lumma | 3621cbb7c16bb07b3636356e9f73788c95057b3fe7cba6850e8f3b2d0fda6dc5

Analysis

max time kernel
245s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14f9e3ea623dccde8cc077de47dc6c1b.exe
Size

216KB
MD5

14f9e3ea623dccde8cc077de47dc6c1b
SHA1

e55644d8a8b366d94f6e05be56daed1ff7ca4241
SHA256

3621cbb7c16bb07b3636356e9f73788c95057b3fe7cba6850e8f3b2d0fda6dc5
SHA512

e35bae057c97a7fe2567ca1562a1c7418f66cd07d92f52cf364133b679677aadece02e28375e44c47d2ed81e458742b2911a0ec2d5c624749cea694edfbd46b4
SSDEEP

6144:6b3UYmL5+wp7XH51MnD9fpoh+WclrLqE:6beLpJXZ1b+WSyE

Score

10^/10

lumma metasploit backdoor stealer trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

Detect Lumma Stealer payload V4 34 IoCs

resource	yara_rule
behavioral1/memory/3060-8-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/3060-12-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/3060-15-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/3060-16-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/3060-31-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/2812-56-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/2812-55-0x0000000000230000-0x000000000027B000-memory.dmp	family_lumma_v4
behavioral1/memory/2812-58-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/2812-57-0x0000000000230000-0x000000000027B000-memory.dmp	family_lumma_v4
behavioral1/memory/2812-59-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/2812-61-0x00000000020A0000-0x00000000020EB000-memory.dmp	family_lumma_v4
behavioral1/memory/1088-71-0x0000000001C30000-0x0000000001C7B000-memory.dmp	family_lumma_v4
behavioral1/memory/2372-91-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/2372-92-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/2372-93-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/1924-101-0x0000000000840000-0x000000000088B000-memory.dmp	family_lumma_v4
behavioral1/memory/2372-95-0x0000000002010000-0x000000000205B000-memory.dmp	family_lumma_v4
behavioral1/memory/1744-129-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/1744-141-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/1360-166-0x0000000000230000-0x000000000027B000-memory.dmp	family_lumma_v4
behavioral1/memory/1360-167-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/1340-174-0x00000000002B0000-0x00000000002FB000-memory.dmp	family_lumma_v4
behavioral1/memory/1360-177-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/2468-201-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/2468-215-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/664-241-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/2128-248-0x0000000000230000-0x000000000027B000-memory.dmp	family_lumma_v4
behavioral1/memory/664-247-0x0000000000230000-0x000000000027B000-memory.dmp	family_lumma_v4
behavioral1/memory/2736-272-0x0000000000270000-0x00000000002BB000-memory.dmp	family_lumma_v4
behavioral1/memory/2736-273-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/2736-275-0x0000000000270000-0x00000000002BB000-memory.dmp	family_lumma_v4
behavioral1/memory/2736-276-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_v4
behavioral1/memory/2944-277-0x0000000000230000-0x000000000027B000-memory.dmp	family_lumma_v4
behavioral1/memory/2944-279-0x0000000000230000-0x000000000027B000-memory.dmp	family_lumma_v4

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 16 IoCs

pid	Process
2164	globalpatch.exe
2812	globalpatch.exe
1088	globalpatch.exe
2372	globalpatch.exe
1924	globalpatch.exe
1744	globalpatch.exe
1208	globalpatch.exe
1360	globalpatch.exe
1340	globalpatch.exe
2468	globalpatch.exe
616	globalpatch.exe
664	globalpatch.exe
2128	globalpatch.exe
2736	globalpatch.exe
2944	globalpatch.exe
2472	globalpatch.exe

Loads dropped DLL 64 IoCs

pid	Process
3060	14f9e3ea623dccde8cc077de47dc6c1b.exe
2164	globalpatch.exe
2164	globalpatch.exe
2164	globalpatch.exe
2164	globalpatch.exe
2812	globalpatch.exe
2812	globalpatch.exe
2812	globalpatch.exe
2812	globalpatch.exe
1088	globalpatch.exe
1088	globalpatch.exe
1088	globalpatch.exe
1088	globalpatch.exe
2372	globalpatch.exe
2372	globalpatch.exe
2372	globalpatch.exe
2372	globalpatch.exe
1924	globalpatch.exe
1924	globalpatch.exe
1924	globalpatch.exe
1924	globalpatch.exe
1744	globalpatch.exe
1744	globalpatch.exe
1744	globalpatch.exe
1744	globalpatch.exe
1208	globalpatch.exe
1208	globalpatch.exe
1208	globalpatch.exe
1208	globalpatch.exe
1360	globalpatch.exe
1360	globalpatch.exe
1360	globalpatch.exe
1360	globalpatch.exe
1340	globalpatch.exe
1340	globalpatch.exe
1340	globalpatch.exe
1340	globalpatch.exe
2468	globalpatch.exe
2468	globalpatch.exe
2468	globalpatch.exe
2468	globalpatch.exe
616	globalpatch.exe
616	globalpatch.exe
616	globalpatch.exe
616	globalpatch.exe
664	globalpatch.exe
664	globalpatch.exe
664	globalpatch.exe
664	globalpatch.exe
2128	globalpatch.exe
2128	globalpatch.exe
2128	globalpatch.exe
2128	globalpatch.exe
2736	globalpatch.exe
2736	globalpatch.exe
2736	globalpatch.exe
2736	globalpatch.exe
2944	globalpatch.exe
2944	globalpatch.exe
2944	globalpatch.exe
2944	globalpatch.exe
2472	globalpatch.exe
2472	globalpatch.exe
2472	globalpatch.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2948-0-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2948-14-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-20.dat	upx
behavioral1/memory/3060-21-0x0000000002360000-0x00000000023AB000-memory.dmp	upx
behavioral1/memory/2164-26-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/2164-48-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-65.dat	upx
behavioral1/files/0x0004000000004ed7-64.dat	upx
behavioral1/memory/1088-85-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-94.dat	upx
behavioral1/memory/1924-102-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/1924-122-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/1208-159-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-162.dat	upx
behavioral1/memory/1340-194-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-208.dat	upx
behavioral1/memory/616-209-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/memory/616-233-0x0000000000400000-0x000000000044B000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-243.dat	upx
behavioral1/memory/2128-268-0x0000000000400000-0x000000000044B000-memory.dmp	upx

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File created	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File opened for modification	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File created	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File opened for modification	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File opened for modification	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File created	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File created	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File created	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File opened for modification	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File created	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File opened for modification	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File opened for modification	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File opened for modification	C:\Windows\SysWOW64\globalpatch.exe	14f9e3ea623dccde8cc077de47dc6c1b.exe
File created	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File opened for modification	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File created	C:\Windows\SysWOW64\globalpatch.exe	globalpatch.exe
File created	C:\Windows\SysWOW64\globalpatch.exe	14f9e3ea623dccde8cc077de47dc6c1b.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 2948 set thread context of 3060	2948	14f9e3ea623dccde8cc077de47dc6c1b.exe	26
PID 2164 set thread context of 2812	2164	globalpatch.exe	28
PID 1088 set thread context of 2372	1088	globalpatch.exe	30
PID 1924 set thread context of 1744	1924	globalpatch.exe	32
PID 1208 set thread context of 1360	1208	globalpatch.exe	34
PID 1340 set thread context of 2468	1340	globalpatch.exe	36
PID 616 set thread context of 664	616	globalpatch.exe	38
PID 2128 set thread context of 2736	2128	globalpatch.exe	40
PID 2944 set thread context of 2472	2944	globalpatch.exe	42

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3060	2948	14f9e3ea623dccde8cc077de47dc6c1b.exe	26
PID 2948 wrote to memory of 3060	2948	14f9e3ea623dccde8cc077de47dc6c1b.exe	26
PID 2948 wrote to memory of 3060	2948	14f9e3ea623dccde8cc077de47dc6c1b.exe	26
PID 2948 wrote to memory of 3060	2948	14f9e3ea623dccde8cc077de47dc6c1b.exe	26
PID 2948 wrote to memory of 3060	2948	14f9e3ea623dccde8cc077de47dc6c1b.exe	26
PID 2948 wrote to memory of 3060	2948	14f9e3ea623dccde8cc077de47dc6c1b.exe	26
PID 2948 wrote to memory of 3060	2948	14f9e3ea623dccde8cc077de47dc6c1b.exe	26
PID 2948 wrote to memory of 3060	2948	14f9e3ea623dccde8cc077de47dc6c1b.exe	26
PID 2948 wrote to memory of 3060	2948	14f9e3ea623dccde8cc077de47dc6c1b.exe	26
PID 3060 wrote to memory of 2164	3060	14f9e3ea623dccde8cc077de47dc6c1b.exe	27
PID 3060 wrote to memory of 2164	3060	14f9e3ea623dccde8cc077de47dc6c1b.exe	27
PID 3060 wrote to memory of 2164	3060	14f9e3ea623dccde8cc077de47dc6c1b.exe	27
PID 3060 wrote to memory of 2164	3060	14f9e3ea623dccde8cc077de47dc6c1b.exe	27
PID 3060 wrote to memory of 2164	3060	14f9e3ea623dccde8cc077de47dc6c1b.exe	27
PID 3060 wrote to memory of 2164	3060	14f9e3ea623dccde8cc077de47dc6c1b.exe	27
PID 3060 wrote to memory of 2164	3060	14f9e3ea623dccde8cc077de47dc6c1b.exe	27
PID 2164 wrote to memory of 2812	2164	globalpatch.exe	28
PID 2164 wrote to memory of 2812	2164	globalpatch.exe	28
PID 2164 wrote to memory of 2812	2164	globalpatch.exe	28
PID 2164 wrote to memory of 2812	2164	globalpatch.exe	28
PID 2164 wrote to memory of 2812	2164	globalpatch.exe	28
PID 2164 wrote to memory of 2812	2164	globalpatch.exe	28
PID 2164 wrote to memory of 2812	2164	globalpatch.exe	28
PID 2164 wrote to memory of 2812	2164	globalpatch.exe	28
PID 2164 wrote to memory of 2812	2164	globalpatch.exe	28
PID 2164 wrote to memory of 2812	2164	globalpatch.exe	28
PID 2164 wrote to memory of 2812	2164	globalpatch.exe	28
PID 2164 wrote to memory of 2812	2164	globalpatch.exe	28
PID 2812 wrote to memory of 1088	2812	globalpatch.exe	29
PID 2812 wrote to memory of 1088	2812	globalpatch.exe	29
PID 2812 wrote to memory of 1088	2812	globalpatch.exe	29
PID 2812 wrote to memory of 1088	2812	globalpatch.exe	29
PID 2812 wrote to memory of 1088	2812	globalpatch.exe	29
PID 2812 wrote to memory of 1088	2812	globalpatch.exe	29
PID 2812 wrote to memory of 1088	2812	globalpatch.exe	29
PID 1088 wrote to memory of 2372	1088	globalpatch.exe	30
PID 1088 wrote to memory of 2372	1088	globalpatch.exe	30
PID 1088 wrote to memory of 2372	1088	globalpatch.exe	30
PID 1088 wrote to memory of 2372	1088	globalpatch.exe	30
PID 1088 wrote to memory of 2372	1088	globalpatch.exe	30
PID 1088 wrote to memory of 2372	1088	globalpatch.exe	30
PID 1088 wrote to memory of 2372	1088	globalpatch.exe	30
PID 1088 wrote to memory of 2372	1088	globalpatch.exe	30
PID 1088 wrote to memory of 2372	1088	globalpatch.exe	30
PID 1088 wrote to memory of 2372	1088	globalpatch.exe	30
PID 1088 wrote to memory of 2372	1088	globalpatch.exe	30
PID 1088 wrote to memory of 2372	1088	globalpatch.exe	30
PID 2372 wrote to memory of 1924	2372	globalpatch.exe	31
PID 2372 wrote to memory of 1924	2372	globalpatch.exe	31
PID 2372 wrote to memory of 1924	2372	globalpatch.exe	31
PID 2372 wrote to memory of 1924	2372	globalpatch.exe	31
PID 2372 wrote to memory of 1924	2372	globalpatch.exe	31
PID 2372 wrote to memory of 1924	2372	globalpatch.exe	31
PID 2372 wrote to memory of 1924	2372	globalpatch.exe	31
PID 1924 wrote to memory of 1744	1924	globalpatch.exe	32
PID 1924 wrote to memory of 1744	1924	globalpatch.exe	32
PID 1924 wrote to memory of 1744	1924	globalpatch.exe	32
PID 1924 wrote to memory of 1744	1924	globalpatch.exe	32
PID 1924 wrote to memory of 1744	1924	globalpatch.exe	32
PID 1924 wrote to memory of 1744	1924	globalpatch.exe	32
PID 1924 wrote to memory of 1744	1924	globalpatch.exe	32
PID 1924 wrote to memory of 1744	1924	globalpatch.exe	32
PID 1924 wrote to memory of 1744	1924	globalpatch.exe	32
PID 1924 wrote to memory of 1744	1924	globalpatch.exe	32

C:\Users\Admin\AppData\Local\Temp\14f9e3ea623dccde8cc077de47dc6c1b.exe
"C:\Users\Admin\AppData\Local\Temp\14f9e3ea623dccde8cc077de47dc6c1b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\14f9e3ea623dccde8cc077de47dc6c1b.exe
  "C:\Users\Admin\AppData\Local\Temp\14f9e3ea623dccde8cc077de47dc6c1b.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\SysWOW64\globalpatch.exe
    C:\Windows\system32\globalpatch.exe 476 "C:\Users\Admin\AppData\Local\Temp\14f9e3ea623dccde8cc077de47dc6c1b.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\SysWOW64\globalpatch.exe
      476 "C:\Users\Admin\AppData\Local\Temp\14f9e3ea623dccde8cc077de47dc6c1b.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Windows\SysWOW64\globalpatch.exe
        
        C:\Windows\system32\globalpatch.exe 588 "C:\Windows\SysWOW64\globalpatch.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1088
      - C:\Windows\SysWOW64\globalpatch.exe
        
        588 "C:\Windows\SysWOW64\globalpatch.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\SysWOW64\globalpatch.exe
        
        C:\Windows\system32\globalpatch.exe 580 "C:\Windows\SysWOW64\globalpatch.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Windows\SysWOW64\globalpatch.exe
        
        580 "C:\Windows\SysWOW64\globalpatch.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1744
        
        C:\Windows\SysWOW64\globalpatch.exe
        
        C:\Windows\system32\globalpatch.exe 580 "C:\Windows\SysWOW64\globalpatch.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1208
        
        C:\Windows\SysWOW64\globalpatch.exe
        
        580 "C:\Windows\SysWOW64\globalpatch.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1360
        
        C:\Windows\SysWOW64\globalpatch.exe
        
        C:\Windows\system32\globalpatch.exe 580 "C:\Windows\SysWOW64\globalpatch.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1340
        
        C:\Windows\SysWOW64\globalpatch.exe
        
        580 "C:\Windows\SysWOW64\globalpatch.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2468
        
        C:\Windows\SysWOW64\globalpatch.exe
        
        C:\Windows\system32\globalpatch.exe 580 "C:\Windows\SysWOW64\globalpatch.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:616
        
        C:\Windows\SysWOW64\globalpatch.exe
        
        580 "C:\Windows\SysWOW64\globalpatch.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:664
        
        C:\Windows\SysWOW64\globalpatch.exe
        
        C:\Windows\system32\globalpatch.exe 588 "C:\Windows\SysWOW64\globalpatch.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2128
        
        C:\Windows\SysWOW64\globalpatch.exe
        
        588 "C:\Windows\SysWOW64\globalpatch.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2736
        
        C:\Windows\SysWOW64\globalpatch.exe
        
        C:\Windows\system32\globalpatch.exe 580 "C:\Windows\SysWOW64\globalpatch.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2944
        
        C:\Windows\SysWOW64\globalpatch.exe
        
        580 "C:\Windows\SysWOW64\globalpatch.exe"
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\globalpatch.exe

Filesize
216KB

MD5
14f9e3ea623dccde8cc077de47dc6c1b

SHA1
e55644d8a8b366d94f6e05be56daed1ff7ca4241

SHA256
3621cbb7c16bb07b3636356e9f73788c95057b3fe7cba6850e8f3b2d0fda6dc5

SHA512
e35bae057c97a7fe2567ca1562a1c7418f66cd07d92f52cf364133b679677aadece02e28375e44c47d2ed81e458742b2911a0ec2d5c624749cea694edfbd46b4

Download Submit
\Windows\SysWOW64\globalpatch.exe

Filesize
64KB

MD5
e102f258f9b4efa4a17268f0c8e95690

SHA1
171a026ba9113b19e7e9fc98937c6b39a5b3b4b5

SHA256
fdc2b28c1ecd3568bedc0638ddd4d6e4e9450c11f8301434b0c4e5c3a2a93a81

SHA512
b38babf87cd9456464c8894c40c07ed10b606dc634b3d14bec528b7e8eae12710db8153e8c6692b150f67baf847ce67ab697f75d1ac898109fe9c396aba1c017

Download Submit
\Windows\SysWOW64\globalpatch.exe

Filesize
149KB

MD5
bd3fa0a059a0ca5190c0f44f4258de38

SHA1
6390aae8d4b81df7a6d9450662a2ccf85fb81019

SHA256
7bc7f611fcbed44b71d4342df673baae6229bb72c7f7adcbe894ead24a17b3cb

SHA512
38c8b18451f807b72d78a0f7e52b99dec6132e04b115596d7928813caaa40e096a1e95deff176b6af7b9cc925f1d755b833f297f950b3f15eed0e4e03492762f

Download Submit
\Windows\SysWOW64\globalpatch.exe

Filesize
192KB

MD5
8e89049bc41ea244863bb14a56ec1c4b

SHA1
23510c9d0a4187bb23480148819b2b47c2cd0fb7

SHA256
30ab6bbfaf2dc9b023407471f56cab80e0b7cdd5cd52955fd778b867d88aca05

SHA512
e31288b2678434b427a9f65e4a51b36431267d84afe86737130ee3651542eae4c4ce6e57902c02d59d59d3f19df89a5c158f6e3b563288b06478836ff2edc304

Download Submit
\Windows\SysWOW64\globalpatch.exe

Filesize
128KB

MD5
4afc2be60f1e99db16fe52ed0bb00bcf

SHA1
a67fda276a4d7850f1cd0ff437e91b970bf877a8

SHA256
2f86f958e3b49368d4a6e5632c53be5dfa60bd4cb2a5c628ce77b32eabeb85ec

SHA512
7d2f2a7776dd60314686c123130f56e611b35fc93b3c1a1b76410faae893dd7a35e1426a19f96a77ea78e9b43cf6fb1f0449546c89fbe29ea413a78db60463d1

Download Submit
\Windows\SysWOW64\globalpatch.exe

Filesize
180KB

MD5
7140454371ea86681f902a9071e13758

SHA1
1cc616267c1ce18d0b2a3bb559e6b4c632597455

SHA256
d33560de989414a60b4c65badd00ecd4f7ad45e1f16bfc4828b86da47f0b4df5

SHA512
8b9ddf20bac7e28ecd2de1466b80ade0c94eb3301af00d9aff913b75a702017a795980ff42a702f94c976c89b3a5a7e4e29dd7a9b6918247779e12574821001f

Download Submit
memory/616-209-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/616-217-0x0000000000380000-0x00000000003CB000-memory.dmp

Filesize
300KB

Download
memory/616-210-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/616-211-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/616-233-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/664-238-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/664-239-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/664-241-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/664-244-0x0000000002400000-0x000000000244B000-memory.dmp

Filesize
300KB

Download
memory/664-247-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/1088-71-0x0000000001C30000-0x0000000001C7B000-memory.dmp

Filesize
300KB

Download
memory/1088-85-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1208-159-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1208-143-0x00000000004C0000-0x000000000050B000-memory.dmp

Filesize
300KB

Download
memory/1208-136-0x00000000003A0000-0x00000000003EB000-memory.dmp

Filesize
300KB

Download
memory/1340-174-0x00000000002B0000-0x00000000002FB000-memory.dmp

Filesize
300KB

Download
memory/1340-194-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1360-165-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/1360-166-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/1360-167-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1360-177-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1744-129-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1744-137-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/1744-127-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/1744-141-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1744-138-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/1924-122-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1924-106-0x0000000000490000-0x00000000004DB000-memory.dmp

Filesize
300KB

Download
memory/1924-102-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1924-101-0x0000000000840000-0x000000000088B000-memory.dmp

Filesize
300KB

Download
memory/1924-100-0x0000000000840000-0x000000000088B000-memory.dmp

Filesize
300KB

Download
memory/2128-248-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/2128-249-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/2128-250-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/2128-253-0x0000000000280000-0x00000000002CB000-memory.dmp

Filesize
300KB

Download
memory/2128-268-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2164-50-0x0000000000230000-0x000000000023D000-memory.dmp

Filesize
52KB

Download
memory/2164-48-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2164-26-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2164-30-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/2164-34-0x0000000000340000-0x000000000038B000-memory.dmp

Filesize
300KB

Download
memory/2372-95-0x0000000002010000-0x000000000205B000-memory.dmp

Filesize
300KB

Download
memory/2372-93-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2372-92-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2372-91-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2468-199-0x00000000008D0000-0x000000000091B000-memory.dmp

Filesize
300KB

Download
memory/2468-215-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2468-214-0x00000000008D0000-0x000000000091B000-memory.dmp

Filesize
300KB

Download
memory/2468-204-0x00000000007E0000-0x000000000082B000-memory.dmp

Filesize
300KB

Download
memory/2468-201-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2736-276-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2736-271-0x0000000000270000-0x00000000002BB000-memory.dmp

Filesize
300KB

Download
memory/2736-281-0x0000000000270000-0x000000000027C000-memory.dmp

Filesize
48KB

Download
memory/2736-272-0x0000000000270000-0x00000000002BB000-memory.dmp

Filesize
300KB

Download
memory/2736-273-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2736-275-0x0000000000270000-0x00000000002BB000-memory.dmp

Filesize
300KB

Download
memory/2812-43-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2812-61-0x00000000020A0000-0x00000000020EB000-memory.dmp

Filesize
300KB

Download
memory/2812-56-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2812-67-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/2812-59-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2812-58-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2812-55-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/2812-66-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/2812-57-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/2944-277-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/2944-279-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/2948-14-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2948-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2948-1-0x0000000000450000-0x000000000049B000-memory.dmp

Filesize
300KB

Download
memory/3060-21-0x0000000002360000-0x00000000023AB000-memory.dmp

Filesize
300KB

Download
memory/3060-2-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3060-4-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3060-6-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3060-8-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3060-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3060-12-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3060-15-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3060-16-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3060-31-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download