lumma | 95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2023 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a.exe
Size

303KB
MD5

566a85715428e226f1c5d48ca90b9e15
SHA1

f252975240083fd3ce4ff62a059d6dab226dd41d
SHA256

95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a
SHA512

2d716809dc374f5cc74f58e3ffca09d2bc7bbff8d27eef21ae768b9ee2148592b2572b194323fa64b814734b1a141d9c05db9a060f2c8e1080a566fc16672e4e
SSDEEP

3072:phLIBaL3BklS19u655D+kMxqrnRdFe1soM+e5CD9iwlgZDGW:PLIYL3BkgCS5vLejMID9iFG

Score

10^/10

lumma redline smokeloader cc summ backdoor discovery infostealer spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Botnet

summ

Extracted

Family

smokeloader

Version

2022

http://stalagmijesarl.com/

http://ukdantist-sarl.com/

http://cpcorprotationltd.com/

rc4.i32

Extracted

Family

redline

Botnet

94.228.169.160:43800

Attributes

auth_value
ec4d19a9dd758ace38b4f5b4a447b048

Extracted

Family

lumma

gstatic-node.io

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 24 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3204-216-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-217-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-219-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-221-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-223-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-225-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-227-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-229-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-231-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-234-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-236-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-238-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-240-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-242-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-244-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-246-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-248-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-250-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-252-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-254-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-256-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-258-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-260-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline
behavioral1/memory/3204-262-0x00000000051C0000-0x0000000005202000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

F721.exeFDE9.exe404.exe

pid process

3204 F721.exe
2636 FDE9.exe
1408 404.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

FDE9.exe

description pid process target process

PID 2636 set thread context of 3948 2636 FDE9.exe AppLaunch.exe
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

1916 2636 WerFault.exe FDE9.exe
3436 1408 WerFault.exe 404.exe
1272 3204 WerFault.exe F721.exe

pid	process
3204	F721.exe
2636	FDE9.exe
1408	404.exe

description	pid	process	target process
PID 2636 set thread context of 3948	2636	FDE9.exe	AppLaunch.exe

pid	pid_target	process	target process
1916	2636	WerFault.exe	FDE9.exe
3436	1408	WerFault.exe	404.exe
1272	3204	WerFault.exe	F721.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a.exe

Modifies registry class 2 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a.exe

pid	process
3384	95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a.exe
3384	95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a.exe
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3156

pid	process
3156

Suspicious behavior: MapViewOfSection 19 IoCs

Processes:

95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a.exe

pid	process
3384	95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a.exe
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156
3156

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

F721.exe

description	pid	process
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeDebugPrivilege	3204	F721.exe
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156
Token: SeShutdownPrivilege	3156
Token: SeCreatePagefilePrivilege	3156

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3156

pid	process
3156

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

FDE9.exe

description	pid	process	target process
PID 3156 wrote to memory of 3204	3156		F721.exe
PID 3156 wrote to memory of 3204	3156		F721.exe
PID 3156 wrote to memory of 3204	3156		F721.exe
PID 3156 wrote to memory of 2636	3156		FDE9.exe
PID 3156 wrote to memory of 2636	3156		FDE9.exe
PID 3156 wrote to memory of 2636	3156		FDE9.exe
PID 2636 wrote to memory of 3948	2636	FDE9.exe	AppLaunch.exe
PID 2636 wrote to memory of 3948	2636	FDE9.exe	AppLaunch.exe
PID 2636 wrote to memory of 3948	2636	FDE9.exe	AppLaunch.exe
PID 2636 wrote to memory of 3948	2636	FDE9.exe	AppLaunch.exe
PID 2636 wrote to memory of 3948	2636	FDE9.exe	AppLaunch.exe
PID 3156 wrote to memory of 1408	3156		404.exe
PID 3156 wrote to memory of 1408	3156		404.exe
PID 3156 wrote to memory of 1408	3156		404.exe
PID 3156 wrote to memory of 2484	3156		explorer.exe
PID 3156 wrote to memory of 2484	3156		explorer.exe
PID 3156 wrote to memory of 2484	3156		explorer.exe
PID 3156 wrote to memory of 2484	3156		explorer.exe
PID 3156 wrote to memory of 4868	3156		explorer.exe
PID 3156 wrote to memory of 4868	3156		explorer.exe
PID 3156 wrote to memory of 4868	3156		explorer.exe
PID 3156 wrote to memory of 4968	3156		explorer.exe
PID 3156 wrote to memory of 4968	3156		explorer.exe
PID 3156 wrote to memory of 4968	3156		explorer.exe
PID 3156 wrote to memory of 4968	3156		explorer.exe
PID 3156 wrote to memory of 1676	3156		explorer.exe
PID 3156 wrote to memory of 1676	3156		explorer.exe
PID 3156 wrote to memory of 1676	3156		explorer.exe
PID 3156 wrote to memory of 1236	3156		explorer.exe
PID 3156 wrote to memory of 1236	3156		explorer.exe
PID 3156 wrote to memory of 1236	3156		explorer.exe
PID 3156 wrote to memory of 1236	3156		explorer.exe
PID 3156 wrote to memory of 916	3156		explorer.exe
PID 3156 wrote to memory of 916	3156		explorer.exe
PID 3156 wrote to memory of 916	3156		explorer.exe
PID 3156 wrote to memory of 916	3156		explorer.exe
PID 3156 wrote to memory of 1816	3156		explorer.exe
PID 3156 wrote to memory of 1816	3156		explorer.exe
PID 3156 wrote to memory of 1816	3156		explorer.exe
PID 3156 wrote to memory of 1816	3156		explorer.exe
PID 3156 wrote to memory of 1772	3156		explorer.exe
PID 3156 wrote to memory of 1772	3156		explorer.exe
PID 3156 wrote to memory of 1772	3156		explorer.exe
PID 3156 wrote to memory of 3688	3156		explorer.exe
PID 3156 wrote to memory of 3688	3156		explorer.exe
PID 3156 wrote to memory of 3688	3156		explorer.exe
PID 3156 wrote to memory of 3688	3156		explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a.exe
"C:\Users\Admin\AppData\Local\Temp\95a2872b960a5ac372c19be5bb2d1f8cb50c75e043841b8862f8e0b0bcb8204a.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3384

C:\Users\Admin\AppData\Local\Temp\F721.exe
C:\Users\Admin\AppData\Local\Temp\F721.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 1756
  2⤵
  - Program crash
  PID:1272

C:\Users\Admin\AppData\Local\Temp\FDE9.exe
C:\Users\Admin\AppData\Local\Temp\FDE9.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 416
  2⤵
  - Program crash
  PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2636 -ip 2636
1⤵
PID:1752

C:\Users\Admin\AppData\Local\Temp\404.exe
C:\Users\Admin\AppData\Local\Temp\404.exe
1⤵
- Executes dropped EXE
PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 3480
  2⤵
  - Program crash
  PID:3436

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2484

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4868

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4968

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1676

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1236

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:916

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1816

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1772

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1408 -ip 1408
1⤵
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3204 -ip 3204
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\404.exe

Filesize
381KB

MD5
ab9327fce682d578e28456820e0d9baa

SHA1
48696ea54a5960a3f9bbbf96819a150ad93c33c1

SHA256
1915d244bae2707f6531ea7ffc0fb7708f7cafcf2aa354223ea8112064b18eaf

SHA512
dcfd05aeb32c42dd9b25c11e214fa7b9aac96c1bdb747ee71487bdce9f58cb6c691bb3266cd3f752b2abd83f9b17d297a767751bf14123dfc14820fb2cb6eaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\404.exe

Filesize
381KB

MD5
ab9327fce682d578e28456820e0d9baa

SHA1
48696ea54a5960a3f9bbbf96819a150ad93c33c1

SHA256
1915d244bae2707f6531ea7ffc0fb7708f7cafcf2aa354223ea8112064b18eaf

SHA512
dcfd05aeb32c42dd9b25c11e214fa7b9aac96c1bdb747ee71487bdce9f58cb6c691bb3266cd3f752b2abd83f9b17d297a767751bf14123dfc14820fb2cb6eaab

Download Submit
C:\Users\Admin\AppData\Local\Temp\F721.exe

Filesize
312KB

MD5
eabf49a55264bcc12f51bd2710718d3d

SHA1
f0e82807f27f2a96f925530bf7aabac46a4e7136

SHA256
ef23ae66bc212bf8e435bf806ff120db2470364f3b7362fe05f48b09df225eed

SHA512
6a232ec02136cafc35bfcc7168c4df591dd712c8f89f8f133154796c0754362f4911dc3220089757eef43247116fa1b115a15f0f1ba6f312e96df5e8f3bb89b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\F721.exe

Filesize
312KB

MD5
eabf49a55264bcc12f51bd2710718d3d

SHA1
f0e82807f27f2a96f925530bf7aabac46a4e7136

SHA256
ef23ae66bc212bf8e435bf806ff120db2470364f3b7362fe05f48b09df225eed

SHA512
6a232ec02136cafc35bfcc7168c4df591dd712c8f89f8f133154796c0754362f4911dc3220089757eef43247116fa1b115a15f0f1ba6f312e96df5e8f3bb89b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\FDE9.exe

Filesize
2.0MB

MD5
71ef5fd46955ea0abd7800e7c99cc8b3

SHA1
a9efdd480409e6b0a626ea6fd9efaf280b20bb75

SHA256
fe20091e32e612a1b5b7043895ddf7d0131a544a6f86d177218645241070f32d

SHA512
a5fb7bdb0df383295d35c7e7e73956e8f5061e9ec00e783fa36c8577234be3333bd8d26fd110de08b9809495587fb3f9b79742bd3fb178cf892c88c36a75e650

Download Submit
C:\Users\Admin\AppData\Local\Temp\FDE9.exe

Filesize
2.0MB

MD5
71ef5fd46955ea0abd7800e7c99cc8b3

SHA1
a9efdd480409e6b0a626ea6fd9efaf280b20bb75

SHA256
fe20091e32e612a1b5b7043895ddf7d0131a544a6f86d177218645241070f32d

SHA512
a5fb7bdb0df383295d35c7e7e73956e8f5061e9ec00e783fa36c8577234be3333bd8d26fd110de08b9809495587fb3f9b79742bd3fb178cf892c88c36a75e650

Download Submit
memory/916-193-0x00000000008D0000-0x00000000008D5000-memory.dmp

Filesize
20KB

Download
memory/916-194-0x00000000008C0000-0x00000000008C9000-memory.dmp

Filesize
36KB

Download
memory/916-192-0x00000000008C0000-0x00000000008C9000-memory.dmp

Filesize
36KB

Download
memory/916-209-0x00000000008D0000-0x00000000008D5000-memory.dmp

Filesize
20KB

Download
memory/1236-189-0x0000000000970000-0x0000000000997000-memory.dmp

Filesize
156KB

Download
memory/1236-208-0x00000000009A0000-0x00000000009C2000-memory.dmp

Filesize
136KB

Download
memory/1236-188-0x00000000009A0000-0x00000000009C2000-memory.dmp

Filesize
136KB

Download
memory/1236-187-0x0000000000970000-0x0000000000997000-memory.dmp

Filesize
156KB

Download
memory/1408-1299-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/1408-268-0x0000000000400000-0x00000000005DD000-memory.dmp

Filesize
1.9MB

Download
memory/1408-266-0x0000000000880000-0x00000000008D5000-memory.dmp

Filesize
340KB

Download
memory/1408-264-0x00000000008F0000-0x00000000009F0000-memory.dmp

Filesize
1024KB

Download
memory/1408-1298-0x00000000008F0000-0x00000000009F0000-memory.dmp

Filesize
1024KB

Download
memory/1676-184-0x0000000000FE0000-0x0000000000FE6000-memory.dmp

Filesize
24KB

Download
memory/1676-185-0x0000000000FD0000-0x0000000000FDC000-memory.dmp

Filesize
48KB

Download
memory/1676-183-0x0000000000FD0000-0x0000000000FDC000-memory.dmp

Filesize
48KB

Download
memory/1676-205-0x0000000000FE0000-0x0000000000FE6000-memory.dmp

Filesize
24KB

Download
memory/1772-202-0x00000000001E0000-0x00000000001E7000-memory.dmp

Filesize
28KB

Download
memory/1772-203-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download
memory/1772-200-0x00000000001D0000-0x00000000001DD000-memory.dmp

Filesize
52KB

Download
memory/1816-199-0x0000000000930000-0x000000000093B000-memory.dmp

Filesize
44KB

Download
memory/1816-233-0x0000000000940000-0x0000000000946000-memory.dmp

Filesize
24KB

Download
memory/1816-196-0x0000000000930000-0x000000000093B000-memory.dmp

Filesize
44KB

Download
memory/1816-198-0x0000000000940000-0x0000000000946000-memory.dmp

Filesize
24KB

Download
memory/2484-175-0x0000000000D90000-0x0000000000D97000-memory.dmp

Filesize
28KB

Download
memory/2484-176-0x0000000000D80000-0x0000000000D8B000-memory.dmp

Filesize
44KB

Download
memory/2484-195-0x0000000000D80000-0x0000000000D8B000-memory.dmp

Filesize
44KB

Download
memory/2484-191-0x0000000000D90000-0x0000000000D97000-memory.dmp

Filesize
28KB

Download
memory/2636-157-0x00000000002D0000-0x00000000004D6000-memory.dmp

Filesize
2.0MB

Download
memory/3156-137-0x0000000000F30000-0x0000000000F46000-memory.dmp

Filesize
88KB

Download
memory/3204-211-0x0000000002210000-0x000000000225A000-memory.dmp

Filesize
296KB

Download
memory/3204-254-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-258-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-1296-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/3204-1300-0x000000000B270000-0x000000000B2E6000-memory.dmp

Filesize
472KB

Download
memory/3204-1301-0x000000000B2F0000-0x000000000B382000-memory.dmp

Filesize
584KB

Download
memory/3204-1302-0x000000000B390000-0x000000000B3F6000-memory.dmp

Filesize
408KB

Download
memory/3204-1303-0x000000000BAE0000-0x000000000BCA2000-memory.dmp

Filesize
1.8MB

Download
memory/3204-1304-0x000000000BCB0000-0x000000000C1DC000-memory.dmp

Filesize
5.2MB

Download
memory/3204-1309-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/3204-1310-0x0000000000400000-0x00000000005CB000-memory.dmp

Filesize
1.8MB

Download
memory/3204-1295-0x00000000028A0000-0x00000000028B0000-memory.dmp

Filesize
64KB

Download
memory/3204-262-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-256-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-213-0x0000000004C10000-0x00000000051B4000-memory.dmp

Filesize
5.6MB

Download
memory/3204-260-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-215-0x00000000028A0000-0x00000000028B0000-memory.dmp

Filesize
64KB

Download
memory/3204-252-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-210-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/3204-1293-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/3204-212-0x0000000000400000-0x00000000005CB000-memory.dmp

Filesize
1.8MB

Download
memory/3204-214-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/3204-216-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-1297-0x00000000028A0000-0x00000000028B0000-memory.dmp

Filesize
64KB

Download
memory/3204-1294-0x00000000028A0000-0x00000000028B0000-memory.dmp

Filesize
64KB

Download
memory/3204-217-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-219-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-221-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-223-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-225-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-227-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-229-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-231-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-250-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-234-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-236-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-238-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-240-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-242-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-244-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-246-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3204-248-0x00000000051C0000-0x0000000005202000-memory.dmp

Filesize
264KB

Download
memory/3384-135-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/3384-136-0x0000000000730000-0x0000000000739000-memory.dmp

Filesize
36KB

Download
memory/3384-134-0x0000000000870000-0x0000000000970000-memory.dmp

Filesize
1024KB

Download
memory/3384-138-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/3688-207-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/3688-428-0x00000000008D0000-0x00000000008D8000-memory.dmp

Filesize
32KB

Download
memory/3688-204-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/3688-206-0x00000000008D0000-0x00000000008D8000-memory.dmp

Filesize
32KB

Download
memory/3948-172-0x0000000005720000-0x0000000005732000-memory.dmp

Filesize
72KB

Download
memory/3948-190-0x00000000057E0000-0x00000000057F0000-memory.dmp

Filesize
64KB

Download
memory/3948-158-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3948-186-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/3948-163-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/3948-169-0x0000000005F10000-0x0000000006528000-memory.dmp

Filesize
6.1MB

Download
memory/3948-170-0x0000000005A00000-0x0000000005B0A000-memory.dmp

Filesize
1.0MB

Download
memory/3948-173-0x00000000057E0000-0x00000000057F0000-memory.dmp

Filesize
64KB

Download
memory/3948-174-0x0000000005780000-0x00000000057BC000-memory.dmp

Filesize
240KB

Download
memory/4868-177-0x00000000006B0000-0x00000000006BF000-memory.dmp

Filesize
60KB

Download
memory/4868-178-0x00000000006C0000-0x00000000006C9000-memory.dmp

Filesize
36KB

Download
memory/4868-179-0x00000000006B0000-0x00000000006BF000-memory.dmp

Filesize
60KB

Download
memory/4868-197-0x00000000006C0000-0x00000000006C9000-memory.dmp

Filesize
36KB

Download
memory/4968-201-0x0000000000F50000-0x0000000000F60000-memory.dmp

Filesize
64KB

Download
memory/4968-180-0x0000000000F40000-0x0000000000F49000-memory.dmp

Filesize
36KB

Download
memory/4968-181-0x0000000000F50000-0x0000000000F60000-memory.dmp

Filesize
64KB

Download
memory/4968-182-0x0000000000F40000-0x0000000000F49000-memory.dmp

Filesize
36KB

Download