Overview

overview

10

Static

static

3

1612E6BB0C...D2.exe

windows7-x64

10

1612E6BB0C...D2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-09-2023 14:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe

  • Size

    1.5MB

  • MD5

    4c6675bcb4996241e68fd4ac2fad45c2

  • SHA1

    e62124ae24bc980199900e5a7c392191882118cc

  • SHA256

    1612e6bb0cce702554b3db27bf98c140772bc85df30d210f2082cb7b01b5148b

  • SHA512

    bf385448e4791a67e6fd79cc2310835320c7c590e95d2933eb661a5fd41712f8f6d3760410d733757effc08da32160b58909b14f8eb295b68594efa885542ab9

  • SSDEEP

    24576:C4Zv8wgIQYygkY9lA6pnLZGBrgxFdgLOjRFqD3Fd2U+1A4EKazGG7/52rhUVrp:CkYIhkeTYBrUyOjjU+1ArF/El+9

Score
10/10
limeratpersistencerat

Malware Config

Extracted

Family

limerat

Wallets

1B5aLZh6psoQttLGn9tpbdibiWqzyh4Jfv

Attributes
  • aes_key

    NYANCAT

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/LJe9sUk5

  • delay

    3

  • download_payload

    false

  • install

    false

  • install_name

    Wservices.exe

  • main_folder

    Temp

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    true

Extracted

Family

limerat

Attributes
  • antivm

    false

  • c2_url

    https://pastebin.com/raw/LJe9sUk5

  • download_payload

    false

  • install

    false

  • pin_spread

    false

  • usb_spread

    false

Signatures

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe
    "C:\Users\Admin\AppData\Local\Temp\1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Users\Admin\AppData\Local\Temp\14982.exe
      "C:\Users\Admin\AppData\Local\Temp\14982.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4900
    • C:\Users\Admin\AppData\Local\Temp\1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe
      C:\Users\Admin\AppData\Local\Temp\1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:640
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        3⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2220
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3000
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2' -Value '"C:\Users\Admin\AppData\Local\Temp\1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe"' -PropertyType 'String'
        3⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1340
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4560
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:776
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 776 -s 3884
      2⤵
      • Program crash
      PID:1888
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 456 -p 776 -ip 776
    1⤵
      PID:208
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4584
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 4584 -s 3600
        2⤵
        • Program crash
        PID:4352
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 480 -p 4584 -ip 4584
      1⤵
        PID:1148
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1268
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 1268 -s 3608
          2⤵
          • Program crash
          PID:3964
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 184 -p 1268 -ip 1268
        1⤵
          PID:3480
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2412
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 2412 -s 3564
            2⤵
            • Program crash
            PID:4724
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 532 -p 2412 -ip 2412
          1⤵
            PID:4340
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4460
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 4460 -s 3532
              2⤵
              • Program crash
              PID:3852
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -pss -s 500 -p 4460 -ip 4460
            1⤵
              PID:3604

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1612E6BB0CCE702554B3DB27BF98C140772BC85DF30D2.exe.log
              Filesize

              1017B

              MD5

              12ded5fc42db36da39ee40506fa984b9

              SHA1

              4a8f204796d3c19eb014b44a8c8fc3db8d837ca8

              SHA256

              75e2ed5aeaff63200f0c0fc5acb5f7658393f991ba276091119cd45e91b91817

              SHA512

              92e54c4ec2684269432346b4a586c8b52e20305493dcbc8760cdb5986e9698595c8096b10013ddb4ad31d9779a76c511ded54e541c224c686f1c4b391b41413e

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YZH8V4R7\microsoft.windows[1].xml
              Filesize

              97B

              MD5

              af9732dc069e3be3cfe037fe390e51b4

              SHA1

              6bec9bf8d771617fa4af09b488cb755f2663b2fe

              SHA256

              5fc258055a978b025fc5e750c2e82aca69fbc0b5d78a7d6a8381a4080ff28ff8

              SHA512

              e2ae012e368d32d72f892090c140fbb4b572e9f8f2f127a9ed04aa35784e2de3bdebb6346b82495d5f87dd7d3236dc340b51ea611627e6ab169f4d6fd55f0825

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133381385165735836.txt
              Filesize

              76KB

              MD5

              6ec7c40cc7c592a071edc5da2a36ff89

              SHA1

              1780ab3174ba137d63b3d0a84b76ab98447d0e78

              SHA256

              3771e3f328076ad04ba060a2901c908b9144bfd2c2dd8db55e5c9d9e04d27ebb

              SHA512

              d9c1177a030baaa9fca4acf26d5f461bb7b04a5f07a9a61cfa11123939a9f288e98e2506526d28e4a9319030c86152891c143682118c0c5839fc535cf912632b

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133381385165735836.txt
              Filesize

              76KB

              MD5

              6ec7c40cc7c592a071edc5da2a36ff89

              SHA1

              1780ab3174ba137d63b3d0a84b76ab98447d0e78

              SHA256

              3771e3f328076ad04ba060a2901c908b9144bfd2c2dd8db55e5c9d9e04d27ebb

              SHA512

              d9c1177a030baaa9fca4acf26d5f461bb7b04a5f07a9a61cfa11123939a9f288e98e2506526d28e4a9319030c86152891c143682118c0c5839fc535cf912632b

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YZH8V4R7\microsoft.windows[1].xml
              Filesize

              97B

              MD5

              af9732dc069e3be3cfe037fe390e51b4

              SHA1

              6bec9bf8d771617fa4af09b488cb755f2663b2fe

              SHA256

              5fc258055a978b025fc5e750c2e82aca69fbc0b5d78a7d6a8381a4080ff28ff8

              SHA512

              e2ae012e368d32d72f892090c140fbb4b572e9f8f2f127a9ed04aa35784e2de3bdebb6346b82495d5f87dd7d3236dc340b51ea611627e6ab169f4d6fd55f0825

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YZH8V4R7\microsoft.windows[1].xml
              Filesize

              97B

              MD5

              af9732dc069e3be3cfe037fe390e51b4

              SHA1

              6bec9bf8d771617fa4af09b488cb755f2663b2fe

              SHA256

              5fc258055a978b025fc5e750c2e82aca69fbc0b5d78a7d6a8381a4080ff28ff8

              SHA512

              e2ae012e368d32d72f892090c140fbb4b572e9f8f2f127a9ed04aa35784e2de3bdebb6346b82495d5f87dd7d3236dc340b51ea611627e6ab169f4d6fd55f0825

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YZH8V4R7\microsoft.windows[1].xml
              Filesize

              97B

              MD5

              af9732dc069e3be3cfe037fe390e51b4

              SHA1

              6bec9bf8d771617fa4af09b488cb755f2663b2fe

              SHA256

              5fc258055a978b025fc5e750c2e82aca69fbc0b5d78a7d6a8381a4080ff28ff8

              SHA512

              e2ae012e368d32d72f892090c140fbb4b572e9f8f2f127a9ed04aa35784e2de3bdebb6346b82495d5f87dd7d3236dc340b51ea611627e6ab169f4d6fd55f0825

              Download Submit

            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YZH8V4R7\microsoft.windows[1].xml
              Filesize

              97B

              MD5

              af9732dc069e3be3cfe037fe390e51b4

              SHA1

              6bec9bf8d771617fa4af09b488cb755f2663b2fe

              SHA256

              5fc258055a978b025fc5e750c2e82aca69fbc0b5d78a7d6a8381a4080ff28ff8

              SHA512

              e2ae012e368d32d72f892090c140fbb4b572e9f8f2f127a9ed04aa35784e2de3bdebb6346b82495d5f87dd7d3236dc340b51ea611627e6ab169f4d6fd55f0825

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\14982.exe
              Filesize

              28KB

              MD5

              22df9b6c3a71b8dbbdef5d5bd09e445f

              SHA1

              0fdb02616c74e6eca4535d7b160a2e16a3e79943

              SHA256

              024cce95a63124cd3cbfe3f21fbacf8437fd288717fce379006064aa2a97641e

              SHA512

              2ada99e227f30c10453d588bbb6b40bdff55825a36bf5fcc16df084dbdca069e6cc0ac6aa612addd0393f8dc8751b3efc1c9626e2d78459faf9d348d1f46aaf3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\14982.exe
              Filesize

              28KB

              MD5

              22df9b6c3a71b8dbbdef5d5bd09e445f

              SHA1

              0fdb02616c74e6eca4535d7b160a2e16a3e79943

              SHA256

              024cce95a63124cd3cbfe3f21fbacf8437fd288717fce379006064aa2a97641e

              SHA512

              2ada99e227f30c10453d588bbb6b40bdff55825a36bf5fcc16df084dbdca069e6cc0ac6aa612addd0393f8dc8751b3efc1c9626e2d78459faf9d348d1f46aaf3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\14982.exe
              Filesize

              28KB

              MD5

              22df9b6c3a71b8dbbdef5d5bd09e445f

              SHA1

              0fdb02616c74e6eca4535d7b160a2e16a3e79943

              SHA256

              024cce95a63124cd3cbfe3f21fbacf8437fd288717fce379006064aa2a97641e

              SHA512

              2ada99e227f30c10453d588bbb6b40bdff55825a36bf5fcc16df084dbdca069e6cc0ac6aa612addd0393f8dc8751b3efc1c9626e2d78459faf9d348d1f46aaf3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xnjojpfk.cvn.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • memory/640-1348-0x0000000005880000-0x0000000005890000-memory.dmp

              Filesize

              64KB

              Download

            • memory/640-1347-0x00000000748E0000-0x0000000075090000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/640-1345-0x0000000000400000-0x00000000004AC000-memory.dmp

              Filesize

              688KB

              Download

            • memory/640-2615-0x00000000748E0000-0x0000000075090000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/640-2617-0x0000000005880000-0x0000000005890000-memory.dmp

              Filesize

              64KB

              Download

            • memory/640-3021-0x00000000748E0000-0x0000000075090000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/1340-3034-0x00000000748E0000-0x0000000075090000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/1340-3043-0x0000000005830000-0x0000000005E58000-memory.dmp

              Filesize

              6.2MB

              Download

            • memory/1340-3031-0x0000000002CA0000-0x0000000002CD6000-memory.dmp

              Filesize

              216KB

              Download

            • memory/1340-3036-0x00000000051F0000-0x0000000005200000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1340-3536-0x00000000748E0000-0x0000000075090000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/1340-3494-0x00000000051F0000-0x0000000005200000-memory.dmp

              Filesize

              64KB

              Download

            • memory/1340-3492-0x00000000748E0000-0x0000000075090000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/1340-3141-0x0000000006B40000-0x0000000006B62000-memory.dmp

              Filesize

              136KB

              Download

            • memory/1340-3138-0x0000000006AF0000-0x0000000006B0A000-memory.dmp

              Filesize

              104KB

              Download

            • memory/1340-3134-0x0000000007610000-0x00000000076A6000-memory.dmp

              Filesize

              600KB

              Download

            • memory/1340-3066-0x0000000005F60000-0x0000000005FC6000-memory.dmp

              Filesize

              408KB

              Download

            • memory/1340-3088-0x0000000006640000-0x000000000665E000-memory.dmp

              Filesize

              120KB

              Download

            • memory/3000-2618-0x0000000000400000-0x0000000000500000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/3000-8001-0x00000000056D0000-0x00000000056E0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3000-8044-0x00000000056D0000-0x00000000056E0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3000-2620-0x00000000748E0000-0x0000000075090000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/3000-3117-0x00000000748E0000-0x0000000075090000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/4900-1338-0x00000000748E0000-0x0000000075090000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/4900-2848-0x0000000005180000-0x0000000005190000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4900-2614-0x00000000748E0000-0x0000000075090000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/4900-2106-0x0000000006550000-0x00000000065E2000-memory.dmp

              Filesize

              584KB

              Download

            • memory/4900-1683-0x0000000005180000-0x0000000005190000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4900-1681-0x0000000005240000-0x00000000052A6000-memory.dmp

              Filesize

              408KB

              Download

            • memory/4900-1342-0x00000000051A0000-0x000000000523C000-memory.dmp

              Filesize

              624KB

              Download

            • memory/4900-1340-0x00000000008C0000-0x00000000008CC000-memory.dmp

              Filesize

              48KB

              Download

            • memory/5104-65-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-59-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-27-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-25-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-29-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-23-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-21-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-1346-0x00000000748E0000-0x0000000075090000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/5104-19-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-31-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-1328-0x0000000006000000-0x0000000006001000-memory.dmp

              Filesize

              4KB

              Download

            • memory/5104-1038-0x0000000005860000-0x0000000005870000-memory.dmp

              Filesize

              64KB

              Download

            • memory/5104-931-0x00000000748E0000-0x0000000075090000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/5104-17-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-67-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-15-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-33-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-63-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-13-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-61-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-0-0x00000000748E0000-0x0000000075090000-memory.dmp

              Filesize

              7.7MB

              Download

            • memory/5104-1337-0x0000000007190000-0x0000000007734000-memory.dmp

              Filesize

              5.6MB

              Download

            • memory/5104-57-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-11-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-55-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-53-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-51-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-49-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-47-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-45-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-9-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-43-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-41-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-39-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-7-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-5-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-4-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-3-0x0000000005A80000-0x0000000005AA2000-memory.dmp

              Filesize

              136KB

              Download

            • memory/5104-37-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/5104-2-0x0000000005860000-0x0000000005870000-memory.dmp

              Filesize

              64KB

              Download

            • memory/5104-1-0x0000000000DB0000-0x0000000000F32000-memory.dmp

              Filesize

              1.5MB

              Download

            • memory/5104-35-0x00000000058E0000-0x0000000005A42000-memory.dmp

              Filesize

              1.4MB

              Download