lumma | 88e4b4a9fb614ec33e573354ecc8086e77d3703fd89b7efd3acc5f8de99287f1

Analysis

max time kernel
15s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

299e7cda75bcbaf576fe85afc0a1f993.exe
Size

1.2MB
MD5

299e7cda75bcbaf576fe85afc0a1f993
SHA1

897bbd813e5acf8f2e6d41531d9a3079dd67a8ea
SHA256

88e4b4a9fb614ec33e573354ecc8086e77d3703fd89b7efd3acc5f8de99287f1
SHA512

9ce2f3c6bdaf0cb31cdb5f7ad9bded6f7fbf21f259a5fca1397d69193b4f934eb05a2e026636ce84e53b91d4819de2e0ef425a3232658bf5dba95ca0cc3521a7
SSDEEP

24576:BQHk18m7hgeUR3Gw4K2unwWJ7DFzkKGTP0oOYvw:BQCBhUwRVWHzkTLGY

Score

10^/10

lumma evasion stealer themida

Malware Config

Signatures

Detect Lumma Stealer payload V4 9 IoCs

resource	yara_rule
behavioral1/memory/1056-143-0x0000000000400000-0x00000000006B7000-memory.dmp	family_lumma_v4
behavioral1/memory/2928-156-0x0000000000400000-0x00000000006B7000-memory.dmp	family_lumma_v4
behavioral1/memory/2928-117-0x0000000000400000-0x00000000006B7000-memory.dmp	family_lumma_v4
behavioral1/memory/1056-158-0x0000000000400000-0x00000000006B7000-memory.dmp	family_lumma_v4
behavioral1/memory/108-282-0x0000000000400000-0x00000000006B7000-memory.dmp	family_lumma_v4
behavioral1/memory/1056-279-0x0000000000400000-0x00000000006B7000-memory.dmp	family_lumma_v4
behavioral1/memory/108-296-0x0000000000400000-0x00000000006B7000-memory.dmp	family_lumma_v4
behavioral1/memory/2640-420-0x0000000000400000-0x00000000006B7000-memory.dmp	family_lumma_v4
behavioral1/memory/108-352-0x0000000000400000-0x00000000006B7000-memory.dmp	family_lumma_v4

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe

Executes dropped EXE 2 IoCs

pid	Process
1056	cPanel.com
108	cPanel.com

Loads dropped DLL 4 IoCs

pid	Process
2928	299e7cda75bcbaf576fe85afc0a1f993.exe
2928	299e7cda75bcbaf576fe85afc0a1f993.exe
1056	cPanel.com
1056	cPanel.com

Themida packer 11 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1056-143-0x0000000000400000-0x00000000006B7000-memory.dmp	themida
behavioral1/memory/2928-156-0x0000000000400000-0x00000000006B7000-memory.dmp	themida
behavioral1/memory/2928-117-0x0000000000400000-0x00000000006B7000-memory.dmp	themida
behavioral1/memory/1056-158-0x0000000000400000-0x00000000006B7000-memory.dmp	themida
behavioral1/memory/108-282-0x0000000000400000-0x00000000006B7000-memory.dmp	themida
behavioral1/memory/1056-279-0x0000000000400000-0x00000000006B7000-memory.dmp	themida
behavioral1/files/0x003a000000012670-160.dat	themida
behavioral1/files/0x003a000000012670-159.dat	themida
behavioral1/memory/108-296-0x0000000000400000-0x00000000006B7000-memory.dmp	themida
behavioral1/memory/2640-420-0x0000000000400000-0x00000000006B7000-memory.dmp	themida
behavioral1/memory/108-352-0x0000000000400000-0x00000000006B7000-memory.dmp	themida

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cPanel.com	cPanel.com
File created	C:\Windows\SysWOW64\cPanel.com	299e7cda75bcbaf576fe85afc0a1f993.exe
File opened for modification	C:\Windows\SysWOW64\cPanel.com	299e7cda75bcbaf576fe85afc0a1f993.exe
File opened for modification	C:\Windows\SysWOW64\cPanel.com	cPanel.com

Runs .reg file with regedit 10 IoCs

pid	Process
2824	regedit.exe
2240	regedit.exe
1984	regedit.exe
2812	regedit.exe
580	regedit.exe
2124	regedit.exe
716	regedit.exe
2624	regedit.exe
3044	regedit.exe
1268	regedit.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2928	299e7cda75bcbaf576fe85afc0a1f993.exe
1056	cPanel.com
108	cPanel.com

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1972	2928	299e7cda75bcbaf576fe85afc0a1f993.exe	18
PID 2928 wrote to memory of 1972	2928	299e7cda75bcbaf576fe85afc0a1f993.exe	18
PID 2928 wrote to memory of 1972	2928	299e7cda75bcbaf576fe85afc0a1f993.exe	18
PID 2928 wrote to memory of 1972	2928	299e7cda75bcbaf576fe85afc0a1f993.exe	18
PID 1972 wrote to memory of 2124	1972	cmd.exe	17
PID 1972 wrote to memory of 2124	1972	cmd.exe	17
PID 1972 wrote to memory of 2124	1972	cmd.exe	17
PID 1972 wrote to memory of 2124	1972	cmd.exe	17
PID 2928 wrote to memory of 1056	2928	299e7cda75bcbaf576fe85afc0a1f993.exe	16
PID 2928 wrote to memory of 1056	2928	299e7cda75bcbaf576fe85afc0a1f993.exe	16
PID 2928 wrote to memory of 1056	2928	299e7cda75bcbaf576fe85afc0a1f993.exe	16
PID 2928 wrote to memory of 1056	2928	299e7cda75bcbaf576fe85afc0a1f993.exe	16
PID 1056 wrote to memory of 108	1056	cPanel.com	33
PID 1056 wrote to memory of 108	1056	cPanel.com	33
PID 1056 wrote to memory of 108	1056	cPanel.com	33
PID 1056 wrote to memory of 108	1056	cPanel.com	33
PID 108 wrote to memory of 900	108	cPanel.com	32
PID 108 wrote to memory of 900	108	cPanel.com	32
PID 108 wrote to memory of 900	108	cPanel.com	32
PID 108 wrote to memory of 900	108	cPanel.com	32

C:\Windows\SysWOW64\cPanel.com
C:\Windows\system32\cPanel.com 696 "C:\Users\Admin\AppData\Local\Temp\299e7cda75bcbaf576fe85afc0a1f993.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\cPanel.com
  C:\Windows\system32\cPanel.com 712 "C:\Windows\SysWOW64\cPanel.com"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:108
- - C:\Windows\SysWOW64\cPanel.com
    C:\Windows\system32\cPanel.com 724 "C:\Windows\SysWOW64\cPanel.com"
    3⤵
    PID:2640
  - - C:\Windows\SysWOW64\cPanel.com
      C:\Windows\system32\cPanel.com 728 "C:\Windows\SysWOW64\cPanel.com"
      4⤵
      PID:1640
    - - C:\Windows\SysWOW64\cPanel.com
        
        C:\Windows\system32\cPanel.com 732 "C:\Windows\SysWOW64\cPanel.com"
        5⤵
        
        PID:1572
      - C:\Windows\SysWOW64\cPanel.com
        
        C:\Windows\system32\cPanel.com 720 "C:\Windows\SysWOW64\cPanel.com"
        6⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\cPanel.com
        
        C:\Windows\system32\cPanel.com 740 "C:\Windows\SysWOW64\cPanel.com"
        7⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\cPanel.com
        
        C:\Windows\system32\cPanel.com 744 "C:\Windows\SysWOW64\cPanel.com"
        8⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\cPanel.com
        
        C:\Windows\system32\cPanel.com 748 "C:\Windows\SysWOW64\cPanel.com"
        9⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\cPanel.com
        
        C:\Windows\system32\cPanel.com 752 "C:\Windows\SysWOW64\cPanel.com"
        10⤵
        
        PID:3028

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Modifies security service
- Runs .reg file with regedit
PID:2124

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\acx.bat
1⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Local\Temp\299e7cda75bcbaf576fe85afc0a1f993.exe
"C:\Users\Admin\AppData\Local\Temp\299e7cda75bcbaf576fe85afc0a1f993.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Runs .reg file with regedit
PID:2824

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\acx.bat
1⤵
PID:900

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Runs .reg file with regedit
PID:2240

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\acx.bat
1⤵
PID:2896

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Runs .reg file with regedit
PID:1984

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\acx.bat
1⤵
PID:2932

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Runs .reg file with regedit
PID:716

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\acx.bat
1⤵
PID:2004

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Runs .reg file with regedit
PID:2624

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\acx.bat
1⤵
PID:1664

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Runs .reg file with regedit
PID:3044

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\acx.bat
1⤵
PID:596

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Runs .reg file with regedit
PID:2812

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\acx.bat
1⤵
PID:980

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Runs .reg file with regedit
PID:1268

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\acx.bat
1⤵
PID:2676

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Runs .reg file with regedit
PID:580

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\acx.bat
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
298B

MD5
4117e5a9c995bab9cd3bce3fc2b99a46

SHA1
80144ccbad81c2efb1df64e13d3d5f59ca4486da

SHA256
37b58c2d66ab2f896316ee0cdba30dcc9aac15a51995b8ba6c143c8ba34bf292

SHA512
bdb721bd3dea641a9b1f26b46311c05199de01c6b0d7ea2b973aa71a4f796b292a6964ddef32ba9dfc4a545768943d105f110c5d60716e0ff6f82914affb507c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
872656500ddac1ddd91d10aba3a8df96

SHA1
ddf655aea7e8eae37b0a2dd4c8cabaf21cf681fc

SHA256
d6f58d2fbf733d278281af0b9e7732a591cdd752e18a430f76cb7afa806c75f8

SHA512
e7fab32f6f38bde67c8ce7af483216c9965ab62a70aee5c9a9e17aa693c33c67953f817406c1687406977b234d89e62d7feb44757527de5db34e5a61462a0be9

Download Submit
\??\c:\acx.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\Windows\SysWOW64\cPanel.com

Filesize
1.2MB

MD5
299e7cda75bcbaf576fe85afc0a1f993

SHA1
897bbd813e5acf8f2e6d41531d9a3079dd67a8ea

SHA256
88e4b4a9fb614ec33e573354ecc8086e77d3703fd89b7efd3acc5f8de99287f1

SHA512
9ce2f3c6bdaf0cb31cdb5f7ad9bded6f7fbf21f259a5fca1397d69193b4f934eb05a2e026636ce84e53b91d4819de2e0ef425a3232658bf5dba95ca0cc3521a7

Download Submit
\Windows\SysWOW64\cPanel.com

Filesize
1.1MB

MD5
39ffccc122449fe16ef4a3a5e38224ed

SHA1
5fdae2ceda235800e709e2923447ff112a077932

SHA256
0c6780916015827acc22ca7a7cc8f71484f737dc48c2a2dad4f32a11b6769aac

SHA512
13c3b4fb6eda792adef34994c3868594e98f94cb7cad971d4bcbb1c19a12a9921bbb57a441702f368d196c3f88866139cefa9e0e7984b42e2f0e94d8e7d6452c

Download Submit
memory/108-293-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/108-300-0x00000000043A0000-0x00000000043A2000-memory.dmp

Filesize
8KB

Download
memory/108-280-0x00000000043F0000-0x00000000043F2000-memory.dmp

Filesize
8KB

Download
memory/108-282-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/108-283-0x00000000043D0000-0x00000000043D1000-memory.dmp

Filesize
4KB

Download
memory/108-284-0x0000000004300000-0x0000000004301000-memory.dmp

Filesize
4KB

Download
memory/108-285-0x00000000043B0000-0x00000000043B1000-memory.dmp

Filesize
4KB

Download
memory/108-286-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download
memory/108-287-0x0000000004400000-0x0000000004401000-memory.dmp

Filesize
4KB

Download
memory/108-289-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/108-290-0x0000000004360000-0x0000000004361000-memory.dmp

Filesize
4KB

Download
memory/108-295-0x0000000004320000-0x0000000004321000-memory.dmp

Filesize
4KB

Download
memory/108-296-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/108-291-0x0000000004330000-0x0000000004331000-memory.dmp

Filesize
4KB

Download
memory/108-292-0x0000000004380000-0x0000000004381000-memory.dmp

Filesize
4KB

Download
memory/108-164-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/108-288-0x00000000042F0000-0x00000000042F1000-memory.dmp

Filesize
4KB

Download
memory/108-352-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/108-301-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1056-144-0x00000000043F0000-0x00000000043F1000-memory.dmp

Filesize
4KB

Download
memory/1056-279-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/1056-157-0x0000000004330000-0x0000000004331000-memory.dmp

Filesize
4KB

Download
memory/1056-153-0x0000000004390000-0x0000000004391000-memory.dmp

Filesize
4KB

Download
memory/1056-152-0x0000000004340000-0x0000000004341000-memory.dmp

Filesize
4KB

Download
memory/1056-151-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/1056-162-0x00000000043C0000-0x00000000043C2000-memory.dmp

Filesize
8KB

Download
memory/1056-141-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1056-150-0x0000000004190000-0x0000000004191000-memory.dmp

Filesize
4KB

Download
memory/1056-149-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/1056-163-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1056-158-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/1056-154-0x0000000004380000-0x0000000004381000-memory.dmp

Filesize
4KB

Download
memory/1056-148-0x0000000004420000-0x0000000004421000-memory.dmp

Filesize
4KB

Download
memory/1056-143-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/1056-142-0x0000000004410000-0x0000000004412000-memory.dmp

Filesize
8KB

Download
memory/1056-145-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/1056-146-0x00000000043D0000-0x00000000043D1000-memory.dmp

Filesize
4KB

Download
memory/1056-147-0x0000000004430000-0x0000000004431000-memory.dmp

Filesize
4KB

Download
memory/1572-705-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/1600-843-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/1640-568-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/1732-1254-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/2292-1115-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/2292-981-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/2592-1252-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/2592-1116-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/2640-426-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/2640-420-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/2640-566-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/2640-432-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/2640-302-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2640-418-0x00000000042A0000-0x00000000042A2000-memory.dmp

Filesize
8KB

Download
memory/2640-429-0x00000000041F0000-0x00000000041F2000-memory.dmp

Filesize
8KB

Download
memory/2640-428-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/2640-427-0x0000000004220000-0x0000000004221000-memory.dmp

Filesize
4KB

Download
memory/2640-421-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/2640-425-0x00000000042B0000-0x00000000042B1000-memory.dmp

Filesize
4KB

Download
memory/2640-424-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download
memory/2640-423-0x0000000004260000-0x0000000004261000-memory.dmp

Filesize
4KB

Download
memory/2640-422-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/2928-1-0x00000000006C0000-0x00000000007A6000-memory.dmp

Filesize
920KB

Download
memory/2928-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2928-124-0x0000000004430000-0x0000000004431000-memory.dmp

Filesize
4KB

Download
memory/2928-125-0x0000000004420000-0x0000000004421000-memory.dmp

Filesize
4KB

Download
memory/2928-119-0x00000000041C0000-0x00000000041C1000-memory.dmp

Filesize
4KB

Download
memory/2928-126-0x00000000041B0000-0x00000000041B1000-memory.dmp

Filesize
4KB

Download
memory/2928-127-0x00000000041D0000-0x00000000041D1000-memory.dmp

Filesize
4KB

Download
memory/2928-118-0x00000000043F0000-0x00000000043F1000-memory.dmp

Filesize
4KB

Download
memory/2928-117-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/2928-128-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/2928-129-0x0000000004340000-0x0000000004341000-memory.dmp

Filesize
4KB

Download
memory/2928-130-0x0000000004390000-0x0000000004391000-memory.dmp

Filesize
4KB

Download
memory/2928-131-0x0000000004380000-0x0000000004381000-memory.dmp

Filesize
4KB

Download
memory/2928-132-0x00000000043C0000-0x00000000043C2000-memory.dmp

Filesize
8KB

Download
memory/2928-156-0x0000000000400000-0x00000000006B7000-memory.dmp

Filesize
2.7MB

Download
memory/2928-121-0x00000000043D0000-0x00000000043D1000-memory.dmp

Filesize
4KB

Download
memory/2928-9-0x0000000004410000-0x0000000004412000-memory.dmp

Filesize
8KB

Download