Overview

overview

10

Static

static

10

XClient.exe

windows10-2004-x64

10

XClient.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    1046s
  • max time network
    1047s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240730-en
  • resource tags

    arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02-08-2024 14:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XClient.exe

  • Size

    75KB

  • MD5

    f7ff3c61ccfe4bf667be21d19d15ae02

  • SHA1

    5b8513ce3c9f9d99f40c5c8ada5c185875c5d5dc

  • SHA256

    9736108b514387789ef980f84f47bacf167e63f7345ae3b7b7709b522e5d2bb5

  • SHA512

    23e0e82f5728735594e17cbe4560589ec1f98bdb9b7945938685f504b41611eb538b77ac70b858521d4c267fb70745a62393c28cd33d04b70e81c9c9739a630e

  • SSDEEP

    1536:xaStNYRxaTNDyXDb6xDcPZZD6SQXsOAt5KdDy:/qa0zb6xgksOGuy

Score
10/10
stormkittyxwormcredential_accessdiscoveryexecutionpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:48776

localhost:48776

via-media.gl.at.ply.gg:48776
Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 43 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\XClient.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3352
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5252
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3228
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5244
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3376
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:5156
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Windows\system32\netsh.exe
        netsh wlan show profiles
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Network Configuration Discovery: Wi-Fi Discovery
        PID:5328
    • C:\Windows\SYSTEM32\CMD.EXE
      "CMD.EXE"
      2⤵
        PID:3624
      • C:\Users\Admin\AppData\Local\Temp\rjhxzk.exe
        "C:\Users\Admin\AppData\Local\Temp\rjhxzk.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4612
      • C:\Users\Admin\AppData\Local\Temp\gblzsd.exe
        "C:\Users\Admin\AppData\Local\Temp\gblzsd.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:728
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5052
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1600
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4612
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1176
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4172
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004C0
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4072
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2168
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2684
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:6040
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5140
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3416
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3964
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5788
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4988
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      PID:5744
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      PID:2828
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      PID:3608
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      PID:5812
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      PID:5656
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      PID:696
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      PID:2956
    • C:\Users\Admin\AppData\Roaming\XClient.exe
      C:\Users\Admin\AppData\Roaming\XClient.exe
      1⤵
      • Executes dropped EXE
      PID:4988

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    PowerShell

    1
    T1059.001

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Persistence

    Boot or Logon Autostart Execution

    2
    T1547

    Active Setup

    1
    T1547.014

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Event Triggered Execution

    1
    T1546

    Netsh Helper DLL

    1
    T1546.007

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Privilege Escalation

    Boot or Logon Autostart Execution

    2
    T1547

    Active Setup

    1
    T1547.014

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Event Triggered Execution

    1
    T1546

    Netsh Helper DLL

    1
    T1546.007

    Scheduled Task/Job

    1
    T1053

    Scheduled Task

    1
    T1053.005

    Defense Evasion

    Modify Registry

    3
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    1
    T1552

    Credentials In Files

    1
    T1552.001

    Discovery

    Browser Information Discovery

    1
    T1217

    Peripheral Device Discovery

    2
    T1120

    Query Registry

    5
    T1012

    System Information Discovery

    5
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    System Network Configuration Discovery

    1
    T1016

    Wi-Fi Discovery

    1
    T1016.002

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log
      Filesize

      654B

      MD5

      2cbbb74b7da1f720b48ed31085cbd5b8

      SHA1

      79caa9a3ea8abe1b9c4326c3633da64a5f724964

      SHA256

      e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

      SHA512

      ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      627073ee3ca9676911bee35548eff2b8

      SHA1

      4c4b68c65e2cab9864b51167d710aa29ebdcff2e

      SHA256

      85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

      SHA512

      3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      e3840d9bcedfe7017e49ee5d05bd1c46

      SHA1

      272620fb2605bd196df471d62db4b2d280a363c6

      SHA256

      3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f

      SHA512

      76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      80707036df540b6657f9d443b449e3c3

      SHA1

      b3e7d5d97274942164bf93c8c4b8a9b68713f46f

      SHA256

      6651e5f976619cef991deef61776cf43d4c4b3d7c551dd2192b647df71586ab0

      SHA512

      65e41e9e730fed4f7a7d3f6f35875a16948b897f87c8c70b371fd0ac7f0951814f6a75e7698665194bbc65a3665a684e7be229e7e24193b50483ae7e55eebf4f

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      944B

      MD5

      a4be454dcbec32af10161f739ec237fc

      SHA1

      44d5b3b34f92818563efeb37dc75442273cc2bf3

      SHA256

      4436e1add60e37baccc40f44b93b8ee2baf4261b5e3e45a834ba350ec9658f15

      SHA512

      a925de5c086cb81b50136d78dc7aea45f8205b57ae8b6219f3d00016b33ebec7e85d7630baf0c09ec2ed29a87c68f0cdefcfd21eb7e99a5679dc632cb725fc4f

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\PBX0KEGC\www.bing[1].xml
      Filesize

      17KB

      MD5

      ffde8f200d59204b115a27e96be05a1e

      SHA1

      fcbb9e6b1862ed50a951c628a9b3d69c5a5bab57

      SHA256

      ac1c69bfd5df26daaeae5e3293b53823863e6369b521b66f415df838d4eb694f

      SHA512

      f92662837ef4d4f2cc2b9c400c2aaab5b9f7831c80aa6803d3e2d01498d018516ab9313329a28c1bc537725031021325bbf52f29c692ed0502b18ede465c862c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ikxnzxgu.cxw.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\gblzsd.exe
      Filesize

      1.0MB

      MD5

      ae250258012727720a7be047f3a551bb

      SHA1

      a605d60d81c6002c8a67c8770c6a7133a281359c

      SHA256

      75cca561fd994676c8925dc592a324739c15e834deae2e0c26cd09519c2f84d7

      SHA512

      9c3e2e449270a74be1af746752946c77dcdff677f4d38767f4eac65b292dca18d5e6935e2c134e625d762af7dd7e3a35ba01ade3c34cc9ae1c66e28d6506ad62

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\rjhxzk.exe
      Filesize

      7.4MB

      MD5

      3c3d1168fc2724c551837a505ea4374e

      SHA1

      86c913a12067fd2c1bbc31fb64a5b5d056175841

      SHA256

      f91c14c328544a2d4cc216c7c2115283806fa3201d40bd3c7c5d79dccd025b09

      SHA512

      0f181c9753a3f55e4f4a434ea3e972e00b46fb7319d95a4b7a5c7d09888537df4a8fc4c2c5e0232f96b441727e45a595eed42721ff8c7799302e4d3f13156a8e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmp55F8.tmp
      Filesize

      100KB

      MD5

      1b942faa8e8b1008a8c3c1004ba57349

      SHA1

      cd99977f6c1819b12b33240b784ca816dfe2cb91

      SHA256

      555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc

      SHA512

      5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43

      Download Submit

    • C:\Users\Admin\AppData\Roaming\XClient.exe
      Filesize

      75KB

      MD5

      f7ff3c61ccfe4bf667be21d19d15ae02

      SHA1

      5b8513ce3c9f9d99f40c5c8ada5c185875c5d5dc

      SHA256

      9736108b514387789ef980f84f47bacf167e63f7345ae3b7b7709b522e5d2bb5

      SHA512

      23e0e82f5728735594e17cbe4560589ec1f98bdb9b7945938685f504b41611eb538b77ac70b858521d4c267fb70745a62393c28cd33d04b70e81c9c9739a630e

      Download Submit

    • memory/2684-158-0x000001EBA00F0000-0x000001EBA01F0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2684-141-0x000001F3FE500000-0x000001F3FE600000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2684-226-0x000001EBA1B80000-0x000001EBA1BA0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2684-206-0x000001EBA0EE0000-0x000001EBA0F00000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2684-204-0x000001EBA03B0000-0x000001EBA03D0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2684-169-0x000001EBA10B0000-0x000001EBA11B0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2684-161-0x000001EBA0270000-0x000001EBA0290000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3352-105-0x000000001BEF0000-0x000000001BF2A000-memory.dmp

      Filesize

      232KB

      Download

    • memory/3352-121-0x000000001D210000-0x000000001D256000-memory.dmp

      Filesize

      280KB

      Download

    • memory/3352-66-0x000000001CDA0000-0x000000001CEC0000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/3352-1-0x00007FFB46EA3000-0x00007FFB46EA5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3352-2-0x00007FFB46EA0000-0x00007FFB47962000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3352-110-0x000000001D0C0000-0x000000001D14E000-memory.dmp

      Filesize

      568KB

      Download

    • memory/3352-112-0x000000001D180000-0x000000001D20E000-memory.dmp

      Filesize

      568KB

      Download

    • memory/3352-113-0x000000001CFC0000-0x000000001CFCC000-memory.dmp

      Filesize

      48KB

      Download

    • memory/3352-114-0x000000001F5E0000-0x000000001FB08000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/3352-117-0x000000001CD80000-0x000000001CD8D000-memory.dmp

      Filesize

      52KB

      Download

    • memory/3352-118-0x000000001D150000-0x000000001D16E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/3352-119-0x000000001CD90000-0x000000001CD9B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/3352-115-0x000000001D210000-0x000000001D256000-memory.dmp

      Filesize

      280KB

      Download

    • memory/3352-116-0x000000001BFD0000-0x000000001BFD9000-memory.dmp

      Filesize

      36KB

      Download

    • memory/3352-120-0x000000001BDF0000-0x000000001BDFA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/3352-64-0x000000001D3A0000-0x000000001D6F0000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/3352-126-0x000000001B8D0000-0x000000001B8DC000-memory.dmp

      Filesize

      48KB

      Download

    • memory/3352-62-0x000000001B550000-0x000000001B55E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/3352-0-0x0000000000890000-0x00000000008AA000-memory.dmp

      Filesize

      104KB

      Download

    • memory/3352-418-0x000000001CFD0000-0x000000001D080000-memory.dmp

      Filesize

      704KB

      Download

    • memory/3352-58-0x000000001C310000-0x000000001C31C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/3352-57-0x00007FFB46EA0000-0x00007FFB47962000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4612-518-0x0000000000180000-0x00000000008E0000-memory.dmp

      Filesize

      7.4MB

      Download

    • memory/4612-519-0x00000000058E0000-0x0000000005E86000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4612-520-0x00000000053D0000-0x0000000005462000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4612-521-0x0000000005390000-0x000000000539A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/5252-14-0x00007FFB46EA0000-0x00007FFB47962000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/5252-15-0x00007FFB46EA0000-0x00007FFB47962000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/5252-11-0x0000025F5AAC0000-0x0000025F5AAE2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/5252-13-0x00007FFB46EA0000-0x00007FFB47962000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/5252-12-0x00007FFB46EA0000-0x00007FFB47962000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/5252-18-0x00007FFB46EA0000-0x00007FFB47962000-memory.dmp

      Filesize

      10.8MB

      Download