Overview

overview

10

Static

static

10

Client-built.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-05-2024 18:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    513fd46951e84bb03ce06b2cb9b36c87

  • SHA1

    0178e00984bd01f6c4139fcafdd66239068c8aab

  • SHA256

    1c35c705b1631b42ec9031cef8e480dcde919b5edd053f44c679ed60ef1e9861

  • SHA512

    a7b2610fdef025d0e8dec106353442a47e6713c92466f6269834966133a255c4165cf4c105d3a3e3064ef7db7fbb9cc3e567d6f382c2e39e6b3934479e0694a6

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+GPIC:5Zv5PDwbjNrmAE+iIC

Score
10/10
discordratpersistenceratrootkitspywarestealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI0MDM2OTMwNTAxOTg3OTYxNQ.GWVbBm.czywoPvQW4vkvutIFNvm-Jgf0tjXRH09lViLf0

  • server_id

    1240368331786027058

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Downloads MZ/PE file
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 18 IoCs
  • Drops file in System32 directory 11 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 14 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:616
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:64
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{3832002a-f7a6-42cf-bf4f-49fba434eabe}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:232
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
        PID:672
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:956
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:516
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
            1⤵
              PID:1032
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:1048
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                1⤵
                  PID:1056
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                  • Drops file in System32 directory
                  PID:1176
                  • C:\Windows\system32\taskhostw.exe
                    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                    2⤵
                      PID:2720
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                    1⤵
                    • Drops file in System32 directory
                    PID:1196
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                    1⤵
                      PID:1308
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1372
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1392
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                          1⤵
                            PID:1408
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                            1⤵
                              PID:1416
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                              1⤵
                                PID:1424
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                1⤵
                                  PID:1580
                                  • C:\Windows\system32\sihost.exe
                                    sihost.exe
                                    2⤵
                                      PID:2572
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                    1⤵
                                      PID:1616
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1696
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                        1⤵
                                          PID:1768
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                          1⤵
                                            PID:1788
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            1⤵
                                              PID:1844
                                              • C:\Windows\system32\AUDIODG.EXE
                                                C:\Windows\system32\AUDIODG.EXE 0x394 0x41c
                                                2⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1136
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                              1⤵
                                                PID:1900
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1908
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                  1⤵
                                                    PID:1976
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                    1⤵
                                                      PID:2044
                                                    • C:\Windows\System32\spoolsv.exe
                                                      C:\Windows\System32\spoolsv.exe
                                                      1⤵
                                                        PID:1632
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                        1⤵
                                                          PID:2068
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                          1⤵
                                                            PID:2252
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                            1⤵
                                                              PID:2332
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                              1⤵
                                                                PID:2424
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2432
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                  1⤵
                                                                    PID:2584
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                    1⤵
                                                                    • Drops file in System32 directory
                                                                    PID:2688
                                                                  • C:\Windows\sysmon.exe
                                                                    C:\Windows\sysmon.exe
                                                                    1⤵
                                                                      PID:2772
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                      1⤵
                                                                        PID:2804
                                                                      • C:\Windows\System32\svchost.exe
                                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                        1⤵
                                                                          PID:2812
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                          1⤵
                                                                            PID:2868
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                            1⤵
                                                                              PID:2992
                                                                            • C:\Windows\system32\wbem\unsecapp.exe
                                                                              C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                              1⤵
                                                                                PID:3052
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                1⤵
                                                                                  PID:3428
                                                                                • C:\Windows\Explorer.EXE
                                                                                  C:\Windows\Explorer.EXE
                                                                                  1⤵
                                                                                  • Suspicious use of UnmapMainImage
                                                                                  PID:3504
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                    2⤵
                                                                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4500
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                  1⤵
                                                                                    PID:3640
                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                    1⤵
                                                                                      PID:3832
                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                      1⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of UnmapMainImage
                                                                                      PID:3992
                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                      1⤵
                                                                                        PID:3516
                                                                                      • C:\Windows\system32\SppExtComObj.exe
                                                                                        C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                        1⤵
                                                                                          PID:4516
                                                                                        • C:\Windows\System32\svchost.exe
                                                                                          C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                          1⤵
                                                                                            PID:4724
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                            1⤵
                                                                                              PID:4564
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                              1⤵
                                                                                                PID:1100
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                1⤵
                                                                                                  PID:2304
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                  1⤵
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:760
                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                  "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                  1⤵
                                                                                                  • Drops file in System32 directory
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:1764
                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                  1⤵
                                                                                                    PID:4892
                                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:4832
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                      1⤵
                                                                                                        PID:1840
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
                                                                                                        1⤵
                                                                                                          PID:4100
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                          • Modifies registry class
                                                                                                          PID:2904
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:4884
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                            1⤵
                                                                                                              PID:552
                                                                                                            • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                              1⤵
                                                                                                                PID:3724
                                                                                                              • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                1⤵
                                                                                                                  PID:3660
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                  1⤵
                                                                                                                    PID:2376
                                                                                                                  • C:\Windows\System32\mousocoreworker.exe
                                                                                                                    C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                    1⤵
                                                                                                                    • Checks processor information in registry
                                                                                                                    • Enumerates system info in registry
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:3148
                                                                                                                  • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                    1⤵
                                                                                                                      PID:4064
                                                                                                                    • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                      1⤵
                                                                                                                        PID:3292
                                                                                                                      • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                        "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                        1⤵
                                                                                                                          PID:4760

                                                                                                                        Network

                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                          SHA1

                                                                                                                          98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                          SHA256

                                                                                                                          ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                          SHA512

                                                                                                                          c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                          Download Submit

                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          f313c5b4f95605026428425586317353

                                                                                                                          SHA1

                                                                                                                          06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                          SHA256

                                                                                                                          129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                          SHA512

                                                                                                                          b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                          Download Submit

                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                          SHA1

                                                                                                                          a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                          SHA256

                                                                                                                          98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                          SHA512

                                                                                                                          1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                          Download Submit

                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                          SHA1

                                                                                                                          63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                          SHA256

                                                                                                                          727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                          SHA512

                                                                                                                          f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                          Download Submit

                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                          SHA1

                                                                                                                          5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                          SHA256

                                                                                                                          55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                          SHA512

                                                                                                                          5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                          Download Submit

                                                                                                                        • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                          Filesize

                                                                                                                          2KB

                                                                                                                          MD5

                                                                                                                          0b990e24f1e839462c0ac35fef1d119e

                                                                                                                          SHA1

                                                                                                                          9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                          SHA256

                                                                                                                          a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                          SHA512

                                                                                                                          c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                          Download Submit

                                                                                                                        • memory/64-39-0x00007FFD3BBF0000-0x00007FFD3BC00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/64-301-0x000001FF12040000-0x000001FF1206A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/64-38-0x000001FF12040000-0x000001FF1206A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/232-24-0x00007FFD7B750000-0x00007FFD7B80E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          760KB

                                                                                                                          Download

                                                                                                                        • memory/232-20-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          256KB

                                                                                                                          Download

                                                                                                                        • memory/232-21-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          256KB

                                                                                                                          Download

                                                                                                                        • memory/232-22-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          256KB

                                                                                                                          Download

                                                                                                                        • memory/232-25-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          256KB

                                                                                                                          Download

                                                                                                                        • memory/232-23-0x00007FFD7BB70000-0x00007FFD7BD65000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.0MB

                                                                                                                          Download

                                                                                                                        • memory/232-26-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          256KB

                                                                                                                          Download

                                                                                                                        • memory/516-304-0x000001C14D700000-0x000001C14D72A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/516-47-0x00007FFD3BBF0000-0x00007FFD3BC00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/516-46-0x000001C14D700000-0x000001C14D72A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/616-299-0x00007FFD7BC0D000-0x00007FFD7BC0E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/616-298-0x00000276BF320000-0x00000276BF34A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/616-29-0x00000276BF320000-0x00000276BF34A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/616-28-0x00000276BF2F0000-0x00000276BF313000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          140KB

                                                                                                                          Download

                                                                                                                        • memory/616-30-0x00007FFD3BBF0000-0x00007FFD3BC00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/672-300-0x000002E3BCEE0000-0x000002E3BCF0A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/672-33-0x000002E3BCEE0000-0x000002E3BCF0A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/672-34-0x00007FFD3BBF0000-0x00007FFD3BC00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/956-302-0x000002B02D040000-0x000002B02D06A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/956-44-0x00007FFD3BBF0000-0x00007FFD3BC00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/956-303-0x00007FFD7BC0C000-0x00007FFD7BC0D000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          4KB

                                                                                                                          Download

                                                                                                                        • memory/956-43-0x000002B02D040000-0x000002B02D06A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/1032-305-0x0000023047B60000-0x0000023047B8A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/1032-50-0x00007FFD3BBF0000-0x00007FFD3BC00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/1032-49-0x0000023047B60000-0x0000023047B8A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/1048-58-0x00007FFD3BBF0000-0x00007FFD3BC00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/1048-57-0x000001B88BE90000-0x000001B88BEBA000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/1056-61-0x00007FFD3BBF0000-0x00007FFD3BC00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/1056-60-0x000002626F960000-0x000002626F98A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/1176-63-0x000001AD66340000-0x000001AD6636A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/1176-64-0x00007FFD3BBF0000-0x00007FFD3BC00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/1196-66-0x000002D122650000-0x000002D12267A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/1196-67-0x00007FFD3BBF0000-0x00007FFD3BC00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/1308-70-0x00007FFD3BBF0000-0x00007FFD3BC00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/1308-69-0x000001F6F3860000-0x000001F6F388A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/1372-73-0x0000014254FD0000-0x0000014254FFA000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          168KB

                                                                                                                          Download

                                                                                                                        • memory/1372-74-0x00007FFD3BBF0000-0x00007FFD3BC00000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          64KB

                                                                                                                          Download

                                                                                                                        • memory/4500-15-0x0000023261F50000-0x000002326221A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.8MB

                                                                                                                          Download

                                                                                                                        • memory/4500-19-0x00007FFD7B750000-0x00007FFD7B80E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          760KB

                                                                                                                          Download

                                                                                                                        • memory/4500-18-0x00007FFD7BB70000-0x00007FFD7BD65000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          2.0MB

                                                                                                                          Download

                                                                                                                        • memory/4500-17-0x00000232604A0000-0x00000232604DE000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          248KB

                                                                                                                          Download

                                                                                                                        • memory/4500-16-0x00007FFD5DB10000-0x00007FFD5E5D1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          10.8MB

                                                                                                                          Download

                                                                                                                        • memory/4500-0-0x0000023245990000-0x00000232459A8000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          96KB

                                                                                                                          Download

                                                                                                                        • memory/4500-14-0x00007FFD5DB10000-0x00007FFD5E5D1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          10.8MB

                                                                                                                          Download

                                                                                                                        • memory/4500-10-0x00000232603F0000-0x000002326049A000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          680KB

                                                                                                                          Download

                                                                                                                        • memory/4500-9-0x00007FFD5DB10000-0x00007FFD5E5D1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          10.8MB

                                                                                                                          Download

                                                                                                                        • memory/4500-8-0x00007FFD5DB13000-0x00007FFD5DB15000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                          Download

                                                                                                                        • memory/4500-7-0x000002325FF50000-0x000002325FF6E000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          120KB

                                                                                                                          Download

                                                                                                                        • memory/4500-6-0x000002325FF20000-0x000002325FF32000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          Download

                                                                                                                        • memory/4500-5-0x00000232602C0000-0x0000023260336000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          472KB

                                                                                                                          Download

                                                                                                                        • memory/4500-4-0x0000023260770000-0x0000023260C98000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          5.2MB

                                                                                                                          Download

                                                                                                                        • memory/4500-3-0x00007FFD5DB10000-0x00007FFD5E5D1000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          10.8MB

                                                                                                                          Download

                                                                                                                        • memory/4500-2-0x000002325FF70000-0x0000023260132000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          1.8MB

                                                                                                                          Download

                                                                                                                        • memory/4500-1-0x00007FFD5DB13000-0x00007FFD5DB15000-memory.dmp

                                                                                                                          Filesize

                                                                                                                          8KB

                                                                                                                          Download