Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18/09/2023, 09:05

General

  • Target

    3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943.exe

  • Size

    7.6MB

  • MD5

    9f42c993b0f9560fce2ac89d5b823b3b

  • SHA1

    7c3ae9d0a92335ec5076490af4544a071d69c6d4

  • SHA256

    3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943

  • SHA512

    867eaa8455f4314e355241374b0eb80bcc7d6f932330e82c0a18a8e79caba014f35621c2bc0e345d294eb95bcecfcfed7652b058c88ae52ebfa82436cc59d379

  • SSDEEP

    196608:Qv9coCuwOc11PU2hGdwV52HSabjklOaxb/1sjK:ObC/O2QejwSZ9/1EK

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

185.225.75.68:3569

Attributes
  • communication_password

    0edcbe7d888380c49e7d1dcf67b6ea6e

  • tor_process

    tor

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • XenArmor Suite

    XenArmor is as suite of password recovery tools for various application.

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943.exe
    "C:\Users\Admin\AppData\Local\Temp\3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4372
    • C:\Users\Admin\AppData\Local\Temp\3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943.exe
      "C:\Users\Admin\AppData\Local\Temp\3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Users\Admin\AppData\Local\Temp\3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943.exe
        -a "C:\Users\Admin\AppData\Local\f9be9104\plg\unWsqhdG.json"
        3⤵
          PID:3340
        • C:\Users\Admin\AppData\Local\Temp\unWsqhdG.exe
          -a "C:\Users\Admin\AppData\Local\f9be9104\plg\unWsqhdG.json"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:208
          • C:\Users\Admin\AppData\Local\Temp\unWsqhdG.exe
            -a "C:\Users\Admin\AppData\Local\Temp\unk.xml"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Accesses Microsoft Outlook accounts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1652
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\hope"
        2⤵
          PID:4488
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943.exe" "C:\Users\Admin\AppData\Roaming\hope\hope.exe"
          2⤵
            PID:4824
          • C:\Windows\SysWOW64\cmd.exe
            "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\hope\hope.exe'" /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2816
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\hope\hope.exe'" /f
              3⤵
              • Creates scheduled task(s)
              PID:360
        • C:\Users\Admin\AppData\Roaming\hope\hope.exe
          C:\Users\Admin\AppData\Roaming\hope\hope.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4104
          • C:\Users\Admin\AppData\Roaming\hope\hope.exe
            "C:\Users\Admin\AppData\Roaming\hope\hope.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of AdjustPrivilegeToken
            PID:3348
          • C:\Windows\SysWOW64\cmd.exe
            "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\hope"
            2⤵
              PID:4668
            • C:\Windows\SysWOW64\cmd.exe
              "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\hope\hope.exe'" /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4700
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\hope\hope.exe'" /f
                3⤵
                • Creates scheduled task(s)
                PID:2876
            • C:\Windows\SysWOW64\cmd.exe
              "cmd" /c copy "C:\Users\Admin\AppData\Roaming\hope\hope.exe" "C:\Users\Admin\AppData\Roaming\hope\hope.exe"
              2⤵
                PID:2948
            • C:\Users\Admin\AppData\Roaming\hope\hope.exe
              C:\Users\Admin\AppData\Roaming\hope\hope.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:3568
              • C:\Users\Admin\AppData\Roaming\hope\hope.exe
                "C:\Users\Admin\AppData\Roaming\hope\hope.exe"
                2⤵
                • Executes dropped EXE
                PID:4648
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 180
                  3⤵
                  • Program crash
                  PID:4288
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\hope"
                2⤵
                  PID:3092
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\hope\hope.exe'" /f
                  2⤵
                    PID:3612
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\hope\hope.exe'" /f
                      3⤵
                      • Creates scheduled task(s)
                      PID:5044
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd" /c copy "C:\Users\Admin\AppData\Roaming\hope\hope.exe" "C:\Users\Admin\AppData\Roaming\hope\hope.exe"
                    2⤵
                      PID:4892
                  • C:\Users\Admin\AppData\Roaming\hope\hope.exe
                    C:\Users\Admin\AppData\Roaming\hope\hope.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:5048
                    • C:\Users\Admin\AppData\Roaming\hope\hope.exe
                      "C:\Users\Admin\AppData\Roaming\hope\hope.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3292
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\hope\hope.exe'" /f
                      2⤵
                        PID:392
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\hope\hope.exe'" /f
                          3⤵
                          • Creates scheduled task(s)
                          PID:3356
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd" /c copy "C:\Users\Admin\AppData\Roaming\hope\hope.exe" "C:\Users\Admin\AppData\Roaming\hope\hope.exe"
                        2⤵
                          PID:2704
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\hope"
                          2⤵
                            PID:5064

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hope.exe.log

                          Filesize

                          520B

                          MD5

                          807cb75397a3a9fc38e9fb5f8566eb2d

                          SHA1

                          367e151fab5a5a80e60202d287ae522ea53e2563

                          SHA256

                          3e5056b73303b361e6b7b52f5edb2ed1a7e9dc2c762bb91d18046f42bc2ffcf3

                          SHA512

                          49efef0401ba0e0dc0b30bdff5d414da5494e4194c6269da2cb40b1ab7dc53e7858d29d2b9982bf3ee60ebc9638b5ed2b5ddcbb536bcc57729e79fc81f59f13d

                        • C:\Users\Admin\AppData\Local\Temp\License.XenArmor

                          Filesize

                          104B

                          MD5

                          4f3bde9212e17ef18226866d6ac739b6

                          SHA1

                          732733bec8314beb81437e60876ffa75e72ae6cd

                          SHA256

                          212173a405c78d70f90e8ec0699a60ed2f4a9f3a8070de62eabd666c268fb174

                          SHA512

                          10b7cdae0b9a7b0f8e1bfc66a60675fa9b25c523864d5ae3da243f4e6e4c5194f3bd92af57ac956157442f66414bdd3393d0a1e5ba4ef0f192561e8524d4e744

                        • C:\Users\Admin\AppData\Local\Temp\License.XenArmor

                          Filesize

                          104B

                          MD5

                          bf5da170f7c9a8eae88d1cb1a191ff80

                          SHA1

                          dd1b991a1b03587a5d1edc94e919a2070e325610

                          SHA256

                          e5d5110feb21939d82d962981aeaaafc4643b40a9b87cbed800ace82135d57cd

                          SHA512

                          9e32247d8556fd6efffbf7b6b9c325652d8c4b223b0fa38020879171476a49ab1f64d8897b5d8d92b79c5484fd9d5899be26ca5f664ee1f9c2acb0857084121e

                        • C:\Users\Admin\AppData\Local\Temp\Unknown.dll

                          Filesize

                          793KB

                          MD5

                          86114faba7e1ec4a667d2bcb2e23f024

                          SHA1

                          670df6e1ba1dc6bece046e8b2e573dd36748245e

                          SHA256

                          568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

                          SHA512

                          d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

                        • C:\Users\Admin\AppData\Local\Temp\unWsqhdG.exe

                          Filesize

                          402B

                          MD5

                          ca42e05f9d53c7ec9383307c1ea282bb

                          SHA1

                          ed0efa1b59b461dcda08121a39411bee72f6b4cb

                          SHA256

                          63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

                          SHA512

                          4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

                        • C:\Users\Admin\AppData\Local\Temp\unWsqhdG.exe

                          Filesize

                          402B

                          MD5

                          ca42e05f9d53c7ec9383307c1ea282bb

                          SHA1

                          ed0efa1b59b461dcda08121a39411bee72f6b4cb

                          SHA256

                          63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

                          SHA512

                          4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

                        • C:\Users\Admin\AppData\Local\Temp\unWsqhdG.exe

                          Filesize

                          402B

                          MD5

                          ca42e05f9d53c7ec9383307c1ea282bb

                          SHA1

                          ed0efa1b59b461dcda08121a39411bee72f6b4cb

                          SHA256

                          63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade

                          SHA512

                          4a1e3655a93f5e29ac7191eb3249b5b5a61b90353e78cc0bae4e81008aaff43bd9db4c2fde0c5ffcdae5e7eb87dfccffd4a1f383c78f5d40d52cbc4d61890196

                        • C:\Users\Admin\AppData\Local\Temp\unk.xml

                          Filesize

                          1KB

                          MD5

                          77e6621fd939338d3f19f3dd948ecf43

                          SHA1

                          53df8b3a76c5d6c35a99aa7759ff3bd7ec46588c

                          SHA256

                          9cb90c1d5c31396519b1f6c73899c062b6ccbd9a8cfc7c0bb054fe88c7825867

                          SHA512

                          6e812be4c3b958f0497f91e0eb2e8b77d4a13e2b7af750a30ec9bff3dde09a233b5510ee6333a9ab3182c11ab6c3d38789921d517449c6a03164e216cee43c4f

                        • C:\Users\Admin\AppData\Local\f9be9104\plg\unWsqhdG.json

                          Filesize

                          1KB

                          MD5

                          77e6621fd939338d3f19f3dd948ecf43

                          SHA1

                          53df8b3a76c5d6c35a99aa7759ff3bd7ec46588c

                          SHA256

                          9cb90c1d5c31396519b1f6c73899c062b6ccbd9a8cfc7c0bb054fe88c7825867

                          SHA512

                          6e812be4c3b958f0497f91e0eb2e8b77d4a13e2b7af750a30ec9bff3dde09a233b5510ee6333a9ab3182c11ab6c3d38789921d517449c6a03164e216cee43c4f

                        • C:\Users\Admin\AppData\Roaming\hope\hope.exe

                          Filesize

                          7.6MB

                          MD5

                          9f42c993b0f9560fce2ac89d5b823b3b

                          SHA1

                          7c3ae9d0a92335ec5076490af4544a071d69c6d4

                          SHA256

                          3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943

                          SHA512

                          867eaa8455f4314e355241374b0eb80bcc7d6f932330e82c0a18a8e79caba014f35621c2bc0e345d294eb95bcecfcfed7652b058c88ae52ebfa82436cc59d379

                        • C:\Users\Admin\AppData\Roaming\hope\hope.exe

                          Filesize

                          7.6MB

                          MD5

                          9f42c993b0f9560fce2ac89d5b823b3b

                          SHA1

                          7c3ae9d0a92335ec5076490af4544a071d69c6d4

                          SHA256

                          3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943

                          SHA512

                          867eaa8455f4314e355241374b0eb80bcc7d6f932330e82c0a18a8e79caba014f35621c2bc0e345d294eb95bcecfcfed7652b058c88ae52ebfa82436cc59d379

                        • C:\Users\Admin\AppData\Roaming\hope\hope.exe

                          Filesize

                          7.6MB

                          MD5

                          9f42c993b0f9560fce2ac89d5b823b3b

                          SHA1

                          7c3ae9d0a92335ec5076490af4544a071d69c6d4

                          SHA256

                          3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943

                          SHA512

                          867eaa8455f4314e355241374b0eb80bcc7d6f932330e82c0a18a8e79caba014f35621c2bc0e345d294eb95bcecfcfed7652b058c88ae52ebfa82436cc59d379

                        • C:\Users\Admin\AppData\Roaming\hope\hope.exe

                          Filesize

                          7.6MB

                          MD5

                          9f42c993b0f9560fce2ac89d5b823b3b

                          SHA1

                          7c3ae9d0a92335ec5076490af4544a071d69c6d4

                          SHA256

                          3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943

                          SHA512

                          867eaa8455f4314e355241374b0eb80bcc7d6f932330e82c0a18a8e79caba014f35621c2bc0e345d294eb95bcecfcfed7652b058c88ae52ebfa82436cc59d379

                        • C:\Users\Admin\AppData\Roaming\hope\hope.exe

                          Filesize

                          7.6MB

                          MD5

                          9f42c993b0f9560fce2ac89d5b823b3b

                          SHA1

                          7c3ae9d0a92335ec5076490af4544a071d69c6d4

                          SHA256

                          3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943

                          SHA512

                          867eaa8455f4314e355241374b0eb80bcc7d6f932330e82c0a18a8e79caba014f35621c2bc0e345d294eb95bcecfcfed7652b058c88ae52ebfa82436cc59d379

                        • C:\Users\Admin\AppData\Roaming\hope\hope.exe

                          Filesize

                          7.6MB

                          MD5

                          9f42c993b0f9560fce2ac89d5b823b3b

                          SHA1

                          7c3ae9d0a92335ec5076490af4544a071d69c6d4

                          SHA256

                          3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943

                          SHA512

                          867eaa8455f4314e355241374b0eb80bcc7d6f932330e82c0a18a8e79caba014f35621c2bc0e345d294eb95bcecfcfed7652b058c88ae52ebfa82436cc59d379

                        • C:\Users\Admin\AppData\Roaming\hope\hope.exe

                          Filesize

                          7.6MB

                          MD5

                          9f42c993b0f9560fce2ac89d5b823b3b

                          SHA1

                          7c3ae9d0a92335ec5076490af4544a071d69c6d4

                          SHA256

                          3e6692760e61b3e71675a24f7b5b50cde09cabf750ede2a9a365c8e482c61943

                          SHA512

                          867eaa8455f4314e355241374b0eb80bcc7d6f932330e82c0a18a8e79caba014f35621c2bc0e345d294eb95bcecfcfed7652b058c88ae52ebfa82436cc59d379

                        • \Users\Admin\AppData\Local\Temp\Unknown.dll

                          Filesize

                          793KB

                          MD5

                          86114faba7e1ec4a667d2bcb2e23f024

                          SHA1

                          670df6e1ba1dc6bece046e8b2e573dd36748245e

                          SHA256

                          568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d

                          SHA512

                          d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f

                        • memory/208-74-0x0000000000400000-0x00000000008DC000-memory.dmp

                          Filesize

                          4.9MB

                        • memory/208-75-0x0000000000400000-0x00000000008DC000-memory.dmp

                          Filesize

                          4.9MB

                        • memory/208-70-0x0000000000400000-0x00000000008DC000-memory.dmp

                          Filesize

                          4.9MB

                        • memory/208-76-0x0000000000400000-0x00000000008DC000-memory.dmp

                          Filesize

                          4.9MB

                        • memory/208-146-0x0000000000400000-0x00000000008DC000-memory.dmp

                          Filesize

                          4.9MB

                        • memory/1652-118-0x0000000000400000-0x00000000006FE000-memory.dmp

                          Filesize

                          3.0MB

                        • memory/1652-100-0x0000000000400000-0x00000000006FE000-memory.dmp

                          Filesize

                          3.0MB

                        • memory/1652-120-0x0000000010000000-0x0000000010227000-memory.dmp

                          Filesize

                          2.2MB

                        • memory/1652-109-0x0000000010000000-0x0000000010227000-memory.dmp

                          Filesize

                          2.2MB

                        • memory/1652-105-0x0000000000400000-0x00000000006FE000-memory.dmp

                          Filesize

                          3.0MB

                        • memory/1652-103-0x0000000000400000-0x00000000006FE000-memory.dmp

                          Filesize

                          3.0MB

                        • memory/1652-102-0x0000000000400000-0x00000000006FE000-memory.dmp

                          Filesize

                          3.0MB

                        • memory/2988-149-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-25-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-17-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-42-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-43-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-44-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-45-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-47-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-180-0x0000000073B80000-0x0000000073BBA000-memory.dmp

                          Filesize

                          232KB

                        • memory/2988-49-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-50-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-177-0x0000000073BB0000-0x0000000073BEA000-memory.dmp

                          Filesize

                          232KB

                        • memory/2988-5-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-53-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-54-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-55-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-56-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-57-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-58-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-59-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-60-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-61-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-63-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-65-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-66-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-23-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-22-0x0000000073B80000-0x0000000073BBA000-memory.dmp

                          Filesize

                          232KB

                        • memory/2988-21-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-20-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-19-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-18-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-153-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-26-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-24-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-150-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-6-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-16-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-15-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-7-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-14-0x0000000073BB0000-0x0000000073BEA000-memory.dmp

                          Filesize

                          232KB

                        • memory/2988-9-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/2988-121-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/3292-208-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/3292-215-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/3292-213-0x0000000072A10000-0x0000000072A4A000-memory.dmp

                          Filesize

                          232KB

                        • memory/3348-48-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/3348-51-0x0000000073B00000-0x0000000073B3A000-memory.dmp

                          Filesize

                          232KB

                        • memory/3348-37-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/3348-36-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/3348-52-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/3348-35-0x0000000000400000-0x00000000007CE000-memory.dmp

                          Filesize

                          3.8MB

                        • memory/3568-176-0x0000000072E80000-0x000000007356E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/3568-163-0x0000000072E80000-0x000000007356E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/3568-165-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4104-39-0x0000000072E80000-0x000000007356E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/4104-32-0x00000000058C0000-0x00000000058D0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4104-31-0x0000000072E80000-0x000000007356E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/4372-4-0x00000000072F0000-0x0000000007A7A000-memory.dmp

                          Filesize

                          7.5MB

                        • memory/4372-2-0x0000000005DF0000-0x00000000062EE000-memory.dmp

                          Filesize

                          5.0MB

                        • memory/4372-1-0x0000000000970000-0x0000000001104000-memory.dmp

                          Filesize

                          7.6MB

                        • memory/4372-3-0x0000000001890000-0x00000000018A0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4372-0-0x00000000737C0000-0x0000000073EAE000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/4372-10-0x00000000737C0000-0x0000000073EAE000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/5048-202-0x0000000072490000-0x0000000072B7E000-memory.dmp

                          Filesize

                          6.9MB

                        • memory/5048-203-0x0000000005BE0000-0x0000000005BF0000-memory.dmp

                          Filesize

                          64KB

                        • memory/5048-211-0x0000000072490000-0x0000000072B7E000-memory.dmp

                          Filesize

                          6.9MB