laplas | 26ee5ecb55714d302e8adcc345fc373abf5eb3189c854922cfca7c3c5c7018fe

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2023 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ff07ccc087a7d29c89cfd7fd5eb9f5d.exe
Size

163KB
MD5

7ff07ccc087a7d29c89cfd7fd5eb9f5d
SHA1

2150a746f78c9648d61a5e6861817408d80296cb
SHA256

26ee5ecb55714d302e8adcc345fc373abf5eb3189c854922cfca7c3c5c7018fe
SHA512

5710315d3921799b192fd3c683aff6282ff55a28c1689441f91277bfa5720212546d14a040963f12810aecd76be6e98b63e8de360ec1e7997848c3eac69e9165
SSDEEP

3072:rri0LnjzU9CSXlwRglQttweek/bOn3fekTBO95wYW:60LnjAxX8WQfY2OvesnYW

Score

10^/10

laplas lumma redline smokeloader cc summ backdoor clipper discovery infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

summ

Extracted

Family

smokeloader

Version

2022

http://stalagmijesarl.com/

http://ukdantist-sarl.com/

http://cpcorprotationltd.com/

rc4.i32

Extracted

Family

redline

Botnet

94.228.169.160:43800

Attributes

auth_value
ec4d19a9dd758ace38b4f5b4a447b048

Extracted

Family

laplas

http://clipper.guru

Attributes

api_key
0be23a6bec914a7d28f1aae995f036fdba93224093ddb48d02fe43e814862f4e

Extracted

Family

lumma

gstatic-node.io

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 14 IoCs

resource	yara_rule
behavioral2/memory/404-254-0x0000000002880000-0x00000000028C2000-memory.dmp	family_redline
behavioral2/memory/404-256-0x0000000002880000-0x00000000028C2000-memory.dmp	family_redline
behavioral2/memory/404-258-0x0000000002880000-0x00000000028C2000-memory.dmp	family_redline
behavioral2/memory/404-260-0x0000000002880000-0x00000000028C2000-memory.dmp	family_redline
behavioral2/memory/404-262-0x0000000002880000-0x00000000028C2000-memory.dmp	family_redline
behavioral2/memory/404-264-0x0000000002880000-0x00000000028C2000-memory.dmp	family_redline
behavioral2/memory/404-266-0x0000000002880000-0x00000000028C2000-memory.dmp	family_redline
behavioral2/memory/404-268-0x0000000002880000-0x00000000028C2000-memory.dmp	family_redline
behavioral2/memory/404-270-0x0000000002880000-0x00000000028C2000-memory.dmp	family_redline
behavioral2/memory/404-272-0x0000000002880000-0x00000000028C2000-memory.dmp	family_redline
behavioral2/memory/404-274-0x0000000002880000-0x00000000028C2000-memory.dmp	family_redline
behavioral2/memory/404-276-0x0000000002880000-0x00000000028C2000-memory.dmp	family_redline
behavioral2/memory/404-278-0x0000000002880000-0x00000000028C2000-memory.dmp	family_redline
behavioral2/memory/404-280-0x0000000002880000-0x00000000028C2000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
3668	F0A9.exe
404	F492.exe
4136	F9C3.exe
4308	FEA6.exe
1456	ntlhost.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	F0A9.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4136 set thread context of 4752	4136	F9C3.exe	101

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4516	4136	WerFault.exe	99
4712	4308	WerFault.exe	103
4312	404	WerFault.exe	98

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7ff07ccc087a7d29c89cfd7fd5eb9f5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7ff07ccc087a7d29c89cfd7fd5eb9f5d.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7ff07ccc087a7d29c89cfd7fd5eb9f5d.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3876	7ff07ccc087a7d29c89cfd7fd5eb9f5d.exe
3876	7ff07ccc087a7d29c89cfd7fd5eb9f5d.exe
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3180	Process not Found

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
3876	7ff07ccc087a7d29c89cfd7fd5eb9f5d.exe
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found
3180	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeDebugPrivilege	404	F492.exe
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found
Token: SeShutdownPrivilege	3180	Process not Found
Token: SeCreatePagefilePrivilege	3180	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3180	Process not Found

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 3668	3180	Process not Found	97
PID 3180 wrote to memory of 3668	3180	Process not Found	97
PID 3180 wrote to memory of 3668	3180	Process not Found	97
PID 3180 wrote to memory of 404	3180	Process not Found	98
PID 3180 wrote to memory of 404	3180	Process not Found	98
PID 3180 wrote to memory of 404	3180	Process not Found	98
PID 3180 wrote to memory of 4136	3180	Process not Found	99
PID 3180 wrote to memory of 4136	3180	Process not Found	99
PID 3180 wrote to memory of 4136	3180	Process not Found	99
PID 4136 wrote to memory of 4752	4136	F9C3.exe	101
PID 4136 wrote to memory of 4752	4136	F9C3.exe	101
PID 4136 wrote to memory of 4752	4136	F9C3.exe	101
PID 4136 wrote to memory of 4752	4136	F9C3.exe	101
PID 4136 wrote to memory of 4752	4136	F9C3.exe	101
PID 3180 wrote to memory of 4308	3180	Process not Found	103
PID 3180 wrote to memory of 4308	3180	Process not Found	103
PID 3180 wrote to memory of 4308	3180	Process not Found	103
PID 3180 wrote to memory of 1188	3180	Process not Found	105
PID 3180 wrote to memory of 1188	3180	Process not Found	105
PID 3180 wrote to memory of 1188	3180	Process not Found	105
PID 3180 wrote to memory of 1188	3180	Process not Found	105
PID 3180 wrote to memory of 2896	3180	Process not Found	106
PID 3180 wrote to memory of 2896	3180	Process not Found	106
PID 3180 wrote to memory of 2896	3180	Process not Found	106
PID 3180 wrote to memory of 4120	3180	Process not Found	107
PID 3180 wrote to memory of 4120	3180	Process not Found	107
PID 3180 wrote to memory of 4120	3180	Process not Found	107
PID 3180 wrote to memory of 4120	3180	Process not Found	107
PID 3180 wrote to memory of 1704	3180	Process not Found	108
PID 3180 wrote to memory of 1704	3180	Process not Found	108
PID 3180 wrote to memory of 1704	3180	Process not Found	108
PID 3180 wrote to memory of 2616	3180	Process not Found	109
PID 3180 wrote to memory of 2616	3180	Process not Found	109
PID 3180 wrote to memory of 2616	3180	Process not Found	109
PID 3180 wrote to memory of 2616	3180	Process not Found	109
PID 3180 wrote to memory of 1388	3180	Process not Found	110
PID 3180 wrote to memory of 1388	3180	Process not Found	110
PID 3180 wrote to memory of 1388	3180	Process not Found	110
PID 3180 wrote to memory of 1388	3180	Process not Found	110
PID 3180 wrote to memory of 4304	3180	Process not Found	111
PID 3180 wrote to memory of 4304	3180	Process not Found	111
PID 3180 wrote to memory of 4304	3180	Process not Found	111
PID 3180 wrote to memory of 4304	3180	Process not Found	111
PID 3180 wrote to memory of 3368	3180	Process not Found	112
PID 3180 wrote to memory of 3368	3180	Process not Found	112
PID 3180 wrote to memory of 3368	3180	Process not Found	112
PID 3180 wrote to memory of 2408	3180	Process not Found	113
PID 3180 wrote to memory of 2408	3180	Process not Found	113
PID 3180 wrote to memory of 2408	3180	Process not Found	113
PID 3180 wrote to memory of 2408	3180	Process not Found	113
PID 3668 wrote to memory of 1456	3668	F0A9.exe	114
PID 3668 wrote to memory of 1456	3668	F0A9.exe	114
PID 3668 wrote to memory of 1456	3668	F0A9.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7ff07ccc087a7d29c89cfd7fd5eb9f5d.exe
"C:\Users\Admin\AppData\Local\Temp\7ff07ccc087a7d29c89cfd7fd5eb9f5d.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3876

C:\Users\Admin\AppData\Local\Temp\F0A9.exe
C:\Users\Admin\AppData\Local\Temp\F0A9.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:1456

C:\Users\Admin\AppData\Local\Temp\F492.exe
C:\Users\Admin\AppData\Local\Temp\F492.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 1304
  2⤵
  - Program crash
  PID:4312

C:\Users\Admin\AppData\Local\Temp\F9C3.exe
C:\Users\Admin\AppData\Local\Temp\F9C3.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 152
  2⤵
  - Program crash
  PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4136 -ip 4136
1⤵
PID:4888

C:\Users\Admin\AppData\Local\Temp\FEA6.exe
C:\Users\Admin\AppData\Local\Temp\FEA6.exe
1⤵
- Executes dropped EXE
PID:4308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 3468
  2⤵
  - Program crash
  PID:4712

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1188

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2896

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4120

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1704

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2616

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1388

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4304

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3368

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4308 -ip 4308
1⤵
PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 404 -ip 404
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F0A9.exe

Filesize
1.8MB

MD5
d5c139fe384e12358c394790b740a429

SHA1
835188fc822341f9226c13412e00f45d666b85f2

SHA256
da8b2ceff64640f1ab5c0acd225762994b9830d50a1db77f7da09ca6f4e33a2e

SHA512
08c7781bfe816ff698e2b7cde8bf4a7c5581a2c7c372d1dc51375af5625b9b4132b380c2a2bdbc028f3ad3a02574baf312d1249acb26abc4585a3bfecc670506

Download Submit
C:\Users\Admin\AppData\Local\Temp\F0A9.exe

Filesize
1.8MB

MD5
d5c139fe384e12358c394790b740a429

SHA1
835188fc822341f9226c13412e00f45d666b85f2

SHA256
da8b2ceff64640f1ab5c0acd225762994b9830d50a1db77f7da09ca6f4e33a2e

SHA512
08c7781bfe816ff698e2b7cde8bf4a7c5581a2c7c372d1dc51375af5625b9b4132b380c2a2bdbc028f3ad3a02574baf312d1249acb26abc4585a3bfecc670506

Download Submit
C:\Users\Admin\AppData\Local\Temp\F492.exe

Filesize
312KB

MD5
eabf49a55264bcc12f51bd2710718d3d

SHA1
f0e82807f27f2a96f925530bf7aabac46a4e7136

SHA256
ef23ae66bc212bf8e435bf806ff120db2470364f3b7362fe05f48b09df225eed

SHA512
6a232ec02136cafc35bfcc7168c4df591dd712c8f89f8f133154796c0754362f4911dc3220089757eef43247116fa1b115a15f0f1ba6f312e96df5e8f3bb89b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\F492.exe

Filesize
312KB

MD5
eabf49a55264bcc12f51bd2710718d3d

SHA1
f0e82807f27f2a96f925530bf7aabac46a4e7136

SHA256
ef23ae66bc212bf8e435bf806ff120db2470364f3b7362fe05f48b09df225eed

SHA512
6a232ec02136cafc35bfcc7168c4df591dd712c8f89f8f133154796c0754362f4911dc3220089757eef43247116fa1b115a15f0f1ba6f312e96df5e8f3bb89b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\F9C3.exe

Filesize
2.0MB

MD5
71ef5fd46955ea0abd7800e7c99cc8b3

SHA1
a9efdd480409e6b0a626ea6fd9efaf280b20bb75

SHA256
fe20091e32e612a1b5b7043895ddf7d0131a544a6f86d177218645241070f32d

SHA512
a5fb7bdb0df383295d35c7e7e73956e8f5061e9ec00e783fa36c8577234be3333bd8d26fd110de08b9809495587fb3f9b79742bd3fb178cf892c88c36a75e650

Download Submit
C:\Users\Admin\AppData\Local\Temp\F9C3.exe

Filesize
2.0MB

MD5
71ef5fd46955ea0abd7800e7c99cc8b3

SHA1
a9efdd480409e6b0a626ea6fd9efaf280b20bb75

SHA256
fe20091e32e612a1b5b7043895ddf7d0131a544a6f86d177218645241070f32d

SHA512
a5fb7bdb0df383295d35c7e7e73956e8f5061e9ec00e783fa36c8577234be3333bd8d26fd110de08b9809495587fb3f9b79742bd3fb178cf892c88c36a75e650

Download Submit
C:\Users\Admin\AppData\Local\Temp\FEA6.exe

Filesize
381KB

MD5
ab9327fce682d578e28456820e0d9baa

SHA1
48696ea54a5960a3f9bbbf96819a150ad93c33c1

SHA256
1915d244bae2707f6531ea7ffc0fb7708f7cafcf2aa354223ea8112064b18eaf

SHA512
dcfd05aeb32c42dd9b25c11e214fa7b9aac96c1bdb747ee71487bdce9f58cb6c691bb3266cd3f752b2abd83f9b17d297a767751bf14123dfc14820fb2cb6eaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\FEA6.exe

Filesize
381KB

MD5
ab9327fce682d578e28456820e0d9baa

SHA1
48696ea54a5960a3f9bbbf96819a150ad93c33c1

SHA256
1915d244bae2707f6531ea7ffc0fb7708f7cafcf2aa354223ea8112064b18eaf

SHA512
dcfd05aeb32c42dd9b25c11e214fa7b9aac96c1bdb747ee71487bdce9f58cb6c691bb3266cd3f752b2abd83f9b17d297a767751bf14123dfc14820fb2cb6eaab

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
584.4MB

MD5
7c01f07ed80441df4e2c4918d8dde942

SHA1
562b63aa843458e7dff96bb69d14a8e362ecb3b5

SHA256
33aeb365b3d543f954819915e87614f914b93490a9359073ae9e609273bbbf9c

SHA512
5b258e0958b90f7ae1f7c5debcd51bed93060126e6388774ba0e01c88af5087d75bfc53c8311609359702530fcd8468f69e9782d9dd92fce9d8b2597b09912cd

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
585.7MB

MD5
d8228f5fa8383a3f31bd93d8a666834d

SHA1
000a3529d8d6739912ad85985e65768ecde7eaa6

SHA256
1465dba99aed368d5b78f901118ee6773cb3946308d07f0b5e60485ee6fe050d

SHA512
f4e4dd88efc3c4720931288497b290c19b546af6c4c68ad0bf80ce2db2857b31b16ba5551bf786e0f0e46a367c424b6972744bcb67b5b7c8a570f1e213358ccf

Download Submit
memory/404-260-0x0000000002880000-0x00000000028C2000-memory.dmp

Filesize
264KB

Download
memory/404-268-0x0000000002880000-0x00000000028C2000-memory.dmp

Filesize
264KB

Download
memory/404-245-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/404-274-0x0000000002880000-0x00000000028C2000-memory.dmp

Filesize
264KB

Download
memory/404-272-0x0000000002880000-0x00000000028C2000-memory.dmp

Filesize
264KB

Download
memory/404-280-0x0000000002880000-0x00000000028C2000-memory.dmp

Filesize
264KB

Download
memory/404-641-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/404-246-0x00000000020E0000-0x000000000212A000-memory.dmp

Filesize
296KB

Download
memory/404-247-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/404-248-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/404-270-0x0000000002880000-0x00000000028C2000-memory.dmp

Filesize
264KB

Download
memory/404-256-0x0000000002880000-0x00000000028C2000-memory.dmp

Filesize
264KB

Download
memory/404-255-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/404-266-0x0000000002880000-0x00000000028C2000-memory.dmp

Filesize
264KB

Download
memory/404-250-0x0000000004E60000-0x0000000005404000-memory.dmp

Filesize
5.6MB

Download
memory/404-251-0x0000000000400000-0x00000000005CB000-memory.dmp

Filesize
1.8MB

Download
memory/404-264-0x0000000002880000-0x00000000028C2000-memory.dmp

Filesize
264KB

Download
memory/404-262-0x0000000002880000-0x00000000028C2000-memory.dmp

Filesize
264KB

Download
memory/404-253-0x0000000075320000-0x0000000075AD0000-memory.dmp

Filesize
7.7MB

Download
memory/404-258-0x0000000002880000-0x00000000028C2000-memory.dmp

Filesize
264KB

Download
memory/404-278-0x0000000002880000-0x00000000028C2000-memory.dmp

Filesize
264KB

Download
memory/404-254-0x0000000002880000-0x00000000028C2000-memory.dmp

Filesize
264KB

Download
memory/404-276-0x0000000002880000-0x00000000028C2000-memory.dmp

Filesize
264KB

Download
memory/1188-176-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/1188-177-0x0000000000110000-0x000000000011B000-memory.dmp

Filesize
44KB

Download
memory/1188-197-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/1188-175-0x0000000000110000-0x000000000011B000-memory.dmp

Filesize
44KB

Download
memory/1388-196-0x00000000012A0000-0x00000000012A9000-memory.dmp

Filesize
36KB

Download
memory/1388-198-0x00000000012B0000-0x00000000012B5000-memory.dmp

Filesize
20KB

Download
memory/1388-199-0x00000000012A0000-0x00000000012A9000-memory.dmp

Filesize
36KB

Download
memory/1704-210-0x0000000000E40000-0x0000000000E50000-memory.dmp

Filesize
64KB

Download
memory/1704-191-0x0000000000E30000-0x0000000000E3C000-memory.dmp

Filesize
48KB

Download
memory/1704-190-0x0000000000E40000-0x0000000000E50000-memory.dmp

Filesize
64KB

Download
memory/1704-189-0x0000000000E30000-0x0000000000E3C000-memory.dmp

Filesize
48KB

Download
memory/2408-209-0x0000000000E30000-0x0000000000E3B000-memory.dmp

Filesize
44KB

Download
memory/2408-212-0x0000000000E30000-0x0000000000E3B000-memory.dmp

Filesize
44KB

Download
memory/2408-211-0x0000000000E40000-0x0000000000E48000-memory.dmp

Filesize
32KB

Download
memory/2408-224-0x0000000000E40000-0x0000000000E48000-memory.dmp

Filesize
32KB

Download
memory/2616-213-0x0000000000E80000-0x0000000000EA2000-memory.dmp

Filesize
136KB

Download
memory/2616-192-0x0000000000E50000-0x0000000000E77000-memory.dmp

Filesize
156KB

Download
memory/2616-195-0x0000000000E50000-0x0000000000E77000-memory.dmp

Filesize
156KB

Download
memory/2616-194-0x0000000000E80000-0x0000000000EA2000-memory.dmp

Filesize
136KB

Download
memory/2896-181-0x0000000000380000-0x000000000038F000-memory.dmp

Filesize
60KB

Download
memory/2896-202-0x0000000000390000-0x0000000000399000-memory.dmp

Filesize
36KB

Download
memory/2896-184-0x0000000000380000-0x000000000038F000-memory.dmp

Filesize
60KB

Download
memory/2896-183-0x0000000000390000-0x0000000000399000-memory.dmp

Filesize
36KB

Download
memory/3180-215-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-241-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-218-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-217-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-220-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-222-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-138-0x0000000001EC0000-0x0000000001ED6000-memory.dmp

Filesize
88KB

Download
memory/3180-223-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-219-0x0000000006EA0000-0x0000000006EB0000-memory.dmp

Filesize
64KB

Download
memory/3180-249-0x0000000008230000-0x0000000008240000-memory.dmp

Filesize
64KB

Download
memory/3180-226-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-228-0x00000000080F0000-0x0000000008100000-memory.dmp

Filesize
64KB

Download
memory/3180-229-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-244-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-231-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-243-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-227-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-236-0x00000000080F0000-0x00000000080F3000-memory.dmp

Filesize
12KB

Download
memory/3180-235-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-234-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-237-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-239-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3180-238-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/3368-205-0x0000000000310000-0x000000000031D000-memory.dmp

Filesize
52KB

Download
memory/3368-207-0x0000000000320000-0x0000000000327000-memory.dmp

Filesize
28KB

Download
memory/3368-221-0x0000000000320000-0x0000000000327000-memory.dmp

Filesize
28KB

Download
memory/3368-208-0x0000000000310000-0x000000000031D000-memory.dmp

Filesize
52KB

Download
memory/3668-240-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/3668-232-0x00000000026E0000-0x0000000002AB0000-memory.dmp

Filesize
3.8MB

Download
memory/3668-230-0x0000000002520000-0x00000000026D2000-memory.dmp

Filesize
1.7MB

Download
memory/3668-567-0x0000000002520000-0x00000000026D2000-memory.dmp

Filesize
1.7MB

Download
memory/3668-639-0x0000000000400000-0x0000000000803000-memory.dmp

Filesize
4.0MB

Download
memory/3876-137-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3876-135-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/3876-136-0x0000000002240000-0x0000000002249000-memory.dmp

Filesize
36KB

Download
memory/3876-134-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/3876-139-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/4120-188-0x0000000000E50000-0x0000000000E59000-memory.dmp

Filesize
36KB

Download
memory/4120-187-0x0000000000E60000-0x0000000000E70000-memory.dmp

Filesize
64KB

Download
memory/4120-186-0x0000000000E50000-0x0000000000E59000-memory.dmp

Filesize
36KB

Download
memory/4120-206-0x0000000000E60000-0x0000000000E70000-memory.dmp

Filesize
64KB

Download
memory/4136-162-0x00000000004A0000-0x00000000006A6000-memory.dmp

Filesize
2.0MB

Download
memory/4304-204-0x0000000000F10000-0x0000000000F1B000-memory.dmp

Filesize
44KB

Download
memory/4304-214-0x0000000000F20000-0x0000000000F26000-memory.dmp

Filesize
24KB

Download
memory/4304-203-0x0000000000F20000-0x0000000000F26000-memory.dmp

Filesize
24KB

Download
memory/4304-200-0x0000000000F10000-0x0000000000F1B000-memory.dmp

Filesize
44KB

Download
memory/4308-305-0x00000000007B0000-0x00000000008B0000-memory.dmp

Filesize
1024KB

Download
memory/4308-307-0x0000000002250000-0x00000000022A5000-memory.dmp

Filesize
340KB

Download
memory/4308-309-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/4752-163-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4752-182-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/4752-185-0x0000000005420000-0x000000000545C000-memory.dmp

Filesize
240KB

Download
memory/4752-180-0x00000000053C0000-0x00000000053D2000-memory.dmp

Filesize
72KB

Download
memory/4752-193-0x0000000075320000-0x0000000075AD0000-memory.dmp

Filesize
7.7MB

Download
memory/4752-179-0x0000000005490000-0x000000000559A000-memory.dmp

Filesize
1.0MB

Download
memory/4752-201-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/4752-170-0x0000000075320000-0x0000000075AD0000-memory.dmp

Filesize
7.7MB

Download
memory/4752-178-0x00000000059A0000-0x0000000005FB8000-memory.dmp

Filesize
6.1MB

Download