Analysis
- user interaction
yes - max time kernel
14s - max time network
43s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
04/11/2026, 19:08
General
- Target 2026-11-03_78bad501f6d1493a4cc1e424480aed5e_elex_glassworm_icedid_vidar.exe
- Size 61.7MB
- Sample261104-xteense14m
- SHA256 8d15b1d33af0a13b21f62e076da34b9087616266a091c67306030d123f946d63
Malware Config
Extracted
-
xworm
-
yNحكـX8ٍبAGLWِF6Jo2DiObلٍLZا3ا
-
Install_directory
%Port%
-
install_file
MicrosoftEdgeUpdateTaskMachineUAC.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 3 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
- Drops file in Windows directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 58 IoCs
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 15 IoCs
- Suspicious use of SendNotifyMessage 13 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ec65f6a8-4884-4dd4-8671-41263d19ff74 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-34ca0d4e-71b8-4e6b-aa00-ea7d925b6671 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-64abfbcf-b48a-419b-b2bd-89efb966f839 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-0c723dcf-f48e-44e9-a702-6c00d9b5edba -LifetimeId:44451966-1516-4ede-9209-528031ef233b -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_78bad501f6d1493a4cc1e424480aed5e_elex_glassworm_icedid_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_78bad501f6d1493a4cc1e424480aed5e_elex_glassworm_icedid_vidar.exe"2⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rx5bwiv3.fcs.exe"C:\Users\Admin\AppData\Local\Temp\rx5bwiv3.fcs.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Mason2026-11-03_78bad501f6d1493a4cc1e424480aed5e_elex_glassworm_icedid_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-11-03_78bad501f6d1493a4cc1e424480aed5e_elex_glassworm_icedid_vidar.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Mason2026-11-03_78bad501f6d1493a4cc1e424480aed5e_elex_glassworm_icedid_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-11-03_78bad501f6d1493a4cc1e424480aed5e_elex_glassworm_icedid_vidar.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\zofjmtba.sv0.exe"C:\Users\Admin\AppData\Local\Temp\zofjmtba.sv0.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 35962851ffbcc36a0a8064273a49b094 wBqUvdsFU0qq+Ihq1KfyOQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Process Injection
1Process Hollowing
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Debugger Evasion
1Indicator Removal
1Clear Windows Event Logs
1Pre-OS Boot
1Bootkit
1Process Injection
1Process Hollowing
1Replay Monitor
Loading Replay Monitor...
Downloads
WER20A.tmp.csv
WER249.tmp.txt
rx5bwiv3.fcs.exe
Schedule Maintenance Work
Schedule Wake To Work
Schedule Wake To Work
Schedule Wake To Work
Schedule Work
Schedule Work
memory/396-26-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/396-25-0x000001C4287F0000-0x000001C42881B000-memory.dmp
memory/396-34-0x000001C4287F0000-0x000001C42881B000-memory.dmp
memory/400-38-0x000001946AF60000-0x000001946AF8B000-memory.dmp
memory/400-112-0x000001946AF60000-0x000001946AF8B000-memory.dmp
memory/400-41-0x000001946AF60000-0x000001946AF8B000-memory.dmp
memory/400-39-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/616-16-0x000001CC99F80000-0x000001CC99FAB000-memory.dmp
memory/616-12-0x000001CC99F30000-0x000001CC99F55000-memory.dmp
memory/616-13-0x000001CC99F80000-0x000001CC99FAB000-memory.dmp
memory/616-14-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/676-19-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/676-21-0x0000024BD5330000-0x0000024BD535B000-memory.dmp
memory/676-18-0x0000024BD5330000-0x0000024BD535B000-memory.dmp
memory/884-35-0x0000025E88B70000-0x0000025E88B9B000-memory.dmp
memory/884-29-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/884-80-0x0000025E88B70000-0x0000025E88B9B000-memory.dmp
memory/884-28-0x0000025E88B70000-0x0000025E88B9B000-memory.dmp
memory/1020-36-0x0000024E6B9B0000-0x0000024E6B9DB000-memory.dmp
memory/1020-81-0x0000024E6B9B0000-0x0000024E6B9DB000-memory.dmp
memory/1020-31-0x0000024E6B9B0000-0x0000024E6B9DB000-memory.dmp
memory/1020-32-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1056-44-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1056-43-0x000001F4779A0000-0x000001F4779CB000-memory.dmp
memory/1056-156-0x000001F4779A0000-0x000001F4779CB000-memory.dmp
memory/1056-46-0x000001F4779A0000-0x000001F4779CB000-memory.dmp
memory/1120-51-0x00000281975B0000-0x00000281975DB000-memory.dmp
memory/1120-293-0x00000281975B0000-0x00000281975DB000-memory.dmp
memory/1120-52-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1120-63-0x00000281975B0000-0x00000281975DB000-memory.dmp
memory/1140-64-0x0000020575B40000-0x0000020575B6B000-memory.dmp
memory/1140-54-0x0000020575B40000-0x0000020575B6B000-memory.dmp
memory/1140-55-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1140-294-0x0000020575B40000-0x0000020575B6B000-memory.dmp
memory/1188-295-0x00000296A8AD0000-0x00000296A8AFB000-memory.dmp
memory/1188-57-0x00000296A8AD0000-0x00000296A8AFB000-memory.dmp
memory/1188-58-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1188-65-0x00000296A8AD0000-0x00000296A8AFB000-memory.dmp
memory/1236-296-0x000002B4C25B0000-0x000002B4C25DB000-memory.dmp
memory/1236-61-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1236-66-0x000002B4C25B0000-0x000002B4C25DB000-memory.dmp
memory/1236-60-0x000002B4C25B0000-0x000002B4C25DB000-memory.dmp
memory/1312-69-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1312-333-0x000001D081980000-0x000001D0819AB000-memory.dmp
memory/1312-68-0x000001D081980000-0x000001D0819AB000-memory.dmp
memory/1312-71-0x000001D081980000-0x000001D0819AB000-memory.dmp
memory/1348-74-0x000001D16E740000-0x000001D16E76B000-memory.dmp
memory/1348-335-0x000001D16E740000-0x000001D16E76B000-memory.dmp
memory/1348-75-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1348-82-0x000001D16E740000-0x000001D16E76B000-memory.dmp
memory/1392-336-0x000001E50E130000-0x000001E50E15B000-memory.dmp
memory/1392-78-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1392-77-0x000001E50E130000-0x000001E50E15B000-memory.dmp
memory/1392-83-0x000001E50E130000-0x000001E50E15B000-memory.dmp
memory/1464-92-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1464-113-0x000002140BE60000-0x000002140BE8B000-memory.dmp
memory/1464-358-0x000002140BE60000-0x000002140BE8B000-memory.dmp
memory/1464-91-0x000002140BE60000-0x000002140BE8B000-memory.dmp
memory/1476-95-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1476-114-0x0000025969450000-0x000002596947B000-memory.dmp
memory/1476-362-0x0000025969450000-0x000002596947B000-memory.dmp
memory/1476-94-0x0000025969450000-0x000002596947B000-memory.dmp
memory/1548-364-0x00000253CEC90000-0x00000253CECBB000-memory.dmp
memory/1548-97-0x00000253CEC90000-0x00000253CECBB000-memory.dmp
memory/1548-115-0x00000253CEC90000-0x00000253CECBB000-memory.dmp
memory/1548-98-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1596-139-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1596-456-0x0000022E95D90000-0x0000022E95DBB000-memory.dmp
memory/1596-160-0x0000022E95D90000-0x0000022E95DBB000-memory.dmp
memory/1596-138-0x0000022E95D90000-0x0000022E95DBB000-memory.dmp
memory/1676-161-0x0000019395690000-0x00000193956BB000-memory.dmp
memory/1676-457-0x0000019395690000-0x00000193956BB000-memory.dmp
memory/1676-141-0x0000019395690000-0x00000193956BB000-memory.dmp
memory/1676-142-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1700-365-0x000001A220D70000-0x000001A220D9B000-memory.dmp
memory/1700-116-0x000001A220D70000-0x000001A220D9B000-memory.dmp
memory/1700-101-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1700-100-0x000001A220D70000-0x000001A220D9B000-memory.dmp
memory/1708-117-0x00000293B15C0000-0x00000293B15EB000-memory.dmp
memory/1708-366-0x00000293B15C0000-0x00000293B15EB000-memory.dmp
memory/1708-104-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1708-103-0x00000293B15C0000-0x00000293B15EB000-memory.dmp
memory/1820-107-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1820-106-0x00000243B7370000-0x00000243B739B000-memory.dmp
memory/1820-118-0x00000243B7370000-0x00000243B739B000-memory.dmp
memory/1820-367-0x00000243B7370000-0x00000243B739B000-memory.dmp
memory/1848-368-0x000001FBBA960000-0x000001FBBA98B000-memory.dmp
memory/1848-119-0x000001FBBA960000-0x000001FBBA98B000-memory.dmp
memory/1848-109-0x000001FBBA960000-0x000001FBBA98B000-memory.dmp
memory/1848-110-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1900-453-0x000001BA59300000-0x000001BA5932B000-memory.dmp
memory/1900-157-0x000001BA59300000-0x000001BA5932B000-memory.dmp
memory/1900-129-0x000001BA59300000-0x000001BA5932B000-memory.dmp
memory/1900-130-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1924-145-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1924-144-0x000002880B3A0000-0x000002880B3CB000-memory.dmp
memory/1964-158-0x0000025252580000-0x00000252525AB000-memory.dmp
memory/1964-454-0x0000025252580000-0x00000252525AB000-memory.dmp
memory/1964-133-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/1964-132-0x0000025252580000-0x00000252525AB000-memory.dmp
memory/2000-136-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/2000-135-0x000001A574200000-0x000001A57422B000-memory.dmp
memory/2000-455-0x000001A574200000-0x000001A57422B000-memory.dmp
memory/2000-159-0x000001A574200000-0x000001A57422B000-memory.dmp
memory/2016-11-0x00007FFAE7590000-0x00007FFAE764E000-memory.dmp
memory/2016-10-0x00007FFAE8790000-0x00007FFAE8985000-memory.dmp
memory/2024-148-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/2024-147-0x0000013EE2D60000-0x0000013EE2D8B000-memory.dmp
memory/2152-150-0x0000000000C00000-0x0000000000C2B000-memory.dmp
memory/2152-151-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/2240-154-0x00007FFAA8810000-0x00007FFAA8820000-memory.dmp
memory/2240-153-0x0000017AB4240000-0x0000017AB426B000-memory.dmp
memory/2404-169-0x00000219D21B0000-0x00000219D21DB000-memory.dmp
memory/3196-444-0x0000000000570000-0x00000000042F8000-memory.dmp
memory/3512-445-0x000002BACF520000-0x000002BACF52E000-memory.dmp
memory/3512-515-0x000002BACFD80000-0x000002BACFD90000-memory.dmp
memory/3512-0-0x000002BAB18B0000-0x000002BAB566A000-memory.dmp
memory/3512-334-0x000002BAD8590000-0x000002BADC318000-memory.dmp
memory/3512-337-0x000002BACFD80000-0x000002BACFD90000-memory.dmp
memory/3512-1-0x000002BAB71B0000-0x000002BAB71DC000-memory.dmp