xworm | c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe
Size 713KB
Sample260712-pb8a2abt81
SHA256 c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9
MD5 95ca5b8c1bfcd91a4b4a48d22baf16e2
SHA1 d22ca7b8b27710b5fc86a9b0e8966cd350e73972
SHA512 cf63c030ecf9e70e56697a893adb0914d6d0ad0fcf318da67083728a14be24ee95405f2672aa9dd5b17e66a390d0e4440568145542a86200c3d12ee3a8dd093b
SSDEEP 12288:2TIFzrn09ESPhv0OIcsCKuKMtyJdl27KFQYFghrl58TYTqqRqtEEfFrlhvAWJdby:yIFzrn0HJJRKsyBqOgf58TAqc0fFZyyY
TLSH
T18AF4220C710DC99BE4624BBD9A60F73913BA6C9CA623E6498FF5BCCF35677240890761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

109.248.150.234:443

Mutex

70vLmgcqMEnUJOeL

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/696-11-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
8	powershell.exe
6048	powershell.exe
5720	powershell.exe
5932	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe

Executes dropped EXE 4 IoCs

pid	Process
4804	bin.exe
3328	bin.exe
3400	bin.exe
5860	bin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Roaming\\bin.exe"	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4284 set thread context of 696	4284	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe	88
PID 4804 set thread context of 3328	4804	bin.exe	104
PID 3400 set thread context of 5860	3400	bin.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4284	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe
4284	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe
8	powershell.exe
8	powershell.exe
6048	powershell.exe
6048	powershell.exe
5720	powershell.exe
5720	powershell.exe
5932	powershell.exe
5932	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe
Token: SeDebugPrivilege	696	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe
Token: SeDebugPrivilege	8	powershell.exe
Token: SeIncreaseQuotaPrivilege	8	powershell.exe
Token: SeSecurityPrivilege	8	powershell.exe
Token: SeTakeOwnershipPrivilege	8	powershell.exe
Token: SeLoadDriverPrivilege	8	powershell.exe
Token: SeSystemProfilePrivilege	8	powershell.exe
Token: SeSystemtimePrivilege	8	powershell.exe
Token: SeProfSingleProcessPrivilege	8	powershell.exe
Token: SeIncBasePriorityPrivilege	8	powershell.exe
Token: SeCreatePagefilePrivilege	8	powershell.exe
Token: SeBackupPrivilege	8	powershell.exe
Token: SeRestorePrivilege	8	powershell.exe
Token: SeShutdownPrivilege	8	powershell.exe
Token: SeDebugPrivilege	8	powershell.exe
Token: SeSystemEnvironmentPrivilege	8	powershell.exe
Token: SeRemoteShutdownPrivilege	8	powershell.exe
Token: SeUndockPrivilege	8	powershell.exe
Token: SeManageVolumePrivilege	8	powershell.exe
Token: 33	8	powershell.exe
Token: 34	8	powershell.exe
Token: 35	8	powershell.exe
Token: 36	8	powershell.exe
Token: SeDebugPrivilege	6048	powershell.exe
Token: SeIncreaseQuotaPrivilege	6048	powershell.exe
Token: SeSecurityPrivilege	6048	powershell.exe
Token: SeTakeOwnershipPrivilege	6048	powershell.exe
Token: SeLoadDriverPrivilege	6048	powershell.exe
Token: SeSystemProfilePrivilege	6048	powershell.exe
Token: SeSystemtimePrivilege	6048	powershell.exe
Token: SeProfSingleProcessPrivilege	6048	powershell.exe
Token: SeIncBasePriorityPrivilege	6048	powershell.exe
Token: SeCreatePagefilePrivilege	6048	powershell.exe
Token: SeBackupPrivilege	6048	powershell.exe
Token: SeRestorePrivilege	6048	powershell.exe
Token: SeShutdownPrivilege	6048	powershell.exe
Token: SeDebugPrivilege	6048	powershell.exe
Token: SeSystemEnvironmentPrivilege	6048	powershell.exe
Token: SeRemoteShutdownPrivilege	6048	powershell.exe
Token: SeUndockPrivilege	6048	powershell.exe
Token: SeManageVolumePrivilege	6048	powershell.exe
Token: 33	6048	powershell.exe
Token: 34	6048	powershell.exe
Token: 35	6048	powershell.exe
Token: 36	6048	powershell.exe
Token: SeDebugPrivilege	5720	powershell.exe
Token: SeIncreaseQuotaPrivilege	5720	powershell.exe
Token: SeSecurityPrivilege	5720	powershell.exe
Token: SeTakeOwnershipPrivilege	5720	powershell.exe
Token: SeLoadDriverPrivilege	5720	powershell.exe
Token: SeSystemProfilePrivilege	5720	powershell.exe
Token: SeSystemtimePrivilege	5720	powershell.exe
Token: SeProfSingleProcessPrivilege	5720	powershell.exe
Token: SeIncBasePriorityPrivilege	5720	powershell.exe
Token: SeCreatePagefilePrivilege	5720	powershell.exe
Token: SeBackupPrivilege	5720	powershell.exe
Token: SeRestorePrivilege	5720	powershell.exe
Token: SeShutdownPrivilege	5720	powershell.exe
Token: SeDebugPrivilege	5720	powershell.exe
Token: SeSystemEnvironmentPrivilege	5720	powershell.exe
Token: SeRemoteShutdownPrivilege	5720	powershell.exe
Token: SeUndockPrivilege	5720	powershell.exe
Token: SeManageVolumePrivilege	5720	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 6020	4284	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe	87
PID 4284 wrote to memory of 696	4284	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe	88
PID 4284 wrote to memory of 696	4284	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe	88
PID 4284 wrote to memory of 696	4284	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe	88
PID 4284 wrote to memory of 696	4284	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe	88
PID 4284 wrote to memory of 696	4284	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe	88
PID 696 wrote to memory of 8	696	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe	89
PID 696 wrote to memory of 6048	696	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe	92
PID 696 wrote to memory of 5720	696	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe	95
PID 696 wrote to memory of 5932	696	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe	97
PID 696 wrote to memory of 5912	696	c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe	99
PID 4804 wrote to memory of 3328	4804	bin.exe	104
PID 4804 wrote to memory of 3328	4804	bin.exe	104
PID 4804 wrote to memory of 3328	4804	bin.exe	104
PID 4804 wrote to memory of 3328	4804	bin.exe	104
PID 4804 wrote to memory of 3328	4804	bin.exe	104
PID 3400 wrote to memory of 5860	3400	bin.exe	106
PID 3400 wrote to memory of 5860	3400	bin.exe	106
PID 3400 wrote to memory of 5860	3400	bin.exe	106
PID 3400 wrote to memory of 5860	3400	bin.exe	106
PID 3400 wrote to memory of 5860	3400	bin.exe	106

C:\Users\Admin\AppData\Local\Temp\c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe
"C:\Users\Admin\AppData\Local\Temp\c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Users\Admin\AppData\Local\Temp\c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe
  "C:\Users\Admin\AppData\Local\Temp\c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe"
  2⤵
  PID:6020
- C:\Users\Admin\AppData\Local\Temp\c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe
  "C:\Users\Admin\AppData\Local\Temp\c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:8
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6048
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5720
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5932
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5912

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3328

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 cf1b34920bca27222b13c7c1852a317e72565019a43c0af1e1296374ede7df2f
MD5 645a2b6c9de2b030b198c572722c946c
SHA1 561331f839d5db7d38d882771dd932148aaf2d35
SHA512 38f8974402d12beacb1900808f0cf55882abd30d2548d0726c91182995077985b617b181064a7cd765a625162687db09291e466bbe34fdfadda7c9054e075db5
SSDEEP 384:51eBaoT1iBGLGW14bTT7Op++MeHrL2PnqIAXz48+FW3CtzKwIvYbhNaPAlRtnZR2:jexZ6GCWiLaA+JaiIAXzX+9VHbhNaPoc
TLSH
T174A2C578213F6DC7D8D226B010D10AF7FBE4D489DAB611D4AF1BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 3b98e1d54a94ef69910be3a4f43b551e406a6fccf0be7f9c2024a0cb7ae99995
MD5 5724dc192b25503e92a5460a7e452ed9
SHA1 fe19eb44e12e26c8a9025c7a73e3ac239f00723d
SHA512 91eb17156766f06c2b0d55e52ec318109c9207cb3da3a135e612043888c96e744a3a81ec6c48b71fa1c15c5042a7013953d6b4c9f4750278c8d7f9ab8a21fbad
SSDEEP 384:l1eBaoT1iBGqibCrM2iGwUQ+U/szhR2PsEPiUDzdC0wIAXI/QtoaqB3KFpxv2Aei:PexZ6G/uAtDl+UASP6UFC0wIAX1toaMY
TLSH
T175A21A2D26AF88CFC85161B80082478AEBF4D559A3D191EBEB5BCA1F1C45E7E4E501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 f446a713eb1447159bc6d66218dd5a38ea09cab34e5cd099d4da59fd3dc40e5a
MD5 6bed5c577ee5670ef40ea03a6015113f
SHA1 3b59c9eb88496df59d26756c09dc0b90d507d842
SHA512 dd22ff2c1e84a0473777a40249de4b2472a9de13c24defd69b7ba5d521c920e94c36ee7085bd5a5b8dc0e8394f8b053271ccfdac4b6c4461ea88d369cfab1a58
SSDEEP 384:dSEboT1iBGJRGlbPyV2hd+ObeCmNBZ6uWOEk5IAC9vQxVOaqB6Fw4v2AeUJhJRW9:z0Z6GJElbPCgd+OW5+NeIA9bOaM6Fwnp
TLSH
T1B8A2D62D26AF59CBD491617800C24383EBF8D568A7E252DBEF0FC91F2C45A7E5E501E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_lfuippil.zce.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lfuippil.zce.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Roaming\bin.exe
Size 713KB
SHA256 c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9
MD5 95ca5b8c1bfcd91a4b4a48d22baf16e2
SHA1 d22ca7b8b27710b5fc86a9b0e8966cd350e73972
SHA512 cf63c030ecf9e70e56697a893adb0914d6d0ad0fcf318da67083728a14be24ee95405f2672aa9dd5b17e66a390d0e4440568145542a86200c3d12ee3a8dd093b
SSDEEP 12288:2TIFzrn09ESPhv0OIcsCKuKMtyJdl27KFQYFghrl58TYTqqRqtEEfFrlhvAWJdby:yIFzrn0HJJRKsyBqOgf58TAqc0fFZyyY
TLSH
T18AF4220C710DC99BE4624BBD9A60F73913BA6C9CA623E6498FF5BCCF35677240890761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-38-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

memory/8-28-0x0000000070510000-0x000000007055C000-memory.dmp

Download

memory/8-36-0x0000000007560000-0x00000000075F6000-memory.dmp

Download

memory/8-35-0x0000000007360000-0x000000000736A000-memory.dmp

Download

memory/8-34-0x00000000072F0000-0x000000000730A000-memory.dmp

Download

memory/8-33-0x0000000007930000-0x0000000007FAC000-memory.dmp

Download

memory/8-32-0x00000000071A0000-0x0000000007243000-memory.dmp

Download

memory/8-31-0x0000000006580000-0x00000000065A0000-memory.dmp

Download

memory/8-27-0x0000000007160000-0x0000000007196000-memory.dmp

Download

memory/8-14-0x0000000002750000-0x0000000002786000-memory.dmp

Download

memory/8-15-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

memory/8-16-0x00000000051C0000-0x000000000580A000-memory.dmp

Download

memory/8-17-0x00000000050A0000-0x00000000050C2000-memory.dmp

Download

memory/8-20-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

memory/8-19-0x00000000059C0000-0x0000000005A26000-memory.dmp

Download

memory/8-22-0x0000000005A80000-0x0000000005DDB000-memory.dmp

Download

memory/8-21-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

memory/8-18-0x0000000005140000-0x00000000051A6000-memory.dmp

Download

memory/8-25-0x0000000005F70000-0x0000000005F8E000-memory.dmp

Download

memory/8-26-0x0000000005FA0000-0x0000000005FEC000-memory.dmp

Download

memory/696-50-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

memory/696-69-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

memory/696-12-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

memory/696-11-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/696-66-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

memory/4284-4-0x0000000005B30000-0x0000000005BCC000-memory.dmp

Download

memory/4284-10-0x0000000007EE0000-0x0000000007F82000-memory.dmp

Download

memory/4284-7-0x0000000005C00000-0x0000000005C0E000-memory.dmp

Download

memory/4284-0-0x0000000074292000-0x0000000074293000-memory.dmp

Download

memory/4284-5-0x0000000005AA0000-0x0000000005AAA000-memory.dmp

Download

memory/4284-13-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

memory/4284-6-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

memory/4284-8-0x0000000074292000-0x0000000074293000-memory.dmp

Download

memory/4284-3-0x00000000059E0000-0x0000000005A72000-memory.dmp

Download

memory/4284-9-0x0000000074280000-0x0000000074A3C000-memory.dmp

Download

memory/4284-1-0x0000000000E20000-0x0000000000ED8000-memory.dmp

Download

memory/4284-2-0x0000000006050000-0x000000000660A000-memory.dmp

Download

memory/5720-48-0x0000000006130000-0x000000000648B000-memory.dmp

Download

memory/5720-51-0x0000000070510000-0x000000007055C000-memory.dmp

Download

memory/5932-58-0x0000000070510000-0x000000007055C000-memory.dmp

Download

memory/6048-42-0x0000000070510000-0x000000007055C000-memory.dmp

Download