Malware Analysis Report

2025-01-03 05:26

Sample ID 230919-thfxkscc78
Target ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA256 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
Tags
bitrat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8

Threat Level: Known bad

The file ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8 was found to be: Known bad.

Malicious Activity Summary

bitrat trojan

BitRAT

Executes dropped EXE

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-09-19 16:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-09-19 16:03

Reported

2023-09-19 16:05

Platform

win10-20230915-en

Max time kernel

126s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe"

Signatures

BitRAT

trojan bitrat

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3384 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe
PID 3384 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe
PID 3384 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe
PID 3384 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe
PID 3384 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe
PID 3384 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe
PID 3384 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe
PID 3384 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe
PID 3384 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe
PID 3384 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe
PID 3384 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe
PID 3384 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Windows\SysWOW64\cmd.exe
PID 3384 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Windows\SysWOW64\cmd.exe
PID 3384 wrote to memory of 2232 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Windows\SysWOW64\cmd.exe
PID 3384 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Windows\SysWOW64\cmd.exe
PID 3384 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Windows\SysWOW64\cmd.exe
PID 3384 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Windows\SysWOW64\cmd.exe
PID 3384 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Windows\SysWOW64\cmd.exe
PID 3384 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Windows\SysWOW64\cmd.exe
PID 3384 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe C:\Windows\SysWOW64\cmd.exe
PID 2564 wrote to memory of 368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2564 wrote to memory of 368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2564 wrote to memory of 368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4072 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4072 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4072 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4072 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4072 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4072 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4072 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4072 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4072 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4072 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4072 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4072 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4072 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4072 wrote to memory of 4404 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4072 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4072 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4072 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4072 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4072 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4072 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4136 wrote to memory of 4068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4136 wrote to memory of 4068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4136 wrote to memory of 4068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 4992 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4992 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4992 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4992 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4992 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4992 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4992 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4992 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4992 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4992 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4992 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Users\Admin\AppData\Roaming\state\state.exe
PID 4992 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4992 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4992 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4992 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4992 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4992 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe
PID 4992 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Roaming\state\state.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe

"C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe"

C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe

"C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\state"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe" "C:\Users\Admin\AppData\Roaming\state\state.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 196

C:\Users\Admin\AppData\Roaming\state\state.exe

C:\Users\Admin\AppData\Roaming\state\state.exe

C:\Users\Admin\AppData\Roaming\state\state.exe

"C:\Users\Admin\AppData\Roaming\state\state.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c copy "C:\Users\Admin\AppData\Roaming\state\state.exe" "C:\Users\Admin\AppData\Roaming\state\state.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f

C:\Windows\SysWOW64\cmd.exe

"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\state"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 180

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f

C:\Users\Admin\AppData\Roaming\state\state.exe

C:\Users\Admin\AppData\Roaming\state\state.exe

C:\Users\Admin\AppData\Roaming\state\state.exe

"C:\Users\Admin\AppData\Roaming\state\state.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\state"

C:\Windows\SysWOW64\cmd.exe

"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f

C:\Windows\SysWOW64\cmd.exe

"cmd" /c copy "C:\Users\Admin\AppData\Roaming\state\state.exe" "C:\Users\Admin\AppData\Roaming\state\state.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 180

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa udp
US 8.8.8.8:53 105.134.101.95.in-addr.arpa udp
US 8.8.8.8:53 135.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 133.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

memory/3384-0-0x0000000073320000-0x0000000073A0E000-memory.dmp

memory/3384-1-0x0000000000FA0000-0x000000000173E000-memory.dmp

memory/3384-2-0x00000000065B0000-0x0000000006AAE000-memory.dmp

memory/3384-3-0x00000000060A0000-0x00000000060B0000-memory.dmp

memory/3384-4-0x0000000007AB0000-0x000000000823A000-memory.dmp

memory/2716-5-0x0000000000E30000-0x00000000011FE000-memory.dmp

memory/3384-9-0x0000000073320000-0x0000000073A0E000-memory.dmp

memory/2716-11-0x0000000000E30000-0x00000000011FE000-memory.dmp

memory/2716-15-0x0000000000E30000-0x00000000011FE000-memory.dmp

C:\Users\Admin\AppData\Roaming\state\state.exe

MD5 18e07c4772a2687ee06a434ffef9572f
SHA1 ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA512 8795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b

C:\Users\Admin\AppData\Roaming\state\state.exe

MD5 18e07c4772a2687ee06a434ffef9572f
SHA1 ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA512 8795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b

memory/4072-20-0x0000000072640000-0x0000000072D2E000-memory.dmp

memory/4072-21-0x00000000056A0000-0x00000000056B0000-memory.dmp

C:\Users\Admin\AppData\Roaming\state\state.exe

MD5 18e07c4772a2687ee06a434ffef9572f
SHA1 ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA512 8795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b

memory/4756-28-0x0000000001000000-0x00000000013CE000-memory.dmp

memory/4072-30-0x0000000072640000-0x0000000072D2E000-memory.dmp

memory/4756-33-0x0000000001000000-0x00000000013CE000-memory.dmp

C:\Users\Admin\AppData\Roaming\state\state.exe

MD5 18e07c4772a2687ee06a434ffef9572f
SHA1 ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA512 8795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\state.exe.log

MD5 807cb75397a3a9fc38e9fb5f8566eb2d
SHA1 367e151fab5a5a80e60202d287ae522ea53e2563
SHA256 3e5056b73303b361e6b7b52f5edb2ed1a7e9dc2c762bb91d18046f42bc2ffcf3
SHA512 49efef0401ba0e0dc0b30bdff5d414da5494e4194c6269da2cb40b1ab7dc53e7858d29d2b9982bf3ee60ebc9638b5ed2b5ddcbb536bcc57729e79fc81f59f13d

memory/4992-36-0x00000000726E0000-0x0000000072DCE000-memory.dmp

memory/4992-37-0x0000000005810000-0x0000000005820000-memory.dmp

C:\Users\Admin\AppData\Roaming\state\state.exe

MD5 18e07c4772a2687ee06a434ffef9572f
SHA1 ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA512 8795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b

memory/4844-43-0x0000000000DC0000-0x000000000118E000-memory.dmp

memory/4992-47-0x00000000726E0000-0x0000000072DCE000-memory.dmp

memory/4844-48-0x0000000000DC0000-0x000000000118E000-memory.dmp