Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    15-09-2023 13:28

General

  • Target

    c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3_JC.exe

  • Size

    3.8MB

  • MD5

    6d4c3a4ff3637ec34f820172f897d476

  • SHA1

    d53fe8f0ecb0536088ec9be5247ab6627baf31cb

  • SHA256

    c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3

  • SHA512

    1ff5f4b215bedf6824c9c1932b5e8dbcbb8e459ee2839c598cc0f955b2948e25c5ce834b963ee1cf6ea22954e9c1fa4b102f117808f6dc8a4891b36c37d7e894

  • SSDEEP

    98304:HjHNSk7Z95fznvi8pzJzTGVDr0io7x9JgDQssR:DtSk7hvi8pzkVnYwQ

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

185.225.75.68:3569

Attributes
  • communication_password

    0edcbe7d888380c49e7d1dcf67b6ea6e

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Users\Admin\AppData\Local\Temp\c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3_JC.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Users\Admin\AppData\Local\Temp\c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3_JC.exe
        -a "C:\Users\Admin\AppData\Local\f9be9104\plg\QeXGQiWA.json"
        3⤵
          PID:2812
        • C:\Users\Admin\AppData\Local\Temp\T0frH3jx.exe
          -a "C:\Users\Admin\AppData\Local\f9be9104\plg\QeXGQiWA.json"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2844
          • C:\Users\Admin\AppData\Local\Temp\T0frH3jx.exe
            -a "C:\Users\Admin\AppData\Local\Temp\unk.xml"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Accesses Microsoft Outlook accounts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1316
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\pint"
        2⤵
          PID:1884
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\pint\pint.exe'" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2644
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\pint\pint.exe'" /f
            3⤵
            • Creates scheduled task(s)
            PID:2652
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3_JC.exe" "C:\Users\Admin\AppData\Roaming\pint\pint.exe"
          2⤵
            PID:2692
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {B21CE224-7A11-4A4E-B1A1-F1EB67302892} S-1-5-21-86725733-3001458681-3405935542-1000:ZWKQHIWB\Admin:Interactive:[1]
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:3032
          • C:\Users\Admin\AppData\Roaming\pint\pint.exe
            C:\Users\Admin\AppData\Roaming\pint\pint.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3028
            • C:\Users\Admin\AppData\Roaming\pint\pint.exe
              "C:\Users\Admin\AppData\Roaming\pint\pint.exe"
              3⤵
              • Executes dropped EXE
              PID:2904
            • C:\Windows\SysWOW64\cmd.exe
              "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\pint"
              3⤵
                PID:2052
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\pint\pint.exe'" /f
                3⤵
                  PID:2016
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\pint\pint.exe'" /f
                    4⤵
                    • Creates scheduled task(s)
                    PID:2388
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd" /c copy "C:\Users\Admin\AppData\Roaming\pint\pint.exe" "C:\Users\Admin\AppData\Roaming\pint\pint.exe"
                  3⤵
                    PID:628
                • C:\Users\Admin\AppData\Roaming\pint\pint.exe
                  C:\Users\Admin\AppData\Roaming\pint\pint.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:2728
                  • C:\Users\Admin\AppData\Roaming\pint\pint.exe
                    "C:\Users\Admin\AppData\Roaming\pint\pint.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:2608
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\pint"
                    3⤵
                      PID:2020
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\pint\pint.exe'" /f
                      3⤵
                        PID:2636
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\pint\pint.exe'" /f
                          4⤵
                          • Creates scheduled task(s)
                          PID:1284
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd" /c copy "C:\Users\Admin\AppData\Roaming\pint\pint.exe" "C:\Users\Admin\AppData\Roaming\pint\pint.exe"
                        3⤵
                          PID:2644

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\License.XenArmor

                      Filesize

                      104B

                      MD5

                      4f3bde9212e17ef18226866d6ac739b6

                      SHA1

                      732733bec8314beb81437e60876ffa75e72ae6cd

                      SHA256

                      212173a405c78d70f90e8ec0699a60ed2f4a9f3a8070de62eabd666c268fb174

                      SHA512

                      10b7cdae0b9a7b0f8e1bfc66a60675fa9b25c523864d5ae3da243f4e6e4c5194f3bd92af57ac956157442f66414bdd3393d0a1e5ba4ef0f192561e8524d4e744

                    • C:\Users\Admin\AppData\Local\Temp\License.XenArmor

                      Filesize

                      104B

                      MD5

                      bf5da170f7c9a8eae88d1cb1a191ff80

                      SHA1

                      dd1b991a1b03587a5d1edc94e919a2070e325610

                      SHA256

                      e5d5110feb21939d82d962981aeaaafc4643b40a9b87cbed800ace82135d57cd

                      SHA512

                      9e32247d8556fd6efffbf7b6b9c325652d8c4b223b0fa38020879171476a49ab1f64d8897b5d8d92b79c5484fd9d5899be26ca5f664ee1f9c2acb0857084121e

                    • C:\Users\Admin\AppData\Local\Temp\T0frH3jx.exe

                      Filesize

                      402B

                      MD5

                      ca42e05f9d53c7ec9383307c1ea282bb

                      SHA1

                      ed0efa1b59b461dcda08121a39411bee72f6b4cb

                      SHA256

                      63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

                      SHA512

                      4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

                    • C:\Users\Admin\AppData\Local\Temp\T0frH3jx.exe

                      Filesize

                      402B

                      MD5

                      ca42e05f9d53c7ec9383307c1ea282bb

                      SHA1

                      ed0efa1b59b461dcda08121a39411bee72f6b4cb

                      SHA256

                      63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

                      SHA512

                      4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

                    • C:\Users\Admin\AppData\Local\Temp\T0frH3jx.exe

                      Filesize

                      402B

                      MD5

                      ca42e05f9d53c7ec9383307c1ea282bb

                      SHA1

                      ed0efa1b59b461dcda08121a39411bee72f6b4cb

                      SHA256

                      63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

                      SHA512

                      4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

                    • C:\Users\Admin\AppData\Local\Temp\T0frH3jx.exe

                      Filesize

                      402B

                      MD5

                      ca42e05f9d53c7ec9383307c1ea282bb

                      SHA1

                      ed0efa1b59b461dcda08121a39411bee72f6b4cb

                      SHA256

                      63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

                      SHA512

                      4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

                    • C:\Users\Admin\AppData\Local\Temp\Unknown.dll

                      Filesize

                      793KB

                      MD5

                      86114faba7e1ec4a667d2bcb2e23f024

                      SHA1

                      670df6e1ba1dc6bece046e8b2e573dd36748245e

                      SHA256

                      568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

                      SHA512

                      d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

                    • C:\Users\Admin\AppData\Local\Temp\unk.xml

                      Filesize

                      98B

                      MD5

                      67efe59fbf8aaf3e8de7d67dab21c2a7

                      SHA1

                      0869d3ea3b16639ed4a0803acea1c476e199b16c

                      SHA256

                      63ca5c5c3cf4be4765115926225c060d89ef54d6f6fc3ec284cb3ecb398b0cb1

                      SHA512

                      75f162ff2cc23dd7df018109264f157727fdecc869e3f493e4d0bed26b4429ab00fc9724a5ea420488ba1b4b102a07992357c0d3567c7acea6dd5333cd8cebbb

                    • C:\Users\Admin\AppData\Local\f9be9104\plg\QeXGQiWA.json

                      Filesize

                      98B

                      MD5

                      67efe59fbf8aaf3e8de7d67dab21c2a7

                      SHA1

                      0869d3ea3b16639ed4a0803acea1c476e199b16c

                      SHA256

                      63ca5c5c3cf4be4765115926225c060d89ef54d6f6fc3ec284cb3ecb398b0cb1

                      SHA512

                      75f162ff2cc23dd7df018109264f157727fdecc869e3f493e4d0bed26b4429ab00fc9724a5ea420488ba1b4b102a07992357c0d3567c7acea6dd5333cd8cebbb

                    • C:\Users\Admin\AppData\Roaming\pint\pint.exe

                      Filesize

                      3.8MB

                      MD5

                      6d4c3a4ff3637ec34f820172f897d476

                      SHA1

                      d53fe8f0ecb0536088ec9be5247ab6627baf31cb

                      SHA256

                      c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3

                      SHA512

                      1ff5f4b215bedf6824c9c1932b5e8dbcbb8e459ee2839c598cc0f955b2948e25c5ce834b963ee1cf6ea22954e9c1fa4b102f117808f6dc8a4891b36c37d7e894

                    • C:\Users\Admin\AppData\Roaming\pint\pint.exe

                      Filesize

                      3.8MB

                      MD5

                      6d4c3a4ff3637ec34f820172f897d476

                      SHA1

                      d53fe8f0ecb0536088ec9be5247ab6627baf31cb

                      SHA256

                      c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3

                      SHA512

                      1ff5f4b215bedf6824c9c1932b5e8dbcbb8e459ee2839c598cc0f955b2948e25c5ce834b963ee1cf6ea22954e9c1fa4b102f117808f6dc8a4891b36c37d7e894

                    • C:\Users\Admin\AppData\Roaming\pint\pint.exe

                      Filesize

                      3.8MB

                      MD5

                      6d4c3a4ff3637ec34f820172f897d476

                      SHA1

                      d53fe8f0ecb0536088ec9be5247ab6627baf31cb

                      SHA256

                      c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3

                      SHA512

                      1ff5f4b215bedf6824c9c1932b5e8dbcbb8e459ee2839c598cc0f955b2948e25c5ce834b963ee1cf6ea22954e9c1fa4b102f117808f6dc8a4891b36c37d7e894

                    • C:\Users\Admin\AppData\Roaming\pint\pint.exe

                      Filesize

                      3.8MB

                      MD5

                      6d4c3a4ff3637ec34f820172f897d476

                      SHA1

                      d53fe8f0ecb0536088ec9be5247ab6627baf31cb

                      SHA256

                      c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3

                      SHA512

                      1ff5f4b215bedf6824c9c1932b5e8dbcbb8e459ee2839c598cc0f955b2948e25c5ce834b963ee1cf6ea22954e9c1fa4b102f117808f6dc8a4891b36c37d7e894

                    • C:\Users\Admin\AppData\Roaming\pint\pint.exe

                      Filesize

                      3.8MB

                      MD5

                      6d4c3a4ff3637ec34f820172f897d476

                      SHA1

                      d53fe8f0ecb0536088ec9be5247ab6627baf31cb

                      SHA256

                      c609d25041b7c463a726027c99c0a264b1e77415612e445fc39cfc9aae9801f3

                      SHA512

                      1ff5f4b215bedf6824c9c1932b5e8dbcbb8e459ee2839c598cc0f955b2948e25c5ce834b963ee1cf6ea22954e9c1fa4b102f117808f6dc8a4891b36c37d7e894

                    • \Users\Admin\AppData\Local\Temp\T0frH3jx.exe

                      Filesize

                      402B

                      MD5

                      ca42e05f9d53c7ec9383307c1ea282bb

                      SHA1

                      ed0efa1b59b461dcda08121a39411bee72f6b4cb

                      SHA256

                      63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

                      SHA512

                      4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

                    • \Users\Admin\AppData\Local\Temp\T0frH3jx.exe

                      Filesize

                      402B

                      MD5

                      ca42e05f9d53c7ec9383307c1ea282bb

                      SHA1

                      ed0efa1b59b461dcda08121a39411bee72f6b4cb

                      SHA256

                      63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

                      SHA512

                      4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

                    • \Users\Admin\AppData\Local\Temp\T0frH3jx.exe

                      Filesize

                      402B

                      MD5

                      ca42e05f9d53c7ec9383307c1ea282bb

                      SHA1

                      ed0efa1b59b461dcda08121a39411bee72f6b4cb

                      SHA256

                      63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

                      SHA512

                      4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

                    • \Users\Admin\AppData\Local\Temp\Unknown.dll

                      Filesize

                      793KB

                      MD5

                      86114faba7e1ec4a667d2bcb2e23f024

                      SHA1

                      670df6e1ba1dc6bece046e8b2e573dd36748245e

                      SHA256

                      568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

                      SHA512

                      d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

                    • memory/1316-149-0x0000000000400000-0x00000000006FE000-memory.dmp

                      Filesize

                      3.0MB

                    • memory/1316-155-0x0000000000400000-0x00000000006FE000-memory.dmp

                      Filesize

                      3.0MB

                    • memory/1316-159-0x0000000010000000-0x0000000010227000-memory.dmp

                      Filesize

                      2.2MB

                    • memory/1316-177-0x0000000010000000-0x0000000010227000-memory.dmp

                      Filesize

                      2.2MB

                    • memory/1316-178-0x0000000000400000-0x00000000006FE000-memory.dmp

                      Filesize

                      3.0MB

                    • memory/1728-3-0x0000000005070000-0x0000000005438000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/1728-0-0x00000000000A0000-0x0000000000478000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/1728-25-0x00000000744D0000-0x0000000074BBE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/1728-2-0x0000000004D50000-0x0000000004D90000-memory.dmp

                      Filesize

                      256KB

                    • memory/1728-1-0x00000000744D0000-0x0000000074BBE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/2324-31-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-36-0x0000000000480000-0x000000000048A000-memory.dmp

                      Filesize

                      40KB

                    • memory/2324-43-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-44-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-45-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-46-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-47-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-50-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-51-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-52-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-53-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-54-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-55-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-56-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-57-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-58-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-59-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-38-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-37-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-9-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-4-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-8-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-68-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-10-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                      Filesize

                      4KB

                    • memory/2324-35-0x0000000000480000-0x000000000048A000-memory.dmp

                      Filesize

                      40KB

                    • memory/2324-34-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-14-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-5-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-39-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-6-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-33-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-7-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-32-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-30-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-29-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-28-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-27-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-26-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-22-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2324-18-0x0000000000740000-0x0000000000B0E000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2728-230-0x0000000073DB0000-0x000000007449E000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/2728-231-0x00000000003C0000-0x0000000000798000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/2728-234-0x0000000004D70000-0x0000000004DB0000-memory.dmp

                      Filesize

                      256KB

                    • memory/2728-254-0x0000000073DB0000-0x000000007449E000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/2844-83-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                      Filesize

                      4KB

                    • memory/2844-166-0x0000000000400000-0x00000000008DC000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/2844-88-0x0000000000400000-0x00000000008DC000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/2844-204-0x0000000000400000-0x00000000008DC000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/2844-85-0x0000000000400000-0x00000000008DC000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/2844-81-0x0000000000400000-0x00000000008DC000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/2844-80-0x0000000000400000-0x00000000008DC000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/2844-78-0x0000000000400000-0x00000000008DC000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/3028-161-0x0000000073E30000-0x000000007451E000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/3028-67-0x0000000004B20000-0x0000000004B60000-memory.dmp

                      Filesize

                      256KB

                    • memory/3028-66-0x00000000003C0000-0x0000000000798000-memory.dmp

                      Filesize

                      3.8MB

                    • memory/3028-65-0x0000000073E30000-0x000000007451E000-memory.dmp

                      Filesize

                      6.9MB