xworm | fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe
Size 781KB
Sample260809-yfezqaxyaz
SHA256 fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9
MD5 538860d455edc8108e667b8498a41fe3
SHA1 6bbb36dc96230667e363d62881a6166ec67b8a89
SHA512 1f1dcc9932f2f0890ddce2eddad00367295a28ffbf5d8e6b1241491dc7f30afb7be7607f9254d41d89eca4af26c392825e1c8f07ee9824d2750261f1711d2be0
SSDEEP 24576:NJa6UwvkxSxczIGoHh4mSKDVa5dw8PJr:3a69Mbzi45dwCr
TLSH
T114050229125ED807D4625FB00F72D67883746FC9A521D213CFEDBE9FB677AA02904392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

109.248.150.234:443

Mutex

70vLmgcqMEnUJOeL

Attributes

Install_directory
%AppData%
install_file
bin.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4920-11-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1200	powershell.exe
4440	powershell.exe
1168	powershell.exe
4376	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bin.lnk	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe

Executes dropped EXE 6 IoCs

pid	Process
4264	bin.exe
2708	bin.exe
2768	bin.exe
3396	bin.exe
1060	bin.exe
632	bin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\bin = "C:\\Users\\Admin\\AppData\\Roaming\\bin.exe"	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4892 set thread context of 4920	4892	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe	89
PID 4264 set thread context of 3396	4264	bin.exe	107
PID 1060 set thread context of 632	1060	bin.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1200	powershell.exe
1200	powershell.exe
4440	powershell.exe
4440	powershell.exe
1168	powershell.exe
1168	powershell.exe
4376	powershell.exe
4376	powershell.exe
4264	bin.exe
4264	bin.exe
4264	bin.exe
4264	bin.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeIncreaseQuotaPrivilege	1200	powershell.exe
Token: SeSecurityPrivilege	1200	powershell.exe
Token: SeTakeOwnershipPrivilege	1200	powershell.exe
Token: SeLoadDriverPrivilege	1200	powershell.exe
Token: SeSystemProfilePrivilege	1200	powershell.exe
Token: SeSystemtimePrivilege	1200	powershell.exe
Token: SeProfSingleProcessPrivilege	1200	powershell.exe
Token: SeIncBasePriorityPrivilege	1200	powershell.exe
Token: SeCreatePagefilePrivilege	1200	powershell.exe
Token: SeBackupPrivilege	1200	powershell.exe
Token: SeRestorePrivilege	1200	powershell.exe
Token: SeShutdownPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeSystemEnvironmentPrivilege	1200	powershell.exe
Token: SeRemoteShutdownPrivilege	1200	powershell.exe
Token: SeUndockPrivilege	1200	powershell.exe
Token: SeManageVolumePrivilege	1200	powershell.exe
Token: 33	1200	powershell.exe
Token: 34	1200	powershell.exe
Token: 35	1200	powershell.exe
Token: 36	1200	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeIncreaseQuotaPrivilege	4440	powershell.exe
Token: SeSecurityPrivilege	4440	powershell.exe
Token: SeTakeOwnershipPrivilege	4440	powershell.exe
Token: SeLoadDriverPrivilege	4440	powershell.exe
Token: SeSystemProfilePrivilege	4440	powershell.exe
Token: SeSystemtimePrivilege	4440	powershell.exe
Token: SeProfSingleProcessPrivilege	4440	powershell.exe
Token: SeIncBasePriorityPrivilege	4440	powershell.exe
Token: SeCreatePagefilePrivilege	4440	powershell.exe
Token: SeBackupPrivilege	4440	powershell.exe
Token: SeRestorePrivilege	4440	powershell.exe
Token: SeShutdownPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeSystemEnvironmentPrivilege	4440	powershell.exe
Token: SeRemoteShutdownPrivilege	4440	powershell.exe
Token: SeUndockPrivilege	4440	powershell.exe
Token: SeManageVolumePrivilege	4440	powershell.exe
Token: 33	4440	powershell.exe
Token: 34	4440	powershell.exe
Token: 35	4440	powershell.exe
Token: 36	4440	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeIncreaseQuotaPrivilege	1168	powershell.exe
Token: SeSecurityPrivilege	1168	powershell.exe
Token: SeTakeOwnershipPrivilege	1168	powershell.exe
Token: SeLoadDriverPrivilege	1168	powershell.exe
Token: SeSystemProfilePrivilege	1168	powershell.exe
Token: SeSystemtimePrivilege	1168	powershell.exe
Token: SeProfSingleProcessPrivilege	1168	powershell.exe
Token: SeIncBasePriorityPrivilege	1168	powershell.exe
Token: SeCreatePagefilePrivilege	1168	powershell.exe
Token: SeBackupPrivilege	1168	powershell.exe
Token: SeRestorePrivilege	1168	powershell.exe
Token: SeShutdownPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeSystemEnvironmentPrivilege	1168	powershell.exe
Token: SeRemoteShutdownPrivilege	1168	powershell.exe
Token: SeUndockPrivilege	1168	powershell.exe
Token: SeManageVolumePrivilege	1168	powershell.exe
Token: 33	1168	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4920	4892	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe	89
PID 4892 wrote to memory of 4920	4892	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe	89
PID 4892 wrote to memory of 4920	4892	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe	89
PID 4892 wrote to memory of 4920	4892	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe	89
PID 4892 wrote to memory of 4920	4892	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe	89
PID 4920 wrote to memory of 1200	4920	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe	90
PID 4920 wrote to memory of 4440	4920	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe	93
PID 4920 wrote to memory of 1168	4920	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe	96
PID 4920 wrote to memory of 4376	4920	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe	98
PID 4920 wrote to memory of 4132	4920	fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe	100
PID 4264 wrote to memory of 2708	4264	bin.exe	105
PID 4264 wrote to memory of 2768	4264	bin.exe	106
PID 4264 wrote to memory of 3396	4264	bin.exe	107
PID 4264 wrote to memory of 3396	4264	bin.exe	107
PID 4264 wrote to memory of 3396	4264	bin.exe	107
PID 4264 wrote to memory of 3396	4264	bin.exe	107
PID 4264 wrote to memory of 3396	4264	bin.exe	107
PID 1060 wrote to memory of 632	1060	bin.exe	109
PID 1060 wrote to memory of 632	1060	bin.exe	109
PID 1060 wrote to memory of 632	1060	bin.exe	109
PID 1060 wrote to memory of 632	1060	bin.exe	109
PID 1060 wrote to memory of 632	1060	bin.exe	109

C:\Users\Admin\AppData\Local\Temp\fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe
"C:\Users\Admin\AppData\Local\Temp\fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe
  "C:\Users\Admin\AppData\Local\Temp\fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe"
  2⤵
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'bin.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4376
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "bin" /tr "C:\Users\Admin\AppData\Roaming\bin.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4132

C:\Users\Admin\AppData\Roaming\bin.exe
C:\Users\Admin\AppData\Roaming\bin.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3396

C:\Users\Admin\AppData\Roaming\bin.exe
"C:\Users\Admin\AppData\Roaming\bin.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Users\Admin\AppData\Roaming\bin.exe
  "C:\Users\Admin\AppData\Roaming\bin.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 4f0a8997a6c529d895d73a0da7d5b7ca5d143ca694c7f01df60460c28169480f
MD5 7cc55764d93c02e7d93c8ee33c083915
SHA1 361f9c35c1e28a8f4ddfbf675c4134750d8159a4
SHA512 2014015eb1c9606cdcee2a85548628e7c4f5e8c5901f0f13ee8730c787012e5886e8b009cb5b0690d78146ceecdeff8c0ee908ca7bca793f5348a3e21e0c8ce2
SSDEEP 384:OI1eBaoT1iBG3GW14bEx6t/+Jh07jrr2Hn9IAXz48+FWbTizKw8vYbhNaPklRtTG:OEexZ6G2Wi46t/+rE6dIAXzX+E+zbhNC
TLSH
T145A2B478213F6DC7D8D226B410D20AB7FBE4D489DAB611D4BF1BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 6a9a1d3b2387e2edbe8209a1658d78e7cf9857377d6893c6d0c66c93cd72cb99
MD5 cbd1a020ab052731e14b3892bae2393e
SHA1 d1a791278360e983ea664f8972cf40a61758c34e
SHA512 75c3340e58a700286529f7f446bcf3d0ba54b483d2cac4bfea13ac4c31760dfdee5759dbc07c2fb94b7d8f66c17b208a31adaeda748a64212001089080187de1
SSDEEP 384:61eBaoT1iBGJimdn6e3gS0xhWWOE6UDzdboIAXIIGQxVpqBBKpM7hNIJJhtcRWhP:qexZ6GJiQn6Wl65N6UFboIAXD1HpM9ho
TLSH
T145A2F82D266F59CBC84160B810824396FBF8D559E7E152DBEB0FC92F2C81A7E5E501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 6ccf7a30d89d1f13b9a794a9a65145a6219b18b4ed184c2fe171d522af89d85c
MD5 84f09d6580075db0f4a45ca89ce1c9b9
SHA1 3e53871488a2f8ced6284e6a95ca8484b3473d06
SHA512 01d6738d52a04fc5b201bb63373cf57ac3217d9814870e4072604b9c200061088d4f563383ebdc6c7f17e011ca2f6dbc9977f3c4d96490d116c72d8a5666df1b
SSDEEP 384:31eBaoT1iBGqGlbcHN+g4mlRupe8HPrOEPiUDzdC0MIAXILQ1aOvqBBKphv27hih:lexZ6Gxlgt+yyp3DN6UFC0MIAXRYOvMg
TLSH
T12BA2F82D26AF48CBC99161B800824382FBF8E555E7E152DBEB4FC91F2C45A7E5E501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0guomfxv.te5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0guomfxv.te5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bin.exe

Path C:\Users\Admin\AppData\Roaming\bin.exe
Size 781KB
SHA256 fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9
MD5 538860d455edc8108e667b8498a41fe3
SHA1 6bbb36dc96230667e363d62881a6166ec67b8a89
SHA512 1f1dcc9932f2f0890ddce2eddad00367295a28ffbf5d8e6b1241491dc7f30afb7be7607f9254d41d89eca4af26c392825e1c8f07ee9824d2750261f1711d2be0
SSDEEP 24576:NJa6UwvkxSxczIGoHh4mSKDVa5dw8PJr:3a69Mbzi45dwCr
TLSH
T114050229125ED807D4625FB00F72D67883746FC9A521D213CFEDBE9FB677AA02904392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1168-51-0x0000000070D50000-0x0000000070D9C000-memory.dmp

Download

memory/1200-38-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/1200-27-0x0000000006F10000-0x0000000006F46000-memory.dmp

Download

memory/1200-36-0x0000000007330000-0x00000000073C6000-memory.dmp

Download

memory/1200-35-0x0000000007130000-0x000000000713A000-memory.dmp

Download

memory/1200-34-0x00000000070C0000-0x00000000070DA000-memory.dmp

Download

memory/1200-33-0x0000000007700000-0x0000000007D7C000-memory.dmp

Download

memory/1200-32-0x0000000006F80000-0x0000000007023000-memory.dmp

Download

memory/1200-28-0x0000000070D50000-0x0000000070D9C000-memory.dmp

Download

memory/1200-14-0x0000000004870000-0x00000000048A6000-memory.dmp

Download

memory/1200-15-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/1200-16-0x0000000004F00000-0x000000000554A000-memory.dmp

Download

memory/1200-17-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/1200-18-0x00000000056D0000-0x00000000056F2000-memory.dmp

Download

memory/1200-20-0x00000000057E0000-0x0000000005846000-memory.dmp

Download

memory/1200-19-0x0000000005770000-0x00000000057D6000-memory.dmp

Download

memory/1200-24-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/1200-23-0x0000000005990000-0x0000000005CEB000-memory.dmp

Download

memory/1200-25-0x0000000005D50000-0x0000000005D6E000-memory.dmp

Download

memory/1200-26-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

Download

memory/1200-31-0x0000000006F50000-0x0000000006F70000-memory.dmp

Download

memory/4376-58-0x0000000070D50000-0x0000000070D9C000-memory.dmp

Download

memory/4440-41-0x0000000005A50000-0x0000000005DAB000-memory.dmp

Download

memory/4440-43-0x0000000070D50000-0x0000000070D9C000-memory.dmp

Download

memory/4892-5-0x0000000005880000-0x000000000591C000-memory.dmp

Download

memory/4892-2-0x0000000005D60000-0x000000000631A000-memory.dmp

Download

memory/4892-9-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4892-8-0x0000000074AD2000-0x0000000074AD3000-memory.dmp

Download

memory/4892-0-0x0000000074AD2000-0x0000000074AD3000-memory.dmp

Download

memory/4892-10-0x0000000009130000-0x00000000091D4000-memory.dmp

Download

memory/4892-6-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4892-7-0x0000000005D30000-0x0000000005D4A000-memory.dmp

Download

memory/4892-1-0x0000000000AC0000-0x0000000000B88000-memory.dmp

Download

memory/4892-13-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4892-4-0x00000000056A0000-0x00000000056AA000-memory.dmp

Download

memory/4892-3-0x00000000056B0000-0x0000000005742000-memory.dmp

Download

memory/4920-11-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4920-46-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4920-66-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4920-12-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download

memory/4920-69-0x0000000074AC0000-0x000000007527C000-memory.dmp

Download