lumma | 5b0277f87ba9d6f996b755001949f7563f7e08800a5b984aeeb65118e345a0aa

Analysis

max time kernel
16s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4789024a329b2261b6913ae6de68180e.exe
Size

692KB
MD5

4789024a329b2261b6913ae6de68180e
SHA1

27fdab1e2ed3dcabbb4fa8b5a093fa5e64378799
SHA256

5b0277f87ba9d6f996b755001949f7563f7e08800a5b984aeeb65118e345a0aa
SHA512

16c19d8e9c10943ad1e8513bcb7a7cac6ffe709164a85de217e3687c9d58e674ba55cf0c53711fe949278d3484e4a0a54cd9e6abd4d3924fd98943dd3efaaf60
SSDEEP

12288:pPAk41FUmnH/VFwl7uGcqh9L8I+UfqgjoGsnipVEYhXt7nXfgkSQ:d54/UWfVFwFuGcwtaY1Bl4kSQ

Score

10^/10

lumma evasion stealer

Malware Config

Signatures

Detect Lumma Stealer payload V4 20 IoCs

resource	yara_rule
behavioral1/memory/1244-148-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/2144-151-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/1244-116-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/2144-168-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/2144-172-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/1768-293-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/1768-311-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/1768-317-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/1944-433-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/1944-451-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/1944-458-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/3032-593-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/3032-600-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/2872-735-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/2872-742-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/804-876-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/804-882-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/1160-1017-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/1160-1024-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4
behavioral1/memory/2668-1158-0x0000000000400000-0x0000000000B6B13D-memory.dmp	family_lumma_v4

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe

Executes dropped EXE 2 IoCs

pid	Process
2144	winapi.exe
1768	winapi.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Wine	4789024a329b2261b6913ae6de68180e.exe
Key opened	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Wine	winapi.exe
Key opened	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Wine	winapi.exe

Loads dropped DLL 4 IoCs

pid	Process
1244	4789024a329b2261b6913ae6de68180e.exe
1244	4789024a329b2261b6913ae6de68180e.exe
2144	winapi.exe
2144	winapi.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winapi.exe	4789024a329b2261b6913ae6de68180e.exe
File opened for modification	C:\Windows\SysWOW64\winapi.exe	4789024a329b2261b6913ae6de68180e.exe
File opened for modification	C:\Windows\SysWOW64\winapi.exe	winapi.exe
File created	C:\Windows\SysWOW64\winapi.exe	winapi.exe
File opened for modification	C:\Windows\SysWOW64\winapi.exe	winapi.exe
File created	C:\Windows\SysWOW64\winapi.exe	winapi.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1244	4789024a329b2261b6913ae6de68180e.exe
2144	winapi.exe
1768	winapi.exe

Runs .reg file with regedit 10 IoCs

pid	Process
2456	regedit.exe
2588	regedit.exe
2068	regedit.exe
1344	regedit.exe
2624	regedit.exe
1960	regedit.exe
2136	regedit.exe
1568	regedit.exe
1912	regedit.exe
876	regedit.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1244	4789024a329b2261b6913ae6de68180e.exe
2144	winapi.exe
1768	winapi.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2572	1244	4789024a329b2261b6913ae6de68180e.exe	30
PID 1244 wrote to memory of 2572	1244	4789024a329b2261b6913ae6de68180e.exe	30
PID 1244 wrote to memory of 2572	1244	4789024a329b2261b6913ae6de68180e.exe	30
PID 1244 wrote to memory of 2572	1244	4789024a329b2261b6913ae6de68180e.exe	30
PID 2572 wrote to memory of 1912	2572	cmd.exe	29
PID 2572 wrote to memory of 1912	2572	cmd.exe	29
PID 2572 wrote to memory of 1912	2572	cmd.exe	29
PID 2572 wrote to memory of 1912	2572	cmd.exe	29
PID 1244 wrote to memory of 2144	1244	4789024a329b2261b6913ae6de68180e.exe	28
PID 1244 wrote to memory of 2144	1244	4789024a329b2261b6913ae6de68180e.exe	28
PID 1244 wrote to memory of 2144	1244	4789024a329b2261b6913ae6de68180e.exe	28
PID 1244 wrote to memory of 2144	1244	4789024a329b2261b6913ae6de68180e.exe	28
PID 2144 wrote to memory of 1768	2144	winapi.exe	33
PID 2144 wrote to memory of 1768	2144	winapi.exe	33
PID 2144 wrote to memory of 1768	2144	winapi.exe	33
PID 2144 wrote to memory of 1768	2144	winapi.exe	33
PID 1768 wrote to memory of 1976	1768	winapi.exe	32
PID 1768 wrote to memory of 1976	1768	winapi.exe	32
PID 1768 wrote to memory of 1976	1768	winapi.exe	32
PID 1768 wrote to memory of 1976	1768	winapi.exe	32

C:\Users\Admin\AppData\Local\Temp\4789024a329b2261b6913ae6de68180e.exe
"C:\Users\Admin\AppData\Local\Temp\4789024a329b2261b6913ae6de68180e.exe"
1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\winapi.exe
  C:\Windows\system32\winapi.exe 708 "C:\Users\Admin\AppData\Local\Temp\4789024a329b2261b6913ae6de68180e.exe"
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\winapi.exe
    C:\Windows\system32\winapi.exe 740 "C:\Windows\SysWOW64\winapi.exe"
    3⤵
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\SysWOW64\winapi.exe
      C:\Windows\system32\winapi.exe 752 "C:\Windows\SysWOW64\winapi.exe"
      4⤵
      PID:1944
    - - C:\Windows\SysWOW64\winapi.exe
        
        C:\Windows\system32\winapi.exe 756 "C:\Windows\SysWOW64\winapi.exe"
        5⤵
        
        PID:3032
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        6⤵
        
        PID:1572
      - C:\Windows\SysWOW64\winapi.exe
        
        C:\Windows\system32\winapi.exe 760 "C:\Windows\SysWOW64\winapi.exe"
        6⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        7⤵
        
        PID:600
        
        C:\Windows\SysWOW64\winapi.exe
        
        C:\Windows\system32\winapi.exe 764 "C:\Windows\SysWOW64\winapi.exe"
        7⤵
        
        PID:804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        8⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Runs .reg file with regedit
        
        PID:1960
        
        C:\Windows\SysWOW64\winapi.exe
        
        C:\Windows\system32\winapi.exe 768 "C:\Windows\SysWOW64\winapi.exe"
        8⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        9⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\winapi.exe
        
        C:\Windows\system32\winapi.exe 772 "C:\Windows\SysWOW64\winapi.exe"
        9⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        10⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        11⤵
        Runs .reg file with regedit
        
        PID:1568
        
        C:\Windows\SysWOW64\winapi.exe
        
        C:\Windows\system32\winapi.exe 744 "C:\Windows\SysWOW64\winapi.exe"
        10⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        11⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        12⤵
        Runs .reg file with regedit
        
        PID:2456
        
        C:\Windows\SysWOW64\winapi.exe
        
        C:\Windows\system32\winapi.exe 776 "C:\Windows\SysWOW64\winapi.exe"
        11⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        12⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        13⤵
        Runs .reg file with regedit
        
        PID:876
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\a.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2572

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Modifies security service
- Runs .reg file with regedit
PID:1912

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Runs .reg file with regedit
PID:2588

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\a.bat
1⤵
PID:1976

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\a.bat
1⤵
PID:1900
- C:\Windows\SysWOW64\regedit.exe
  REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
  2⤵
  - Runs .reg file with regedit
  PID:2068

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Runs .reg file with regedit
PID:1344

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Runs .reg file with regedit
PID:2624

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Runs .reg file with regedit
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\Windows\SysWOW64\winapi.exe

Filesize
61KB

MD5
c86b4e064d2a7943e2145bc95c0bed70

SHA1
d20c32a1c89cd86cf4aaf226ea0220546a91b1a1

SHA256
8d184d01f301d39d45ae445531f448c2ebb3014ec577639b38d8f78a9e9742e3

SHA512
2a6b8cfb5899f3b8a0b7c80ce2ff0f429060555f5cd88153b43eed882d92170f7de53c4fabeb8b771f947a4553a8dce3e1102ab3d12c951d13f3d736256908b1

Download Submit
memory/804-743-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/804-876-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/804-882-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1160-883-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1160-1024-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1160-1017-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1244-129-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/1244-126-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download
memory/1244-148-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1244-147-0x00000000051F0000-0x000000000595C000-memory.dmp

Filesize
7.4MB

Download
memory/1244-143-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/1244-145-0x00000000051F0000-0x000000000595C000-memory.dmp

Filesize
7.4MB

Download
memory/1244-1-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1244-116-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1244-117-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download
memory/1244-118-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/1244-119-0x0000000004B20000-0x0000000004B22000-memory.dmp

Filesize
8KB

Download
memory/1244-120-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/1244-137-0x0000000004A70000-0x0000000004A71000-memory.dmp

Filesize
4KB

Download
memory/1244-121-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download
memory/1244-0-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1244-122-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/1244-123-0x0000000004A80000-0x0000000004A82000-memory.dmp

Filesize
8KB

Download
memory/1244-124-0x0000000000E30000-0x0000000000E32000-memory.dmp

Filesize
8KB

Download
memory/1244-131-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/1244-130-0x0000000000E40000-0x0000000000E41000-memory.dmp

Filesize
4KB

Download
memory/1244-125-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/1244-128-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download
memory/1244-127-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/1768-315-0x00000000052A0000-0x0000000005A0C000-memory.dmp

Filesize
7.4MB

Download
memory/1768-175-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1768-295-0x0000000004A70000-0x0000000004A71000-memory.dmp

Filesize
4KB

Download
memory/1768-294-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download
memory/1768-293-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1768-311-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1768-301-0x00000000044F0000-0x00000000044F1000-memory.dmp

Filesize
4KB

Download
memory/1768-317-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1768-302-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/1768-303-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/1768-304-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/1768-305-0x0000000004B20000-0x0000000004B21000-memory.dmp

Filesize
4KB

Download
memory/1768-296-0x0000000004B30000-0x0000000004B32000-memory.dmp

Filesize
8KB

Download
memory/1768-300-0x0000000004AD0000-0x0000000004AD2000-memory.dmp

Filesize
8KB

Download
memory/1768-297-0x0000000004A20000-0x0000000004A22000-memory.dmp

Filesize
8KB

Download
memory/1768-298-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/1768-299-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download
memory/1768-177-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1768-310-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/1768-309-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/1768-308-0x0000000004500000-0x0000000004501000-memory.dmp

Filesize
4KB

Download
memory/1768-307-0x0000000004A00000-0x0000000004A01000-memory.dmp

Filesize
4KB

Download
memory/1768-306-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download
memory/1944-458-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1944-451-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1944-318-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1944-433-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/1944-316-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2144-154-0x0000000004B30000-0x0000000004B32000-memory.dmp

Filesize
8KB

Download
memory/2144-166-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/2144-173-0x0000000005270000-0x00000000059DC000-memory.dmp

Filesize
7.4MB

Download
memory/2144-174-0x0000000005270000-0x00000000059DC000-memory.dmp

Filesize
7.4MB

Download
memory/2144-168-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2144-151-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2144-152-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download
memory/2144-153-0x0000000004930000-0x0000000004931000-memory.dmp

Filesize
4KB

Download
memory/2144-155-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/2144-156-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/2144-157-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download
memory/2144-158-0x0000000004AD0000-0x0000000004AD2000-memory.dmp

Filesize
8KB

Download
memory/2144-159-0x0000000000C00000-0x0000000000C02000-memory.dmp

Filesize
8KB

Download
memory/2144-160-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/2144-161-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/2144-162-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/2144-146-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2144-149-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2144-167-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/2144-172-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2144-165-0x0000000000C10000-0x0000000000C11000-memory.dmp

Filesize
4KB

Download
memory/2144-164-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download
memory/2144-163-0x0000000004B20000-0x0000000004B21000-memory.dmp

Filesize
4KB

Download
memory/2372-1307-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2668-1025-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2668-1164-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2668-1158-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2688-1165-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2688-1299-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2688-1306-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2872-601-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2872-742-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/2872-735-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/3032-459-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/3032-593-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download
memory/3032-600-0x0000000000400000-0x0000000000B6B13D-memory.dmp

Filesize
7.4MB

Download