lumma | cfbcaceb818ccb9659325848991f7825d682e790abecc15cf6418d3577f1f0c5

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2023, 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

startup.dll.exe
Size

216KB
MD5

33d60a6162d7c6c1f48f96c770ba8dc3
SHA1

6e9e1c3f7d570756e51a95d1add013a70340fd19
SHA256

cfbcaceb818ccb9659325848991f7825d682e790abecc15cf6418d3577f1f0c5
SHA512

ac9b80376166ceea1a612ccecab67ddb0b220003099efeaebcddae7bf96001118611b05263be32ca1cd581765fae920bd7ceae256ea7380cab39e967d5cf7c44
SSDEEP

3072:8wo8lMoohg9X4FmOpS3Td4pDwhDOXG9X7ZOqzm0mDrj0RtP5y:Flp9IFLpSd4pKOsX7ZOwmVDERS

Score

10^/10

lumma smokeloader vidar da3b70a6d41764717ff479f0edd50071 sprg backdoor discovery spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32

Extracted

Family

vidar

Version

3.9

Botnet

da3b70a6d41764717ff479f0edd50071

https://steamcommunity.com/profiles/76561199263069598

https://t.me/cybehost

Attributes

profile_id_v2
da3b70a6d41764717ff479f0edd50071
user_agent
Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.7 (like Gecko) (Debian)

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
1412	77B0.exe
4368	77B0.exe
2760	8231.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2760	8231.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1412 set thread context of 4368	1412	77B0.exe	94

Program crash 1 IoCs

pid	pid_target	Process	procid_target
452	4368	WerFault.exe	94

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	startup.dll.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	startup.dll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	startup.dll.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2820	startup.dll.exe
2820	startup.dll.exe
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3140	Process not Found

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
2820	startup.dll.exe
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found
3140	Process not Found

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeLoadDriverPrivilege	2760	8231.exe
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found
Token: SeShutdownPrivilege	3140	Process not Found
Token: SeCreatePagefilePrivilege	3140	Process not Found

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 1412	3140	Process not Found	93
PID 3140 wrote to memory of 1412	3140	Process not Found	93
PID 3140 wrote to memory of 1412	3140	Process not Found	93
PID 1412 wrote to memory of 4368	1412	77B0.exe	94
PID 1412 wrote to memory of 4368	1412	77B0.exe	94
PID 1412 wrote to memory of 4368	1412	77B0.exe	94
PID 1412 wrote to memory of 4368	1412	77B0.exe	94
PID 1412 wrote to memory of 4368	1412	77B0.exe	94
PID 1412 wrote to memory of 4368	1412	77B0.exe	94
PID 1412 wrote to memory of 4368	1412	77B0.exe	94
PID 1412 wrote to memory of 4368	1412	77B0.exe	94
PID 1412 wrote to memory of 4368	1412	77B0.exe	94
PID 3140 wrote to memory of 2760	3140	Process not Found	97
PID 3140 wrote to memory of 2760	3140	Process not Found	97
PID 3140 wrote to memory of 2760	3140	Process not Found	97
PID 3140 wrote to memory of 1316	3140	Process not Found	98
PID 3140 wrote to memory of 1316	3140	Process not Found	98
PID 3140 wrote to memory of 1316	3140	Process not Found	98
PID 3140 wrote to memory of 1316	3140	Process not Found	98
PID 3140 wrote to memory of 4316	3140	Process not Found	99
PID 3140 wrote to memory of 4316	3140	Process not Found	99
PID 3140 wrote to memory of 4316	3140	Process not Found	99
PID 3140 wrote to memory of 1996	3140	Process not Found	100
PID 3140 wrote to memory of 1996	3140	Process not Found	100
PID 3140 wrote to memory of 1996	3140	Process not Found	100
PID 3140 wrote to memory of 1996	3140	Process not Found	100
PID 3140 wrote to memory of 4732	3140	Process not Found	101
PID 3140 wrote to memory of 4732	3140	Process not Found	101
PID 3140 wrote to memory of 4732	3140	Process not Found	101
PID 3140 wrote to memory of 2084	3140	Process not Found	102
PID 3140 wrote to memory of 2084	3140	Process not Found	102
PID 3140 wrote to memory of 2084	3140	Process not Found	102
PID 3140 wrote to memory of 2084	3140	Process not Found	102
PID 3140 wrote to memory of 472	3140	Process not Found	103
PID 3140 wrote to memory of 472	3140	Process not Found	103
PID 3140 wrote to memory of 472	3140	Process not Found	103
PID 3140 wrote to memory of 472	3140	Process not Found	103
PID 3140 wrote to memory of 2104	3140	Process not Found	104
PID 3140 wrote to memory of 2104	3140	Process not Found	104
PID 3140 wrote to memory of 2104	3140	Process not Found	104
PID 3140 wrote to memory of 2104	3140	Process not Found	104
PID 3140 wrote to memory of 3240	3140	Process not Found	105
PID 3140 wrote to memory of 3240	3140	Process not Found	105
PID 3140 wrote to memory of 3240	3140	Process not Found	105
PID 3140 wrote to memory of 4760	3140	Process not Found	106
PID 3140 wrote to memory of 4760	3140	Process not Found	106
PID 3140 wrote to memory of 4760	3140	Process not Found	106
PID 3140 wrote to memory of 4760	3140	Process not Found	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\startup.dll.exe
"C:\Users\Admin\AppData\Local\Temp\startup.dll.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2820

C:\Users\Admin\AppData\Local\Temp\77B0.exe
C:\Users\Admin\AppData\Local\Temp\77B0.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Local\Temp\77B0.exe
  "C:\Users\Admin\AppData\Local\Temp\77B0.exe"
  2⤵
  - Executes dropped EXE
  PID:4368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 344
    3⤵
    - Program crash
    PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4368 -ip 4368
1⤵
PID:2296

C:\Users\Admin\AppData\Local\Temp\8231.exe
C:\Users\Admin\AppData\Local\Temp\8231.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1316

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4316

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1996

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4732

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2084

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:472

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2104

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3240

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\77B0.exe

Filesize
552KB

MD5
de27e688202b4fc37b916962b4060c67

SHA1
3e657e69e5c3b3a9e0ed5354e8f28a80b3552599

SHA256
84fc76615347be1aea7e2a4625c7cf5973cee76865bd85c0da51e5303d242cb4

SHA512
5232858ea01f670f7d3bed374c7a403c4374db65b270487add630b81fc5251cf074a9c07017e077af97bb72728e95dbe496cbfb28b7e929116e5468f2c845ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\77B0.exe

Filesize
552KB

MD5
de27e688202b4fc37b916962b4060c67

SHA1
3e657e69e5c3b3a9e0ed5354e8f28a80b3552599

SHA256
84fc76615347be1aea7e2a4625c7cf5973cee76865bd85c0da51e5303d242cb4

SHA512
5232858ea01f670f7d3bed374c7a403c4374db65b270487add630b81fc5251cf074a9c07017e077af97bb72728e95dbe496cbfb28b7e929116e5468f2c845ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\77B0.exe

Filesize
552KB

MD5
de27e688202b4fc37b916962b4060c67

SHA1
3e657e69e5c3b3a9e0ed5354e8f28a80b3552599

SHA256
84fc76615347be1aea7e2a4625c7cf5973cee76865bd85c0da51e5303d242cb4

SHA512
5232858ea01f670f7d3bed374c7a403c4374db65b270487add630b81fc5251cf074a9c07017e077af97bb72728e95dbe496cbfb28b7e929116e5468f2c845ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\8231.exe

Filesize
316KB

MD5
cd4121ea74cbd684bdf3a08c0aaf54a4

SHA1
ee87db3dd134332b815d17d717b1ed36939dfa35

SHA256
4ebe4e62066ac10efc23e7b63e421cc153b426e036309dbf99e4a4aa97122782

SHA512
af2b1ee11be992295a932fb6bf6221a077c33823367e5f26aa7b4f9bdd573482a67b2dab90cc778096cd57bf5892adc0678d23fe73de39c29f9377b1835ca100

Download Submit
C:\Users\Admin\AppData\Local\Temp\8231.exe

Filesize
316KB

MD5
cd4121ea74cbd684bdf3a08c0aaf54a4

SHA1
ee87db3dd134332b815d17d717b1ed36939dfa35

SHA256
4ebe4e62066ac10efc23e7b63e421cc153b426e036309dbf99e4a4aa97122782

SHA512
af2b1ee11be992295a932fb6bf6221a077c33823367e5f26aa7b4f9bdd573482a67b2dab90cc778096cd57bf5892adc0678d23fe73de39c29f9377b1835ca100

Download Submit
memory/472-202-0x00000000007C0000-0x00000000007C9000-memory.dmp

Filesize
36KB

Download
memory/472-220-0x00000000007D0000-0x00000000007D5000-memory.dmp

Filesize
20KB

Download
memory/472-200-0x00000000007C0000-0x00000000007C9000-memory.dmp

Filesize
36KB

Download
memory/472-201-0x00000000007D0000-0x00000000007D5000-memory.dmp

Filesize
20KB

Download
memory/1316-186-0x0000000000130000-0x0000000000137000-memory.dmp

Filesize
28KB

Download
memory/1316-187-0x0000000000120000-0x000000000012B000-memory.dmp

Filesize
44KB

Download
memory/1316-215-0x0000000000130000-0x0000000000137000-memory.dmp

Filesize
28KB

Download
memory/1316-185-0x0000000000120000-0x000000000012B000-memory.dmp

Filesize
44KB

Download
memory/1412-149-0x0000000000560000-0x00000000005F0000-memory.dmp

Filesize
576KB

Download
memory/1412-150-0x0000000005440000-0x00000000059E4000-memory.dmp

Filesize
5.6MB

Download
memory/1996-191-0x00000000003D0000-0x00000000003D9000-memory.dmp

Filesize
36KB

Download
memory/1996-217-0x00000000003E0000-0x00000000003E5000-memory.dmp

Filesize
20KB

Download
memory/1996-193-0x00000000003D0000-0x00000000003D9000-memory.dmp

Filesize
36KB

Download
memory/1996-192-0x00000000003E0000-0x00000000003E5000-memory.dmp

Filesize
20KB

Download
memory/2084-219-0x0000000000940000-0x0000000000962000-memory.dmp

Filesize
136KB

Download
memory/2084-199-0x0000000000910000-0x0000000000937000-memory.dmp

Filesize
156KB

Download
memory/2084-198-0x0000000000940000-0x0000000000962000-memory.dmp

Filesize
136KB

Download
memory/2084-197-0x0000000000910000-0x0000000000937000-memory.dmp

Filesize
156KB

Download
memory/2104-205-0x0000000000D60000-0x0000000000D6B000-memory.dmp

Filesize
44KB

Download
memory/2104-203-0x0000000000D60000-0x0000000000D6B000-memory.dmp

Filesize
44KB

Download
memory/2104-204-0x0000000000D70000-0x0000000000D76000-memory.dmp

Filesize
24KB

Download
memory/2104-221-0x0000000000D70000-0x0000000000D76000-memory.dmp

Filesize
24KB

Download
memory/2820-134-0x0000000002CF0000-0x0000000002CF9000-memory.dmp

Filesize
36KB

Download
memory/2820-136-0x0000000000400000-0x0000000002B91000-memory.dmp

Filesize
39.6MB

Download
memory/3140-173-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-155-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-179-0x0000000008B40000-0x0000000008B50000-memory.dmp

Filesize
64KB

Download
memory/3140-177-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-176-0x0000000008B40000-0x0000000008B50000-memory.dmp

Filesize
64KB

Download
memory/3140-174-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-246-0x0000000002F60000-0x0000000002F70000-memory.dmp

Filesize
64KB

Download
memory/3140-245-0x0000000002F60000-0x0000000002F70000-memory.dmp

Filesize
64KB

Download
memory/3140-244-0x0000000002F60000-0x0000000002F70000-memory.dmp

Filesize
64KB

Download
memory/3140-175-0x0000000008B40000-0x0000000008B50000-memory.dmp

Filesize
64KB

Download
memory/3140-171-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-243-0x0000000002F60000-0x0000000002F70000-memory.dmp

Filesize
64KB

Download
memory/3140-242-0x0000000002F60000-0x0000000002F70000-memory.dmp

Filesize
64KB

Download
memory/3140-241-0x0000000002F60000-0x0000000002F70000-memory.dmp

Filesize
64KB

Download
memory/3140-240-0x0000000002F50000-0x0000000002F52000-memory.dmp

Filesize
8KB

Download
memory/3140-169-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-239-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-166-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-168-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-238-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-164-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-161-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-156-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-154-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-237-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-236-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-235-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-234-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-233-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-232-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-212-0x0000000008B40000-0x0000000008B50000-memory.dmp

Filesize
64KB

Download
memory/3140-213-0x0000000008B40000-0x0000000008B50000-memory.dmp

Filesize
64KB

Download
memory/3140-214-0x0000000008B40000-0x0000000008B50000-memory.dmp

Filesize
64KB

Download
memory/3140-178-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-231-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-153-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-230-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-152-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-151-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-135-0x0000000003380000-0x0000000003396000-memory.dmp

Filesize
88KB

Download
memory/3140-229-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-228-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-224-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-225-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-226-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3140-227-0x0000000008A50000-0x0000000008A60000-memory.dmp

Filesize
64KB

Download
memory/3240-222-0x00000000009F0000-0x00000000009F7000-memory.dmp

Filesize
28KB

Download
memory/3240-208-0x00000000009E0000-0x00000000009ED000-memory.dmp

Filesize
52KB

Download
memory/3240-207-0x00000000009F0000-0x00000000009F7000-memory.dmp

Filesize
28KB

Download
memory/3240-206-0x00000000009E0000-0x00000000009ED000-memory.dmp

Filesize
52KB

Download
memory/4316-188-0x0000000000FC0000-0x0000000000FCF000-memory.dmp

Filesize
60KB

Download
memory/4316-216-0x0000000000FD0000-0x0000000000FD9000-memory.dmp

Filesize
36KB

Download
memory/4316-189-0x0000000000FD0000-0x0000000000FD9000-memory.dmp

Filesize
36KB

Download
memory/4316-190-0x0000000000FC0000-0x0000000000FCF000-memory.dmp

Filesize
60KB

Download
memory/4368-165-0x0000000000590000-0x00000000005FB000-memory.dmp

Filesize
428KB

Download
memory/4368-172-0x0000000000590000-0x00000000005FB000-memory.dmp

Filesize
428KB

Download
memory/4368-159-0x0000000000590000-0x00000000005FB000-memory.dmp

Filesize
428KB

Download
memory/4732-196-0x0000000000E10000-0x0000000000E1C000-memory.dmp

Filesize
48KB

Download
memory/4732-195-0x0000000000E20000-0x0000000000E26000-memory.dmp

Filesize
24KB

Download
memory/4732-194-0x0000000000E10000-0x0000000000E1C000-memory.dmp

Filesize
48KB

Download
memory/4732-218-0x0000000000E20000-0x0000000000E26000-memory.dmp

Filesize
24KB

Download
memory/4760-223-0x0000000000810000-0x0000000000818000-memory.dmp

Filesize
32KB

Download
memory/4760-209-0x0000000000800000-0x000000000080B000-memory.dmp

Filesize
44KB

Download
memory/4760-210-0x0000000000810000-0x0000000000818000-memory.dmp

Filesize
32KB

Download
memory/4760-211-0x0000000000800000-0x000000000080B000-memory.dmp

Filesize
44KB

Download