users\Admin\AppData\Local\Temp\70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe
"C:\Users\Admin\AppData\Local\Temp\70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Users\Admin\AppData\Local\Temp\70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe
  "C:\Users\Admin\AppData\Local\Temp\70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1864
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5620
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3004
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2200

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5052

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5660

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 4de2e6540ee13aacac41891e8db77ec44b17947f9c0d44707835d57fc5e5927b
MD5 c019eb1ac2f7e493617505babe346f6f
SHA1 658e80d65362f37a4e154106669a135b468bfed5
SHA512 4ae99a921047b84bd4bc671e0bd53c724f11d024faf7e608e752dc4d523825c2bf09f2591d478c04a6198b118c270c720447f2df86f0fd2c1073aca151998e17
SSDEEP 384:z1eBaoT1iBG0KqkDORl+I3LG3M4y15P4oiKzA8d8JYQlia9YPgAx8m:hexZ6G0cSRlXb3wHiA8dMiGmKm
TLSH
T123A2C622538F6F6DE16B7F39C5F948539F24236AEF81B4821B3854080972A92EF83945
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 5d7aa6de6882095496bd15693588268609b69da112d53d23d51671b9182cde87
MD5 bc9bac23d031ce4a3cce000040c271c1
SHA1 eab87d1781b4a356ff83f66af645d6e2c3d737ce
SHA512 8ba4f72c55192ee1fc19f6e1c8d909474356c7a17ff6ea47d28a724352244b55316bf0ab5107c0887c06f1c6cd2f2f56f443075f63210709d6429ff107c9daa8
SSDEEP 384:i1eBaoT1iBGQJGlbOwU2cD+gIzhR2PtWOEbDzVMIAXIIEbQVVOaqBBKpNv2HbhN2:CexZ6GQslbOwU2cD+gESUNbNMIAXDNP7
TLSH
T1BFA2F72C266F4DCBDA5151B810810382FBF8E555E7E052DAEF1BC91F1C85A7E5E901F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 504be54b496a60b113d7f816c64c5b856ea73109595728c97ed23ae8e7a715e7
MD5 676de42606fb4e840a2fa374f5515702
SHA1 e5dfb848225e69fede9e6be528cb01e76c7c805b
SHA512 9788be4ede2c29deafcc763cc0830ab2359d903f63c7f19c9c425fe53b167caed4c7c4b3925053ae8c0fdd96e57bac351c277026a9a0201095d45e1c2c72cdda
SSDEEP 384:baSEboT1iBGQiarbALU0b/+3EVR2PtWOEfzdC0wIAC9JRQ1VZqB6Fwcv27hNIeU8:bu0Z6GQiaYAy/+3NUNZC0wIAyCvZM6eF
TLSH
T167A2F72D266F59CBC49151B410820786FBF8D558EBE291DAFB4FC91F2C81A7E4E901F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ahlswjq1.2bx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ahlswjq1.2bx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Roaming\bin.exe
Size 735KB
SHA256 70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7
MD5 f3f5b3f73221c983693a4658a8875fc1
SHA1 53b4f3493184045d5bbff9de6b8a94b150c6e0e9
SHA512 f15a76928e03bf36fe368119d0811657f6361aeb5a60717786ab8cb8ac106a43c83e1c0a3577882bce05fcdfcae17704d06b8a79a02eeb71838228d72d32125d
SSDEEP 12288:D2LxnupjXgxUf1sOhbrotlBIeSYsJd3Q8mClXi2zGF9fiRWl:D8IjY0otpSY+d3Mr2zGDqR
TLSH
T10DF40228042BC40AE9F56EB11C71F1F5A7B73D9AB238D0296FC64D6F72636087D89325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1864-38-0x0000000074460000-0x0000000074C1C000-memory.dmp

Download

memory/1864-27-0x0000000006D80000-0x0000000006DB6000-memory.dmp

Download

memory/1864-36-0x00000000071A0000-0x0000000007236000-memory.dmp

Download

memory/1864-35-0x0000000006FA0000-0x0000000006FAA000-memory.dmp

Download

memory/1864-34-0x0000000006F30000-0x0000000006F4A000-memory.dmp

Download

memory/1864-33-0x0000000007570000-0x0000000007BEC000-memory.dmp

Download

memory/1864-32-0x0000000006DD0000-0x0000000006E73000-memory.dmp

Download

memory/1864-31-0x00000000061B0000-0x00000000061D0000-memory.dmp

Download

memory/1864-28-0x00000000702E0000-0x000000007032C000-memory.dmp

Download

memory/1864-14-0x0000000002390000-0x00000000023C6000-memory.dmp

Download

memory/1864-15-0x0000000074460000-0x0000000074C1C000-memory.dmp

Download

memory/1864-16-0x0000000004ED0000-0x000000000551A000-memory.dmp

Download

memory/1864-17-0x0000000074460000-0x0000000074C1C000-memory.dmp

Download

memory/1864-18-0x0000000074460000-0x0000000074C1C000-memory.dmp

Download

memory/1864-19-0x0000000005550000-0x0000000005572000-memory.dmp

Download

memory/1864-22-0x00000000055F0000-0x0000000005656000-memory.dmp

Download

memory/1864-23-0x0000000005660000-0x00000000056C6000-memory.dmp

Download

memory/1864-24-0x00000000057D0000-0x0000000005B2B000-memory.dmp

Download

memory/1864-25-0x0000000005BC0000-0x0000000005BDE000-memory.dmp

Download

memory/1864-26-0x0000000005C70000-0x0000000005CBC000-memory.dmp

Download

memory/3004-57-0x00000000702E0000-0x000000007032C000-memory.dmp

Download

memory/3012-52-0x0000000074460000-0x0000000074C1C000-memory.dmp

Download

memory/3012-12-0x0000000074460000-0x0000000074C1C000-memory.dmp

Download

memory/3012-11-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3012-68-0x0000000074460000-0x0000000074C1C000-memory.dmp

Download

memory/3012-65-0x0000000074460000-0x0000000074C1C000-memory.dmp

Download

memory/3536-73-0x0000000007320000-0x00000000073C2000-memory.dmp

Download

memory/3940-5-0x0000000074460000-0x0000000074C1C000-memory.dmp

Download

memory/3940-9-0x0000000074460000-0x0000000074C1C000-memory.dmp

Download

memory/3940-4-0x0000000005770000-0x000000000577A000-memory.dmp

Download

memory/3940-13-0x0000000074460000-0x0000000074C1C000-memory.dmp

Download

memory/3940-7-0x0000000005DC0000-0x0000000005E5C000-memory.dmp

Download

memory/3940-3-0x00000000057A0000-0x0000000005832000-memory.dmp

Download

memory/3940-10-0x0000000007DF0000-0x0000000007E92000-memory.dmp

Download

memory/3940-6-0x0000000005970000-0x0000000005982000-memory.dmp

Download

memory/3940-2-0x0000000005E60000-0x000000000641A000-memory.dmp

Download

memory/3940-8-0x0000000074472000-0x0000000074473000-memory.dmp

Download

memory/3940-0-0x0000000074472000-0x0000000074473000-memory.dmp

Download

memory/3940-1-0x0000000000B90000-0x0000000000C4E000-memory.dmp

Download

memory/4800-49-0x00000000702E0000-0x000000007032C000-memory.dmp

Download

memory/5620-42-0x00000000702E0000-0x000000007032C000-memory.dmp

Download