Analysis

  • max time kernel
    133s
  • max time network
    132s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    19-01-2022 15:11

General

  • Target

    650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exe

  • Size

    578KB

  • MD5

    dfbf1c3345fa6eecbc7625e48745bb5d

  • SHA1

    4052413e09323f822f5e4dcbd8a82ca376d6e26f

  • SHA256

    650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b

  • SHA512

    269c4ed1dd5b2cfe93eaab0b0173762a1351630af91938f54f6da852a8feca1a51127e0ab57ca06d4fd36e2847595a47ebf6336f21e12b239bbaf65453676364

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 11 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 46 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 11 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 11 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exe
    "C:\Users\Admin\AppData\Local\Temp\650f2409b85f546ee7345a8281edddd2b084152df6bb45778c958b31ab14d84b.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\Users\Admin\AppData\Local\Temp\fl.exe
      "C:\Users\Admin\AppData\Local\Temp\fl.exe"
      2⤵
      • Executes dropped EXE
      • Checks BIOS information in registry
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4392
      • C:\Windows\bfsvc.exe
        C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
        3⤵
          PID:916
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1088
          • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
            4⤵
            • Executes dropped EXE
            • Checks BIOS information in registry
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1500
            • C:\Windows\bfsvc.exe
              C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
              5⤵
                PID:1820
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2184
                • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                  "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                  6⤵
                  • Executes dropped EXE
                  • Checks BIOS information in registry
                  • Adds Run key to start application
                  • Checks whether UAC is enabled
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:2772
                  • C:\Windows\bfsvc.exe
                    C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                    7⤵
                      PID:3600
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                      7⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4508
                      • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                        8⤵
                        • Executes dropped EXE
                        • Checks BIOS information in registry
                        • Adds Run key to start application
                        • Checks whether UAC is enabled
                        • Suspicious use of SetThreadContext
                        PID:4756
                        • C:\Windows\bfsvc.exe
                          C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                          9⤵
                            PID:1964
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                            9⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5088
                            • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                              "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                              10⤵
                              • Executes dropped EXE
                              • Checks BIOS information in registry
                              • Adds Run key to start application
                              • Checks whether UAC is enabled
                              • Suspicious use of SetThreadContext
                              PID:1924
                              • C:\Windows\bfsvc.exe
                                C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                                11⤵
                                  PID:4976
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                                  11⤵
                                    PID:2928
                                    • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                      "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                      12⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Adds Run key to start application
                                      • Checks whether UAC is enabled
                                      • Suspicious use of SetThreadContext
                                      PID:4128
                                      • C:\Windows\bfsvc.exe
                                        C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                                        13⤵
                                          PID:392
                                        • C:\Windows\explorer.exe
                                          C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                                          13⤵
                                            PID:3244
                                            • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                              "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                              14⤵
                                              • Executes dropped EXE
                                              • Checks BIOS information in registry
                                              • Adds Run key to start application
                                              • Checks whether UAC is enabled
                                              • Suspicious use of SetThreadContext
                                              PID:3552
                                              • C:\Windows\bfsvc.exe
                                                C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                                                15⤵
                                                  PID:1452
                                                • C:\Windows\explorer.exe
                                                  C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                                                  15⤵
                                                    PID:2396
                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                                      16⤵
                                                      • Executes dropped EXE
                                                      • Checks BIOS information in registry
                                                      • Adds Run key to start application
                                                      • Checks whether UAC is enabled
                                                      • Suspicious use of SetThreadContext
                                                      PID:1548
                                                      • C:\Windows\bfsvc.exe
                                                        C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                                                        17⤵
                                                          PID:1800
                                                        • C:\Windows\explorer.exe
                                                          C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                                                          17⤵
                                                            PID:1680
                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                                              18⤵
                                                              • Executes dropped EXE
                                                              • Checks BIOS information in registry
                                                              • Adds Run key to start application
                                                              • Checks whether UAC is enabled
                                                              • Suspicious use of SetThreadContext
                                                              PID:3504
                                                              • C:\Windows\bfsvc.exe
                                                                C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                                                                19⤵
                                                                  PID:3764
                                                                • C:\Windows\explorer.exe
                                                                  C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                                                                  19⤵
                                                                    PID:1264
                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                                                      20⤵
                                                                      • Executes dropped EXE
                                                                      • Checks BIOS information in registry
                                                                      • Adds Run key to start application
                                                                      • Checks whether UAC is enabled
                                                                      • Suspicious use of SetThreadContext
                                                                      PID:2388
                                                                      • C:\Windows\bfsvc.exe
                                                                        C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                                                                        21⤵
                                                                          PID:2220
                                                                        • C:\Windows\explorer.exe
                                                                          C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                                                                          21⤵
                                                                            PID:3964
                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                                                              22⤵
                                                                              • Executes dropped EXE
                                                                              • Checks BIOS information in registry
                                                                              • Adds Run key to start application
                                                                              • Checks whether UAC is enabled
                                                                              PID:3480
                                                                              • C:\Windows\system32\WerFault.exe
                                                                                C:\Windows\system32\WerFault.exe -u -p 3480 -s 572
                                                                                23⤵
                                                                                • Program crash
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4600

                                  Network

                                  MITRE ATT&CK Matrix ATT&CK v6

                                  Persistence

                                  Modify Existing Service

                                  1
                                  T1031

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1060

                                  Defense Evasion

                                  Modify Registry

                                  2
                                  T1112

                                  Disabling Security Tools

                                  1
                                  T1089

                                  Virtualization/Sandbox Evasion

                                  1
                                  T1497

                                  Credential Access

                                  Credentials in Files

                                  2
                                  T1081

                                  Discovery

                                  Query Registry

                                  3
                                  T1012

                                  Virtualization/Sandbox Evasion

                                  1
                                  T1497

                                  System Information Discovery

                                  3
                                  T1082

                                  Collection

                                  Data from Local System

                                  2
                                  T1005

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Temp\fl.exe
                                    MD5

                                    600c20e18834769dc0ae528c69108a5d

                                    SHA1

                                    743b942a951d381c0e3efc1fac3e2f09740769c2

                                    SHA256

                                    b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                    SHA512

                                    36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                  • C:\Users\Admin\AppData\Local\Temp\fl.exe
                                    MD5

                                    600c20e18834769dc0ae528c69108a5d

                                    SHA1

                                    743b942a951d381c0e3efc1fac3e2f09740769c2

                                    SHA256

                                    b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                    SHA512

                                    36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                    MD5

                                    600c20e18834769dc0ae528c69108a5d

                                    SHA1

                                    743b942a951d381c0e3efc1fac3e2f09740769c2

                                    SHA256

                                    b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                    SHA512

                                    36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                    MD5

                                    600c20e18834769dc0ae528c69108a5d

                                    SHA1

                                    743b942a951d381c0e3efc1fac3e2f09740769c2

                                    SHA256

                                    b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                    SHA512

                                    36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                    MD5

                                    600c20e18834769dc0ae528c69108a5d

                                    SHA1

                                    743b942a951d381c0e3efc1fac3e2f09740769c2

                                    SHA256

                                    b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                    SHA512

                                    36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                    MD5

                                    600c20e18834769dc0ae528c69108a5d

                                    SHA1

                                    743b942a951d381c0e3efc1fac3e2f09740769c2

                                    SHA256

                                    b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                    SHA512

                                    36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                    MD5

                                    600c20e18834769dc0ae528c69108a5d

                                    SHA1

                                    743b942a951d381c0e3efc1fac3e2f09740769c2

                                    SHA256

                                    b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                    SHA512

                                    36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                    MD5

                                    600c20e18834769dc0ae528c69108a5d

                                    SHA1

                                    743b942a951d381c0e3efc1fac3e2f09740769c2

                                    SHA256

                                    b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                    SHA512

                                    36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                    MD5

                                    600c20e18834769dc0ae528c69108a5d

                                    SHA1

                                    743b942a951d381c0e3efc1fac3e2f09740769c2

                                    SHA256

                                    b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                    SHA512

                                    36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                    MD5

                                    600c20e18834769dc0ae528c69108a5d

                                    SHA1

                                    743b942a951d381c0e3efc1fac3e2f09740769c2

                                    SHA256

                                    b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                    SHA512

                                    36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                    MD5

                                    600c20e18834769dc0ae528c69108a5d

                                    SHA1

                                    743b942a951d381c0e3efc1fac3e2f09740769c2

                                    SHA256

                                    b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                    SHA512

                                    36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                    MD5

                                    600c20e18834769dc0ae528c69108a5d

                                    SHA1

                                    743b942a951d381c0e3efc1fac3e2f09740769c2

                                    SHA256

                                    b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                    SHA512

                                    36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                    MD5

                                    600c20e18834769dc0ae528c69108a5d

                                    SHA1

                                    743b942a951d381c0e3efc1fac3e2f09740769c2

                                    SHA256

                                    b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                    SHA512

                                    36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                  • memory/916-145-0x0000000140000000-0x000000014274C000-memory.dmp
                                    Filesize

                                    39.3MB

                                  • memory/1088-146-0x0000000140000000-0x000000014002A000-memory.dmp
                                    Filesize

                                    168KB

                                  • memory/1088-147-0x0000000140000000-0x000000014002A000-memory.dmp
                                    Filesize

                                    168KB

                                  • memory/1264-204-0x0000000140000000-0x000000014002A000-memory.dmp
                                    Filesize

                                    168KB

                                  • memory/1500-152-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/1500-150-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/1500-151-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/1548-194-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/1548-192-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/1548-193-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/1680-197-0x0000000140000000-0x000000014002A000-memory.dmp
                                    Filesize

                                    168KB

                                  • memory/1924-171-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/1924-173-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/1924-172-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/2184-155-0x0000000140000000-0x000000014002A000-memory.dmp
                                    Filesize

                                    168KB

                                  • memory/2388-206-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/2388-207-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/2388-208-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/2396-190-0x0000000140000000-0x000000014002A000-memory.dmp
                                    Filesize

                                    168KB

                                  • memory/2772-159-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/2772-158-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/2772-157-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/2928-176-0x0000000140000000-0x000000014002A000-memory.dmp
                                    Filesize

                                    168KB

                                  • memory/3244-183-0x0000000140000000-0x000000014002A000-memory.dmp
                                    Filesize

                                    168KB

                                  • memory/3480-214-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/3480-213-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/3480-215-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/3504-199-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/3504-201-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/3504-200-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/3552-186-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/3552-185-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/3552-187-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/3964-211-0x0000000140000000-0x000000014002A000-memory.dmp
                                    Filesize

                                    168KB

                                  • memory/3996-135-0x0000000006440000-0x00000000064B6000-memory.dmp
                                    Filesize

                                    472KB

                                  • memory/3996-136-0x0000000006560000-0x00000000065F2000-memory.dmp
                                    Filesize

                                    584KB

                                  • memory/3996-117-0x0000000074D70000-0x0000000074F32000-memory.dmp
                                    Filesize

                                    1.8MB

                                  • memory/3996-133-0x00000000068C0000-0x0000000006DBE000-memory.dmp
                                    Filesize

                                    5.0MB

                                  • memory/3996-134-0x0000000005B40000-0x0000000005BA6000-memory.dmp
                                    Filesize

                                    408KB

                                  • memory/3996-132-0x0000000070BE0000-0x0000000070C2B000-memory.dmp
                                    Filesize

                                    300KB

                                  • memory/3996-138-0x0000000007370000-0x00000000073C0000-memory.dmp
                                    Filesize

                                    320KB

                                  • memory/3996-119-0x0000000076130000-0x0000000076221000-memory.dmp
                                    Filesize

                                    964KB

                                  • memory/3996-120-0x0000000001000000-0x0000000001071000-memory.dmp
                                    Filesize

                                    452KB

                                  • memory/3996-121-0x0000000001000000-0x0000000001071000-memory.dmp
                                    Filesize

                                    452KB

                                  • memory/3996-137-0x00000000064C0000-0x00000000064DE000-memory.dmp
                                    Filesize

                                    120KB

                                  • memory/3996-126-0x0000000005790000-0x0000000005791000-memory.dmp
                                    Filesize

                                    4KB

                                  • memory/3996-122-0x0000000072990000-0x0000000072A10000-memory.dmp
                                    Filesize

                                    512KB

                                  • memory/3996-115-0x0000000001000000-0x0000000001071000-memory.dmp
                                    Filesize

                                    452KB

                                  • memory/3996-123-0x0000000005DB0000-0x00000000063B6000-memory.dmp
                                    Filesize

                                    6.0MB

                                  • memory/3996-124-0x00000000057A0000-0x00000000057B2000-memory.dmp
                                    Filesize

                                    72KB

                                  • memory/3996-118-0x0000000002D90000-0x0000000002DD4000-memory.dmp
                                    Filesize

                                    272KB

                                  • memory/3996-125-0x00000000058D0000-0x00000000059DA000-memory.dmp
                                    Filesize

                                    1.0MB

                                  • memory/3996-139-0x00000000082E0000-0x000000000880C000-memory.dmp
                                    Filesize

                                    5.2MB

                                  • memory/3996-131-0x0000000005870000-0x00000000058BB000-memory.dmp
                                    Filesize

                                    300KB

                                  • memory/3996-130-0x00000000768C0000-0x0000000077C08000-memory.dmp
                                    Filesize

                                    19.3MB

                                  • memory/3996-129-0x0000000074F40000-0x00000000754C4000-memory.dmp
                                    Filesize

                                    5.5MB

                                  • memory/3996-128-0x0000000005BB0000-0x0000000005D72000-memory.dmp
                                    Filesize

                                    1.8MB

                                  • memory/3996-127-0x0000000005800000-0x000000000583E000-memory.dmp
                                    Filesize

                                    248KB

                                  • memory/4128-180-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/4128-179-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/4128-178-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/4392-143-0x00007FF7EC340000-0x00007FF7EC77B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/4392-142-0x00007FF7EC340000-0x00007FF7EC77B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/4392-144-0x00007FF7EC340000-0x00007FF7EC77B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/4508-162-0x0000000140000000-0x000000014002A000-memory.dmp
                                    Filesize

                                    168KB

                                  • memory/4756-164-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/4756-166-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/4756-165-0x00007FF6ED000000-0x00007FF6ED43B000-memory.dmp
                                    Filesize

                                    4.2MB

                                  • memory/5088-169-0x0000000140000000-0x000000014002A000-memory.dmp
                                    Filesize

                                    168KB