discordrat | b39337904af234ce5ab04051a009b9a8c60fa46bccc76d449800be886c123e0b

Analysis

max time kernel
79s
max time network
74s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09-09-2024 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

bd8aa548c282f2156b940c67f212a196
SHA1

5c76d556322dd933ae1e0304a3667e2121bed0c4
SHA256

b39337904af234ce5ab04051a009b9a8c60fa46bccc76d449800be886c123e0b
SHA512

976930e1551958cf9469b4bad2c6b52f1844ef8c303d4182d6486a7ed09f11ecff0ae1433031d44e466f24944a6a5101148268f370c5a76f62d606e79a34e685
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+HPIC:5Zv5PDwbjNrmAE+vIC

Score

10^/10

discordrat credential_access defense_evasion persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI4MjgyNzA4MTIyMjE5NzI1OA.GYGKGD._ZCToapQCVB6uJoewAZmBanGCE2C92HCs5RwD0
server_id
1282683459751510098

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1356 created 636	1356	Client-built.exe	5

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
3	discord.com
5	discord.com
8	discord.com
11	discord.com
1	discord.com
1	raw.githubusercontent.com
7	raw.githubusercontent.com
9	raw.githubusercontent.com
10	discord.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1356 set thread context of 644	1356	Client-built.exe	81

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1356	Client-built.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
1356	Client-built.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
1356	Client-built.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
1356	Client-built.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
1356	Client-built.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
1356	Client-built.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
644	dllhost.exe
1356	Client-built.exe
644	dllhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	Client-built.exe
Token: SeDebugPrivilege	1356	Client-built.exe
Token: SeDebugPrivilege	644	dllhost.exe
Token: SeShutdownPrivilege	3360	Explorer.EXE
Token: SeCreatePagefilePrivilege	3360	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 644	1356	Client-built.exe	81
PID 1356 wrote to memory of 644	1356	Client-built.exe	81
PID 1356 wrote to memory of 644	1356	Client-built.exe	81
PID 1356 wrote to memory of 644	1356	Client-built.exe	81
PID 1356 wrote to memory of 644	1356	Client-built.exe	81
PID 1356 wrote to memory of 644	1356	Client-built.exe	81
PID 1356 wrote to memory of 644	1356	Client-built.exe	81
PID 1356 wrote to memory of 644	1356	Client-built.exe	81
PID 1356 wrote to memory of 644	1356	Client-built.exe	81
PID 1356 wrote to memory of 644	1356	Client-built.exe	81
PID 1356 wrote to memory of 644	1356	Client-built.exe	81
PID 644 wrote to memory of 636	644	dllhost.exe	5
PID 644 wrote to memory of 688	644	dllhost.exe	7
PID 644 wrote to memory of 984	644	dllhost.exe	12
PID 644 wrote to memory of 476	644	dllhost.exe	13
PID 644 wrote to memory of 1036	644	dllhost.exe	14
PID 644 wrote to memory of 1060	644	dllhost.exe	16
PID 644 wrote to memory of 1068	644	dllhost.exe	17
PID 644 wrote to memory of 1156	644	dllhost.exe	18
PID 644 wrote to memory of 1192	644	dllhost.exe	19
PID 644 wrote to memory of 1308	644	dllhost.exe	20
PID 644 wrote to memory of 1348	644	dllhost.exe	21
PID 644 wrote to memory of 1408	644	dllhost.exe	22
PID 644 wrote to memory of 1424	644	dllhost.exe	23
PID 644 wrote to memory of 1456	644	dllhost.exe	24
PID 644 wrote to memory of 1484	644	dllhost.exe	25
PID 644 wrote to memory of 1580	644	dllhost.exe	26
PID 644 wrote to memory of 1616	644	dllhost.exe	27
PID 644 wrote to memory of 1672	644	dllhost.exe	28
PID 644 wrote to memory of 1684	644	dllhost.exe	29
PID 644 wrote to memory of 1796	644	dllhost.exe	30
PID 644 wrote to memory of 1820	644	dllhost.exe	31
PID 644 wrote to memory of 1864	644	dllhost.exe	32
PID 644 wrote to memory of 1872	644	dllhost.exe	33
PID 644 wrote to memory of 1988	644	dllhost.exe	34
PID 644 wrote to memory of 2024	644	dllhost.exe	35
PID 644 wrote to memory of 2052	644	dllhost.exe	36
PID 644 wrote to memory of 2184	644	dllhost.exe	38
PID 644 wrote to memory of 2272	644	dllhost.exe	39
PID 644 wrote to memory of 2388	644	dllhost.exe	40
PID 644 wrote to memory of 2396	644	dllhost.exe	41
PID 644 wrote to memory of 2424	644	dllhost.exe	42
PID 644 wrote to memory of 2508	644	dllhost.exe	43
PID 644 wrote to memory of 2548	644	dllhost.exe	44
PID 644 wrote to memory of 2576	644	dllhost.exe	45
PID 644 wrote to memory of 2584	644	dllhost.exe	46
PID 644 wrote to memory of 2616	644	dllhost.exe	47
PID 644 wrote to memory of 2624	644	dllhost.exe	48
PID 644 wrote to memory of 2316	644	dllhost.exe	50
PID 644 wrote to memory of 2640	644	dllhost.exe	51
PID 644 wrote to memory of 2608	644	dllhost.exe	52
PID 644 wrote to memory of 3360	644	dllhost.exe	53
PID 644 wrote to memory of 3492	644	dllhost.exe	54
PID 644 wrote to memory of 3532	644	dllhost.exe	55
PID 644 wrote to memory of 3912	644	dllhost.exe	58
PID 644 wrote to memory of 4024	644	dllhost.exe	59
PID 644 wrote to memory of 4088	644	dllhost.exe	60
PID 644 wrote to memory of 3596	644	dllhost.exe	61
PID 644 wrote to memory of 4320	644	dllhost.exe	62
PID 644 wrote to memory of 4576	644	dllhost.exe	63
PID 644 wrote to memory of 4312	644	dllhost.exe	66
PID 644 wrote to memory of 4988	644	dllhost.exe	67
PID 644 wrote to memory of 1948	644	dllhost.exe	68
PID 644 wrote to memory of 1232	644	dllhost.exe	71

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:636
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:476
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{b15c098a-0de5-4fc8-b599-1658c6219cdf}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:644

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2024

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:2272
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2424

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2508

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2640

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2608

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3360
- C:\Users\Admin\AppData\Local\Temp\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3532

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3912

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4088

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3596

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1232

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4048

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2612

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/476-32-0x000002355A420000-0x000002355A44A000-memory.dmp

Filesize
168KB

Download
memory/476-33-0x00007FFC0FE10000-0x00007FFC0FE20000-memory.dmp

Filesize
64KB

Download
memory/476-38-0x000002355A420000-0x000002355A44A000-memory.dmp

Filesize
168KB

Download
memory/636-24-0x00007FFC0FE10000-0x00007FFC0FE20000-memory.dmp

Filesize
64KB

Download
memory/636-22-0x00000296AACF0000-0x00000296AAD13000-memory.dmp

Filesize
140KB

Download
memory/636-23-0x00000296AAD20000-0x00000296AAD4A000-memory.dmp

Filesize
168KB

Download
memory/636-35-0x00000296AAD20000-0x00000296AAD4A000-memory.dmp

Filesize
168KB

Download
memory/636-36-0x00007FFC4FE24000-0x00007FFC4FE25000-memory.dmp

Filesize
4KB

Download
memory/644-13-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/644-263-0x00007FFC4FD80000-0x00007FFC4FF89000-memory.dmp

Filesize
2.0MB

Download
memory/644-17-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/644-14-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/644-11-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/644-15-0x00007FFC4FD80000-0x00007FFC4FF89000-memory.dmp

Filesize
2.0MB

Download
memory/644-16-0x00007FFC4E7E0000-0x00007FFC4E89D000-memory.dmp

Filesize
756KB

Download
memory/644-19-0x00007FFC4FD80000-0x00007FFC4FF89000-memory.dmp

Filesize
2.0MB

Download
memory/644-18-0x00007FFC4FD81000-0x00007FFC4FEAA000-memory.dmp

Filesize
1.2MB

Download
memory/688-28-0x00007FFC0FE10000-0x00007FFC0FE20000-memory.dmp

Filesize
64KB

Download
memory/688-27-0x000002319A330000-0x000002319A35A000-memory.dmp

Filesize
168KB

Download
memory/688-37-0x000002319A330000-0x000002319A35A000-memory.dmp

Filesize
168KB

Download
memory/984-260-0x000001FB05890000-0x000001FB058BA000-memory.dmp

Filesize
168KB

Download
memory/984-40-0x00007FFC0FE10000-0x00007FFC0FE20000-memory.dmp

Filesize
64KB

Download
memory/984-39-0x000001FB05890000-0x000001FB058BA000-memory.dmp

Filesize
168KB

Download
memory/1036-45-0x00007FFC0FE10000-0x00007FFC0FE20000-memory.dmp

Filesize
64KB

Download
memory/1036-258-0x000001ADC7340000-0x000001ADC736A000-memory.dmp

Filesize
168KB

Download
memory/1036-44-0x000001ADC7340000-0x000001ADC736A000-memory.dmp

Filesize
168KB

Download
memory/1060-259-0x00000274E5FB0000-0x00000274E5FDA000-memory.dmp

Filesize
168KB

Download
memory/1060-47-0x00000274E5FB0000-0x00000274E5FDA000-memory.dmp

Filesize
168KB

Download
memory/1060-48-0x00007FFC0FE10000-0x00007FFC0FE20000-memory.dmp

Filesize
64KB

Download
memory/1068-54-0x00007FFC0FE10000-0x00007FFC0FE20000-memory.dmp

Filesize
64KB

Download
memory/1068-53-0x0000024392FA0000-0x0000024392FCA000-memory.dmp

Filesize
168KB

Download
memory/1156-57-0x00007FFC0FE10000-0x00007FFC0FE20000-memory.dmp

Filesize
64KB

Download
memory/1156-56-0x000001E97A860000-0x000001E97A88A000-memory.dmp

Filesize
168KB

Download
memory/1192-59-0x0000020275000000-0x000002027502A000-memory.dmp

Filesize
168KB

Download
memory/1192-60-0x00007FFC0FE10000-0x00007FFC0FE20000-memory.dmp

Filesize
64KB

Download
memory/1308-64-0x000001E9EBBC0000-0x000001E9EBBEA000-memory.dmp

Filesize
168KB

Download
memory/1308-65-0x00007FFC0FE10000-0x00007FFC0FE20000-memory.dmp

Filesize
64KB

Download
memory/1348-67-0x00000190A6910000-0x00000190A693A000-memory.dmp

Filesize
168KB

Download
memory/1348-68-0x00007FFC0FE10000-0x00007FFC0FE20000-memory.dmp

Filesize
64KB

Download
memory/1356-4-0x0000027663C20000-0x0000027664148000-memory.dmp

Filesize
5.2MB

Download
memory/1356-9-0x00007FFC4E7E0000-0x00007FFC4E89D000-memory.dmp

Filesize
756KB

Download
memory/1356-5-0x00007FFC2EC73000-0x00007FFC2EC75000-memory.dmp

Filesize
8KB

Download
memory/1356-0-0x00007FFC2EC73000-0x00007FFC2EC75000-memory.dmp

Filesize
8KB

Download
memory/1356-7-0x0000027662720000-0x000002766275E000-memory.dmp

Filesize
248KB

Download
memory/1356-12-0x00007FFC2EC70000-0x00007FFC2F732000-memory.dmp

Filesize
10.8MB

Download
memory/1356-3-0x00007FFC2EC70000-0x00007FFC2F732000-memory.dmp

Filesize
10.8MB

Download
memory/1356-2-0x00000276627A0000-0x0000027662962000-memory.dmp

Filesize
1.8MB

Download
memory/1356-8-0x00007FFC4FD80000-0x00007FFC4FF89000-memory.dmp

Filesize
2.0MB

Download
memory/1356-6-0x00007FFC2EC70000-0x00007FFC2F732000-memory.dmp

Filesize
10.8MB

Download
memory/1356-10-0x00007FFC2EC70000-0x00007FFC2F732000-memory.dmp

Filesize
10.8MB

Download
memory/1356-261-0x00007FFC2EC70000-0x00007FFC2F732000-memory.dmp

Filesize
10.8MB

Download
memory/1356-262-0x00007FFC2EC70000-0x00007FFC2F732000-memory.dmp

Filesize
10.8MB

Download
memory/1356-1-0x0000027648070000-0x0000027648088000-memory.dmp

Filesize
96KB

Download
memory/1356-264-0x0000027665F70000-0x0000027665FE6000-memory.dmp

Filesize
472KB

Download
memory/1356-265-0x0000027649EE0000-0x0000027649EF2000-memory.dmp

Filesize
72KB

Download
memory/1356-266-0x0000027665EF0000-0x0000027665F0E000-memory.dmp

Filesize
120KB

Download