Analysis

  • max time kernel
    161s
  • max time network
    169s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    21-01-2022 11:18

General

  • Target

    a2169db0fe5dc66d6a207a3d7adfe163decda2922c1980fc6d67e0a10638f9f8.exe

  • Size

    879KB

  • MD5

    b1145a56bbeb10cb56f9482e6f0beea9

  • SHA1

    e6d21a807cf01dffd4d03f63d816a21e9739fd6f

  • SHA256

    a2169db0fe5dc66d6a207a3d7adfe163decda2922c1980fc6d67e0a10638f9f8

  • SHA512

    87d72557604d0d6c3ce163a54e43ae597f93556346d13acc5028bc4904c0ad823ded6b887b2e56c94dacbc297aacaf43be675c519f11550e1c48b6e31d43bfda

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 11 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 46 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 11 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 11 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2169db0fe5dc66d6a207a3d7adfe163decda2922c1980fc6d67e0a10638f9f8.exe
    "C:\Users\Admin\AppData\Local\Temp\a2169db0fe5dc66d6a207a3d7adfe163decda2922c1980fc6d67e0a10638f9f8.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3688
    • C:\Users\Admin\AppData\Local\Temp\fl.exe
      "C:\Users\Admin\AppData\Local\Temp\fl.exe"
      2⤵
      • Executes dropped EXE
      • Checks BIOS information in registry
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4348
      • C:\Windows\bfsvc.exe
        C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
        3⤵
          PID:3192
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1060
          • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
            4⤵
            • Executes dropped EXE
            • Checks BIOS information in registry
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1432
            • C:\Windows\bfsvc.exe
              C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
              5⤵
                PID:1748
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2064
                • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                  "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                  6⤵
                  • Executes dropped EXE
                  • Checks BIOS information in registry
                  • Adds Run key to start application
                  • Checks whether UAC is enabled
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:2696
                  • C:\Windows\bfsvc.exe
                    C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                    7⤵
                      PID:4248
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                      7⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4792
                      • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                        8⤵
                        • Executes dropped EXE
                        • Checks BIOS information in registry
                        • Adds Run key to start application
                        • Checks whether UAC is enabled
                        • Suspicious use of SetThreadContext
                        PID:4900
                        • C:\Windows\bfsvc.exe
                          C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                          9⤵
                            PID:3080
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                            9⤵
                              PID:4832
                              • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                10⤵
                                • Executes dropped EXE
                                • Checks BIOS information in registry
                                • Adds Run key to start application
                                • Checks whether UAC is enabled
                                • Suspicious use of SetThreadContext
                                PID:4948
                                • C:\Windows\bfsvc.exe
                                  C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                                  11⤵
                                    PID:5016
                                  • C:\Windows\explorer.exe
                                    C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                                    11⤵
                                      PID:696
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                        12⤵
                                        • Executes dropped EXE
                                        • Checks BIOS information in registry
                                        • Adds Run key to start application
                                        • Checks whether UAC is enabled
                                        • Suspicious use of SetThreadContext
                                        PID:2660
                                        • C:\Windows\bfsvc.exe
                                          C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                                          13⤵
                                            PID:4916
                                          • C:\Windows\explorer.exe
                                            C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                                            13⤵
                                              PID:2372
                                              • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                                "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                                14⤵
                                                • Executes dropped EXE
                                                • Checks BIOS information in registry
                                                • Adds Run key to start application
                                                • Checks whether UAC is enabled
                                                • Suspicious use of SetThreadContext
                                                PID:4536
                                                • C:\Windows\bfsvc.exe
                                                  C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                                                  15⤵
                                                    PID:1704
                                                  • C:\Windows\explorer.exe
                                                    C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                                                    15⤵
                                                      PID:1104
                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                                        16⤵
                                                        • Executes dropped EXE
                                                        • Checks BIOS information in registry
                                                        • Adds Run key to start application
                                                        • Checks whether UAC is enabled
                                                        • Suspicious use of SetThreadContext
                                                        PID:2124
                                                        • C:\Windows\bfsvc.exe
                                                          C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                                                          17⤵
                                                            PID:2036
                                                          • C:\Windows\explorer.exe
                                                            C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                                                            17⤵
                                                              PID:2900
                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                                                18⤵
                                                                • Executes dropped EXE
                                                                • Checks BIOS information in registry
                                                                • Adds Run key to start application
                                                                • Checks whether UAC is enabled
                                                                • Suspicious use of SetThreadContext
                                                                PID:1032
                                                                • C:\Windows\bfsvc.exe
                                                                  C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                                                                  19⤵
                                                                    PID:4232
                                                                  • C:\Windows\explorer.exe
                                                                    C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                                                                    19⤵
                                                                      PID:3472
                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                                                        20⤵
                                                                        • Executes dropped EXE
                                                                        • Checks BIOS information in registry
                                                                        • Adds Run key to start application
                                                                        • Checks whether UAC is enabled
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:3236
                                                                        • C:\Windows\bfsvc.exe
                                                                          C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                                                                          21⤵
                                                                            PID:3960
                                                                          • C:\Windows\explorer.exe
                                                                            C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                                                                            21⤵
                                                                              PID:4100
                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
                                                                                22⤵
                                                                                • Executes dropped EXE
                                                                                • Checks BIOS information in registry
                                                                                • Adds Run key to start application
                                                                                • Checks whether UAC is enabled
                                                                                • Suspicious use of SetThreadContext
                                                                                PID:3404
                                                                                • C:\Windows\bfsvc.exe
                                                                                  C:\Windows\bfsvc.exe -a TON --pool https://server1.whalestonpool.com --user EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm
                                                                                  23⤵
                                                                                    PID:3852
                                                                                  • C:\Windows\explorer.exe
                                                                                    C:\Windows\explorer.exe "EQAts4pWtXhujvOGkuGJklDeNF5DubyRR7prqLdz--sbJIQm" "Microsoft%20Basic%20Display%20Adapter" "None" "ton"
                                                                                    23⤵
                                                                                      PID:3536

                                        Network

                                        MITRE ATT&CK Matrix ATT&CK v6

                                        Persistence

                                        Modify Existing Service

                                        1
                                        T1031

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1060

                                        Defense Evasion

                                        Modify Registry

                                        2
                                        T1112

                                        Disabling Security Tools

                                        1
                                        T1089

                                        Virtualization/Sandbox Evasion

                                        1
                                        T1497

                                        Credential Access

                                        Credentials in Files

                                        2
                                        T1081

                                        Discovery

                                        Query Registry

                                        3
                                        T1012

                                        Virtualization/Sandbox Evasion

                                        1
                                        T1497

                                        System Information Discovery

                                        3
                                        T1082

                                        Collection

                                        Data from Local System

                                        2
                                        T1005

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Temp\fl.exe
                                          MD5

                                          600c20e18834769dc0ae528c69108a5d

                                          SHA1

                                          743b942a951d381c0e3efc1fac3e2f09740769c2

                                          SHA256

                                          b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                          SHA512

                                          36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                        • C:\Users\Admin\AppData\Local\Temp\fl.exe
                                          MD5

                                          600c20e18834769dc0ae528c69108a5d

                                          SHA1

                                          743b942a951d381c0e3efc1fac3e2f09740769c2

                                          SHA256

                                          b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                          SHA512

                                          36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                          MD5

                                          600c20e18834769dc0ae528c69108a5d

                                          SHA1

                                          743b942a951d381c0e3efc1fac3e2f09740769c2

                                          SHA256

                                          b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                          SHA512

                                          36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                          MD5

                                          600c20e18834769dc0ae528c69108a5d

                                          SHA1

                                          743b942a951d381c0e3efc1fac3e2f09740769c2

                                          SHA256

                                          b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                          SHA512

                                          36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                          MD5

                                          600c20e18834769dc0ae528c69108a5d

                                          SHA1

                                          743b942a951d381c0e3efc1fac3e2f09740769c2

                                          SHA256

                                          b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                          SHA512

                                          36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                          MD5

                                          600c20e18834769dc0ae528c69108a5d

                                          SHA1

                                          743b942a951d381c0e3efc1fac3e2f09740769c2

                                          SHA256

                                          b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                          SHA512

                                          36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                          MD5

                                          600c20e18834769dc0ae528c69108a5d

                                          SHA1

                                          743b942a951d381c0e3efc1fac3e2f09740769c2

                                          SHA256

                                          b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                          SHA512

                                          36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                          MD5

                                          600c20e18834769dc0ae528c69108a5d

                                          SHA1

                                          743b942a951d381c0e3efc1fac3e2f09740769c2

                                          SHA256

                                          b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                          SHA512

                                          36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                          MD5

                                          600c20e18834769dc0ae528c69108a5d

                                          SHA1

                                          743b942a951d381c0e3efc1fac3e2f09740769c2

                                          SHA256

                                          b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                          SHA512

                                          36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                          MD5

                                          600c20e18834769dc0ae528c69108a5d

                                          SHA1

                                          743b942a951d381c0e3efc1fac3e2f09740769c2

                                          SHA256

                                          b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                          SHA512

                                          36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                          MD5

                                          600c20e18834769dc0ae528c69108a5d

                                          SHA1

                                          743b942a951d381c0e3efc1fac3e2f09740769c2

                                          SHA256

                                          b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                          SHA512

                                          36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                          MD5

                                          600c20e18834769dc0ae528c69108a5d

                                          SHA1

                                          743b942a951d381c0e3efc1fac3e2f09740769c2

                                          SHA256

                                          b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                          SHA512

                                          36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                        • C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
                                          MD5

                                          600c20e18834769dc0ae528c69108a5d

                                          SHA1

                                          743b942a951d381c0e3efc1fac3e2f09740769c2

                                          SHA256

                                          b8931e787497efcd1306a1b86529f1d930084650fd6c38fd7051bc167b02e6fb

                                          SHA512

                                          36079c25f17ce81de7ebe8b3225421191ba73c1f7a9cf049c7bbc818f8b2b5c157e279dc8e2aeb3d5addb93e233768792ad52a2e75218d55ddfeaf46e30e20ec

                                        • memory/696-180-0x0000000140000000-0x000000014002A000-memory.dmp
                                          Filesize

                                          168KB

                                        • memory/1032-205-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/1032-204-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/1032-203-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/1060-151-0x0000000140000000-0x000000014002A000-memory.dmp
                                          Filesize

                                          168KB

                                        • memory/1060-150-0x0000000140000000-0x000000014002A000-memory.dmp
                                          Filesize

                                          168KB

                                        • memory/1104-194-0x0000000140000000-0x000000014002A000-memory.dmp
                                          Filesize

                                          168KB

                                        • memory/1432-156-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/1432-155-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/1432-154-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/2064-159-0x0000000140000000-0x000000014002A000-memory.dmp
                                          Filesize

                                          168KB

                                        • memory/2124-198-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/2124-196-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/2124-197-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/2372-187-0x0000000140000000-0x000000014002A000-memory.dmp
                                          Filesize

                                          168KB

                                        • memory/2660-182-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/2660-183-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/2660-184-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/2696-162-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/2696-161-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/2696-163-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/2900-201-0x0000000140000000-0x000000014002A000-memory.dmp
                                          Filesize

                                          168KB

                                        • memory/3192-149-0x0000000140000000-0x000000014274C000-memory.dmp
                                          Filesize

                                          39.3MB

                                        • memory/3236-211-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/3236-210-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/3236-212-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/3404-218-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/3404-217-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/3404-219-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/3472-208-0x0000000140000000-0x000000014002A000-memory.dmp
                                          Filesize

                                          168KB

                                        • memory/3688-139-0x00000000061B0000-0x0000000006226000-memory.dmp
                                          Filesize

                                          472KB

                                        • memory/3688-127-0x0000000003080000-0x0000000003081000-memory.dmp
                                          Filesize

                                          4KB

                                        • memory/3688-119-0x0000000000A30000-0x0000000000B0C000-memory.dmp
                                          Filesize

                                          880KB

                                        • memory/3688-120-0x0000000000700000-0x0000000000701000-memory.dmp
                                          Filesize

                                          4KB

                                        • memory/3688-121-0x00000000025B0000-0x00000000025F4000-memory.dmp
                                          Filesize

                                          272KB

                                        • memory/3688-122-0x00000000767B0000-0x0000000076972000-memory.dmp
                                          Filesize

                                          1.8MB

                                        • memory/3688-123-0x0000000077550000-0x0000000077641000-memory.dmp
                                          Filesize

                                          964KB

                                        • memory/3688-124-0x0000000000A30000-0x0000000000B0C000-memory.dmp
                                          Filesize

                                          880KB

                                        • memory/3688-125-0x0000000000A30000-0x0000000000B0C000-memory.dmp
                                          Filesize

                                          880KB

                                        • memory/3688-126-0x0000000072880000-0x0000000072900000-memory.dmp
                                          Filesize

                                          512KB

                                        • memory/3688-128-0x0000000005760000-0x0000000005D66000-memory.dmp
                                          Filesize

                                          6.0MB

                                        • memory/3688-129-0x0000000002FC0000-0x0000000002FD2000-memory.dmp
                                          Filesize

                                          72KB

                                        • memory/3688-143-0x00000000066A0000-0x00000000066F0000-memory.dmp
                                          Filesize

                                          320KB

                                        • memory/3688-142-0x0000000007160000-0x000000000768C000-memory.dmp
                                          Filesize

                                          5.2MB

                                        • memory/3688-141-0x0000000006390000-0x00000000063AE000-memory.dmp
                                          Filesize

                                          120KB

                                        • memory/3688-140-0x0000000006730000-0x0000000006C2E000-memory.dmp
                                          Filesize

                                          5.0MB

                                        • memory/3688-118-0x0000000000A30000-0x0000000000B0C000-memory.dmp
                                          Filesize

                                          880KB

                                        • memory/3688-138-0x0000000006110000-0x00000000061A2000-memory.dmp
                                          Filesize

                                          584KB

                                        • memory/3688-130-0x0000000005260000-0x000000000536A000-memory.dmp
                                          Filesize

                                          1.0MB

                                        • memory/3688-131-0x0000000003020000-0x000000000305E000-memory.dmp
                                          Filesize

                                          248KB

                                        • memory/3688-132-0x0000000005540000-0x0000000005702000-memory.dmp
                                          Filesize

                                          1.8MB

                                        • memory/3688-137-0x0000000005370000-0x00000000053D6000-memory.dmp
                                          Filesize

                                          408KB

                                        • memory/3688-136-0x0000000070AD0000-0x0000000070B1B000-memory.dmp
                                          Filesize

                                          300KB

                                        • memory/3688-135-0x0000000003090000-0x00000000030DB000-memory.dmp
                                          Filesize

                                          300KB

                                        • memory/3688-134-0x0000000074C00000-0x0000000075F48000-memory.dmp
                                          Filesize

                                          19.3MB

                                        • memory/3688-133-0x0000000076980000-0x0000000076F04000-memory.dmp
                                          Filesize

                                          5.5MB

                                        • memory/4100-215-0x0000000140000000-0x000000014002A000-memory.dmp
                                          Filesize

                                          168KB

                                        • memory/4348-147-0x00007FF782200000-0x00007FF78263B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/4348-146-0x00007FF782200000-0x00007FF78263B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/4348-148-0x00007FF782200000-0x00007FF78263B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/4536-190-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/4536-189-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/4536-191-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/4792-166-0x0000000140000000-0x000000014002A000-memory.dmp
                                          Filesize

                                          168KB

                                        • memory/4832-173-0x0000000140000000-0x000000014002A000-memory.dmp
                                          Filesize

                                          168KB

                                        • memory/4900-170-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/4900-169-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/4900-168-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/4948-175-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/4948-176-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB

                                        • memory/4948-177-0x00007FF619400000-0x00007FF61983B000-memory.dmp
                                          Filesize

                                          4.2MB