xworm | aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d.exe
Size 750KB
Sample260720-e11blshw3y
SHA256 aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d
MD5 bf60422cd6be29dec23354ba9c503454
SHA1 cbb6ef5dc04b91f30330c3134ce8b661158419e2
SHA512 75886363573195b3e6106d26f4a789078c438de7a307d0c9ec25fd486e475299913761ec7edb0e7b4ebb4c5d109067791c540648bdfd0fff8e1d2129763fd30d
SSDEEP 12288:+4ZvsHPNzQF9rqPVGkVPdJL5hU+S5CQWiFiROPU512sLb0KM9R9OCtHn:1ZvsHPNzQF9rq0kVPdJVhmviYs54IbmL
TLSH
T14FF412B867A8D757C87A8BB10922D27047B91D5EDA30D31BCFD8ACDB3D297619408393
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V7.1

84.38.129.122:443

Attributes

Install_directory
%AppData%
install_file
bin.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2016-13-0x0000000000400000-0x0000000000414000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4536	powershell.exe
4228	powershell.exe
4200	powershell.exe
564	powershell.exe
4464	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	RegSvcs.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	RegSvcs.exe

Executes dropped EXE 4 IoCs

pid	Process
4052	bdQABiTTR.exe
1148	bin.exe
3896	bin.exe
3928	bin.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdQABiTTR = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\xjwsm0uzik4.ps1\""	aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Roaming\\bin.exe"	RegSvcs.exe

SmartAssembly .NET packer 2 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/2396-5-0x0000000006EA0000-0x0000000006EB2000-memory.dmp	SmartAssembly
behavioral1/memory/4052-43-0x0000000005070000-0x0000000005082000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2396 set thread context of 2016	2396	aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d.exe	92
PID 4052 set thread context of 4120	4052	bdQABiTTR.exe	118

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bdQABiTTR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4536	powershell.exe
4536	powershell.exe
4464	powershell.exe
4464	powershell.exe
4228	powershell.exe
4228	powershell.exe
4200	powershell.exe
4200	powershell.exe
564	powershell.exe
564	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	RegSvcs.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	564	powershell.exe
Token: SeDebugPrivilege	4120	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2016	2396	aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d.exe	92
PID 2396 wrote to memory of 2016	2396	aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d.exe	92
PID 2396 wrote to memory of 2016	2396	aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d.exe	92
PID 2396 wrote to memory of 2016	2396	aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d.exe	92
PID 2396 wrote to memory of 2016	2396	aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d.exe	92
PID 2016 wrote to memory of 4464	2016	RegSvcs.exe	95
PID 4536 wrote to memory of 4052	4536	powershell.exe	97
PID 2016 wrote to memory of 4228	2016	RegSvcs.exe	98
PID 2016 wrote to memory of 4200	2016	RegSvcs.exe	101
PID 2016 wrote to memory of 564	2016	RegSvcs.exe	103
PID 2016 wrote to memory of 4760	2016	RegSvcs.exe	107
PID 4052 wrote to memory of 4120	4052	bdQABiTTR.exe	118
PID 4052 wrote to memory of 4120	4052	bdQABiTTR.exe	118
PID 4052 wrote to memory of 4120	4052	bdQABiTTR.exe	118
PID 4052 wrote to memory of 4120	4052	bdQABiTTR.exe	118
PID 4052 wrote to memory of 4120	4052	bdQABiTTR.exe	118

C:\Users\Admin\AppData\Local\Temp\aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d.exe
"C:\Users\Admin\AppData\Local\Temp\aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4760

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\xjwsm0uzik4.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Roaming\bdQABiTTR.exe
  "C:\Users\Admin\AppData\Roaming\bdQABiTTR.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4120

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1148

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3896

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bin.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bin.exe.log
Size 142B
SHA256 c578e86db701b9afa3626e804cf434f9d32272ff59fb32fa9a51835e5a148b53
MD5 8c0458bb9ea02d50565175e38d577e35
SHA1 f0b50702cd6470f3c17d637908f83212fdbdb2f2
SHA512 804a47494d9a462ffa6f39759480700ecbe5a7f3a15ec3a6330176ed9c04695d2684bf6bf85ab86286d52e7b727436d0bb2e8da96e20d47740b5ce3f856b5d0f
TLSH
T129C02B3421D310C409404E14000C294CC0FB06052BD4DF7C6941514CC8E5CCFA3220F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 05b7a8086c9d67144936c39acc65235549ebafcc40abce9ed53e72afc8997bc6
MD5 1677fd9a1adf053646f49f4a2afc1684
SHA1 53a8216cf0f30f1275d304457b6397de7062876c
SHA512 4a5d9b7fc76569faa7fd687f80fb5081c0eecd7e50934914399e27817a070af488e3a1383b487bf3c718b03b7c82db2c01abdcb19623d105fabe08d0aba244c4
SSDEEP 384:Wsf+B/9iuY0se/d5EJkTH69LGZcifE6h58dq38+nFVkki0SO1:zfAj/3lz6Vifxh58dqJFiki0H
TLSH
T158821969121F26DBC06523F4C83B47EBE9B08DDFD30007DD67891A3B06CA77594A94E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ca35a46f109cac0b0a9cce6cf64c11868117a8700af6ffe8cb1d06076c8a3391
MD5 d66d8365e1d6029795dd45be00344413
SHA1 f827e1e272a0404c221b671dbbf6431b880e6a3a
SHA512 464ea49e7902e093502576bb0bc534024f59443570e25c212331987b6a9b188093e84f4c9f8e769285c7bd5f0f2cc38d0e2623023637effe7a0981820eddd364
TLSH
T17621A837B3DC8921CC86163A109D9C1072B283C7819ECF9FBFC4D610A07F988CB22290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 88cb4e1116129a83dbd14271fb000b095aadaa58acdb5f10a73730e02320022f
MD5 b2dbe08ccc101bb4ba0d2ee7d5e937b2
SHA1 95bade6705fd15a16875c5456435c781d63ad983
SHA512 844b4a1de647ef3bbbb3d92fe6d95d847ba890db8ad67ae7ffe601babd68cebcc5528806deef025b25e3a1d4453876b3064fa7f3fa52dad5b25a5b43bd38aea5
SSDEEP 384:6sf+B09i+LdBW+qjr+tw0k+o9olZTVK6seYwME/F03SoZZfYSgojEDkSQ0gdMtk6:Hfra+tMjolZTVNfruSEW2ED/Cm3
TLSH
T1A282D66E611F16C3C48613B8E11B055FE8F2DD8D531A13D8BB1E9F3B8AAC69E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 0a77d6c93afde91269bc949c9f651328162943e4b3ad13ab6e1c69a39fa2adea
MD5 bfa049ed6e3d09cbf329ec6bb3240a6a
SHA1 3f8fd89c5751e77a388ec5e166010b4aa722b4dd
SHA512 3a2ebdc83752aee05483768fa72d813b6601cc925fe1a8745def352c11112e3c7094a52b89d6951d2f9ba569e04f4cbd4635db8a629ffc01271d9fe390994032
SSDEEP 384:isf+Bz991GRMPSVcS5VJXkyto9o5gL69/G3op6d5Mdqki8+nUKkKkki0SO1:/f6Gma13J0jo5gL66xd5Mdq9UKiki0H
TLSH
T14D82086E612F2A97C12A13F4C43A4BDBE9F08DCEC38006DD67445A3706DA36684ED1EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_e5unpixo.kf4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e5unpixo.kf4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

xjwsm0uzik4.ps1

Path C:\Users\Admin\AppData\Local\Temp\xjwsm0uzik4.ps1
Size 1KB
SHA256 b9d97e8fb808622ffd8a1eae31682c697e70c9a03600444dffa24549f33bd7d1
MD5 88709f0a1a6c53de642432e1a480162b
SHA1 04ced48ec91f8f95a8688487e14265137133526a
SHA512 e8af5e28c4df59acb0980a9183b4930d926d40d8e39d9798800c9ba1dde0879eb45a2858af1cb01af0d4f53af5a7ed80b6e33a34e968cb7a7722364809f99198
TLSH
T14011E31B8E8947C6446403F10A1370CD756D60CB676F049055ECF8EEB32BD67356ADE8
MD5 SHA1 SHA512 TLSH

Submit Download

bdQABiTTR.exe

Path C:\Users\Admin\AppData\Roaming\bdQABiTTR.exe
Size 750KB
SHA256 aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d
MD5 bf60422cd6be29dec23354ba9c503454
SHA1 cbb6ef5dc04b91f30330c3134ce8b661158419e2
SHA512 75886363573195b3e6106d26f4a789078c438de7a307d0c9ec25fd486e475299913761ec7edb0e7b4ebb4c5d109067791c540648bdfd0fff8e1d2129763fd30d
SSDEEP 12288:+4ZvsHPNzQF9rqPVGkVPdJL5hU+S5CQWiFiROPU512sLb0KM9R9OCtHn:1ZvsHPNzQF9rq0kVPdJVhmviYs54IbmL
TLSH
T14FF412B867A8D757C87A8BB10922D27047B91D5EDA30D31BCFD8ACDB3D297619408393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Roaming\bin.exe
Size 44KB
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
SSDEEP 768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
TLSH
T19323D82897F85203F2B74BB099F5C487AD36FA536D74D79C348A534D0A527808A53B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/564-110-0x0000000006120000-0x0000000006474000-memory.dmp

Download

memory/564-112-0x000000006FE60000-0x000000006FEAC000-memory.dmp

Download

memory/1148-130-0x00000000016D0000-0x00000000016F1000-memory.dmp

Download

memory/1148-128-0x0000000000C70000-0x0000000000C7E000-memory.dmp

Download

memory/1148-129-0x0000000003120000-0x000000000315C000-memory.dmp

Download

memory/2016-125-0x0000000005630000-0x0000000005640000-memory.dmp

Download

memory/2016-132-0x0000000005630000-0x0000000005640000-memory.dmp

Download

memory/2016-13-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2396-2-0x00000000054F0000-0x0000000005582000-memory.dmp

Download

memory/2396-8-0x00000000075D0000-0x000000000766C000-memory.dmp

Download

memory/2396-1-0x0000000005AA0000-0x0000000006044000-memory.dmp

Download

memory/2396-6-0x00000000054D0000-0x00000000054E0000-memory.dmp

Download

memory/2396-5-0x0000000006EA0000-0x0000000006EB2000-memory.dmp

Download

memory/2396-7-0x0000000007520000-0x00000000075C8000-memory.dmp

Download

memory/2396-0-0x00000000009D0000-0x0000000000A92000-memory.dmp

Download

memory/2396-3-0x00000000054D0000-0x00000000054E0000-memory.dmp

Download

memory/2396-4-0x00000000054A0000-0x00000000054AA000-memory.dmp

Download

memory/3896-138-0x00000000050E0000-0x0000000005101000-memory.dmp

Download

memory/4052-43-0x0000000005070000-0x0000000005082000-memory.dmp

Download

memory/4200-94-0x000000006FE60000-0x000000006FEAC000-memory.dmp

Download

memory/4228-77-0x000000006FE60000-0x000000006FEAC000-memory.dmp

Download

memory/4464-32-0x0000000005720000-0x0000000005786000-memory.dmp

Download

memory/4464-60-0x00000000073A0000-0x0000000007436000-memory.dmp

Download

memory/4464-61-0x0000000007320000-0x0000000007331000-memory.dmp

Download

memory/4464-62-0x0000000007350000-0x000000000735E000-memory.dmp

Download

memory/4464-63-0x0000000007360000-0x0000000007374000-memory.dmp

Download

memory/4464-64-0x0000000007460000-0x000000000747A000-memory.dmp

Download

memory/4464-65-0x0000000007440000-0x0000000007448000-memory.dmp

Download

memory/4464-59-0x0000000007190000-0x000000000719A000-memory.dmp

Download

memory/4464-57-0x0000000007760000-0x0000000007DDA000-memory.dmp

Download

memory/4464-58-0x0000000007120000-0x000000000713A000-memory.dmp

Download

memory/4464-56-0x0000000007030000-0x00000000070D3000-memory.dmp

Download

memory/4464-55-0x0000000006360000-0x000000000637E000-memory.dmp

Download

memory/4464-47-0x000000006FE60000-0x000000006FEAC000-memory.dmp

Download

memory/4464-46-0x0000000006DF0000-0x0000000006E22000-memory.dmp

Download

memory/4464-45-0x00000000063A0000-0x00000000063EC000-memory.dmp

Download

memory/4464-44-0x0000000005E00000-0x0000000005E1E000-memory.dmp

Download

memory/4464-41-0x0000000005800000-0x0000000005B54000-memory.dmp

Download

memory/4464-33-0x0000000005790000-0x00000000057F6000-memory.dmp

Download

memory/4464-31-0x0000000004F20000-0x0000000004F42000-memory.dmp

Download

memory/4464-30-0x0000000004FF0000-0x0000000005618000-memory.dmp

Download

memory/4464-29-0x0000000002520000-0x0000000002556000-memory.dmp

Download

memory/4536-16-0x0000021167B30000-0x0000021167B52000-memory.dmp

Download

memory/4536-15-0x00000211670A0000-0x00000211670B0000-memory.dmp

Download