xworm | 30f8fdb26e5ef75f382fd927a35e00ea8accd504e677058b7fd28e6a73553d40

Analysis

max time kernel
299s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW RFQ.exe
Size 803KB
Sample260730-t1rf2acb99
SHA256 30f8fdb26e5ef75f382fd927a35e00ea8accd504e677058b7fd28e6a73553d40
MD5 7311320686afe0a309586adb63442d46
SHA1 1dc70364adbe70b7f1396fb1ae54bd56769b1f4b
SHA512 80698de6b6f3c5140d6f44610d9d9b533a28904f32dc5494ca3e20eace94b9d2631294ac5c42ea41b998bef0fb818747204f3a487540d93527d33847274286d4
SSDEEP 24576:ueA9sc3qymb6fWdVLO1pGsy+Jp238NtpY3:PUs+5w6MVLO1wIp23a+
TLSH
T1D80502582A16EA06D99243B80BB1E3B417BC5DDDE820E3179FE9BDEB7629F444D04343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

31.59.118.77:7004

Mutex

czAMoLDJ88IF5X7d

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2752-11-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2000	powershell.exe
5516	powershell.exe
4796	powershell.exe
2008	powershell.exe
3248	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	RegSvcs.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWormClient.lnk	RegSvcs.exe

Executes dropped EXE 5 IoCs

pid	Process
2408	XWormClient.exe
2964	XWormClient.exe
2980	XWormClient.exe
4168	XWormClient.exe
1184	XWormClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\XWormClient = "C:\\Users\\Admin\\AppData\\Roaming\\XWormClient.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5640 set thread context of 2752	5640	NEW RFQ.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWormClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NEW RFQ.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5640	NEW RFQ.exe
5640	NEW RFQ.exe
5516	powershell.exe
5516	powershell.exe
4796	powershell.exe
4796	powershell.exe
2008	powershell.exe
2008	powershell.exe
3248	powershell.exe
3248	powershell.exe
2000	powershell.exe
2000	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5640	NEW RFQ.exe
Token: SeDebugPrivilege	2752	RegSvcs.exe
Token: SeDebugPrivilege	5516	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeIncreaseQuotaPrivilege	4796	powershell.exe
Token: SeSecurityPrivilege	4796	powershell.exe
Token: SeTakeOwnershipPrivilege	4796	powershell.exe
Token: SeLoadDriverPrivilege	4796	powershell.exe
Token: SeSystemProfilePrivilege	4796	powershell.exe
Token: SeSystemtimePrivilege	4796	powershell.exe
Token: SeProfSingleProcessPrivilege	4796	powershell.exe
Token: SeIncBasePriorityPrivilege	4796	powershell.exe
Token: SeCreatePagefilePrivilege	4796	powershell.exe
Token: SeBackupPrivilege	4796	powershell.exe
Token: SeRestorePrivilege	4796	powershell.exe
Token: SeShutdownPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeSystemEnvironmentPrivilege	4796	powershell.exe
Token: SeRemoteShutdownPrivilege	4796	powershell.exe
Token: SeUndockPrivilege	4796	powershell.exe
Token: SeManageVolumePrivilege	4796	powershell.exe
Token: 33	4796	powershell.exe
Token: 34	4796	powershell.exe
Token: 35	4796	powershell.exe
Token: 36	4796	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeIncreaseQuotaPrivilege	2008	powershell.exe
Token: SeSecurityPrivilege	2008	powershell.exe
Token: SeTakeOwnershipPrivilege	2008	powershell.exe
Token: SeLoadDriverPrivilege	2008	powershell.exe
Token: SeSystemProfilePrivilege	2008	powershell.exe
Token: SeSystemtimePrivilege	2008	powershell.exe
Token: SeProfSingleProcessPrivilege	2008	powershell.exe
Token: SeIncBasePriorityPrivilege	2008	powershell.exe
Token: SeCreatePagefilePrivilege	2008	powershell.exe
Token: SeBackupPrivilege	2008	powershell.exe
Token: SeRestorePrivilege	2008	powershell.exe
Token: SeShutdownPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeSystemEnvironmentPrivilege	2008	powershell.exe
Token: SeRemoteShutdownPrivilege	2008	powershell.exe
Token: SeUndockPrivilege	2008	powershell.exe
Token: SeManageVolumePrivilege	2008	powershell.exe
Token: 33	2008	powershell.exe
Token: 34	2008	powershell.exe
Token: 35	2008	powershell.exe
Token: 36	2008	powershell.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeIncreaseQuotaPrivilege	3248	powershell.exe
Token: SeSecurityPrivilege	3248	powershell.exe
Token: SeTakeOwnershipPrivilege	3248	powershell.exe
Token: SeLoadDriverPrivilege	3248	powershell.exe
Token: SeSystemProfilePrivilege	3248	powershell.exe
Token: SeSystemtimePrivilege	3248	powershell.exe
Token: SeProfSingleProcessPrivilege	3248	powershell.exe
Token: SeIncBasePriorityPrivilege	3248	powershell.exe
Token: SeCreatePagefilePrivilege	3248	powershell.exe
Token: SeBackupPrivilege	3248	powershell.exe
Token: SeRestorePrivilege	3248	powershell.exe
Token: SeShutdownPrivilege	3248	powershell.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeSystemEnvironmentPrivilege	3248	powershell.exe
Token: SeRemoteShutdownPrivilege	3248	powershell.exe
Token: SeUndockPrivilege	3248	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5640 wrote to memory of 5516	5640	NEW RFQ.exe	89
PID 5640 wrote to memory of 2752	5640	NEW RFQ.exe	91
PID 5640 wrote to memory of 2752	5640	NEW RFQ.exe	91
PID 5640 wrote to memory of 2752	5640	NEW RFQ.exe	91
PID 5640 wrote to memory of 2752	5640	NEW RFQ.exe	91
PID 5640 wrote to memory of 2752	5640	NEW RFQ.exe	91
PID 2752 wrote to memory of 4796	2752	RegSvcs.exe	92
PID 2752 wrote to memory of 2008	2752	RegSvcs.exe	95
PID 2752 wrote to memory of 3248	2752	RegSvcs.exe	97
PID 2752 wrote to memory of 2000	2752	RegSvcs.exe	99
PID 2752 wrote to memory of 5476	2752	RegSvcs.exe	101

C:\Users\Admin\AppData\Local\Temp\NEW RFQ.exe
"C:\Users\Admin\AppData\Local\Temp\NEW RFQ.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NEW RFQ.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3248
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2000
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XWormClient" /tr "C:\Users\Admin\AppData\Roaming\XWormClient.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5476

C:\Users\Admin\AppData\Roaming\XWormClient.exe
C:\Users\Admin\AppData\Roaming\XWormClient.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5544

C:\Users\Admin\AppData\Roaming\XWormClient.exe
"C:\Users\Admin\AppData\Roaming\XWormClient.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2964

C:\Users\Admin\AppData\Roaming\XWormClient.exe
"C:\Users\Admin\AppData\Roaming\XWormClient.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2980

C:\Users\Admin\AppData\Roaming\XWormClient.exe
"C:\Users\Admin\AppData\Roaming\XWormClient.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4168

C:\Users\Admin\AppData\Roaming\XWormClient.exe
"C:\Users\Admin\AppData\Roaming\XWormClient.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 1c0a7279c213e15dbe60a3983154593073848e5f00744ff8a6657db9e8dcc0ed
MD5 9e15833043ab247801a52321c799d60d
SHA1 a448c41b19158c3b2172d7c2b880c1a9c2529f15
SHA512 18f4432778b0a295f07674fccd5f3b69672d20df22ba476d4d8827733ac38bdfe97a6a9ae44e1b7a2ebb5a7ce213304fd1aad112465eca9064eeff4b8096c5f2
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 a0f2deb42a77b1dbf4eb2baf4f21a116da0d316f3badbd54f95ce430613eab0a
MD5 0a0d842917cc558669208748b6db1d10
SHA1 5225364d3b478821a1046ea982fea3c97bb61780
SHA512 e785565e2bc7a972a13e96f6ff10ceb6e7a7e68dc75d1700bcb8a3b148ee0d8b14225cdff635e9a0664396b6a546945313734eabe7a1f4df62a687cd907041a4
SSDEEP 384:HSEboT1iBGHGW14b1siLqx/qe0DgeCyrF2lPn5IAXz48+pWvWtzKw4vYbhNaPUW2:V0Z6GmWixjy/qeQpxGRIAXzX+NVXbhNR
TLSH
T153A2C578203F6DC7D8D216B010D50AE7FBE4D489DAB65194BF2BDE2F4C90EBA4A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 634084264bd42664970e2e31c981c54b13c8322b01b794b123ed68a920b9c022
MD5 d27a82f270b1b4e791dd2c5909c9d804
SHA1 c765d37b358795a44c3f1404c124b6fb47fe7147
SHA512 c91fad4e0e79c7a74ddcbe8c6897b63968cf5f022398b67c82ef49131fe1884fae6ca811e9ce1df1491420c63cde4d92c5d6245f799792323b6b75d088e42c60
SSDEEP 384:ISEboT1iBGHibV+sKF4Y+ghX+se6redtTMLIAXIIIWWEoaqB3KFw4v2AeUJhtDRY:M0Z6GCB1KF4Y+8BsaLIAXDroaM6FwnU0
TLSH
T1A7A2F62C266F99CFD4A1627810814397EBF8D5A8A7F58297AF0FC91F3C4167D4E901E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 0b26ae5f001a5cb044d5d3647a9f4b4ec0681f14d9b8a715948d9ff99d9783f9
MD5 efcda1143d8e2780194039dd5684b3ad
SHA1 826a44ddb592aaa58745354b88c46b9cdf0530c1
SHA512 c467d40315bcb07fc6a40e329af9ad669c565817d0bc111917a1275cee3bcd20bf6f622f9dc021725ca53dfc956be8bc39933f526cb2ce284138313857c28aae
SSDEEP 384:rSEboT1iBGXiblynh4+geenJThR2PnMzdC0wIAXIZRCXBoaqB3KFw3schNIJJhtW:50Z6GSblAh4+WSSC0wIAX6YXBoaM6FwV
TLSH
T1E3A2E72C266F8CCFE99162B800814782FBF8D565E9D192DBEB5BC91F2C05A7D4E501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0s4kuocb.auz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0s4kuocb.auz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

XWormClient.exe

Path C:\Users\Admin\AppData\Roaming\XWormClient.exe
Size 38KB
SHA256 083bc9319eb8066131b8005dd7013f85f2a27c7908767f94183d3e153b8db12b
MD5 d85f3f7a1d6107853816be0e4b020b7e
SHA1 eec2fbcc0138d7281f57291304637445841c25ed
SHA512 937b3fd8834bd3883d80add70263a6eb7b3c568f97acb99b53da9d25cc9d3962f581d1caf0f8f9eb9e73a51f60be72a189b5e3e45153d4d3c100067bf645f456
SSDEEP 768:nb/ZOc/rh0k2dsDtA6Iq86tqJTN4RXMWF//dj9z9R:7Lrh0ddsDtfcJTN4RXMWZz9R
TLSH
T17803B72897F84316F2B74BB099F5C047ADB2B9536EB5D79C388A530D0A227818553B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2000-70-0x000000006FED0000-0x000000006FF1C000-memory.dmp

Download

memory/2008-48-0x0000000006590000-0x00000000068EB000-memory.dmp

Download

memory/2008-50-0x0000000006A10000-0x0000000006A5C000-memory.dmp

Download

memory/2008-51-0x0000000070790000-0x00000000707DC000-memory.dmp

Download

memory/2008-54-0x0000000007C60000-0x0000000007D03000-memory.dmp

Download

memory/2408-80-0x0000000000D30000-0x0000000000D3E000-memory.dmp

Download

memory/2408-82-0x0000000005660000-0x000000000569C000-memory.dmp

Download

memory/2408-83-0x0000000005620000-0x0000000005642000-memory.dmp

Download

memory/2752-65-0x0000000074420000-0x0000000074BDC000-memory.dmp

Download

memory/2752-11-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2752-81-0x0000000074420000-0x0000000074BDC000-memory.dmp

Download

memory/2752-13-0x0000000074420000-0x0000000074BDC000-memory.dmp

Download

memory/2752-84-0x0000000074420000-0x0000000074BDC000-memory.dmp

Download

memory/2964-86-0x0000000002A20000-0x0000000002A42000-memory.dmp

Download

memory/3248-60-0x0000000006070000-0x00000000060BC000-memory.dmp

Download

memory/3248-58-0x00000000056D0000-0x0000000005A2B000-memory.dmp

Download

memory/3248-64-0x0000000006D50000-0x0000000006DF3000-memory.dmp

Download

memory/3248-61-0x000000006FED0000-0x000000006FF1C000-memory.dmp

Download

memory/4796-41-0x0000000070700000-0x000000007074C000-memory.dmp

Download

memory/5516-14-0x0000000005D00000-0x000000000634A000-memory.dmp

Download

memory/5516-19-0x0000000006350000-0x0000000006372000-memory.dmp

Download

memory/5516-34-0x0000000007BE0000-0x0000000007C83000-memory.dmp

Download

memory/5516-30-0x0000000070700000-0x000000007074C000-memory.dmp

Download

memory/5516-29-0x00000000079A0000-0x00000000079D6000-memory.dmp

Download

memory/5516-36-0x0000000007D20000-0x0000000007D3A000-memory.dmp

Download

memory/5516-35-0x0000000008360000-0x00000000089DC000-memory.dmp

Download

memory/5516-37-0x0000000007D90000-0x0000000007D9A000-memory.dmp

Download

memory/5516-38-0x0000000007F90000-0x0000000008026000-memory.dmp

Download

memory/5516-40-0x0000000074420000-0x0000000074BDC000-memory.dmp

Download

memory/5516-26-0x0000000006F30000-0x0000000006F7C000-memory.dmp

Download

memory/5516-25-0x00000000069B0000-0x00000000069CE000-memory.dmp

Download

memory/5516-24-0x0000000006600000-0x000000000695B000-memory.dmp

Download

memory/5516-22-0x00000000063F0000-0x0000000006456000-memory.dmp

Download

memory/5516-23-0x0000000006460000-0x00000000064C6000-memory.dmp

Download

memory/5516-33-0x0000000006F80000-0x0000000006FA0000-memory.dmp

Download

memory/5516-12-0x00000000031B0000-0x00000000031E6000-memory.dmp

Download

memory/5516-17-0x0000000074420000-0x0000000074BDC000-memory.dmp

Download

memory/5516-16-0x0000000074420000-0x0000000074BDC000-memory.dmp

Download

memory/5516-15-0x0000000074420000-0x0000000074BDC000-memory.dmp

Download

memory/5640-0-0x0000000074432000-0x0000000074433000-memory.dmp

Download

memory/5640-18-0x0000000074420000-0x0000000074BDC000-memory.dmp

Download

memory/5640-10-0x0000000007710000-0x00000000077BE000-memory.dmp

Download

memory/5640-9-0x0000000007640000-0x00000000076DC000-memory.dmp

Download

memory/5640-8-0x0000000074420000-0x0000000074BDC000-memory.dmp

Download

memory/5640-7-0x0000000074432000-0x0000000074433000-memory.dmp

Download

memory/5640-6-0x0000000005530000-0x000000000554C000-memory.dmp

Download

memory/5640-5-0x0000000074420000-0x0000000074BDC000-memory.dmp

Download

memory/5640-4-0x0000000004E90000-0x0000000004E9A000-memory.dmp

Download

memory/5640-3-0x0000000004F90000-0x0000000005022000-memory.dmp

Download

memory/5640-2-0x0000000005550000-0x0000000005B0A000-memory.dmp

Download

memory/5640-1-0x00000000002B0000-0x0000000000380000-memory.dmp

Download