Overview

overview

10

Static

static

3

1612E6BB0C...D2.exe

windows7-x64

10

1612E6BB0C...D2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-09-2023 14:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe

  • Size

    1.5MB

  • MD5

    4c6675bcb4996241e68fd4ac2fad45c2

  • SHA1

    e62124ae24bc980199900e5a7c392191882118cc

  • SHA256

    1612e6bb0cce702554b3db27bf98c140772bc85df30d210f2082cb7b01b5148b

  • SHA512

    bf385448e4791a67e6fd79cc2310835320c7c590e95d2933eb661a5fd41712f8f6d3760410d733757effc08da32160b58909b14f8eb295b68594efa885542ab9

  • SSDEEP

    24576:C4Zv8wgIQYygkY9lA6pnLZGBrgxFdgLOjRFqD3Fd2U+1A4EKazGG7/52rhUVrp:CkYIhkeTYBrUyOjjU+1ArF/El+9

Score
10/10
limeratpersistencerat

Malware Config

Extracted

Family

limerat

Wallets

1B5aLZh6psoQttLGn9tpbdibiWqzyh4Jfv

Attributes
  • aes_key

    NYANCAT

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/LJe9sUk5

  • delay

    3

  • download_payload

    false

  • install

    false

  • install_name

    Wservices.exe

  • main_folder

    Temp

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    true

Extracted

Family

limerat

Attributes
  • antivm

    false

  • c2_url

    https://pastebin.com/raw/LJe9sUk5

  • download_payload

    false

  • install

    false

  • pin_spread

    false

  • usb_spread

    false

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe
    "C:\Users\Admin\AppData\Local\Temp\1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3940
    • C:\Users\Admin\AppData\Local\Temp\14982.exe
      "C:\Users\Admin\AppData\Local\Temp\14982.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3736
    • C:\Users\Admin\AppData\Local\Temp\1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe
      C:\Users\Admin\AppData\Local\Temp\1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:408
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        3⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2376
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3652
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2' -Value '"C:\Users\Admin\AppData\Local\Temp\1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe"' -PropertyType 'String'
        3⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4252
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4628
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3848
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3848 -s 4060
      2⤵
      • Program crash
      PID:4452
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 408 -p 3848 -ip 3848
    1⤵
      PID:2488
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4032
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 4032 -s 3520
        2⤵
        • Program crash
        PID:1160
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 484 -p 4032 -ip 4032
      1⤵
        PID:2444
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4092
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 4092 -s 3576
          2⤵
          • Program crash
          PID:3692
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 524 -p 4092 -ip 4092
        1⤵
          PID:1712
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4548
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 4548 -s 3580
            2⤵
            • Program crash
            PID:3820
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 520 -p 4548 -ip 4548
          1⤵
            PID:3184
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4680
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 4680 -s 3560
              2⤵
              • Program crash
              PID:2868
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -pss -s 504 -p 4680 -ip 4680
            1⤵
              PID:3852

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe.log
              Filesize

              1017B

              MD5

              12ded5fc42db36da39ee40506fa984b9

              SHA1

              4a8f204796d3c19eb014b44a8c8fc3db8d837ca8

              SHA256

              75e2ed5aeaff63200f0c0fc5acb5f7658393f991ba276091119cd45e91b91817

              SHA512

              92e54c4ec2684269432346b4a586c8b52e20305493dcbc8760cdb5986e9698595c8096b10013ddb4ad31d9779a76c511ded54e541c224c686f1c4b391b41413e

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MBV9C40A\microsoft.windows[1].xml
              Filesize

              97B

              MD5

              859e2124b22e05d3e68a989282c2fb56

              SHA1

              e78eeb524f14146b0a533e9a5932c3783957f2c9

              SHA256

              bce98c19634453255e69b8f9acf09fc94337104cb0c49d218e1769d5eb903aa6

              SHA512

              53e677e0b8e15c89300194ea7d887c2a97dfa200329e8ab478a5dea151e4820ccec40df0ce878c1833edd08e6e3db04a48c7b7072fdf3a8a8e340541c16103fa

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133381384223944364.txt
              Filesize

              75KB

              MD5

              acfca62b955f4a76968c3a8d4e9de625

              SHA1

              62af8f5b8d1761c535dc6bf45e72ae532b502e0c

              SHA256

              ee07972ab3acd4def5e842dab0c8827dd8799faf5f5c80c407718ffe862fef8f

              SHA512

              0f7cd9c5e0c607d28178c7ed561ecfdd52930885a4dce552009b932b162ff87d86a242c94469685a476bd0262066a415d13f45ff62f9d5ebd0e8533468e1519b

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133381384223944364.txt
              Filesize

              75KB

              MD5

              acfca62b955f4a76968c3a8d4e9de625

              SHA1

              62af8f5b8d1761c535dc6bf45e72ae532b502e0c

              SHA256

              ee07972ab3acd4def5e842dab0c8827dd8799faf5f5c80c407718ffe862fef8f

              SHA512

              0f7cd9c5e0c607d28178c7ed561ecfdd52930885a4dce552009b932b162ff87d86a242c94469685a476bd0262066a415d13f45ff62f9d5ebd0e8533468e1519b

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MBV9C40A\microsoft.windows[1].xml
              Filesize

              97B

              MD5

              859e2124b22e05d3e68a989282c2fb56

              SHA1

              e78eeb524f14146b0a533e9a5932c3783957f2c9

              SHA256

              bce98c19634453255e69b8f9acf09fc94337104cb0c49d218e1769d5eb903aa6

              SHA512

              53e677e0b8e15c89300194ea7d887c2a97dfa200329e8ab478a5dea151e4820ccec40df0ce878c1833edd08e6e3db04a48c7b7072fdf3a8a8e340541c16103fa

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MBV9C40A\microsoft.windows[1].xml
              Filesize

              97B

              MD5

              859e2124b22e05d3e68a989282c2fb56

              SHA1

              e78eeb524f14146b0a533e9a5932c3783957f2c9

              SHA256

              bce98c19634453255e69b8f9acf09fc94337104cb0c49d218e1769d5eb903aa6

              SHA512

              53e677e0b8e15c89300194ea7d887c2a97dfa200329e8ab478a5dea151e4820ccec40df0ce878c1833edd08e6e3db04a48c7b7072fdf3a8a8e340541c16103fa

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MBV9C40A\microsoft.windows[1].xml
              Filesize

              97B

              MD5

              859e2124b22e05d3e68a989282c2fb56

              SHA1

              e78eeb524f14146b0a533e9a5932c3783957f2c9

              SHA256

              bce98c19634453255e69b8f9acf09fc94337104cb0c49d218e1769d5eb903aa6

              SHA512

              53e677e0b8e15c89300194ea7d887c2a97dfa200329e8ab478a5dea151e4820ccec40df0ce878c1833edd08e6e3db04a48c7b7072fdf3a8a8e340541c16103fa

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\14982.exe
              Filesize

              28KB

              MD5

              22df9b6c3a71b8dbbdef5d5bd09e445f

              SHA1

              0fdb02616c74e6eca4535d7b160a2e16a3e79943

              SHA256

              024cce95a63124cd3cbfe3f21fbacf8437fd288717fce379006064aa2a97641e

              SHA512

              2ada99e227f30c10453d588bbb6b40bdff55825a36bf5fcc16df084dbdca069e6cc0ac6aa612addd0393f8dc8751b3efc1c9626e2d78459faf9d348d1f46aaf3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\14982.exe
              Filesize

              28KB

              MD5

              22df9b6c3a71b8dbbdef5d5bd09e445f

              SHA1

              0fdb02616c74e6eca4535d7b160a2e16a3e79943

              SHA256

              024cce95a63124cd3cbfe3f21fbacf8437fd288717fce379006064aa2a97641e

              SHA512

              2ada99e227f30c10453d588bbb6b40bdff55825a36bf5fcc16df084dbdca069e6cc0ac6aa612addd0393f8dc8751b3efc1c9626e2d78459faf9d348d1f46aaf3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\14982.exe
              Filesize

              28KB

              MD5

              22df9b6c3a71b8dbbdef5d5bd09e445f

              SHA1

              0fdb02616c74e6eca4535d7b160a2e16a3e79943

              SHA256

              024cce95a63124cd3cbfe3f21fbacf8437fd288717fce379006064aa2a97641e

              SHA512

              2ada99e227f30c10453d588bbb6b40bdff55825a36bf5fcc16df084dbdca069e6cc0ac6aa612addd0393f8dc8751b3efc1c9626e2d78459faf9d348d1f46aaf3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_otf5lpmn.f1d.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • memory/408-1347-0x00000000052E0000-0x00000000052F0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/408-1345-0x0000000000400000-0x00000000004AC000-memory.dmp

              Filesize

              688KB

              Download

            • memory/408-1346-0x0000000074BD0000-0x0000000075380000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/408-2868-0x0000000074BD0000-0x0000000075380000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/408-2583-0x00000000052E0000-0x00000000052F0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/408-2369-0x0000000074BD0000-0x0000000075380000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3652-2620-0x0000000000400000-0x0000000000500000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/3652-8026-0x0000000004F50000-0x0000000004F60000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3652-7987-0x0000000004F50000-0x0000000004F60000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3652-2621-0x0000000074BD0000-0x0000000075380000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3652-2980-0x0000000074BD0000-0x0000000075380000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3736-1690-0x0000000005290000-0x00000000052F6000-memory.dmp

              Filesize

              408KB

              Download

            • memory/3736-2618-0x00000000055B0000-0x00000000055C0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3736-2365-0x0000000074BD0000-0x0000000075380000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3736-1340-0x0000000005360000-0x00000000053FC000-memory.dmp

              Filesize

              624KB

              Download

            • memory/3736-1341-0x0000000074BD0000-0x0000000075380000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3736-1338-0x0000000000A60000-0x0000000000A6C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/3736-1694-0x00000000055B0000-0x00000000055C0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3736-1947-0x0000000006840000-0x00000000068D2000-memory.dmp

              Filesize

              584KB

              Download

            • memory/3940-39-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-21-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-59-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-61-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-63-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-65-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-67-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-544-0x0000000074BD0000-0x0000000075380000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3940-599-0x0000000005350000-0x0000000005360000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3940-1328-0x0000000005A20000-0x0000000005A21000-memory.dmp

              Filesize

              4KB

              Download

            • memory/3940-55-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-53-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-51-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-1337-0x0000000006BE0000-0x0000000007184000-memory.dmp

              Filesize

              5.6MB

              Download

            • memory/3940-49-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-47-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-45-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-43-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-41-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-0-0x00000000007F0000-0x0000000000972000-memory.dmp

              Filesize

              1.5MB

              Download

            • memory/3940-1348-0x0000000074BD0000-0x0000000075380000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3940-37-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-35-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-33-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-31-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-29-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-27-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-25-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-23-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-57-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-19-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-17-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-1-0x0000000074BD0000-0x0000000075380000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3940-2-0x0000000005350000-0x0000000005360000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3940-3-0x0000000005320000-0x0000000005342000-memory.dmp

              Filesize

              136KB

              Download

            • memory/3940-4-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-5-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-7-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-15-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-9-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-13-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/3940-11-0x0000000005360000-0x00000000054C2000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/4252-3770-0x0000000074BD0000-0x0000000075380000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/4252-2982-0x00000000055A0000-0x00000000055B0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4252-3002-0x0000000006EC0000-0x0000000006EE2000-memory.dmp

              Filesize

              136KB

              Download

            • memory/4252-3332-0x00000000055A0000-0x00000000055B0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4252-2999-0x0000000007920000-0x00000000079B6000-memory.dmp

              Filesize

              600KB

              Download

            • memory/4252-3404-0x00000000055A0000-0x00000000055B0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4252-3000-0x0000000006E70000-0x0000000006E8A000-memory.dmp

              Filesize

              104KB

              Download

            • memory/4252-3632-0x00000000055A0000-0x00000000055B0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4252-3366-0x0000000074BD0000-0x0000000075380000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/4252-2937-0x0000000006970000-0x000000000698E000-memory.dmp

              Filesize

              120KB

              Download

            • memory/4252-2899-0x0000000006280000-0x00000000062E6000-memory.dmp

              Filesize

              408KB

              Download

            • memory/4252-2889-0x0000000005BE0000-0x0000000006208000-memory.dmp

              Filesize

              6.2MB

              Download

            • memory/4252-2883-0x00000000055A0000-0x00000000055B0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4252-2881-0x00000000055A0000-0x00000000055B0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4252-2879-0x0000000074BD0000-0x0000000075380000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/4252-2876-0x0000000003040000-0x0000000003076000-memory.dmp

              Filesize

              216KB

              Download